Fix config and variable mismatches found in the audit

content/en/3.serveex/2.core/2.docker.md

@@ -157,6 +157,11 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
 ```
 
+::warning
+
+`WATCHTOWER_REMOVE_VOLUMES=true` deletes a container's anonymous volumes as soon as it's updated. Combined with a `latest` tag, an automatic update can silently wipe data for any app that still stores something in an anonymous (unnamed) volume instead of a bind mount.
+::
+
 #### Set your environment variables
 
 Fill in the `.env` section in Dockge with the following:
@@ -177,8 +182,11 @@ To have Watchtower monitor your other containers, add this to their `compose.yml
 
 ```yaml [compose.yaml]
 ---
-labels:
-  - com.centurylinklabs.watchtower.enable=true
+services:
+  yourapp:
+    # ...
+    labels:
+      - com.centurylinklabs.watchtower.enable=true
 ```
 
 Then restart the modified stacks.

content/en/3.serveex/2.core/3.wireguard.md

@@ -60,8 +60,7 @@ tree:
     - srv:
       - docker:
         - wg-easy:
-          - config:
-            - etc_wireguard/
+          - etc_wireguard/
           - compose.yaml
           - .env
 ---
@@ -70,7 +69,7 @@ tree:
 ::steps{level="3"}
 ### Deploy the stack
 
-Open Dockge, click **Compose**, and name the stack `wg_easy`.
+Open Dockge, click **Compose**, and name the stack `wg-easy`.
 
 Copy the following configuration:
 
@@ -79,7 +78,7 @@ Copy the following configuration:
 services:
   wg-easy:
     environment:
-      - INSECURE=true
+      - INSECURE=true # disables the web UI's own HTTPS; fine on a LAN-only or SWAG-fronted setup, remove it otherwise
     image: ghcr.io/wg-easy/wg-easy:15
     container_name: wg-easy
     networks:
@@ -148,8 +147,8 @@ Once connected, follow the web UI instructions to:
 
 Then go to *Administrator → Admin Panel → Config*:
 
-- Change `Allowed IPs` from `0.0.0.0/24` to `10.8.0.0/24` for **split tunneling**.
-- Remove IPv6 (it often causes unnecessary issues).
+- Change `Allowed IPs` from the default `0.0.0.0/0` (full tunnel) to `10.8.0.0/24` for **split tunneling**.
+- Optionally remove the IPv6 entry from `Allowed IPs` if you don't want client IPv6 traffic routed through the tunnel. This only affects what clients tunnel, not the container's own IPv6 setup above.
 
 ### Done !
 ::

content/en/3.serveex/2.core/4.swag.md

@@ -390,7 +390,7 @@ Wait a moment, then visit `https://dockge.mydomain.com` in your browser. You sho
 SWAG includes templates for most known services, named `servicename.subdomain.conf.sample`. Just create the subdomain in your registrar's DNS zone (like OVH), point it to your main domain via a CNAME, then copy and rename the sample file:
 
 ```bash [Terminal]
-cd /srv/docker/swag/config/proxy-confs
+cd /srv/docker/swag/config/nginx/proxy-confs
 sudo cp servicename.subdomain.conf.sample servicename.subdomain.conf
 ```