diff --git a/compose.yml b/compose.yml
index d6e0763..707386d 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,13 +3,10 @@
 networks:
   wg:
     driver: bridge
-  default:
+  hs:
     driver: bridge
-volumes:
-  tscale_data:
-    driver: local
-  actual_data:
-    driver: local
+
+
 services:
   # @NOTE https://oneuptime.com/blog/post/2026-03-18-use-podman-containers-wireguard-vpn/view
   wgclient:
@@ -35,6 +32,11 @@ services:
       - net.ipv6.conf.all.src_valid_mark=1
       - net.ipv6.ip_forward=1data
       - net.ipv4.ip_forward=1
+    labels:
+      glance.name: Wireguard
+      glance.id: wireguard
+      glance.icon: "si:wireguard"
+      glance.description: VPN client connection
 
   # @NOTE https://tailscale.com/docs/features/containers/docker
   # @NOTE https://tailscale.com/blog/docker-tailscale-guide
@@ -45,13 +47,16 @@ services:
       # - SYS_MODULE
       - NET_ADMIN
     restart: unless-stopped
-    volumes:
-      # - /lib/modules:/lib/modules:ro
-      - tscale_data:/var/lib/tailscale
-      - ~/.config/tailscale:/config
     devices:
       - /dev/net/tun:/dev/net/tun
+    volumes:
+      # - /lib/modules:/lib/modules:ro
+      - ~/.cvols/tailscale:/var/lib/tailscale
+      - ~/.config/tailscale:/config:Z
+    networks:
+      - hs
     hostname: nirvana
+    # env_file: [tailclient/prod.env]
     environment:
       TS_AUTHKEY: ${TS_AUTHKEY:?Provide authentication key}?ephemeral=false
       TS_SERVE_CONFIG: /config/${TS_SERVE_CONFIG_BASENAME:?Provide a basename for the Tailscale Serve configuration file}.json
@@ -60,3 +65,81 @@ services:
 
   # @TODO make subsequent containers have 'network_mode' attrbute set to value 'service:wgclient'/'service:tailclient'
   #   OR make subsequent containers have 'networks' attribute set to list value with 'container:wgclient'/'contaner:tailclient' item
+
+  revproxy0:
+    image: caddy:latest
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+    volumes:
+      - ~/.caddy:/etc/caddy
+      - ~/srv:/srv
+      - ~/.local/share/caddy:/usr/share/caddy
+      - ~/.cvols/caddy:/data
+      - ~/.config/caddy:/config
+    networks:
+      - "container:wgclient"
+    dns:
+      - ${WG_INTFACE_ADDR:?Enter Wireguard client container's interface address}
+    # env_file: [wg0-dns.env]
+    depends_on:
+      - wgclient
+    labels:
+      glance.name: Caddy
+      glance.id: caddy
+      glance.icon: "si:caddy"
+      glance.description: HTTPS reverse proxy server
+
+  glance:
+    container_name: glance
+    image: glanceapp/glance
+    restart: unless-stopped
+    volumes:
+      # @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#configuring-glance
+      - ~/.config/glance:/app/config # @NOTE internal container server port is changed via 'glance.yml' config file; default is 8080
+      - ~/.local/share/glance:/app/assets
+      - /etc/localtime:/etc/localtime:ro
+      # Optionally, also mount docker socket if you want to use the docker containers widget
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - "container:tailclient"
+    # env_file: [hs.env,glance/prod.env]
+    depends_on:
+      - tailclient
+    labels:
+      glance.name: Self
+      glance.icon: "si:glance"
+      glance.url: "${HS_URL_SCHEME:?Enter Headscale URL scheme for server}://${HS_DOMAIN:?Enter Headscale domain}"
+      glance.description: Dashboard
+
+# @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#docker-containers
+# @TODO apply labels to each container that allows it to show up in Glance dashboard
+
+  stash:
+    image: stashapp/stash:latest
+    container_name: stash
+    restart: unless-stopped
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.config/stash:/root/.stash
+      - ~/.xxx/media:/data
+      - ~/.local/share/stash/metadata:/metadata
+      - ~/.local/share/stash/cache:/cache
+      - ~/.local/share/stash/blobs:/blobs
+      - ~/.xxx/stash:/generated
+    logging:
+      driver: "json-file"
+      options:
+        max-file: "10"
+        max-size: "2m"
+    networks:
+      - "container:tailclient"
+    depends_on:
+      - tailclient
+    environment:
+      STASH_PORT: "9999"
+    labels:
+      glance.name: Stash
+      glance.icon: "si:stash"
+      glance.url: "${HS_URL_SCHEME:?Enter Headscale URL scheme for server}://${HS_DOMAIN:?Enter Headscale domain}"
+      glance.description: NSFW media streaming service and gallery