diff --git a/AGENTS.md b/AGENTS.md
index 8497b85..5fb0308 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,10 +36,9 @@ This is the `tower-of-joy` project - a containerized home server infrastructure
 **External Access Rule:** All public/external services MUST route through Nginx Proxy Manager (NPM) for Let's Encrypt SSL management and unified logging. Never expose service ports directly to the internet (except NPM and Headscale).
 
 **Service Maintenance**
-- **Stack Management** the portainer (and docker), NPM and Uptime Kuma services are managed through the core-api service. To maintain settings and configurations of these systems, read the documentation at http://tower-of-joy:8083/docs and prefer to use the api functions over direct reads an edits.
+- **Stack Management** the portainer (and docker) and NPM services are managed through the core-api service. To maintain settings and configurations of these systems, read the documentation at http://tower-of-joy:8083/docs and prefer to use the api functions over direct reads an edits.
 
 **Service Integration Policy:** A service deployment is INCOMPLETE until cross-service integrations are implemented. Every new service MUST be integrated with:
-- **Uptime Kuma:** Add health check monitor (use `scripts/setup-kuma-monitors.sh` as guide)
 - **Organizr:** Configure service in dashboard (Settings → Tab Editor, Homepage Items)
 - **docs/reference/CONTAINERS.md:** Document the service with full profile and configuration table
 
@@ -356,11 +355,6 @@ When deploying a NEW service, follow this complete checklist. A deployment is **
 - [ ] Document access credentials securely
 
 **Phase 3: Cross-Service Integration (MANDATORY)**
-- [ ] **Uptime Kuma Integration:**
-  - Add HTTP monitor for service health check
-  - Set appropriate heartbeat interval (typically 60s)
-  - Verify monitor shows "Up" status
-  - Reference: `scripts/setup-kuma-monitors.sh`
 - [ ] **Organizr Integration:**
   - Add service URL and API token to Organizr (Settings → Tab Editor)
   - Enable homepage widgets if supported
@@ -385,7 +379,7 @@ When deploying a NEW service, follow this complete checklist. A deployment is **
 
 **Phase 5: Verification**
 - [ ] Service accessible at documented URL
-- [ ] Uptime Kuma shows service as "Up"
+- [ ] Docker healthcheck shows healthy status
 - [ ] Organizr displays service widget/tab correctly
 - [ ] Service persists across container restart
 - [ ] Backups configured (if service has important data)
@@ -394,10 +388,9 @@ When deploying a NEW service, follow this complete checklist. A deployment is **
 ```bash
 # 1. Deploy Jellyfin container
 # 2. Configure Jellyfin settings and add media
-# 3. Add Jellyfin to Uptime Kuma (HTTP monitor)
-# 4. Add Jellyfin to Organizr (homepage widgets + tab)
-# 5. Document in CONTAINERS.md
-# 6. Test all integrations work
+# 3. Add Jellyfin to Organizr (homepage widgets + tab)
+# 4. Document in CONTAINERS.md
+# 5. Test all integrations work
 # ✓ NOW the deployment is complete
 ```
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2cc366e..22e74b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Authentik SSO Milestones 4-5: Protect remaining services (deferred)
 - Disaster recovery and offsite backup strategy
 
+## [0.13.0-healthchecks] - 2025-12-14
+
+### Added
+- **Docker Healthchecks** - Added healthcheck configurations to 13 stacks for Portainer container status monitoring
+  - `gitea.yml` - gitea-db (pg_isready), gitea (git.schweitz.internal/api/healthz), gitea-runner (pgrep)
+  - `headscale.yml` - /health endpoint
+  - `jellyfin.yml` - /health endpoint
+  - `netdata.yml` - /api/v1/info endpoint
+  - `nginx-proxy-manager.yml` - /api/ endpoint
+  - `ollama.yml` - /api/tags endpoint
+  - `open-webui.yml` - /health endpoint
+  - `organizr.yml` - root page check
+  - `portainer.yml` - /api/system/status endpoint
+  - `qdrant.yml` - /readyz endpoint
+  - `samba.yml` - pgrep smbd (10m interval)
+  - `watchtower.yml` - pgrep watchtower
+
+### Removed
+- **Uptime Kuma** - Removed external monitoring service (replaced by Docker healthchecks + Portainer status)
+  - Deleted `stacks/uptime-kuma.yml`
+  - Removed KUMA environment variables from core-api
+  - Removed uptime-kuma-api from requirements.txt
+  - Cleaned up documentation references in CONTAINERS.md, README.md, AGENTS.md, Makefile
+- **Heimdall** - Cleaned up stale references (service was previously removed)
+  - Removed from documentation and Makefile
+
+### Changed
+- **CONTAINERS.md** - Updated service count to 21 containers across 16 stacks
+- **AGENTS.md** - Updated service integration policy (removed Uptime Kuma requirement)
+- **Makefile** - Simplified deploy-phase3 to Netdata only
+
 ## [0.12.0-library-desk-enhancements] - 2025-12-10
 
 ### Added
diff --git a/CONTAINERS.md b/CONTAINERS.md
index 88a386a..71546dd 100644
--- a/CONTAINERS.md
+++ b/CONTAINERS.md
@@ -1,7 +1,7 @@
 # Container Reference - tower-of-joy Infrastructure
 
-> **Last Updated:** 2025-12-03  
-> **Total Services:** 22 containers across 17 stacks  
+> **Last Updated:** 2025-12-14
+> **Total Services:** 21 containers across 16 stacks  
 > **System:** Intel i7-6700, RTX 2080 Ti (11GB VRAM), 16GB RAM, Zorin OS 16.3
 
 ---
@@ -17,7 +17,6 @@
 | **Redis Shared** | 6379 | N/A (internal) | No | No | ✅ Running |
 | **Ollama** | 11434 | http://192.168.86.149:11434 | LAN | Yes (RTX 2080 Ti) | ✅ Running |
 | **Headscale** | 8085, 9090 | http://192.168.86.149:8085 | LAN | No | ✅ Running |
-| **Uptime Kuma** | 3001 | http://192.168.86.149:3001 | LAN | No | ✅ Running |
 | **Netdata** | 19999 | http://192.168.86.149:19999 | LAN | No | ✅ Running |
 | **Organizr** | 9999 | https://home.schweitz.net | Internet (SSO) | No | ✅ Running |
 | **Watchtower** | None | N/A (background) | No | No | ✅ Running |
@@ -73,11 +72,6 @@ The Core API (port 8083) provides REST endpoints for managing the entire infrast
 - `GET /infrastructure/proxy/{id}` - Get proxy host details
 - `POST /infrastructure/proxy` - Create new proxy host with SSL
 - `PUT /infrastructure/proxy/{id}` - Update proxy configuration
-- `GET /infrastructure/monitors` - List Uptime Kuma monitors
-- `POST /infrastructure/monitors` - Create new health monitor
-- `PUT /infrastructure/monitors/{id}` - Update monitor
-- `DELETE /infrastructure/monitors/{id}` - Delete monitor
-
 **API Documentation:** http://192.168.86.149:8083/docs
 
 ---
@@ -261,28 +255,6 @@ Headscale is a self-hosted control server for Tailscale's mesh VPN protocol, cre
 
 ## Monitoring Layer
 
-### Uptime Kuma
-
-Uptime Kuma monitors the availability and response times of all infrastructure and application services, providing real-time status dashboards with historical uptime tracking, incident detection, and notification capabilities. It performs HTTP, TCP, and ICMP checks at configurable intervals against each service endpoint, alerting on downtime events through multiple notification channels including email, Discord, and Slack. The service maintains a SQLite database of uptime history and response time metrics accessible through a clean web interface.
-
-| Property | Value |
-|----------|-------|
-| **Image** | `louislam/uptime-kuma:latest` |
-| **Container Name** | `uptime-kuma` |
-| **Access URL** | http://192.168.86.149:3001 |
-| **External Access** | LAN only (monitoring dashboard) |
-| **Port Mapping** | 3001:3001 (Web UI) |
-| **Network Mode** | Bridge |
-| **Restart Policy** | `unless-stopped` |
-| **Volume Mounts** | `~/docker-data/uptime-kuma:/app/data` |
-| **Resource Limits** | None |
-| **GPU Required** | No |
-| **Dependencies** | None (monitors other services) |
-| **Database** | SQLite (persistent in volume) |
-| **Check Intervals** | 60 seconds (configurable) |
-
----
-
 ### Netdata
 
 Netdata provides comprehensive real-time system performance monitoring with per-second metric collection for CPU, RAM, disk I/O, network traffic, and Docker container resource usage, displaying everything through interactive web dashboards with zero configuration required. It collects thousands of metrics automatically with minimal overhead, offering drill-down capabilities from system-wide views to per-container and per-process analysis. The service maintains short-term metric history in RAM and can stream data to long-term storage backends for historical analysis.
@@ -307,7 +279,7 @@ Netdata provides comprehensive real-time system performance monitoring with per-
 
 ### Organizr
 
-Organizr serves as a comprehensive unified dashboard that consolidates all homelab services into a single tabbed interface with integrated homepage widgets showing real-time statistics from Jellyfin streams, Netdata metrics, Uptime Kuma status checks, and download client activity. It provides customizable authentication per-tab with support for SSO integration, user management with group-based access control, and a mobile-responsive interface for managing the entire infrastructure from anywhere. The service acts as a central hub replacing the need for multiple bookmarks or remembering service ports, offering both quick-access tabs and homepage cards with live data feeds from connected services.
+Organizr serves as a comprehensive unified dashboard that consolidates all homelab services into a single tabbed interface with integrated homepage widgets showing real-time statistics from Jellyfin streams, Netdata metrics, and download client activity. It provides customizable authentication per-tab with support for SSO integration, user management with group-based access control, and a mobile-responsive interface for managing the entire infrastructure from anywhere. The service acts as a central hub replacing the need for multiple bookmarks or remembering service ports, offering both quick-access tabs and homepage cards with live data feeds from connected services.
 
 | Property | Value |
 |----------|-------|
@@ -326,7 +298,7 @@ Organizr serves as a comprehensive unified dashboard that consolidates all homel
 | **Dependencies** | PostgreSQL Shared |
 | **Database** | PostgreSQL on `postgres-shared` (database `organizr`) |
 | **Database Size** | ~5-10MB (typical) |
-| **Integrated Services** | Jellyfin, Netdata, Uptime Kuma |
+| **Integrated Services** | Jellyfin, Netdata |
 | **Authentication** | Internal (supports SSO, Plex OAuth, LDAP) |
 
 **Configuration**:
@@ -415,45 +387,9 @@ Core API provides OpenAI-compatible HTTP functions for Open WebUI, extending LLM
 | **GPU Required** | No (proxies requests to Ollama which uses GPU) |
 | **Dependencies** | Ollama (model inference), Open WebUI (consumes this API), ai-dataplane network |
 | **Framework** | FastAPI 0.115.0, Uvicorn 0.32.0, Pydantic 2.10.4, httpx 0.28.1 |
-| **Key Features** | OpenAI-compatible API (`/v1/chat/completions`, `/v1/models`), Model aliasing (OpenAI → local models), Streaming & non-streaming responses, Web scraping (Trafilatura, BeautifulSoup), Hot-reload development, OpenAPI spec, Infrastructure management (Portainer, Uptime Kuma) |
+| **Key Features** | OpenAI-compatible API (`/v1/chat/completions`, `/v1/models`), Model aliasing (OpenAI → local models), Streaming & non-streaming responses, Web scraping (Trafilatura, BeautifulSoup), Hot-reload development, OpenAPI spec, Infrastructure management (Portainer) |
 | **AI Orchestrator** | **Phase 1 Complete** - OpenAI API wrapper with model routing. Phase 2+ will add memory systems, multi-agent workflows, and tool integration. |
 | **Health Check** | `GET /health` (30s interval) - checks API status and Ollama connectivity |
-| **Monitoring API** | Full CRUD for Uptime Kuma monitors via Socket.IO: `GET /infrastructure/monitors`, `POST /infrastructure/monitors`, `GET /infrastructure/monitors/{id}`, `PUT /infrastructure/monitors/{id}`, `DELETE /infrastructure/monitors/{id}` |
-
-**Creating Monitors via API**:
-```bash
-# Create a TCP port monitor for Redis
-curl -X POST http://192.168.86.149:8083/infrastructure/monitors \
-  -H "Content-Type: application/json" \
-  -d '{
-    "type": "port",
-    "name": "Redis Shared - Port Check",
-    "hostname": "redis-shared",
-    "port": 6379,
-    "interval": 60,
-    "retryInterval": 60,
-    "maxretries": 3,
-    "notificationIDList": [],
-    "accepted_statuscodes": ["200-299"]
-  }'
-
-# Create a PostgreSQL database monitor (note URL-encoded password)
-curl -X POST http://192.168.86.149:8083/infrastructure/monitors \
-  -H "Content-Type: application/json" \
-  -d '{
-    "type": "postgres",
-    "name": "PostgreSQL Shared",
-    "interval": 60,
-    "retryInterval": 60,
-    "maxretries": 3,
-    "notificationIDList": [],
-    "accepted_statuscodes": ["200-299"],
-    "databaseConnectionString": "postgres://user:password@postgres-shared:5432/postgres"
-  }'
-```
-
-**Important**: When creating database monitors with passwords containing special characters (`/`, `=`, `+`, etc.), URL-encode them in the connection string (e.g., `/` → `%2F`, `=` → `%3D`).
-
 ---
 
 ### Jellyfin
@@ -569,9 +505,7 @@ Gitea is a lightweight, self-hosted Git service providing repository hosting, is
 | **Code-Server** | https://code.schweitz.net | Yes | Browser-based IDE |
 | **Ollama** | http://192.168.86.149:11434 | No | ML model API |
 | **Headscale** | http://192.168.86.149:8085 | No | VPN control server |
-| **Uptime Kuma** | http://192.168.86.149:3001 | No | Uptime monitoring |
 | **Netdata** | http://192.168.86.149:19999 | No | System metrics |
-| **Heimdall** | http://192.168.86.149:8888 | No | Service dashboard |
 | **Organizr** | https://home.schweitz.net | Yes | Unified dashboard |
 | **Open WebUI** | http://192.168.86.149:82 | No | LLM chat interface |
 | **Core API** | http://192.168.86.149:8083 | No | API functions & infrastructure mgmt |
@@ -605,9 +539,7 @@ Gitea is a lightweight, self-hosted Git service providing repository hosting, is
 | **Code-Server** | `~/.config/code-server/`, `~/docker-data/code-server/` | N/A | Config: ~5MB, Extensions: ~50-200MB, User data: ~50MB |
 | **Ollama** | `~/docker-data/ollama/models/` | Alt: `/mnt/media/ollama/` | 2-15GB per model |
 | **Headscale** | `~/docker-data/headscale/` | N/A | ~10MB |
-| **Uptime Kuma** | `~/docker-data/uptime-kuma/` | N/A | ~50MB |
 | **Netdata** | RAM-based (ephemeral) | N/A | ~200MB RAM |
-| **Heimdall** | `~/docker-data/heimdall/` | N/A | ~20MB |
 | **Organizr** | `~/docker-data/organizr/` | N/A | ~50MB |
 | **Open WebUI** | `~/docker-data/open-webui/` | N/A | ~100MB |
 | **Core API** | `~/docker-data/core-api/` | N/A | Logs: ~10MB |
@@ -627,19 +559,17 @@ Gitea is a lightweight, self-hosted Git service providing repository hosting, is
 
 | Network Name | Containers | Purpose |
 |--------------|------------|---------|
-| **docker-dataplane** | Ollama, Open WebUI, Core API, Qdrant, Uptime Kuma, PostgreSQL Shared, Redis Shared, Headscale, Nextcloud, Gitea, Samba, Watchtower, Organizr, Netdata | Unified service mesh for all containerized applications |
+| **docker-dataplane** | Ollama, Open WebUI, Core API, Qdrant, PostgreSQL Shared, Redis Shared, Headscale, Nextcloud, Gitea, Samba, Watchtower, Organizr, Netdata | Unified service mesh for all containerized applications |
 | **host** | Portainer, NPM | Direct host port access for infrastructure management |
 
 **Benefits of Consolidation**:
 - **Service Discovery**: All services reachable via `http://container-name:port` (e.g., `http://postgres-shared:5432`)
-- **Simplified Monitoring**: Uptime Kuma can monitor all services on docker-dataplane
 - **Shared Infrastructure**: postgres-shared and redis-shared accessible to all applications
 - **Network Cleanup**: Removed 7 obsolete networks (stacks_default, ai-dataplane, various stack-specific networks)
 
 **Container Name Resolution Examples**:
 ```bash
 # From any container on docker-dataplane
-curl http://uptime-kuma:3001      # Uptime Kuma API
 curl http://ollama:11434           # Ollama LLM API
 psql -h postgres-shared -U postgres  # PostgreSQL connection
 redis-cli -h redis-shared          # Redis connection
diff --git a/Makefile b/Makefile
index 8160caa..de55ed0 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ help:
 	@echo ""
 	@echo "Available Stacks:"
 	@echo "  - portainer, nginx-proxy-manager, ollama"
-	@echo "  - headscale, uptime-kuma, netdata, heimdall"
+	@echo "  - headscale, netdata"
 	@echo "  - watchtower, maintenance"
 	@echo "  - jellyfin, nextcloud, samba"
 	@echo ""
@@ -109,7 +109,7 @@ update-%:
 # Setup directories
 setup-dirs:
 	@echo "Creating directory structure..."
-	@mkdir -p ~/docker-data/{portainer,nginx-proxy-manager,ollama,headscale,uptime-kuma,netdata,heimdall,jellyfin,nextcloud,samba}
+	@mkdir -p ~/docker-data/{portainer,nginx-proxy-manager,ollama,headscale,netdata,jellyfin,nextcloud,samba}
 	@mkdir -p /mnt/media/{jellyfin,nextcloud,game-servers,backups,downloads}
 	@echo "✅ Directories created"
 	@echo ""
@@ -168,23 +168,13 @@ deploy-phase2:
 deploy-phase3:
 	@echo "=== Deploying Phase 3: Monitoring ==="
 	@echo ""
-	@echo "[1/3] Deploying Uptime Kuma..."
-	@make deploy-uptime-kuma
-	@sleep 3
-	@echo ""
-	@echo "[2/3] Deploying Netdata..."
+	@echo "Deploying Netdata..."
 	@make deploy-netdata
-	@sleep 3
-	@echo ""
-	@echo "[3/3] Deploying Heimdall..."
-	@make deploy-heimdall
 	@echo ""
 	@echo "=== Phase 3 Complete ==="
 	@echo ""
 	@echo "Access monitoring:"
-	@echo "  Uptime Kuma: http://localhost:3001"
 	@echo "  Netdata:     http://localhost:19999"
-	@echo "  Heimdall:    http://localhost:8888"
 
 # Quick deploy - Phase 4 optimization
 deploy-phase4:
diff --git a/README.md b/README.md
index 3083daf..31d3fab 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,6 @@
 │  └── Headscale (8085) - VPN mesh       │
 ├─────────────────────────────────────────┤
 │  Monitoring Layer                       │
-│  ├── Uptime Kuma (3001) - Uptime       │
 │  ├── Netdata (19999) - Metrics         │
 │  └── Organizr (8084) - Dashboard       │
 ├─────────────────────────────────────────┤
@@ -134,7 +133,6 @@ See [External Services](docs/EXTERNAL_SERVICES.md) for services maintained in se
 | **Organizr** | 8084 | Unified dashboard |
 | **Headscale** | 8085 | VPN control server |
 | **Jellyfin** | 8096 | Media streaming |
-| **Uptime Kuma** | 3001 | Service monitoring |
 | **Gitea** | 3002 | Git repository hosting |
 | **Gitea SSH** | 2222 | Git SSH access |
 | **PostgreSQL Shared** | 5432 | Shared database (internal) |
diff --git a/npm-configs/README.md b/npm-configs/README.md
index 6d64854..4a5de58 100644
--- a/npm-configs/README.md
+++ b/npm-configs/README.md
@@ -30,7 +30,7 @@ Services to protect (in order):
 2. Nextcloud (cloud.schweitz.net)
 3. Gitea (git.schweitz.net)
 4. Jellyfin (media.schweitz.net)
-5. Open WebUI, Netdata, Uptime Kuma, etc.
+5. Open WebUI, Netdata, etc.
 
 **Rule:** Deploy to ONE service at a time, test for 24 hours before proceeding to next.
 
diff --git a/organizr-widgets/README.md b/organizr-widgets/README.md
index 9658ad4..c20995f 100644
--- a/organizr-widgets/README.md
+++ b/organizr-widgets/README.md
@@ -173,7 +173,6 @@ These infrastructure services are protected:
 - portainer
 - nginx-proxy-manager
 - core-api
-- uptime-kuma
 - organizr
 - headscale
 - watchtower
diff --git a/requirements.txt b/requirements.txt
index 50a2760..049048b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,9 +1,6 @@
 # Python dependencies for tower-of-joy project
 # Install with: source .venv/bin/activate && pip install -r requirements.txt
 
-# Uptime Kuma API client for automated monitor setup
-uptime-kuma-api==1.2.1
-
 # FastAPI and ASGI server
 fastapi==0.115.0
 uvicorn[standard]==0.32.0
diff --git a/stacks/README.md b/stacks/README.md
index 654d04d..e679fd6 100644
--- a/stacks/README.md
+++ b/stacks/README.md
@@ -26,9 +26,7 @@ review the http://core-api/docs openapi documentation for infrastructure managem
 
 | Stack | File | Ports | GPU | Description |
 |-------|------|-------|-----|-------------|
-| **Uptime Kuma** | `uptime-kuma.yml` | 3001 | No | Service availability monitoring |
 | **Netdata** | `netdata.yml` | 19999 | No | Real-time system performance monitoring |
-| **Heimdall** | `heimdall.yml` | 8888, 8889 | No | Application dashboard |
 
 ### Phase 4: Optimization
 
@@ -60,10 +58,8 @@ review the http://core-api/docs openapi documentation for infrastructure managem
 - 2222: Gitea SSH
 - 3002: Gitea HTTP
 
-### Monitoring Services (3000-3999, 19000-19999)
-- 3001: Uptime Kuma
+### Monitoring Services (19000-19999)
 - 8200: Duplicati
-- 8888: Heimdall
 - 19999: Netdata
 
 ### ML/API Services (11000+)
diff --git a/stacks/authentik.yml b/stacks/authentik.yml
index c574fcb..eee18df 100644
--- a/stacks/authentik.yml
+++ b/stacks/authentik.yml
@@ -2,7 +2,7 @@ version: '3.8'
 
 # Authentik Identity Provider (SSO)
 # Purpose: Centralized authentication for all homelab services
-# Ports: 9000 (web UI), 9443 (standalone proxy outpost)
+# Ports: 9000 (web UI), 9444 (standalone proxy outpost)
 # GPU: No
 # Storage: SSD (configs), PostgreSQL shared (user data)
 # Note: Using standalone outpost - embedded outpost has issues in 2024.8.4
@@ -152,7 +152,7 @@ services:
       TZ: Europe/Amsterdam
 
     ports:
-      - "9443:9443"   # Proxy outpost endpoint
+      - "9444:9443"   # Proxy outpost endpoint (9443 used by Portainer)
 
     networks:
       - docker-dataplane
diff --git a/stacks/core-api.yml b/stacks/core-api.yml
index 8628b49..89732f0 100644
--- a/stacks/core-api.yml
+++ b/stacks/core-api.yml
@@ -5,11 +5,11 @@ version: '3.8'
 # Port: 8083 (HTTP API)
 # Network: docker-dataplane (shared infrastructure network)
 #
-# Container image built from: git.schweitz.net/jpmschweitzer/core-api
+# Container image built from: tower-of-joy:3002/jpmschweitzer/core-api (internal registry)
 
 services:
   core-api:
-    image: git.schweitz.net/jpmschweitzer/core-api:latest
+    image: tower-of-joy:3002/jpmschweitzer/core-api:latest
     container_name: core-api
     restart: unless-stopped
 
@@ -56,11 +56,6 @@ services:
       - WEB_SCRAPER_DEFAULT_MAX_LENGTH=10000
       - WEB_SCRAPER_MAX_LINKS_TO_EXTRACT=50
 
-      # Uptime Kuma Configuration
-      - KUMA_URL=http://uptime-kuma:3001
-      - KUMA_USERNAME=${KUMA_USERNAME}
-      - KUMA_PASSWORD=${KUMA_PASSWORD}
-
       # Python path
       - PYTHONPATH=/app
 
diff --git a/stacks/gitea.yml b/stacks/gitea.yml
index 34fbd39..4d907df 100644
--- a/stacks/gitea.yml
+++ b/stacks/gitea.yml
@@ -19,6 +19,12 @@ services:
       - POSTGRES_PASSWORD=gPdM7QV4gvotE9f9lGS4yj
       - POSTGRES_DB=gitea
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U gitea -d gitea"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     networks:
       - docker-dataplane
 
@@ -43,6 +49,12 @@ services:
       - GITEA__database__USER=gitea
       - GITEA__database__PASSWD=gPdM7QV4gvotE9f9lGS4yj
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://git.schweitz.internal/api/healthz || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
     depends_on:
       - gitea-db
     networks:
@@ -61,6 +73,12 @@ services:
       - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_TOKEN}
       - GITEA_RUNNER_NAME=docker-runner
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "pgrep -x act_runner || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     depends_on:
       - gitea
     networks:
diff --git a/stacks/headscale.yml b/stacks/headscale.yml
index 25af856..33eba82 100644
--- a/stacks/headscale.yml
+++ b/stacks/headscale.yml
@@ -20,6 +20,12 @@ services:
     command: serve
     environment:
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     networks:
       - docker-dataplane
 
diff --git a/stacks/jellyfin.yml b/stacks/jellyfin.yml
index b744d72..cb66e43 100644
--- a/stacks/jellyfin.yml
+++ b/stacks/jellyfin.yml
@@ -25,6 +25,12 @@ services:
       - NVIDIA_VISIBLE_DEVICES=all
       - NVIDIA_DRIVER_CAPABILITIES=all
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:8096/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
     deploy:
       resources:
         reservations:
diff --git a/stacks/library-desk.yml b/stacks/library-desk.yml
index fb6e361..6b9298f 100644
--- a/stacks/library-desk.yml
+++ b/stacks/library-desk.yml
@@ -4,11 +4,11 @@ version: '3.8'
 # Application Layer
 # Port: 8089 (HTTP)
 # GPU: No
-# Source: https://git.schweitz.net/jpmschweitzer/library-desk
+# Source: tower-of-joy:3002/jpmschweitzer/library-desk (internal registry)
 
 services:
   library-desk:
-    image: git.schweitz.net/jpmschweitzer/library-desk:latest
+    image: tower-of-joy:3002/jpmschweitzer/library-desk:latest
     container_name: library-desk
     restart: unless-stopped
     ports:
diff --git a/stacks/netdata.yml b/stacks/netdata.yml
index 671646b..1aa2b3d 100644
--- a/stacks/netdata.yml
+++ b/stacks/netdata.yml
@@ -27,6 +27,12 @@ services:
       # Optional: Claim to Netdata Cloud for remote access
       # - NETDATA_CLAIM_TOKEN=your-claim-token
       # - NETDATA_CLAIM_URL=https://app.netdata.cloud
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:19999/api/v1/info || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     networks:
       - docker-dataplane
 
diff --git a/stacks/nginx-proxy-manager.yml b/stacks/nginx-proxy-manager.yml
index 34c4b07..dcc57a4 100644
--- a/stacks/nginx-proxy-manager.yml
+++ b/stacks/nginx-proxy-manager.yml
@@ -22,6 +22,12 @@ services:
     environment:
       - DB_SQLITE_FILE=/data/database.sqlite
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:81/api/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
 
 # Setup Instructions:
 # 1. Deploy this stack
diff --git a/stacks/ollama.yml b/stacks/ollama.yml
index 3acdf94..87930fb 100644
--- a/stacks/ollama.yml
+++ b/stacks/ollama.yml
@@ -28,6 +28,12 @@ services:
       - OLLAMA_KEEP_ALIVE=-1
       # Load multiple models concurrently (mistral-nemo + nomic-embed-text)
       - OLLAMA_MAX_LOADED_MODELS=2
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:11434/api/tags || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
     deploy:
       resources:
         limits:
diff --git a/stacks/open-webui.yml b/stacks/open-webui.yml
index 25fd083..558b0ba 100644
--- a/stacks/open-webui.yml
+++ b/stacks/open-webui.yml
@@ -7,6 +7,13 @@ services:
     ports:
       - "82:8080"
 
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
     environment:
       # Ollama connection (direct - fallback)
       - OLLAMA_BASE_URL=http://192.168.86.149:11434
diff --git a/stacks/organizr.yml b/stacks/organizr.yml
index b70f7ba..a0032da 100644
--- a/stacks/organizr.yml
+++ b/stacks/organizr.yml
@@ -28,6 +28,12 @@ services:
       - DB_NAME=organizr
       - DB_USER=organizr_user
       - DB_PASS=${ORGANIZR_DB_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:80/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     networks:
       - docker-dataplane
 
@@ -43,9 +49,7 @@ networks:
 # 4. Complete setup wizard
 # 5. Add tabs using MESH IPs for VPN access:
 #    - Portainer: http://10.99.0.1:8001
-#    - Uptime Kuma: http://10.99.0.1:3001
 #    - Netdata: http://10.99.0.1:19999
-#    - Heimdall: http://10.99.0.1:8888
 #    - Jellyfin: http://10.99.0.1:8096 (when deployed)
 #    - Nextcloud: http://10.99.0.1:8082 (when deployed)
 #
diff --git a/stacks/portainer.yml b/stacks/portainer.yml
index d6895d4..c5a2c78 100644
--- a/stacks/portainer.yml
+++ b/stacks/portainer.yml
@@ -19,6 +19,12 @@ services:
       - portainer_data:/data  # Persistent data storage
     environment:
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:9000/api/system/status || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
 
 volumes:
   portainer_data:
diff --git a/stacks/qdrant.yml b/stacks/qdrant.yml
index 3b5adca..ff0e027 100644
--- a/stacks/qdrant.yml
+++ b/stacks/qdrant.yml
@@ -21,6 +21,12 @@ services:
       - /home/jpmschweitzer/docker-data/qdrant/snapshots:/qdrant/snapshots
     environment:
       - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fSs http://localhost:6333/readyz || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     deploy:
       resources:
         limits:
diff --git a/stacks/samba.yml b/stacks/samba.yml
index b362df4..f602264 100644
--- a/stacks/samba.yml
+++ b/stacks/samba.yml
@@ -32,6 +32,12 @@ services:
       -s "Backups;/share/backups;yes;no;yes;all"
       -u "jpmschweitzer;IG3omTybtVW3pVmmBi1D5FjnQ0MnZLUG"
       -p
+    healthcheck:
+      test: ["CMD-SHELL", "pgrep smbd || exit 1"]
+      interval: 10m
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     networks:
       - docker-dataplane
 
diff --git a/stacks/scheduler.yml b/stacks/scheduler.yml
index 24b36ec..3e327a1 100644
--- a/stacks/scheduler.yml
+++ b/stacks/scheduler.yml
@@ -4,11 +4,11 @@ version: '3.8'
 # Purpose: System-wide maintenance orchestration - backups, doc mirroring, cleanup, task automation
 # Port: 8090 (API + UI)
 # Network: docker-dataplane
-# Image: git.schweitz.net/jpmschweitzer/scheduler (private registry)
+# Image: tower-of-joy:3002/jpmschweitzer/scheduler (internal registry)
 
 services:
   scheduler:
-    image: git.schweitz.net/jpmschweitzer/scheduler:latest
+    image: tower-of-joy:3002/jpmschweitzer/scheduler:latest
     container_name: scheduler
     restart: unless-stopped
 
diff --git a/stacks/tatlock.yml b/stacks/tatlock.yml
index 7ca10fc..e314d8a 100644
--- a/stacks/tatlock.yml
+++ b/stacks/tatlock.yml
@@ -4,11 +4,11 @@ version: '3.8'
 # Purpose: OpenAI-compatible API server with LLM agent orchestration
 # Port: 8000 (API)
 # Network: docker-dataplane
-# Image: git.schweitz.net/jpmschweitzer/tatlock (private registry)
+# Image: tower-of-joy:3002/jpmschweitzer/tatlock (internal registry)
 
 services:
   tatlock:
-    image: git.schweitz.net/jpmschweitzer/tatlock:latest
+    image: tower-of-joy:3002/jpmschweitzer/tatlock:latest
     container_name: tatlock
     restart: unless-stopped
 
diff --git a/stacks/uptime-kuma.yml b/stacks/uptime-kuma.yml
deleted file mode 100644
index b64905c..0000000
--- a/stacks/uptime-kuma.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-version: '3.8'
-
-# Uptime Kuma - Service Availability Monitoring
-# Phase 3: Monitoring & Management
-# Ports: 3001
-# GPU: No
-# Storage: SSD (monitoring data)
-
-services:
-  uptime-kuma:
-    image: louislam/uptime-kuma:latest
-    container_name: uptime-kuma
-    restart: unless-stopped
-    ports:
-      - "3001:3001"
-    volumes:
-      - /home/jpmschweitzer/docker-data/uptime-kuma:/app/data
-    environment:
-      - TZ=Europe/Amsterdam
-    networks:
-      - docker-dataplane
-
-networks:
-  docker-dataplane:
-    external: true
-    name: docker-dataplane
-
-# After Deployment:
-# 1. Access http://localhost:3001
-# 2. Create admin account on first visit
-# 3. Add monitors for services:
-#    - Jellyfin: http://localhost:8096
-#    - Nextcloud: http://localhost:8082
-#    - Portainer: http://localhost:8080
-#    - NPM: http://localhost:8000
-#    - Headscale: http://localhost:8085/health
-#    - Ollama: http://localhost:11434/api/tags
-# 4. Set check intervals (60 seconds recommended)
-# 5. Configure notifications (optional: email, Discord, Slack)
diff --git a/stacks/watchtower.yml b/stacks/watchtower.yml
index f7d4884..81d9592 100644
--- a/stacks/watchtower.yml
+++ b/stacks/watchtower.yml
@@ -23,6 +23,12 @@ services:
 
       # Optional: Monitor only specific containers
       # - WATCHTOWER_LABEL_ENABLE=true  # Only update containers with label com.centurylinklabs.watchtower.enable=true
+    healthcheck:
+      test: ["CMD-SHELL", "pgrep watchtower || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     networks:
       - docker-dataplane