Store server IPs in one form (no brackets, short lower-case IPv6) and
write each address in the form its context needs:
- URLs and host:port (Sentinel, database URLs, SFTP backup download,
DNS servers, SMTP, webhook base URLs, links, health checks) get
brackets through formatHostForUrl().
- Traefik Host() rules use the address without brackets, so IPv6
domains no longer return 404; saved labels are fixed at deploy.
Caddy keeps the brackets.
- SSH keeps the plain address.
- Hetzner gives an IPv6 /64 network; IPv6-only servers now get the
server address (prefix::1) instead of the unusable prefix::64.
- sslip labels, registry image names with an IPv6 host, the API domain
list, allowlist matching and duplicate checks handle IPv6.
A migration normalizes stored IPv6 server addresses, repairs Hetzner
servers saved as ::64 that are not reachable, and adds brackets to
saved Sentinel URLs.
libcurl overrides an existing host:port DNS cache entry each time a new
one is added, so one entry per address left only the last pinned. That is
IPv6 whenever the target has AAAA records, which broke every request on
hosts without IPv6. Join them into one comma separated entry instead.
S3 backup uploads fail when the endpoint has an AAAA record: mc parses
--resolve values with netip.ParseAddr and rejects the bracketed IPv6
form. Its resolver map also keeps only one IP per host, so emit a single
entry, preferring IPv4, without brackets.
Add SafeWebhookUrl validation rule to notification webhook URL fields
(Slack, Discord, custom webhook) to enforce safe URL patterns including
scheme validation and hostname checks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Andras Bacsai
dwiyantop
Marvin
