Fix config and variable mismatches found in the audit

content/en/3.serveex/3.security/2.cloudflare.md

@@ -58,7 +58,7 @@ Once created, your token will only be shown once. Save it securely, as it cannot
 
 You must register for _Cloudflare Teams_ to access the _Zero Trust_ dashboard that manages tunnels and access policies. This is a premium service, but there’s a free plan for up to 50 users, perfect for a home lab. Keep in mind that a valid credit card is required to register, but the free plan incurs no charges.
 
-Register [via this link](https://dash.teams.cloudflare.com/).
+Register [via this link](https://one.dash.cloudflare.com/).
 
 ## SWAG Configuration
 ::note
@@ -124,6 +124,17 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
 
 ### Deploy the SWAG stack
 
+::warning
+
+This replaces your whole SWAG service definition. If you already added a `networks:` section or `EXTRA_DOMAINS` for other apps (Dockge, TinyAuth, etc.), merge those into the block below instead of pasting over them, or you'll lose that configuration.
+::
+
+Make sure the fail2ban database file already exists, or Docker will create a directory in its place instead of mounting the file, silently breaking ban persistence:
+
+```bash [Terminal]
+sudo touch /srv/docker/swag/config/fail2ban/fail2ban.sqlite3
+```
+
 In Dockge, edit your SWAG stack with this:
 
 ```yaml [compose.yaml]
@@ -190,7 +201,7 @@ TUNNEL_PW=
 | Variable       | Value                                                       | Example                        |
 |----------------|-------------------------------------------------------------|--------------------------------|
 | `PUID`         | User ID (`id username`)                                     | `1000`                         |
-| `GUID`         | Group ID (`id username`)                                    | `1000`                         |
+| `PGID`         | Group ID (`id username`)                                    | `1000`                         |
 | `DOMAIN`       | Your reserved domain                                         | `mondomaine.fr`                |
 | `PLUGIN`       | DNS provider (also configure `cloudflare.ini`)              | `cloudflare`                   |
 | `EMAIL`        | Email for the certificate                                   | `you@email.com`                |

content/en/3.serveex/3.security/3.tinyauth.md

@@ -64,7 +64,7 @@ services:
     volumes:
       - /srv/docker/tinyauth/data:/data
     ports:
-      - 3000:3000
+      - 3002:3000 # host port only, avoids clashing with AdGuard's own 3000
 ```
 
 ::tip{icon=""}
@@ -94,7 +94,7 @@ TINYAUTH_AUTH_USERS=
 | `TINYAUTH_APPURL`{lang=properties} | The public URL you'll use to reach TinyAuth (see exposure below) | `https://tinyauth.mydomain.com` |
 | `TINYAUTH_AUTH_USERS`{lang=properties} | The hash generated above | `user:$$2a$$10$$UdLYoJ5lgPsC0RKq...` |
 
-Deploy the stack. The local interface is available at `http://yourserverip:3000`.
+Deploy the stack. The local interface is available at `http://yourserverip:3002`.
 
 ### Done !
 ::

content/en/3.serveex/3.security/4.pocket-id.md

@@ -63,7 +63,7 @@ services:
     ports:
       - 1411:1411
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:1411/healthz"]
+      test: ["CMD", "/app/pocket-id", "healthcheck"]
       interval: 90s
       timeout: 5s
       retries: 3
@@ -111,7 +111,7 @@ Pocket ID doesn't use passwords: your first account is created with a **passkey*
 
 ::note
 
-Since `APP_URL` is already set to your future public domain, passkey registration may ask you to open Pocket ID from that domain instead. Expose it first (see below) if setup doesn't complete locally.
+Passkeys require a secure context: HTTPS, or `localhost`. Registering one from `http://yourserverip:1411` on another machine will be refused by the browser, since that's plain HTTP to a non-`localhost` address. If setup doesn't complete locally, expose Pocket ID first (see below) and finish setup over HTTPS instead.
 ::
 
 ## Exposing Pocket ID with Swag