Caddy (+ a truncated/sanitized example Caddyfile showing the mTLS + Authentik forward-auth pattern without the real subdomain list), Hawser, Gitea (private instance only, dropped the public-mirror service - that's already its own public thing), Kestra (genericized the ansible-repo/SSH-key bind mounts), Mosquitto, n8n, NetBox, Node-RED.