- Enabled GitLab Container Registry on its own subdomain via NPM/mkcert
- Built minimal ssh-alpine image (Alpine + OpenSSH, key-only auth)
- Docker-outside-of-Docker build pipeline reusing the host socket, no DinD
- Forced --pull --no-cache builds so scheduled rebuilds pick up real upstream updates
- Biweekly Pipeline Schedule (cron: 0 3 */14 * *)
- Registry cleanup policy to prevent unbounded tag growth
- Documented the Tailscale/Pi-hole DNS conflict and other gotchas hit along the way
