MetaPlugin/MetaFeeder/MetaTransport apps: headless services (no AppShield, no Caddy route, no webui); drop parent; MetaFeederUsenet tile → nntmux

2026-10-04 11:12:44 +00:00
parent 2c64e3c90e
commit ffc06507fc
32 changed files with 86 additions and 1437 deletions
@@ -48,48 +48,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederanilist
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederanilist:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederanilist
-    hostname: metafeederanilist
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederanilist-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederanilist-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederanilist-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederanilist-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederanilist-feeder
-    networks:
-      - metafeederanilist
-      - pcs
-
 networks:
-  metafeederanilist:
-    name: metafeederanilist
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -101,9 +61,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederanilist
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -149,7 +106,7 @@ x-casaos:
        dashboard's *Add a feeder* box — name `anilist-feeder`, URL `http://metafeederanilist-feeder:8080`.
        The gateway restarts itself: feeder discovery is startup-only.
        No other setup. For chapters, also install **MetaFeeder · Suwayomi**.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -163,6 +120,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederanilist/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederanilist-${domain}
-  webui-path: "/config"
@@ -44,48 +44,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederarxiv
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederarxiv:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederarxiv
-    hostname: metafeederarxiv
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederarxiv-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederarxiv-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederarxiv-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederarxiv-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederarxiv-feeder
-    networks:
-      - metafeederarxiv
-      - pcs
-
 networks:
-  metafeederarxiv:
-    name: metafeederarxiv
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -97,9 +57,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederarxiv
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -137,7 +94,7 @@ x-casaos:
        dashboard's *Add a feeder* box — name `arxiv-feeder`, URL `http://metafeederarxiv-feeder:8080`.
        The gateway restarts itself: feeder discovery is startup-only.
        No other setup.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -151,6 +108,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederarxiv/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederarxiv-${domain}
-  webui-path: "/config"
@@ -44,48 +44,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeedereuropepmc
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeedereuropepmc:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeedereuropepmc
-    hostname: metafeedereuropepmc
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeedereuropepmc-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeedereuropepmc-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeedereuropepmc-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeedereuropepmc-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeedereuropepmc-feeder
-    networks:
-      - metafeedereuropepmc
-      - pcs
-
 networks:
-  metafeedereuropepmc:
-    name: metafeedereuropepmc
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -97,9 +57,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeedereuropepmc
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -138,7 +95,7 @@ x-casaos:
        dashboard's *Add a feeder* box — name `europepmc-feeder`, URL `http://metafeedereuropepmc-feeder:8080`.
        The gateway restarts itself: feeder discovery is startup-only.
        No other setup.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -152,6 +109,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeedereuropepmc/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeedereuropepmc-${domain}
-  webui-path: "/config"
@@ -46,48 +46,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeedergiphy
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeedergiphy:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeedergiphy
-    hostname: metafeedergiphy
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeedergiphy-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeedergiphy-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeedergiphy-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeedergiphy-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeedergiphy-feeder
-    networks:
-      - metafeedergiphy
-      - pcs
-
 networks:
-  metafeedergiphy:
-    name: metafeedergiphy
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -99,9 +59,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeedergiphy
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -142,7 +99,7 @@ x-casaos:

        **API key:** set `GIPHY_API_KEY` in this app's environment (developers.giphy.com),
        then restart the app. Without it the feeder soft-skips.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -156,6 +113,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeedergiphy/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeedergiphy-${domain}
-  webui-path: "/config"
@@ -38,48 +38,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeedergutenberg
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeedergutenberg:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeedergutenberg
-    hostname: metafeedergutenberg
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeedergutenberg-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeedergutenberg-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeedergutenberg-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeedergutenberg-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeedergutenberg-feeder
-    networks:
-      - metafeedergutenberg
-      - pcs
-
 networks:
-  metafeedergutenberg:
-    name: metafeedergutenberg
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -91,9 +51,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeedergutenberg
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -136,7 +93,7 @@ x-casaos:
        is listed in its feeders config (`http://metafeedergutenberg-feeder:8080`) so
        it gets discovered (or add it from the gateway dashboard). No other setup.

-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -150,6 +107,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeedergutenberg/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeedergutenberg-${domain}
-  webui-path: "/config"
@@ -22,8 +22,8 @@ name: metafeederinternetarchive
 services:
  # ---------------------------------------------------------------------------
  # metafeederinternetarchive-feeder — the feeder itself. The gateway reaches it directly on
-  # `pcs` for discovery/query/compute; the human sees it through the AppShield
-  # gate below.
+  # `pcs` for discovery/query/compute; the human configures it
+  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeederinternetarchive-feeder:
    image: ghcr.io/worph/meta-feeder-internetarchive:1.1.2
@@ -53,48 +53,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederinternetarchive
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederinternetarchive:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederinternetarchive
-    hostname: metafeederinternetarchive
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederinternetarchive-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederinternetarchive-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederinternetarchive-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederinternetarchive-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederinternetarchive-feeder
-    networks:
-      - metafeederinternetarchive
-      - pcs
-
 networks:
-  metafeederinternetarchive:
-    name: metafeederinternetarchive
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -106,9 +66,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederinternetarchive
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -153,7 +110,7 @@ x-casaos:
        The gateway restarts itself: feeder discovery is startup-only.
        No API key and no account: the feeder answers as soon as the gateway
        discovers it. Pairs with **MetaListen** for a music client.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -167,6 +124,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederinternetarchive/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederinternetarchive-${domain}
-  webui-path: "/config"
@@ -23,8 +23,8 @@ name: metafeederjamendo
 services:
  # ---------------------------------------------------------------------------
  # metafeederjamendo-feeder — the feeder itself. The gateway reaches it directly on
-  # `pcs` for discovery/query/compute; the human sees it through the AppShield
-  # gate below.
+  # `pcs` for discovery/query/compute; the human configures it
+  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeederjamendo-feeder:
    image: ghcr.io/worph/meta-feeder-jamendo:1.1.2
@@ -56,48 +56,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederjamendo
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederjamendo:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederjamendo
-    hostname: metafeederjamendo
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederjamendo-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederjamendo-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederjamendo-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederjamendo-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederjamendo-feeder
-    networks:
-      - metafeederjamendo
-      - pcs
-
 networks:
-  metafeederjamendo:
-    name: metafeederjamendo
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -109,9 +69,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederjamendo
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -160,7 +117,7 @@ x-casaos:
        **Client id:** register a free app at developer.jamendo.com, set
        `JAMENDO_CLIENT_ID` in this app's environment, then restart the app.
        Without it the feeder soft-skips. Pairs with **MetaListen**.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -174,6 +131,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederjamendo/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederjamendo-${domain}
-  webui-path: "/config"
@@ -25,8 +25,8 @@ name: metafeedermusicbrainz
 services:
  # ---------------------------------------------------------------------------
  # metafeedermusicbrainz-feeder — the feeder itself. The gateway reaches it directly on
-  # `pcs` for discovery/query/compute; the human sees it through the AppShield
-  # gate below.
+  # `pcs` for discovery/query/compute; the human configures it
+  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeedermusicbrainz-feeder:
    image: ghcr.io/worph/meta-feeder-musicbrainz:1.1.2
@@ -55,48 +55,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeedermusicbrainz
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeedermusicbrainz:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeedermusicbrainz
-    hostname: metafeedermusicbrainz
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeedermusicbrainz-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeedermusicbrainz-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeedermusicbrainz-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeedermusicbrainz-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeedermusicbrainz-feeder
-    networks:
-      - metafeedermusicbrainz
-      - pcs
-
 networks:
-  metafeedermusicbrainz:
-    name: metafeedermusicbrainz
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -108,9 +68,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeedermusicbrainz
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -161,7 +118,7 @@ x-casaos:
        No API key. For anything playable, also install a bytes tier
        (**MetaFeeder · Internet Archive**, **MetaFeeder · Jamendo**) or
        **MetaFeeder · YouTube**. Pairs with **MetaListen**.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -175,6 +132,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeedermusicbrainz/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeedermusicbrainz-${domain}
-  webui-path: "/config"
@@ -36,7 +36,7 @@ services:
  # ---------------------------------------------------------------------------
  # metafeederopensubtitles-feeder — the feeder (meta-feeder-opensubtitles) hosting
  # the `opensubtitles` upstream. The gateway core reaches it directly on `pcs`
-  # for discovery/query; the human configures it through the AppShield gate below.
+  # for discovery/query; the human configures it from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeederopensubtitles-feeder:
    image: ghcr.io/worph/meta-feeder-opensubtitles:1.0.2
@@ -57,7 +57,7 @@ services:
    environment:
      # INFRA-ONLY env (the "config: no env if in webui" rule). The OpenSubtitles
      # API key and User-Agent are read from the persisted config.json written by
-      # this feeder's config page (behind the AppShield gate below).
+      # this feeder's config page (opened from the MetaGateway dashboard (configure panel)).
      # OPENSUBTITLES_API_KEY / OPENSUBTITLES_USER_AGENT exist only as first-boot
      # seeds; don't set them here. META_FEEDER_STATE_DIR is left at its default
      # (/data/meta-feeder), which is what the volume below mounts.
@@ -74,49 +74,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederopensubtitles
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config UI (set the OpenSubtitles API key)
-  # behind Yundera OIDC SSO. container_name == subdomain prefix. The gateway
-  # still reaches the feeder directly on `pcs` (this gate is for the human
-  # only); index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederopensubtitles:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederopensubtitles
-    hostname: metafeederopensubtitles
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederopensubtitles-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederopensubtitles-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederopensubtitles-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederopensubtitles-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederopensubtitles-feeder
-    networks:
-      - metafeederopensubtitles
-      - pcs
-
 networks:
-  metafeederopensubtitles:
-    name: metafeederopensubtitles
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -128,9 +87,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederopensubtitles
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -211,7 +167,7 @@ x-casaos:
        1. Get a free **OpenSubtitles API key** — opensubtitles.com → sign in →
           *API consumers* → create a consumer and copy its key. No account
           password is needed here: this feeder only searches.
-        2. Open this app's config UI (the dashboard link), paste it into
+        2. Open its config panel (the **MetaGateway** dashboard → this feeder → *configure*), paste it into
           **OpenSubtitles API key** and save. Leave **User-Agent** blank unless
           OpenSubtitles asks you to use your registered app name. The feeder
           restarts itself to apply the key.
@@ -227,7 +183,7 @@ x-casaos:
        **Searches must ask for subtitles** (`fileType:subtitle`). A plain search
        box query never reaches this feeder.

-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -241,6 +197,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederopensubtitles/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederopensubtitles-${domain}
-  webui-path: "/config"
@@ -32,8 +32,8 @@ services:
  # ---------------------------------------------------------------------------
  # metafeederprowlarr-feeder — the feeder (meta-feeder-torznab) running the
  # Prowlarr/Torznab source. The gateway reaches it directly on `pcs` for
-  # discovery/query/compute; the human configures it through the AppShield gate
-  # below.
+  # discovery/query/compute; the human configures it
+  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeederprowlarr-feeder:
    # Image name is `meta-feeder-torznab` — the repo (and therefore the ghcr
@@ -56,8 +56,8 @@ services:
    environment:
      # INFRA-ONLY env (the "config: no env if in webui" rule). Operator config —
      # Prowlarr indexers + API key, TMDB token / language, meta-core URL — is
-      # read from the persisted config.json (this feeder's config page behind the
-      # AppShield gate); env is only a deprecated first-boot seed. These env vars
+      # read from the persisted config.json (this feeder's config page, opened from
+      # the MetaGateway dashboard (configure panel)); env is only a deprecated first-boot seed. These env vars
      # are wiring only: the enrichment sidecars, the enrich callback, the peer id
      # and Prowlarr paging. meta-core defaults to the pcs
      # `http://metacore-app:9000`; Prowlarr is reached as `prowlarr:9696`.
@@ -144,43 +144,6 @@ services:
    networks:
      - metafeederprowlarr
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config UI (set the Prowlarr key, TMDB token)
-  # behind Yundera OIDC SSO. container_name == subdomain prefix. The gateway
-  # still reaches the feeder directly on `pcs` (this gate is for the human only);
-  # index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederprowlarr:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederprowlarr
-    hostname: metafeederprowlarr
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederprowlarr-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederprowlarr-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederprowlarr-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederprowlarr-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederprowlarr-feeder
-    networks:
-      - metafeederprowlarr
-      - pcs
-
 networks:
  metafeederprowlarr:
    name: metafeederprowlarr
@@ -196,9 +159,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederprowlarr
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -265,14 +225,14 @@ x-casaos:
        1. In **Prowlarr**: complete its first-run wizard, add one or more
           indexers (torrent or usenet), then copy the **API Key**
           (Settings → General).
-        2. Open this app's config UI (the dashboard link). Paste the Prowlarr key
+        2. Open its config panel (the **MetaGateway** dashboard → this feeder → *configure*). Paste the Prowlarr key
           into the indexer's API-key field; optionally set a TMDB v4 token for
           posters. Save — the feeder reloads automatically.
        3. In **MetaGateway**, make sure this feeder is listed in its feeders
           config (`http://metafeederprowlarr-feeder:8080`) so it gets
           discovered.

-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -289,6 +249,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederprowlarr/tmdb-cache
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederprowlarr-${domain}
-  webui-path: "/config"
@@ -45,48 +45,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederscihub
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederscihub:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederscihub
-    hostname: metafeederscihub
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederscihub-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederscihub-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederscihub-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederscihub-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederscihub-feeder
-    networks:
-      - metafeederscihub
-      - pcs
-
 networks:
-  metafeederscihub:
-    name: metafeederscihub
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -98,9 +58,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederscihub
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -147,7 +104,7 @@ x-casaos:

        **Mirrors:** set `SCIHUB_MIRRORS` (comma-separated URLs) in this app's
        environment, then restart the app. Without it the feeder soft-skips.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -161,6 +118,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederscihub/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederscihub-${domain}
-  webui-path: "/config"
@@ -55,7 +55,7 @@ services:
      RUST_LOG: "info,meta_feeder=info,suwayomi_feeder=info"
      META_FEEDER_STATE_DIR: "/data/meta-feeder"
      # INFRA-ONLY env, and only a FIRST-BOOT SEED: `base_url` is a field on
-      # this feeder's own config page (the dashboard link), and a value saved
+      # this feeder's own config page (the MetaGateway dashboard (configure panel)), and a value saved
      # there wins. `suwayomi` is the container the Suwayomi store app publishes
      # on `pcs` — change it only to point at a Suwayomi somewhere else, and see
      # the reachability warning in the header before you do.
@@ -78,48 +78,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeedersuwayomi
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeedersuwayomi:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeedersuwayomi
-    hostname: metafeedersuwayomi
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeedersuwayomi-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeedersuwayomi-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeedersuwayomi-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeedersuwayomi-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeedersuwayomi-feeder
-    networks:
-      - metafeedersuwayomi
-      - pcs
-
 networks:
-  metafeedersuwayomi:
-    name: metafeedersuwayomi
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -131,9 +91,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeedersuwayomi
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -210,8 +167,9 @@ x-casaos:
        4. Optionally install **MetaFeeder · AniList** so chapters from several sources
           converge on one work page.

-        This app's own dashboard link opens the **feeder's config page** (Suwayomi URL,
-        chapters per work, chapters pre-loaded) — not Suwayomi.
+        This app has no web UI of its own: the **feeder's config page** (Suwayomi URL,
+        chapters per work, chapters pre-loaded) opens from the **MetaGateway**
+        dashboard → this feeder → *configure*. Suwayomi's own UI is the Suwayomi app.

        **⚠ Querying Suwayomi writes to it.** Rows will appear in its library that you
        did not add by hand. That is inherent to how the aggregator works.
@@ -219,7 +177,7 @@ x-casaos:
        **Suwayomi's own login must stay off** — the reader fetches chapter pages from it
        unauthenticated, so enabling it gives a library that lists every chapter and can
        open none.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -233,6 +191,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeedersuwayomi/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeedersuwayomi-${domain}
-  webui-path: "/config"
@@ -39,8 +39,8 @@ services:
  # ---------------------------------------------------------------------------
  # metafeedertmdb-feeder — the feeder (meta-feeder-tmdb) hosting the `tmdb`
  # upstream. The gateway core reaches it directly on `pcs` for
-  # discovery/query/compute; the human configures it through the AppShield gate
-  # below.
+  # discovery/query/compute; the human configures it
+  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeedertmdb-feeder:
    image: ghcr.io/worph/meta-feeder-tmdb:1.0.3
@@ -59,8 +59,8 @@ services:
    environment:
      # INFRA-ONLY env (the "config: no env if in webui" rule). Operator config —
      # TMDB token, rate/burst, cards-per-search — is read from the persisted
-      # config.json written by this feeder's config page (behind the AppShield
-      # gate below). TMDB_TOKEN / TMDB_RATE_PER_SEC / TMDB_BURST / CARD_TOP_N
+      # config.json written by this feeder's config page (opened from
+      # the MetaGateway dashboard (configure panel)). TMDB_TOKEN / TMDB_RATE_PER_SEC / TMDB_BURST / CARD_TOP_N
      # exist only as deprecated first-boot seeds; don't set them here.
      # META_FEEDER_STATE_DIR is left at its default (/data/meta-feeder), which
      # is what the volume below mounts.
@@ -78,49 +78,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeedertmdb
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config UI (set the TMDB token, tune the rate
-  # and cards-per-search) behind Yundera OIDC SSO. container_name == subdomain
-  # prefix. The gateway still reaches the feeder directly on `pcs` (this gate is
-  # for the human only); index → /config.
-  # ---------------------------------------------------------------------------
-  metafeedertmdb:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeedertmdb
-    hostname: metafeedertmdb
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeedertmdb-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeedertmdb-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeedertmdb-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeedertmdb-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeedertmdb-feeder
-    networks:
-      - metafeedertmdb
-      - pcs
-
 networks:
-  metafeedertmdb:
-    name: metafeedertmdb
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -132,9 +91,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeedertmdb
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -225,7 +181,7 @@ x-casaos:
        **After installing this app:**
        1. Get a free **TMDB v4 read access token** — themoviedb.org →
           Settings → API. (The v4 "Read Access Token", not the v3 API key.)
-        2. Open this app's config UI (the dashboard link) and paste it into
+        2. Open its config panel (the **MetaGateway** dashboard → this feeder → *configure*) and paste it into
           **TMDB v4 token**. Leave the rate, burst and cards-per-search fields
           blank unless you have a reason — the defaults (20 req/s, burst 20,
           10 cards per search) are sane. Save, then restart this app: the
@@ -244,7 +200,7 @@ x-casaos:
        retrieval feeder — **MetaFeeder · Prowlarr**, **· Usenet** or
        **· Tribler**.

-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -258,6 +214,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeedertmdb/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeedertmdb-${domain}
-  webui-path: "/config"
@@ -67,8 +67,8 @@ services:
  # metafeedertribler-feeder — the tribler feeder (dedicated meta-feeder-tribler
  # image). A thin client of tribler-instance; self-publishes resolved records to
  # the shared meta-core + drives the bundled enrichment plugins. The gateway
-  # reaches it directly on `pcs`; the human configures it through the AppShield
-  # gate below.
+  # reaches it directly on `pcs`; the human configures it
+  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeedertribler-feeder:
    image: ghcr.io/worph/meta-feeder-tribler:1.0.6
@@ -83,7 +83,7 @@ services:
      # INFRA-ONLY env (the "config: no env if in webui" rule). Operator config —
      # Tribler sidecar URL, api key, TMDB token / language, meta-core URL — is
      # read from the persisted config.json (pre-seeded by pre-install-cmd, then
-      # editable in the config UI behind the AppShield gate). These env vars are
+      # editable in the config page, opened from the MetaGateway dashboard (configure panel)). These env vars are
      # wiring only: enrichment sidecars, the enrich callback, the peer id
      # (analytics group by it), and the state dir.
      RUST_LOG: "info,meta_feeder=info,tribler_feeder=info"
@@ -154,43 +154,6 @@ services:
    networks:
      - metafeedertribler
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config UI (Tribler sidecar URL / api key, TMDB
-  # token) behind Yundera OIDC SSO. container_name == subdomain prefix. The
-  # gateway still reaches the feeder directly on `pcs` (this gate is for the
-  # human only); index → /config.
-  # ---------------------------------------------------------------------------
-  metafeedertribler:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeedertribler
-    hostname: metafeedertribler
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeedertribler-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeedertribler-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeedertribler-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeedertribler-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeedertribler-feeder
-    networks:
-      - metafeedertribler
-      - pcs
-
 networks:
  metafeedertribler:
    name: metafeedertribler
@@ -206,9 +169,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeedertribler
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -262,7 +222,7 @@ x-casaos:

        **After installing this app:**
        1. It works out of the box: the feeder is pre-wired to its bundled Tribler
-           core. Optionally open the config UI (the dashboard link) to set a TMDB
+           core. Optionally open its config panel (the **MetaGateway** dashboard → this feeder → *configure*) to set a TMDB
           v4 token for posters, then Save — the feeder reloads automatically.
        2. In **MetaGateway**, make sure this feeder is listed in its feeders
           config (`http://metafeedertribler-feeder:8080`) so it gets discovered
@@ -271,7 +231,7 @@ x-casaos:
        **Note:** the bundled Tribler core needs a few minutes to bootstrap onto
        the IPv8 network before search results appear.

-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

  pre-install-cmd: |
    # Seed the bundled Tribler core config (api on 0.0.0.0:8085, key `changeme`).
@@ -309,6 +269,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeedertribler/tribler-seed
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeedertribler-${domain}
-  webui-path: "/config"
@@ -303,8 +303,8 @@ services:
  # metafeederusenet-feeder — the usenet feeder sidecar (meta-feeder-usenet).
  # Reads nntmux's release catalog + shared .nzb store; self-publishes
  # resolved records + seeds the `.nzb` manifest to the shared MetaCore. The
-  # gateway reaches it directly on `pcs`; the human configures it through the
-  # AppShield gate below.
+  # gateway reaches it directly on `pcs`; the human configures it from
+  # the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeederusenet-feeder:
    image: ghcr.io/worph/meta-feeder-usenet:1.0.6
@@ -323,7 +323,7 @@ services:
      # INFRA-ONLY env (the "config: no env if in webui" rule). Operator
      # config beyond the two DB/path seeds below — TMDB token / language,
      # meta-core URL — is read from the persisted config.json (this
-      # feeder's config page behind the AppShield gate). These env vars are
+      # feeder's config page, opened from the MetaGateway dashboard (configure panel)). These env vars are
      # wiring only: the enrichment sidecars, the enrich callback, the peer id.
      RUST_LOG: "info,meta_feeder=info"
      # The peer id stamped into provenance.gateway_peer on every record this
@@ -402,43 +402,6 @@ services:
    networks:
      - metafeederusenet
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config UI (nntmux DB URL / nzb path, TMDB
-  # token) behind Yundera OIDC SSO. container_name == subdomain prefix. The
-  # gateway still reaches the feeder directly on `pcs` (this gate is for the
-  # human only); index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederusenet:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederusenet
-    hostname: metafeederusenet
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederusenet-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederusenet-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederusenet-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederusenet-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederusenet-feeder
-    networks:
-      - metafeederusenet
-      - pcs
-
 networks:
  metafeederusenet:
    name: metafeederusenet
@@ -454,9 +417,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederusenet
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -609,7 +569,7 @@ x-casaos:
           full-retention backfill is hundreds of GB. `backfill_days` is the
           knob that bounds it — start small, widen once you see releases.

-        7. Open this app's config UI (the dashboard link) to optionally set a
+        7. Open its config panel (the **MetaGateway** dashboard → this feeder → *configure*) to optionally set a
           TMDB v4 token for posters, then Save.
        8. In **MetaGateway**, make sure this feeder is listed in its feeders
           config (`http://metafeederusenet-feeder:8080`) so it gets
@@ -623,8 +583,8 @@ x-casaos:
        <group>` / `sleeping`). `settings.running=0` shows up there as
        `idle`.

-        **Authentication:** the feeder's config UI is protected by Yundera's
-        Authelia (OIDC); nntmux uses its own login (seeded above).
+        **Authentication:** the feeder's config page opens from the **MetaGateway**
+        dashboard (behind its login); nntmux uses its own login (seeded above).

  pre-install-cmd: |
    # Seed nntmux's .env (trap #1 — must be a complete file, see header).
@@ -903,6 +863,8 @@ x-compose-app:
    - path: /DATA/AppData/metafeederusenet/scanner
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederusenet-${domain}
-  webui-path: "/config"
+  # Same string as nntmux's caddy_0 label, so the tile link and the route agree.
+  # The tile opens nntmux's own admin UI (its own login, its own Caddy route).
+  # The feeder itself is configured from the MetaGateway dashboard.
+  webui-host: metafeederusenetnntmux-${domain}
+  webui-path: "/"
@@ -44,48 +44,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederwikicommons
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederwikicommons:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederwikicommons
-    hostname: metafeederwikicommons
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederwikicommons-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederwikicommons-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederwikicommons-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederwikicommons-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederwikicommons-feeder
-    networks:
-      - metafeederwikicommons
-      - pcs
-
 networks:
-  metafeederwikicommons:
-    name: metafeederwikicommons
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -97,9 +57,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederwikicommons
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -138,7 +95,7 @@ x-casaos:
        dashboard's *Add a feeder* box — name `wikicommons-feeder`, URL `http://metafeederwikicommons-feeder:8080`.
        The gateway restarts itself: feeder discovery is startup-only.
        No other setup.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -152,6 +109,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederwikicommons/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederwikicommons-${domain}
-  webui-path: "/config"
@@ -26,8 +26,8 @@ name: metafeederyoutube
 services:
  # ---------------------------------------------------------------------------
  # metafeederyoutube-feeder — the feeder itself. The gateway reaches it directly on
-  # `pcs` for discovery/query/compute; the human sees it through the AppShield
-  # gate below.
+  # `pcs` for discovery/query/compute; the human configures it
+  # from the MetaGateway dashboard (configure panel).
  # ---------------------------------------------------------------------------
  metafeederyoutube-feeder:
    image: ghcr.io/worph/meta-feeder-youtube:1.1.1
@@ -56,48 +56,8 @@ services:
      retries: 10
      start_period: 5s
    networks:
-      - metafeederyoutube
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
-  # ---------------------------------------------------------------------------
-  metafeederyoutube:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metafeederyoutube
-    hostname: metafeederyoutube
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metafeederyoutube-feeder"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metafeederyoutube-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metafeederyoutube-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metafeederyoutube-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metafeederyoutube-feeder
-    networks:
-      - metafeederyoutube
-      - pcs
-
 networks:
-  metafeederyoutube:
-    name: metafeederyoutube
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -109,9 +69,6 @@ x-casaos:
  author: Worph Team
  category: Media
  developer: Aptero Team
-  main: metafeederyoutube
-  webui_port: 80
-  index: /config

  description:
    en_us: |
@@ -160,7 +117,7 @@ x-casaos:
        The gateway restarts itself: feeder discovery is startup-only.
        No API key. For music, also install **MetaFeeder · MusicBrainz** — it
        names the recording a YouTube candidate must match before it is accepted.
-        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+        **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -174,6 +131,3 @@ x-compose-app:
    - path: /DATA/AppData/metafeederyoutube/state
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metafeederyoutube-${domain}
-  webui-path: "/config"
@@ -50,50 +50,8 @@ services:
      # payload and writes back through the caller. No key, no WebDAV.
      TZ: "$TZ"
    networks:
-      - metapluginanimedetector
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginanimedetector:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginanimedetector
-    hostname: metapluginanimedetector
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginanimedetector-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginanimedetector-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginanimedetector-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginanimedetector-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginanimedetector-plugin
-    networks:
-      - metapluginanimedetector
-      - pcs
-
 networks:
-  metapluginanimedetector:
-    name: metapluginanimedetector
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -105,9 +63,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginanimedetector
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -161,14 +116,11 @@ x-casaos:
        addressable at `http://metapluginanimedetector-plugin:8080` for your own caller — not
        expecting it to light up MetaSort or a MetaFeeder on its own.

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginanimedetector-${domain}
-  webui-path: "/manifest"
@@ -58,50 +58,8 @@ services:
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginffmpeg/cache:/cache:rw
    networks:
-      - metapluginffmpeg
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginffmpeg:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginffmpeg
-    hostname: metapluginffmpeg
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginffmpeg-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginffmpeg-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginffmpeg-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginffmpeg-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginffmpeg-plugin
-    networks:
-      - metapluginffmpeg
-      - pcs
-
 networks:
-  metapluginffmpeg:
-    name: metapluginffmpeg
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -113,9 +71,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginffmpeg
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -174,8 +129,8 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -189,6 +144,3 @@ x-compose-app:
    - path: /DATA/AppData/metapluginffmpeg/cache
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginffmpeg-${domain}
-  webui-path: "/manifest"
@@ -58,50 +58,8 @@ services:
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginfileinfo/cache:/cache:rw
    networks:
-      - metapluginfileinfo
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginfileinfo:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginfileinfo
-    hostname: metapluginfileinfo
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginfileinfo-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginfileinfo-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginfileinfo-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginfileinfo-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginfileinfo-plugin
-    networks:
-      - metapluginfileinfo
-      - pcs
-
 networks:
-  metapluginfileinfo:
-    name: metapluginfileinfo
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -113,9 +71,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginfileinfo
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -172,8 +127,8 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -187,6 +142,3 @@ x-compose-app:
    - path: /DATA/AppData/metapluginfileinfo/cache
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginfileinfo-${domain}
-  webui-path: "/manifest"
@@ -55,50 +55,8 @@ services:
      EMIT_TITLE_TAGS: "${EMIT_TITLE_TAGS:-}"
      TZ: "$TZ"
    networks:
-      - metapluginfilenameparser
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginfilenameparser:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginfilenameparser
-    hostname: metapluginfilenameparser
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginfilenameparser-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginfilenameparser-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginfilenameparser-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginfilenameparser-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginfilenameparser-plugin
-    networks:
-      - metapluginfilenameparser
-      - pcs
-
 networks:
-  metapluginfilenameparser:
-    name: metapluginfilenameparser
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -110,9 +68,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginfilenameparser
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -173,14 +128,11 @@ x-casaos:
        from `plugins.yml` (`image:`), with no URL slot — installing this app does
        not add `filename-parser` to MetaSort.

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginfilenameparser-${domain}
-  webui-path: "/manifest"
@@ -55,50 +55,8 @@ services:
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/cache:/cache:rw
    networks:
-      - metapluginfullhash
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginfullhash:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginfullhash
-    hostname: metapluginfullhash
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginfullhash-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginfullhash-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginfullhash-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginfullhash-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginfullhash-plugin
-    networks:
-      - metapluginfullhash
-      - pcs
-
 networks:
-  metapluginfullhash:
-    name: metapluginfullhash
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -110,9 +68,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginfullhash
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -169,8 +124,8 @@ x-casaos:
        addressable at `http://metapluginfullhash-plugin:8080` for your own caller — not
        expecting it to light up MetaSort or a MetaFeeder on its own.

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -184,6 +139,3 @@ x-compose-app:
    - path: /DATA/AppData/metapluginfullhash/cache
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginfullhash-${domain}
-  webui-path: "/manifest"
@@ -54,50 +54,8 @@ services:
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
    networks:
-      - metapluginjellyfinnfo
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginjellyfinnfo:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginjellyfinnfo
-    hostname: metapluginjellyfinnfo
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginjellyfinnfo-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginjellyfinnfo-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginjellyfinnfo-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginjellyfinnfo-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginjellyfinnfo-plugin
-    networks:
-      - metapluginjellyfinnfo
-      - pcs
-
 networks:
-  metapluginjellyfinnfo:
-    name: metapluginjellyfinnfo
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -109,9 +67,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginjellyfinnfo
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -170,14 +125,11 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginjellyfinnfo-${domain}
-  webui-path: "/manifest"
@@ -50,50 +50,8 @@ services:
      # payload and writes back through the caller. No key, no WebDAV.
      TZ: "$TZ"
    networks:
-      - metapluginlanguage
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginlanguage:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginlanguage
-    hostname: metapluginlanguage
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginlanguage-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginlanguage-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginlanguage-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginlanguage-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginlanguage-plugin
-    networks:
-      - metapluginlanguage
-      - pcs
-
 networks:
-  metapluginlanguage:
-    name: metapluginlanguage
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -105,9 +63,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginlanguage
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -163,14 +118,11 @@ x-casaos:
        addressable at `http://metapluginlanguage-plugin:8080` for your own caller — not
        expecting it to light up MetaSort or a MetaFeeder on its own.

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginlanguage-${domain}
-  webui-path: "/manifest"
@@ -54,50 +54,8 @@ services:
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
    networks:
-      - metapluginopensubtitles
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginopensubtitles:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginopensubtitles
-    hostname: metapluginopensubtitles
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginopensubtitles-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginopensubtitles-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginopensubtitles-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginopensubtitles-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginopensubtitles-plugin
-    networks:
-      - metapluginopensubtitles
-      - pcs
-
 networks:
-  metapluginopensubtitles:
-    name: metapluginopensubtitles
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -109,9 +67,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginopensubtitles
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -174,14 +129,11 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginopensubtitles-${domain}
-  webui-path: "/manifest"
@@ -54,50 +54,8 @@ services:
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
    networks:
-      - metapluginstillextractor
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginstillextractor:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginstillextractor
-    hostname: metapluginstillextractor
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginstillextractor-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginstillextractor-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginstillextractor-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginstillextractor-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginstillextractor-plugin
-    networks:
-      - metapluginstillextractor
-      - pcs
-
 networks:
-  metapluginstillextractor:
-    name: metapluginstillextractor
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -109,9 +67,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginstillextractor
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -170,14 +125,11 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginstillextractor-${domain}
-  webui-path: "/manifest"
@@ -54,50 +54,8 @@ services:
      WEBDAV_URL: "http://metacore-app:9000/webdav"
      TZ: "$TZ"
    networks:
-      - metapluginsubtitle
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginsubtitle:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginsubtitle
-    hostname: metapluginsubtitle
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginsubtitle-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginsubtitle-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginsubtitle-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginsubtitle-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginsubtitle-plugin
-    networks:
-      - metapluginsubtitle
-      - pcs
-
 networks:
-  metapluginsubtitle:
-    name: metapluginsubtitle
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -109,9 +67,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginsubtitle
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -171,14 +126,11 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
 # outright rather than starting it without its directories.
 x-compose-app:
  schema_version: 2
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginsubtitle-${domain}
-  webui-path: "/manifest"
@@ -58,50 +58,8 @@ services:
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/cache:/cache:rw
    networks:
-      - metapluginsubtitleextractor
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metapluginsubtitleextractor:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metapluginsubtitleextractor
-    hostname: metapluginsubtitleextractor
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metapluginsubtitleextractor-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metapluginsubtitleextractor-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metapluginsubtitleextractor-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metapluginsubtitleextractor-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metapluginsubtitleextractor-plugin
-    networks:
-      - metapluginsubtitleextractor
-      - pcs
-
 networks:
-  metapluginsubtitleextractor:
-    name: metapluginsubtitleextractor
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -113,9 +71,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metapluginsubtitleextractor
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -175,8 +130,8 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -190,6 +145,3 @@ x-compose-app:
    - path: /DATA/AppData/metapluginsubtitleextractor/cache
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metapluginsubtitleextractor-${domain}
-  webui-path: "/manifest"
@@ -58,50 +58,8 @@ services:
      # expensive to redo; safe to delete, it rebuilds.
      - ${DATA_ROOT:-/DATA}/AppData/metaplugintmdb/cache:/cache:rw
    networks:
-      - metaplugintmdb
      - pcs
-
-  # ---------------------------------------------------------------------------
-  # AppShield gate — the plugin's `/manifest` behind Yundera OIDC SSO.
-  # container_name == subdomain prefix (the auth-registrar derives the client_id
-  # from it). Consumers still reach the plugin directly on `pcs`; this gate
-  # exists so `/process` and `/configure` are never reachable from the internet
-  # without a session.
-  # ---------------------------------------------------------------------------
-  metaplugintmdb:
-    image: ghcr.io/yundera/appshield:2.0.9
-    cpu_shares: 80
-    container_name: metaplugintmdb
-    hostname: metaplugintmdb
-    restart: unless-stopped
-    user: "0:0"
-    expose:
-      - 80
-    environment:
-      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
-      BACKEND_HOST: "metaplugintmdb-plugin"
-      BACKEND_PORT: "8080"
-      LISTEN_PORT: "80"
-    labels:
-      caddy_0: metaplugintmdb-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metaplugintmdb-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: metaplugintmdb-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - metaplugintmdb-plugin
-    networks:
-      - metaplugintmdb
-      - pcs
-
 networks:
-  metaplugintmdb:
-    name: metaplugintmdb
-    driver: bridge
  pcs:
    name: ${APP_NET:-pcs}
    external: true
@@ -113,9 +71,6 @@ x-casaos:
  author: Worph Team
  category: Developer
  developer: Aptero Team
-  main: metaplugintmdb
-  webui_port: 80
-  index: /manifest

  description:
    en_us: |
@@ -179,8 +134,8 @@ x-casaos:
        **Requires MetaCore** on the same box: this plugin writes what it
        produces to MetaCore's WebDAV (`http://metacore-app:9000/webdav`).

-        **Authentication:** the `/manifest` page is protected by Yundera's Authelia
-        (OIDC). Consumers on the `pcs` network bypass the gate by design.
+        **No web UI:** a headless service. Its consumers reach it directly on the
+        `pcs` network.

 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
 # schema_version 2 is required for `folders`: an older Maison refuses the app
@@ -194,6 +149,3 @@ x-compose-app:
    - path: /DATA/AppData/metaplugintmdb/cache
      user: $PUID
      group: $PGID
-  # Same string as the caddy_0 label, so the tile link and the route agree.
-  webui-host: metaplugintmdb-${domain}
-  webui-path: "/manifest"
@@ -135,7 +135,5 @@ x-compose-app:
    - path: /DATA/AppData/metatransportipfs/state
      user: $PUID
      group: $PGID
-  # An extension of MetaShare: no tile of its own, nested under MetaShare's,
-  # and listed in the store under MetaShare's Extensions. Presentation only —
-  # lifecycle and backups stay per-app.
-  parent: metashare
+  # No webui-host and no x-casaos hostname/webui_port/port_map: Maison files it
+  # under Services (no click target). Its config opens from MetaShare → Plugins.
@@ -117,7 +117,5 @@ x-compose-app:
    - path: /DATA/AppData/metatransportnzb/state
      user: $PUID
      group: $PGID
-  # An extension of MetaShare: no tile of its own, nested under MetaShare's,
-  # and listed in the store under MetaShare's Extensions. Presentation only —
-  # lifecycle and backups stay per-app.
-  parent: metashare
+  # No webui-host and no x-casaos hostname/webui_port/port_map: Maison files it
+  # under Services (no click target). Its config opens from MetaShare → Plugins.
@@ -126,7 +126,5 @@ x-compose-app:
    - path: /DATA/AppData/metatransporttorrent/state
      user: $PUID
      group: $PGID
-  # An extension of MetaShare: no tile of its own, nested under MetaShare's,
-  # and listed in the store under MetaShare's Extensions. Presentation only —
-  # lifecycle and backups stay per-app.
-  parent: metashare
+  # No webui-host and no x-casaos hostname/webui_port/port_map: Maison files it
+  # under Services (no click target). Its config opens from MetaShare → Plugins.