diff --git a/.github/scripts/render_schema.py b/.github/scripts/render_schema.py
new file mode 100644
index 0000000..044ee22
--- /dev/null
+++ b/.github/scripts/render_schema.py
@@ -0,0 +1,202 @@
+#!/usr/bin/env python3
+"""Render the definitions that differ between schemas into their published trees.
+
+Every binary in the field computes its own store URL and cannot be taught a new
+one, so the unprefixed path has to keep carrying what those binaries expect.
+That is the oldest schema still supported, and it is where a definition lives by
+default: services/<name>.yaml is authored, published as it stands, and copied
+nowhere.
+
+A definition is authored in the highest schema tree it needs, and every tree
+below renders down from it. One needing nothing newer is authored in services/
+and published as it stands; one carrying a key that would be wrong to publish to
+an older binary is authored in schema/N/services/ instead, and services/ gets the
+downgrade rendered from it. A schema tree is sparse, holding only the definitions
+authored there plus its own index, since the client tries its bases in order and
+a 404 falls straight through to the tree below.
+
+Usage: render_schema.py
+"""
+
+import copy
+import json
+import pathlib
+import sys
+import yaml
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+LEGACY = ROOT / "services"
+SCHEMA_DIR = ROOT / "schema"
+
+INDEX_FIELDS = ["name", "description", "family", "dashboard", "image", "category",
+                "icon", "color", "admin_for", "admin_rank", "depends_on",
+                "versions", "default_version", "env_role"]
+
+
+def load_yaml(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return yaml.safe_load(handle) or {}
+
+
+def schemas():
+    out = []
+    for path in sorted(SCHEMA_DIR.glob("*.yaml"), key=lambda p: int(p.stem)):
+        spec = load_yaml(path)
+        out.append((int(spec["schema"]), spec))
+    return out
+
+
+def resolve(doc, path):
+    node = doc
+    for part in path.split("."):
+        if not isinstance(node, dict) or part not in node:
+            return None
+        node = node[part]
+    return node
+
+
+def drop(doc, path):
+    parts = path.split(".")
+    node = doc
+    for part in parts[:-1]:
+        if not isinstance(node, dict) or part not in node:
+            return
+        node = node[part]
+    if isinstance(node, dict):
+        node.pop(parts[-1], None)
+
+
+def apply_change(doc, change, guard):
+    """Render one change backwards, newer schema to older.
+
+    A `when` guard reads the document as it entered this schema's step, not the
+    half-rendered one: a rule commonly depends on a key an earlier rule in the
+    same step has already dropped.
+    """
+    if "when" in change and not resolve(guard, change["when"]):
+        return
+    path, how = change["path"], change["downgrade"]
+    if how == "drop":
+        drop(doc, path)
+    elif isinstance(how, dict) and "join" in how:
+        value = resolve(doc, path)
+        if isinstance(value, list):
+            parts = path.split(".")
+            node = doc
+            for part in parts[:-1]:
+                node = node[part]
+            node[parts[-1]] = how["join"].join(str(v) for v in value)
+    elif isinstance(how, dict) and "rename" in how:
+        value = resolve(doc, path)
+        if value is not None:
+            drop(doc, path)
+            doc[how["rename"]] = value
+    else:
+        raise SystemExit(f"unknown downgrade {how!r} for {path}")
+
+
+def render_to(doc, target, specs):
+    out = copy.deepcopy(doc)
+    for version, spec in sorted(specs, reverse=True):
+        if version <= target:
+            continue
+        guard = copy.deepcopy(out)
+        for change in spec.get("changes", []):
+            apply_change(out, change, guard)
+    return out
+
+
+def dump(doc, path):
+    with open(path, "w", encoding="utf-8") as handle:
+        yaml.safe_dump(doc, handle, sort_keys=False, default_flow_style=False, allow_unicode=True)
+
+
+def index_for(docs):
+    entries = []
+    for doc in sorted(docs, key=lambda d: d.get("name", "")):
+        entries.append({f: doc[f] for f in INDEX_FIELDS
+                        if f in doc and doc[f] not in (None, "", [], {})})
+    return {"services": entries}
+
+
+def write_index(path, published, docs, owned):
+    """Rewrite only the entries this render owns.
+
+    The published index is hand-maintained and does not always match what a
+    projection of the YAML would produce. Regenerating it wholesale would push
+    those differences to every install as a change nobody asked for, so entries
+    for definitions this render does not touch are carried through exactly as
+    they stand.
+    """
+    entries = index_for(docs)["services"]
+    fresh = {e["name"]: e for e in entries if e.get("name") in owned}
+    out, seen = [], set()
+    if published.exists():
+        with open(published, "r", encoding="utf-8") as handle:
+            for entry in json.load(handle).get("services", []):
+                name = entry.get("name")
+                out.append(fresh.get(name, entry))
+                seen.add(name)
+    for entry in entries:
+        if entry.get("name") not in seen:
+            out.append(entry)
+    with open(path, "w", encoding="utf-8") as handle:
+        json.dump({"services": out}, handle, indent=2)
+        handle.write("\n")
+
+
+def main():
+    specs = schemas()
+    if not specs:
+        print("no schema deltas; nothing to render")
+        return 0
+    oldest = 1
+    newest = max(v for v, _ in specs)
+
+    # A definition is authored in the highest schema tree it needs, and every
+    # tree below renders down from it. One that needs nothing newer is authored
+    # in services/ and published as it stands.
+    top = SCHEMA_DIR / str(newest) / "services"
+    sources = {p.stem: load_yaml(p) for p in sorted(top.glob("*.yaml"))} if top.exists() else {}
+    plain = {p.stem: load_yaml(p) for p in sorted(LEGACY.glob("*.yaml")) if p.stem not in sources}
+
+    inert = []
+    for name, doc in sorted(sources.items()):
+        low = render_to(doc, oldest, specs)
+        dump(low, LEGACY / f"{name}.yaml")
+        if low == doc:
+            inert.append(name)
+
+    write_index(LEGACY / "index.json", LEGACY / "index.json",
+                list(plain.values()) + [render_to(d, oldest, specs) for d in sources.values()],
+                set(sources))
+    print(f"schema {oldest}: {len(plain)} authored in place, {len(sources)} rendered -> services")
+
+    for version, _ in sorted(specs):
+        if version <= oldest:
+            continue
+        out_dir = SCHEMA_DIR / str(version) / "services"
+        out_dir.mkdir(parents=True, exist_ok=True)
+        carried = 0
+        for name, doc in sorted(sources.items()):
+            # The newest tree is authored, not rendered: leave its bytes alone.
+            if version < newest:
+                high = render_to(doc, version, specs)
+                if high != render_to(doc, oldest, specs):
+                    dump(high, out_dir / f"{name}.yaml")
+                    carried += 1
+            else:
+                carried += 1
+        write_index(out_dir / "index.json", LEGACY / "index.json",
+                    list(plain.values()) + [render_to(d, version, specs) for d in sources.values()],
+                    set(sources))
+        print(f"schema {version}: {carried} definition(s) -> {out_dir.relative_to(ROOT)}")
+
+    if inert:
+        print(f"note: {', '.join(inert)} render the same in every schema and need no source")
+    print(f"authored schema is {newest}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/scripts/schema_guard.py b/.github/scripts/schema_guard.py
index 4051259..14ac466 100755
--- a/.github/scripts/schema_guard.py
+++ b/.github/scripts/schema_guard.py
@@ -75,6 +75,26 @@ def profile(root, pattern):
     return out
 
 
+def schema_dropped_paths(root):
+    """Paths a schema delta renders away, which are removals by design.
+
+    The published legacy tree is the oldest schema, so every key a later schema
+    added is absent from it on purpose. Without this the guard would read each
+    of those as a key that disappeared.
+    """
+    dropped = set()
+    for path in sorted(pathlib.Path(root, "schema").glob("*.yaml")):
+        try:
+            with open(path, "r", encoding="utf-8") as handle:
+                spec = yaml.safe_load(handle) or {}
+        except (OSError, yaml.YAMLError):
+            continue
+        for change in spec.get("changes", []):
+            if change.get("downgrade") == "drop" and "path" in change:
+                dropped.add(change["path"])
+    return dropped
+
+
 def closed_sets(profiles):
     """Union every file's observed values per path, keeping the small ones."""
     merged = {}
@@ -96,6 +116,7 @@ def main():
     published = profile(published_dir, pattern)
     candidate = profile(candidate_dir, pattern)
     enums = closed_sets(published)
+    by_design = schema_dropped_paths(candidate_dir)
 
     failures, warnings = [], []
 
@@ -110,6 +131,8 @@ def main():
 
         for path, kinds in sorted(old_types.items()):
             if path not in new_types:
+                if path.split("[]")[0] in by_design:
+                    continue
                 failures.append(f"{rel}: key `{path}` was removed, an older lerd still reads it")
                 continue
             if kinds != new_types[path] and not kinds & new_types[path]:
diff --git a/.github/workflows/schema-guard.yml b/.github/workflows/schema-guard.yml
index c8bcd6d..ac1fa57 100644
--- a/.github/workflows/schema-guard.yml
+++ b/.github/workflows/schema-guard.yml
@@ -3,22 +3,40 @@ name: Schema guard
 on:
   pull_request:
 
-# A store definition reaches every install within a day, whatever version of
-# lerd it runs, so a pull request may only grow the schema. This refuses a key
-# that disappeared or changed type, and reports a value no published definition
-# has used before.
+# A definition is authored in the highest schema tree it needs and rendered down
+# into every tree below. Two things have to hold on every pull request: the lower
+# trees are what the authored ones render to, and the lowest stays readable by
+# the binaries that fetch it.
 jobs:
+  render:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install pyyaml
+
+      - name: Render every schema
+        run: python3 .github/scripts/render_schema.py
+
+      - name: The published trees must match the sources
+        run: |
+          if ! git diff --quiet; then
+            echo "The rendered trees are stale. Run .github/scripts/render_schema.py and commit the result."
+            git diff --stat
+            exit 1
+          fi
+
   schema-guard:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-
       - run: pip install pyyaml
 
       - name: Extract the published tree
diff --git a/schema/2.yaml b/schema/2.yaml
new file mode 100644
index 0000000..a5a424d
--- /dev/null
+++ b/schema/2.yaml
@@ -0,0 +1,41 @@
+# Schema 2, as understood by lerd 1.36.0 and later.
+#
+# A schema states only what changed since the one before it, and how to render a
+# document back down to that one. A definition is authored in the highest schema
+# tree it needs and rendered down into every tree below, the lowest being the
+# unprefixed path: that is what every binary up to 1.35.0 computes for itself and
+# cannot be taught otherwise.
+schema: 2
+since_lerd: "1.36.0"
+
+changes:
+  # Keys schema 1 has no field for. An old binary ignores them, so dropping is
+  # about publishing a tree that means what it says rather than about safety.
+  - path: admin_rank
+    downgrade: drop
+  - path: dashboard_follows_color_scheme
+    downgrade: drop
+  - path: dashboard_login
+    downgrade: drop
+  - path: dashboard_proxy_at_path
+    downgrade: drop
+  - path: dashboard_proxy_keep_host
+    downgrade: drop
+  - path: dashboard_proxy_rebase
+    downgrade: drop
+  - path: dashboard_proxy_reroute
+    downgrade: drop
+  - path: dashboard_proxy_strip
+    downgrade: drop
+  - path: dashboard_scheme_key
+    downgrade: drop
+
+  # This one is not cosmetic. Schema 2 proxies a dashboard at /_svc/<name>/ and
+  # strips the upstream's X-Frame-Options and frame-ancestors on the way through.
+  # Schema 1 has no such proxy and opens the dashboard URL directly in an iframe,
+  # so a UI that refuses framing, which is every upstream needing the strip flag,
+  # renders a blocked panel. Better to publish no dashboard to schema 1 than a
+  # card that cannot work: the service still installs, runs and serves its port.
+  - path: dashboard
+    downgrade: drop
+    when: dashboard_proxy_strip
diff --git a/schema/2/services/adminer.yaml b/schema/2/services/adminer.yaml
new file mode 100644
index 0000000..c7ef790
--- /dev/null
+++ b/schema/2/services/adminer.yaml
@@ -0,0 +1,147 @@
+name: adminer
+image: docker.io/library/adminer:6
+update_strategy: rolling
+description: Adminer web UI for every database lerd runs
+ports:
+- 8081:8080
+dynamic_env:
+  ADMINER_MYSQL_HOSTS: discover_family:mysql,mariadb
+  ADMINER_PGSQL_HOSTS: discover_family:postgres
+files:
+- target: /var/www/html/index.php
+  content: "<?php\nnamespace docker {\n\tfunction adminer_object() {\n\t\trequire_once\
+    \ './plugins/login-servers.php';\n\t\tclass LerdServers extends \\AdminerLoginServers\
+    \ {\n\t\t\tfunction credentials() {\n\t\t\t\t$s = $this->servers[\\Adminer\\SERVER];\n\
+    \t\t\t\treturn array($s['server'], $s['username'], $s['password']);\n\t\t\t}\n\
+    \t\t\tfunction login($login, $password) { return true; }\n\t\t}\n\t\treturn new\
+    \ \\Adminer\\Plugins(array(new LerdServers(\\lerd_servers())));\n\t}\n}\nnamespace\
+    \ {\n\tfunction lerd_servers() {\n\t\tstatic $out = null;\n\t\tif ($out !== null)\
+    \ { return $out; }\n\t\t$families = array(\n\t\t\t'ADMINER_MYSQL_HOSTS'      =>\
+    \ array('server',     'root',     'lerd'),\n\t\t\t'ADMINER_PGSQL_HOSTS'      =>\
+    \ array('pgsql',      'postgres', 'lerd'),\n\t\t);\n\t\t$out = array();\n\t\t\
+    foreach ($families as $env => $spec) {\n\t\t\tforeach (array_filter(explode(',',\
+    \ (string) getenv($env))) as $host) {\n\t\t\t\t$out[$host] = array('server' =>\
+    \ $host, 'driver' => $spec[0], 'username' => $spec[1], 'password' => $spec[2]);\n\
+    \t\t\t}\n\t\t}\n\t\tif (!$out) {\n\t\t\t$out['lerd-mysql'] = array('server' =>\
+    \ 'lerd-mysql', 'driver' => 'server', 'username' => 'root', 'password' => 'lerd');\n\
+    \t\t}\n\t\treturn $out;\n\t}\n\n\tfunction lerd_query_key(array $s) {\n\t\treturn\
+    \ $s['driver'] === 'server' ? 'server' : $s['driver'];\n\t}\n\n\t// Which server\
+    \ actually holds this database. The dashboard deep-links a\n\t// database by name\
+    \ alone, so without this a Postgres database opens against\n\t// MySQL and Adminer\
+    \ answers \"Invalid database\".\n\tfunction lerd_server_with_db($db) {\n\t\tforeach\
+    \ (lerd_servers() as $host => $s) {\n\t\t\ttry {\n\t\t\t\tif ($s['driver'] ===\
+    \ 'server' && extension_loaded('mysqli')) {\n\t\t\t\t\t$c = @new mysqli($host,\
+    \ $s['username'], $s['password']);\n\t\t\t\t\tif ($c->connect_errno) { continue;\
+    \ }\n\t\t\t\t\t$q = $c->query(\"SHOW DATABASES LIKE '\" . $c->real_escape_string($db)\
+    \ . \"'\");\n\t\t\t\t\t$hit = $q && $q->num_rows > 0;\n\t\t\t\t\t$c->close();\n\
+    \t\t\t\t\tif ($hit) { return $host; }\n\t\t\t\t} elseif ($s['driver'] === 'pgsql'\
+    \ && extension_loaded('pdo_pgsql')) {\n\t\t\t\t\t$p = new PDO(\"pgsql:host=$host;dbname=postgres\"\
+    , $s['username'], $s['password'], array(PDO::ATTR_TIMEOUT => 2));\n\t\t\t\t\t\
+    $st = $p->prepare('SELECT 1 FROM pg_database WHERE datname = ?');\n\t\t\t\t\t\
+    $st->execute(array($db));\n\t\t\t\t\tif ($st->fetchColumn()) { return $host; }\n\
+    \t\t\t\t}\n\t\t\t} catch (\\Throwable $e) {\n\t\t\t\t// A server that is down\
+    \ must not stop the search.\n\t\t\t}\n\t\t}\n\t\treturn null;\n\t}\n\n\t// The\
+    \ dashboard proxy forwards its own /_svc/<name>/ prefix, and Adminer's own\n\t\
+    // assets are query strings rather than paths, so they survive it. A design\n\t\
+    // stylesheet is the exception: Adminer links it as a plain file name, which\n\
+    \t// arrives here under the prefix, misses on disk and falls through to this\n\
+    \t// script. Serve it rather than treat it as a page to redirect.\n\t$asset =\
+    \ basename(parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '');\n\t\
+    if (preg_match('~^[\\\\w.-]+\\\\.(css|js|png|gif|ico|svg|woff2?)$~', $asset) &&\
+    \ is_file(__DIR__ . '/' . $asset)) {\n\t\t$types = array('css' => 'text/css',\
+    \ 'js' => 'application/javascript', 'png' => 'image/png',\n\t\t\t'gif' => 'image/gif',\
+    \ 'ico' => 'image/x-icon', 'svg' => 'image/svg+xml',\n\t\t\t'woff' => 'font/woff',\
+    \ 'woff2' => 'font/woff2');\n\t\t$ext = strtolower(pathinfo($asset, PATHINFO_EXTENSION));\n\
+    \t\theader('Content-Type: ' . ($types[$ext] ?? 'application/octet-stream'));\n\
+    \t\treadfile(__DIR__ . '/' . $asset);\n\t\texit;\n\t}\n\n\t$servers = lerd_servers();\n\
+    \t// Seeded and closed before adminer.php is included, with the cache limiter\n\
+    \t// off, so its own session_start sends no headers after ours have gone out.\n\
+    \tini_set('session.cache_limiter', '');\n\tob_start();\n\tsession_name('adminer_sid');\n\
+    \tsession_start();\n\tforeach ($servers as $host => $s) {\n\t\tif (!isset($_SESSION['pwds'][$s['driver']][$host][$s['username']]))\
+    \ {\n\t\t\t$_SESSION['pwds'][$s['driver']][$host][$s['username']] = $s['password'];\n\
+    \t\t\t$_SESSION['db'][$s['driver']][$host][$s['username']] = array();\n\t\t}\n\
+    \t}\n\tsession_write_close();\n\tob_end_clean();\n\n\t// Which server this request\
+    \ is for. A request that already names one is left\n\t// alone; anything else\
+    \ is answered with a redirect to the canonical URL rather\n\t// than by rewriting\
+    \ the request in place, because the versions disagree about\n\t// whether they\
+    \ build their own links from $_GET or from the raw query string,\n\t// and a rewrite\
+    \ that one of them ignores turns into a redirect loop.\n\t$named = false;\n\t\
+    foreach ($servers as $host => $s) {\n\t\tif (isset($_GET[lerd_query_key($s)]))\
+    \ { $named = true; break; }\n\t}\n\t// An asset request carries file=; it needs\
+    \ no server and redirecting it only\n\t// costs a round trip before Adminer serves\
+    \ the same bytes.\n\tif (!$named && !isset($_GET['file'])) {\n\t\t$pick = null;\n\
+    \t\t// lerd_server is how the dashboard says which engine it opened this for,\n\
+    \t\t// without having to know the driver or the credentials that go with it.\n\
+    \t\tif (isset($_GET['lerd_server']) && isset($servers[$_GET['lerd_server']]))\
+    \ {\n\t\t\t$pick = $_GET['lerd_server'];\n\t\t} elseif (isset($_GET['db']) &&\
+    \ $_GET['db'] !== '') {\n\t\t\t$pick = lerd_server_with_db($_GET['db']);\n\t\t\
+    }\n\t\tif ($pick === null) { $pick = key($servers); }\n\t\t$s = $servers[$pick];\n\
+    \t\t$q = $_GET;\n\t\tunset($q['lerd_server']);\n\t\t$q[lerd_query_key($s)] = $pick;\n\
+    \t\t$q['username'] = $s['username'];\n\t\t// A Postgres database is only half\
+    \ an address; without a schema the hub\n\t\t// of the URL is incomplete and 6\
+    \ bounces it back rather than opening it.\n\t\tif ($s['driver'] === 'pgsql' &&\
+    \ !empty($q['db']) && !isset($q['ns'])) {\n\t\t\t$q['ns'] = 'public';\n\t\t}\n\
+    \t\theader('Location: ?' . http_build_query($q), true, 302);\n\t\texit;\n\t}\n\
+    \n\t// Adminer 5 registers a plugin hook only for methods that exist on its core\n\
+    \t// object, and navigation() is a plain function there, so a plugin cannot add\n\
+    \t// to the sidebar. The switcher is spliced into the rendered page instead, from\n\
+    \t// an output-buffer callback: Adminer exits on most paths, and a callback still\n\
+    \t// runs at shutdown where code after the include would not.\n\tfunction lerd_switcher($html)\
+    \ {\n\t\t$servers = lerd_servers();\n\t\tif (count($servers) < 2 || strpos($html,\
+    \ \"<div id='menu'>\") === false) {\n\t\t\treturn $html;\n\t\t}\n\t\t$links =\
+    \ array();\n\t\tforeach ($servers as $host => $s) {\n\t\t\t$key = lerd_query_key($s);\n\
+    \t\t\t$label = htmlspecialchars($host);\n\t\t\t$links[] = (isset($_GET[$key])\
+    \ && $_GET[$key] === $host)\n\t\t\t\t? \"<b>$label</b>\"\n\t\t\t\t: \"<a href='?\"\
+    \ . $key . '=' . urlencode($host) . '&username=' . urlencode($s['username']) .\
+    \ \"'>$label</a>\";\n\t\t}\n\t\t$bar = \"<div id='lerd-servers' style='padding:.6em\
+    \ .8em;line-height:1.9'>\" . implode('<br>', $links) . \"</div>\";\n\t\t$out =\
+    \ preg_replace(\"~(<div id='menu'>)~\", '$1' . $bar, $html, 1);\n\t\treturn $out\
+    \ === null ? $html : $out;\n\t}\n\n\tif (isset($_GET['dump']) || isset($_GET['download'])\
+    \ || isset($_POST['export'])) {\n\t\trequire './adminer.php';\n\t\treturn;\n\t\
+    }\n\tob_start('lerd_switcher');\n\trequire './adminer.php';\n}\n"
+- target: /var/www/html/adminer.css
+  content: "/* Adminer design lerd */\n/* Adminer themes itself through four variables,\
+    \ so matching the dashboard is a\n   matter of setting them rather than restyling\
+    \ the page. Only the accent comes\n   from lerd's palette, which the overlay copies\
+    \ into this document, so picking\n   another palette repaints the embedded tool\
+    \ too. The surfaces are lerd's own\n   light neutrals, which are plain greys and\
+    \ not palette driven. */\nhtml {\n\t--bg: #f9fafb;\n\t--fg: #1f2937;\n\t--dim:\
+    \ #f3f4f6;\n\t--lit: #e5e7eb;\n}\na, a:visited { color: var(--lerd-accent, #ff2d20);\
+    \ }\n"
+- target: /var/www/html/adminer-dark.css
+  content: "/* Adminer design lerd */\n/* Adminer themes itself through four variables,\
+    \ and its own dark sheet then\n   repaints about thirty rules in blues that ignore\
+    \ them. The variables carry the\n   surfaces, and the rules below take those blues\
+    \ back onto lerd's own greys, so\n   the embedded tool sits on the same palette\
+    \ as the panel around it. bg, card\n   and border come from the palette the overlay\
+    \ copies in, so changing palette in\n   lerd repaints this too. */\nhtml {\n\t\
+    --bg: var(--lerd-bg, #0d0d0d);\n\t--fg: #e5e5e5;\n\t--dim: var(--lerd-card, #161616);\n\
+    \t--lit: var(--lerd-border, #262626);\n\t--accent: var(--lerd-accent, #ff2d20);\n\
+    }\n\na, a:visited, button.link, #schema div.table a, .js .checkable .checked a\
+    \ { color: var(--accent); }\na:link:hover, a:visited:hover, button.link:hover\
+    \ { color: var(--lerd-accent-hover, #e02419); }\n\nh1 { border-color: var(--lit);\
+    \ color: var(--fg); }\nh2 { border-color: var(--lit); color: var(--fg); background:\
+    \ var(--dim); }\n#h1, .version, #version, .plugins .update { color: var(--fg);\
+    \ }\n\ntable, td, th, .column, fieldset, #menu, #menu p, #logins, #tables,\n#schema\
+    \ .table, #help { border-color: var(--lit); }\nth, code { background: var(--dim);\
+    \ }\nthead td, thead th, thead th a, :target { color: var(--fg); }\ntbody tr:hover\
+    \ td, tbody tr:hover th,\n#edit-fields tbody tr:hover td, #edit-fields tbody tr:hover\
+    \ th { background: var(--lit); }\n.odds tbody tr:nth-child(2n) { background: var(--dim);\
+    \ }\n.js .checkable .checked td, .js .checkable .checked th { background: var(--lit);\
+    \ color: var(--fg); }\n.js .checkable .checked:hover td, .js .checkable .checked:hover\
+    \ th { background: var(--lit); }\n#menu .active { color: var(--accent); }\n.icon\
+    \ { background-color: var(--dim); }\n.icon:hover { background-color: var(--accent);\
+    \ }\n\n/* The syntax highlighter has its own set, keyed to the same surfaces.\
+    \ */\n.jush { --bg-color: var(--dim); --border-color: var(--lit); }\n"
+dashboard: http://localhost:8081
+dashboard_external: true
+category: admin
+icon: database
+color: '#34567c'
+admin_for:
+- mysql
+- mariadb
+- postgres
+- postgres-pgvector
+- postgres-timescaledb
+admin_rank: 10
diff --git a/schema/2/services/index.json b/schema/2/services/index.json
new file mode 100644
index 0000000..81f89fa
--- /dev/null
+++ b/schema/2/services/index.json
@@ -0,0 +1,362 @@
+{
+  "services": [
+    {
+      "name": "adminer",
+      "description": "Adminer web UI for every database lerd runs",
+      "dashboard": "http://localhost:8081",
+      "image": "docker.io/library/adminer:6",
+      "category": "admin",
+      "icon": "database",
+      "color": "#34567c",
+      "admin_for": [
+        "mysql",
+        "mariadb",
+        "postgres",
+        "postgres-pgvector",
+        "postgres-timescaledb"
+      ],
+      "admin_rank": 10
+    },
+    {
+      "name": "beanstalkd",
+      "description": "Beanstalkd work queue",
+      "image": "docker.io/schickling/beanstalkd:latest",
+      "category": "messaging",
+      "icon": "queue"
+    },
+    {
+      "name": "clickhouse",
+      "description": "ClickHouse column-oriented analytics database",
+      "family": "clickhouse",
+      "dashboard": "http://localhost:8123/play?user=lerd&password=lerd",
+      "image": "docker.io/library/clickhouse:26.3",
+      "category": "databases",
+      "icon": "database",
+      "color": "#ffcc01"
+    },
+    {
+      "name": "elasticsearch",
+      "description": "Elasticsearch single-node search and analytics engine",
+      "image": "docker.elastic.co/elasticsearch/elasticsearch:8.13.4",
+      "category": "search",
+      "icon": "search",
+      "color": "#005571"
+    },
+    {
+      "name": "elasticvue",
+      "description": "Elasticvue web UI for the lerd Elasticsearch service",
+      "dashboard": "http://localhost:8083",
+      "depends_on": [
+        "elasticsearch"
+      ],
+      "image": "docker.io/cars10/elasticvue:latest",
+      "category": "admin",
+      "icon": "search",
+      "admin_for": [
+        "elasticsearch"
+      ]
+    },
+    {
+      "name": "gotenberg",
+      "description": "Gotenberg API for PDF generation and document conversion",
+      "image": "docker.io/gotenberg/gotenberg:8",
+      "category": "other",
+      "icon": "document"
+    },
+    {
+      "name": "kafka",
+      "description": "Apache Kafka event streaming broker",
+      "image": "docker.io/apache/kafka:4.3.1",
+      "category": "messaging",
+      "icon": "queue",
+      "color": "#231f20"
+    },
+    {
+      "name": "kafka-ui",
+      "description": "Kafbat UI web console for the lerd Kafka service",
+      "dashboard": "http://localhost:8087",
+      "image": "ghcr.io/kafbat/kafka-ui:v1.5.0",
+      "category": "admin",
+      "icon": "queue",
+      "admin_for": [
+        "kafka"
+      ],
+      "depends_on": [
+        "kafka"
+      ]
+    },
+    {
+      "name": "localstack",
+      "description": "LocalStack, the AWS APIs (SQS, SES, DynamoDB, Secrets Manager) run locally",
+      "image": "docker.io/localstack/localstack:4.14",
+      "category": "testing",
+      "icon": "cube",
+      "color": "#4b4ed2"
+    },
+    {
+      "name": "mariadb",
+      "description": "MariaDB (MySQL-compatible) versions",
+      "family": "mariadb",
+      "versions": [
+        {
+          "tag": "12",
+          "label": "12 (latest)",
+          "image": "docker.io/library/mariadb:12",
+          "host_port": 3306
+        },
+        {
+          "tag": "12.3",
+          "label": "12.3 LTS",
+          "image": "docker.io/library/mariadb:12.3",
+          "host_port": 3306
+        },
+        {
+          "tag": "11.8",
+          "label": "11.8 LTS",
+          "image": "docker.io/library/mariadb:11.8",
+          "host_port": 3306
+        },
+        {
+          "tag": "11.4",
+          "label": "11.4 LTS",
+          "image": "docker.io/library/mariadb:11.4",
+          "host_port": 3306
+        },
+        {
+          "tag": "11",
+          "label": "11 (legacy)",
+          "image": "docker.io/library/mariadb:11",
+          "host_port": 3306
+        },
+        {
+          "tag": "10.11",
+          "label": "10.11 LTS",
+          "image": "docker.io/library/mariadb:10.11",
+          "host_port": 3306
+        }
+      ],
+      "default_version": "11.8",
+      "category": "databases",
+      "icon": "database",
+      "color": "#003545",
+      "env_role": "mysql"
+    },
+    {
+      "name": "memcached",
+      "description": "Memcached in-memory key/value cache",
+      "image": "docker.io/library/memcached:1.6-alpine",
+      "category": "cache",
+      "icon": "bolt"
+    },
+    {
+      "name": "mongo",
+      "description": "MongoDB document database",
+      "image": "docker.io/library/mongo:7",
+      "category": "databases",
+      "icon": "leaf",
+      "color": "#47a248"
+    },
+    {
+      "name": "mongo-express",
+      "description": "Mongo Express web UI for the lerd MongoDB service",
+      "dashboard": "http://localhost:8082",
+      "depends_on": [
+        "mongo"
+      ],
+      "image": "docker.io/library/mongo-express:latest",
+      "category": "admin",
+      "icon": "leaf",
+      "admin_for": [
+        "mongo"
+      ]
+    },
+    {
+      "name": "opensearch",
+      "description": "OpenSearch single-node search and analytics engine",
+      "image": "docker.io/opensearchproject/opensearch:2.19.5",
+      "category": "search",
+      "icon": "search",
+      "color": "#005eb8"
+    },
+    {
+      "name": "opensearch-dashboards",
+      "description": "OpenSearch Dashboards web UI for the lerd OpenSearch service",
+      "dashboard": "http://localhost:8086",
+      "depends_on": [
+        "opensearch"
+      ],
+      "image": "docker.io/opensearchproject/opensearch-dashboards:2.19.5",
+      "category": "admin",
+      "icon": "search",
+      "admin_for": [
+        "opensearch"
+      ]
+    },
+    {
+      "name": "pgadmin",
+      "description": "pgAdmin web UI for the lerd Postgres service",
+      "dashboard": "http://localhost:8081",
+      "image": "docker.io/dpage/pgadmin4:latest",
+      "category": "admin",
+      "icon": "elephant",
+      "admin_for": [
+        "postgres",
+        "postgres-pgvector",
+        "postgres-timescaledb"
+      ],
+      "depends_on": [
+        "postgres"
+      ]
+    },
+    {
+      "name": "phpmyadmin",
+      "description": "phpMyAdmin web UI for every installed lerd MySQL service",
+      "dashboard": "http://localhost:8080",
+      "depends_on": [
+        "mysql"
+      ],
+      "image": "docker.io/library/phpmyadmin:latest",
+      "category": "admin",
+      "icon": "database",
+      "color": "#6c78af",
+      "admin_for": [
+        "mysql",
+        "mariadb"
+      ]
+    },
+    {
+      "name": "postgres-pgvector",
+      "description": "PostgreSQL with pgvector (vector embeddings, no PostGIS)",
+      "family": "postgres",
+      "versions": [
+        {
+          "tag": "18",
+          "label": "18 (default)",
+          "image": "docker.io/pgvector/pgvector:pg18",
+          "host_port": 5432,
+          "canonical": true
+        },
+        {
+          "tag": "17",
+          "label": "17",
+          "image": "docker.io/pgvector/pgvector:pg17",
+          "host_port": 5432
+        },
+        {
+          "tag": "16",
+          "label": "16",
+          "image": "docker.io/pgvector/pgvector:pg16",
+          "host_port": 5432
+        }
+      ],
+      "default_version": "18",
+      "category": "databases",
+      "icon": "elephant",
+      "color": "#4169e1"
+    },
+    {
+      "name": "postgres-timescaledb",
+      "description": "PostgreSQL with TimescaleDB (time-series extension)",
+      "family": "postgres",
+      "versions": [
+        {
+          "tag": "17",
+          "label": "17 (default)",
+          "image": "docker.io/timescale/timescaledb:latest-pg17",
+          "host_port": 5432,
+          "canonical": true
+        },
+        {
+          "tag": "16",
+          "label": "16",
+          "image": "docker.io/timescale/timescaledb:latest-pg16",
+          "host_port": 5432
+        }
+      ],
+      "default_version": "17",
+      "category": "databases",
+      "icon": "elephant",
+      "color": "#4169e1"
+    },
+    {
+      "name": "rabbitmq",
+      "description": "RabbitMQ message broker with management UI",
+      "dashboard": "http://localhost:15672",
+      "image": "docker.io/library/rabbitmq:3-management-alpine",
+      "category": "messaging",
+      "icon": "queue",
+      "color": "#ff6600"
+    },
+    {
+      "name": "redisinsight",
+      "description": "RedisInsight web UI for every installed lerd Redis and Valkey service",
+      "dashboard": "http://localhost:8085",
+      "image": "docker.io/redis/redisinsight:latest",
+      "category": "admin",
+      "icon": "database",
+      "admin_for": [
+        "redis",
+        "valkey"
+      ],
+      "depends_on": [
+        "redis"
+      ]
+    },
+    {
+      "name": "selenium",
+      "description": "Selenium + Chromium for browser testing (Laravel Dusk, Symfony Panther, etc.)",
+      "dashboard": "http://localhost:7900/?autoconnect=1&resize=scale",
+      "image": "docker.io/selenium/standalone-chromium:latest",
+      "category": "testing",
+      "icon": "browserPlay",
+      "color": "#43b02a"
+    },
+    {
+      "name": "soketi",
+      "description": "Soketi realtime WebSocket server (Pusher-compatible)",
+      "image": "quay.io/soketi/soketi:1.6-16-alpine",
+      "category": "messaging",
+      "icon": "broadcast"
+    },
+    {
+      "name": "stripe-mock",
+      "description": "Local Stripe API mock for Cashier and webhook testing",
+      "image": "docker.io/stripemock/stripe-mock:latest",
+      "category": "testing",
+      "icon": "card",
+      "color": "#635bff"
+    },
+    {
+      "name": "typesense",
+      "description": "Typesense search engine",
+      "family": "typesense",
+      "image": "docker.io/typesense/typesense:30.2",
+      "category": "search",
+      "icon": "search"
+    },
+    {
+      "name": "typesense-dashboard",
+      "description": "Typesense Dashboard web UI for the lerd Typesense service",
+      "dashboard": "http://localhost:8084",
+      "depends_on": [
+        "typesense"
+      ],
+      "image": "docker.io/bfritscher/typesense-dashboard:latest",
+      "category": "admin",
+      "icon": "search",
+      "admin_for": [
+        "typesense"
+      ]
+    },
+    {
+      "name": "valkey",
+      "description": "Valkey in-memory store (Redis-compatible)",
+      "family": "valkey",
+      "image": "docker.io/valkey/valkey:9-alpine",
+      "category": "cache",
+      "icon": "bolt",
+      "color": "#123678",
+      "env_role": "redis"
+    }
+  ]
+}
diff --git a/schema/2/services/kafka-ui.yaml b/schema/2/services/kafka-ui.yaml
new file mode 100644
index 0000000..7a37ce4
--- /dev/null
+++ b/schema/2/services/kafka-ui.yaml
@@ -0,0 +1,19 @@
+name: kafka-ui
+image: ghcr.io/kafbat/kafka-ui:v1.5.0
+description: Kafbat UI web console for the lerd Kafka service
+ports:
+- 8087:8080
+environment:
+  KAFKA_CLUSTERS_0_NAME: lerd
+  KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: lerd-kafka:9092
+  SERVER_SERVLET_CONTEXT_PATH: /_svc/kafka-ui
+depends_on:
+- kafka
+dashboard: http://localhost:8087
+dashboard_proxy: true
+dashboard_follows_color_scheme: true
+dashboard_scheme_key: mode
+category: admin
+icon: queue
+admin_for:
+- kafka
diff --git a/schema/2/services/pgadmin.yaml b/schema/2/services/pgadmin.yaml
new file mode 100644
index 0000000..fc7e237
--- /dev/null
+++ b/schema/2/services/pgadmin.yaml
@@ -0,0 +1,54 @@
+name: pgadmin
+image: docker.io/dpage/pgadmin4:latest
+description: pgAdmin web UI for the lerd Postgres service
+ports:
+- 8081:80
+environment:
+  PGADMIN_DEFAULT_EMAIL: admin@pgadmin.org
+  PGADMIN_DEFAULT_PASSWORD: lerd
+  PGADMIN_CONFIG_SERVER_MODE: 'False'
+  PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: 'False'
+  PGADMIN_REPLACE_SERVERS_ON_STARTUP: 'True'
+dynamic_env:
+  LERD_POSTGRES_HOSTS: discover_family:postgres
+depends_on:
+- postgres
+dashboard: http://localhost:8081
+dashboard_proxy: true
+dashboard_follows_color_scheme: true
+files:
+- target: /pgadmin4/servers.json
+  generator: pgadmin_servers
+- target: /pgpass
+  mode: '0600'
+  chown: true
+  generator: pgadmin_pgpass
+- target: /pgadmin4/config_local.py
+  content: 'X_FRAME_OPTIONS = ''''
+
+    ENHANCED_COOKIE_PROTECTION = False
+
+    WTF_CSRF_CHECK_DEFAULT = False
+
+
+    # A lerd that does not know dashboard_proxy still frames this from its own
+
+    # origin, where the Flask session and CSRF cookies need SameSite=None to
+
+    # be sent at all. That needs Secure=True, which browsers accept over HTTP
+
+    # on localhost. Inert once the dashboard is served same-origin, so it stays
+
+    # until no supported lerd frames this cross-origin.
+
+    SESSION_COOKIE_SAMESITE = ''None''
+
+    SESSION_COOKIE_SECURE = True
+
+    '
+category: admin
+icon: elephant
+admin_for:
+- postgres
+- postgres-pgvector
+- postgres-timescaledb
diff --git a/schema/2/services/redisinsight.yaml b/schema/2/services/redisinsight.yaml
new file mode 100644
index 0000000..019b7bb
--- /dev/null
+++ b/schema/2/services/redisinsight.yaml
@@ -0,0 +1,25 @@
+name: redisinsight
+image: docker.io/redis/redisinsight:latest
+description: RedisInsight web UI for every installed lerd Redis and Valkey service
+ports:
+- 8085:5540
+environment:
+  RI_APP_PORT: '5540'
+  RI_REDIS_HOST: lerd-redis
+  RI_REDIS_PORT: '6379'
+  RI_REDIS_ALIAS: lerd-redis
+expand_env:
+  RI_REDIS_HOST: redis,valkey={host}
+  RI_REDIS_PORT: redis,valkey=6379
+  RI_REDIS_ALIAS: redis,valkey={name}
+depends_on:
+- redis
+dashboard: http://localhost:8085
+dashboard_external: true
+dashboard_follows_color_scheme: true
+dashboard_scheme_key: '{{mount}}_theme'
+category: admin
+icon: database
+admin_for:
+- redis
+- valkey
diff --git a/services/adminer.yaml b/services/adminer.yaml
index 56bba54..72fb95e 100644
--- a/services/adminer.yaml
+++ b/services/adminer.yaml
@@ -1,259 +1,146 @@
 name: adminer
 image: docker.io/library/adminer:6
 update_strategy: rolling
-description: "Adminer web UI for every database lerd runs"
+description: Adminer web UI for every database lerd runs
 ports:
-  - "8081:8080"
+- 8081:8080
 dynamic_env:
-  # Every running member of each family, comma joined, so the mount below can
-  # authenticate all of them rather than the one the preset happens to name.
   ADMINER_MYSQL_HOSTS: discover_family:mysql,mariadb
   ADMINER_PGSQL_HOSTS: discover_family:postgres
-# Adminer's own index.php only prefills the server field, which leaves a login
-# form in front of databases lerd already holds the credentials for. This one
-# seeds a session per running server, resolves a database named without a server
-# to the engine that actually holds it, and splices in a server switcher.
 files:
-  - target: /var/www/html/index.php
-    content: |
-      <?php
-      namespace docker {
-      	function adminer_object() {
-      		require_once './plugins/login-servers.php';
-      		class LerdServers extends \AdminerLoginServers {
-      			function credentials() {
-      				$s = $this->servers[\Adminer\SERVER];
-      				return array($s['server'], $s['username'], $s['password']);
-      			}
-      			function login($login, $password) { return true; }
-      		}
-      		return new \Adminer\Plugins(array(new LerdServers(\lerd_servers())));
-      	}
-      }
-      namespace {
-      	function lerd_servers() {
-      		static $out = null;
-      		if ($out !== null) { return $out; }
-      		$families = array(
-      			'ADMINER_MYSQL_HOSTS'      => array('server',     'root',     'lerd'),
-      			'ADMINER_PGSQL_HOSTS'      => array('pgsql',      'postgres', 'lerd'),
-      		);
-      		$out = array();
-      		foreach ($families as $env => $spec) {
-      			foreach (array_filter(explode(',', (string) getenv($env))) as $host) {
-      				$out[$host] = array('server' => $host, 'driver' => $spec[0], 'username' => $spec[1], 'password' => $spec[2]);
-      			}
-      		}
-      		if (!$out) {
-      			$out['lerd-mysql'] = array('server' => 'lerd-mysql', 'driver' => 'server', 'username' => 'root', 'password' => 'lerd');
-      		}
-      		return $out;
-      	}
-
-      	function lerd_query_key(array $s) {
-      		return $s['driver'] === 'server' ? 'server' : $s['driver'];
-      	}
-
-      	// Which server actually holds this database. The dashboard deep-links a
-      	// database by name alone, so without this a Postgres database opens against
-      	// MySQL and Adminer answers "Invalid database".
-      	function lerd_server_with_db($db) {
-      		foreach (lerd_servers() as $host => $s) {
-      			try {
-      				if ($s['driver'] === 'server' && extension_loaded('mysqli')) {
-      					$c = @new mysqli($host, $s['username'], $s['password']);
-      					if ($c->connect_errno) { continue; }
-      					$q = $c->query("SHOW DATABASES LIKE '" . $c->real_escape_string($db) . "'");
-      					$hit = $q && $q->num_rows > 0;
-      					$c->close();
-      					if ($hit) { return $host; }
-      				} elseif ($s['driver'] === 'pgsql' && extension_loaded('pdo_pgsql')) {
-      					$p = new PDO("pgsql:host=$host;dbname=postgres", $s['username'], $s['password'], array(PDO::ATTR_TIMEOUT => 2));
-      					$st = $p->prepare('SELECT 1 FROM pg_database WHERE datname = ?');
-      					$st->execute(array($db));
-      					if ($st->fetchColumn()) { return $host; }
-      				}
-      			} catch (\Throwable $e) {
-      				// A server that is down must not stop the search.
-      			}
-      		}
-      		return null;
-      	}
-
-      	// The dashboard proxy forwards its own /_svc/<name>/ prefix, and Adminer's own
-      	// assets are query strings rather than paths, so they survive it. A design
-      	// stylesheet is the exception: Adminer links it as a plain file name, which
-      	// arrives here under the prefix, misses on disk and falls through to this
-      	// script. Serve it rather than treat it as a page to redirect.
-      	$asset = basename(parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '');
-      	if (preg_match('~^[\\w.-]+\\.(css|js|png|gif|ico|svg|woff2?)$~', $asset) && is_file(__DIR__ . '/' . $asset)) {
-      		$types = array('css' => 'text/css', 'js' => 'application/javascript', 'png' => 'image/png',
-      			'gif' => 'image/gif', 'ico' => 'image/x-icon', 'svg' => 'image/svg+xml',
-      			'woff' => 'font/woff', 'woff2' => 'font/woff2');
-      		$ext = strtolower(pathinfo($asset, PATHINFO_EXTENSION));
-      		header('Content-Type: ' . ($types[$ext] ?? 'application/octet-stream'));
-      		readfile(__DIR__ . '/' . $asset);
-      		exit;
-      	}
-
-      	$servers = lerd_servers();
-      	// Seeded and closed before adminer.php is included, with the cache limiter
-      	// off, so its own session_start sends no headers after ours have gone out.
-      	ini_set('session.cache_limiter', '');
-      	ob_start();
-      	session_name('adminer_sid');
-      	session_start();
-      	foreach ($servers as $host => $s) {
-      		if (!isset($_SESSION['pwds'][$s['driver']][$host][$s['username']])) {
-      			$_SESSION['pwds'][$s['driver']][$host][$s['username']] = $s['password'];
-      			$_SESSION['db'][$s['driver']][$host][$s['username']] = array();
-      		}
-      	}
-      	session_write_close();
-      	ob_end_clean();
-
-      	// Which server this request is for. A request that already names one is left
-      	// alone; anything else is answered with a redirect to the canonical URL rather
-      	// than by rewriting the request in place, because the versions disagree about
-      	// whether they build their own links from $_GET or from the raw query string,
-      	// and a rewrite that one of them ignores turns into a redirect loop.
-      	$named = false;
-      	foreach ($servers as $host => $s) {
-      		if (isset($_GET[lerd_query_key($s)])) { $named = true; break; }
-      	}
-      	// An asset request carries file=; it needs no server and redirecting it only
-      	// costs a round trip before Adminer serves the same bytes.
-      	if (!$named && !isset($_GET['file'])) {
-      		$pick = null;
-      		// lerd_server is how the dashboard says which engine it opened this for,
-      		// without having to know the driver or the credentials that go with it.
-      		if (isset($_GET['lerd_server']) && isset($servers[$_GET['lerd_server']])) {
-      			$pick = $_GET['lerd_server'];
-      		} elseif (isset($_GET['db']) && $_GET['db'] !== '') {
-      			$pick = lerd_server_with_db($_GET['db']);
-      		}
-      		if ($pick === null) { $pick = key($servers); }
-      		$s = $servers[$pick];
-      		$q = $_GET;
-      		unset($q['lerd_server']);
-      		$q[lerd_query_key($s)] = $pick;
-      		$q['username'] = $s['username'];
-      		// A Postgres database is only half an address; without a schema the hub
-      		// of the URL is incomplete and 6 bounces it back rather than opening it.
-      		if ($s['driver'] === 'pgsql' && !empty($q['db']) && !isset($q['ns'])) {
-      			$q['ns'] = 'public';
-      		}
-      		header('Location: ?' . http_build_query($q), true, 302);
-      		exit;
-      	}
-
-      	// Adminer 5 registers a plugin hook only for methods that exist on its core
-      	// object, and navigation() is a plain function there, so a plugin cannot add
-      	// to the sidebar. The switcher is spliced into the rendered page instead, from
-      	// an output-buffer callback: Adminer exits on most paths, and a callback still
-      	// runs at shutdown where code after the include would not.
-      	function lerd_switcher($html) {
-      		$servers = lerd_servers();
-      		if (count($servers) < 2 || strpos($html, "<div id='menu'>") === false) {
-      			return $html;
-      		}
-      		$links = array();
-      		foreach ($servers as $host => $s) {
-      			$key = lerd_query_key($s);
-      			$label = htmlspecialchars($host);
-      			$links[] = (isset($_GET[$key]) && $_GET[$key] === $host)
-      				? "<b>$label</b>"
-      				: "<a href='?" . $key . '=' . urlencode($host) . '&username=' . urlencode($s['username']) . "'>$label</a>";
-      		}
-      		$bar = "<div id='lerd-servers' style='padding:.6em .8em;line-height:1.9'>" . implode('<br>', $links) . "</div>";
-      		$out = preg_replace("~(<div id='menu'>)~", '$1' . $bar, $html, 1);
-      		return $out === null ? $html : $out;
-      	}
-
-      	if (isset($_GET['dump']) || isset($_GET['download']) || isset($_POST['export'])) {
-      		require './adminer.php';
-      		return;
-      	}
-      	ob_start('lerd_switcher');
-      	require './adminer.php';
-      }
-  - target: /var/www/html/adminer.css
-    content: |
-      /* Adminer design lerd */
-      /* Adminer themes itself through four variables, so matching the dashboard is a
-         matter of setting them rather than restyling the page. Only the accent comes
-         from lerd's palette, which the overlay copies into this document, so picking
-         another palette repaints the embedded tool too. The surfaces are lerd's own
-         light neutrals, which are plain greys and not palette driven. */
-      html {
-      	--bg: #f9fafb;
-      	--fg: #1f2937;
-      	--dim: #f3f4f6;
-      	--lit: #e5e7eb;
-      }
-      a, a:visited { color: var(--lerd-accent, #ff2d20); }
-  - target: /var/www/html/adminer-dark.css
-    content: |
-      /* Adminer design lerd */
-      /* Adminer themes itself through four variables, and its own dark sheet then
-         repaints about thirty rules in blues that ignore them. The variables carry the
-         surfaces, and the rules below take those blues back onto lerd's own greys, so
-         the embedded tool sits on the same palette as the panel around it. bg, card
-         and border come from the palette the overlay copies in, so changing palette in
-         lerd repaints this too. */
-      html {
-      	--bg: var(--lerd-bg, #0d0d0d);
-      	--fg: #e5e5e5;
-      	--dim: var(--lerd-card, #161616);
-      	--lit: var(--lerd-border, #262626);
-      	--accent: var(--lerd-accent, #ff2d20);
-      }
-
-      a, a:visited, button.link, #schema div.table a, .js .checkable .checked a { color: var(--accent); }
-      a:link:hover, a:visited:hover, button.link:hover { color: var(--lerd-accent-hover, #e02419); }
-
-      h1 { border-color: var(--lit); color: var(--fg); }
-      h2 { border-color: var(--lit); color: var(--fg); background: var(--dim); }
-      #h1, .version, #version, .plugins .update { color: var(--fg); }
-
-      table, td, th, .column, fieldset, #menu, #menu p, #logins, #tables,
-      #schema .table, #help { border-color: var(--lit); }
-      th, code { background: var(--dim); }
-      thead td, thead th, thead th a, :target { color: var(--fg); }
-      tbody tr:hover td, tbody tr:hover th,
-      #edit-fields tbody tr:hover td, #edit-fields tbody tr:hover th { background: var(--lit); }
-      .odds tbody tr:nth-child(2n) { background: var(--dim); }
-      .js .checkable .checked td, .js .checkable .checked th { background: var(--lit); color: var(--fg); }
-      .js .checkable .checked:hover td, .js .checkable .checked:hover th { background: var(--lit); }
-      #menu .active { color: var(--accent); }
-      .icon { background-color: var(--dim); }
-      .icon:hover { background-color: var(--accent); }
-
-      /* The syntax highlighter has its own set, keyed to the same surfaces. */
-      .jush { --bg-color: var(--dim); --border-color: var(--lit); }
-# The dashboard's own palette, as an Adminer design. Adminer pairs adminer.css
-# with adminer-dark.css behind the prefers-color-scheme queries, and the overlay
-# drives which one applies and copies lerd's custom properties in, so the
-# embedded tool follows both the theme and the palette picked in lerd.
+- target: /var/www/html/index.php
+  content: "<?php\nnamespace docker {\n\tfunction adminer_object() {\n\t\trequire_once\
+    \ './plugins/login-servers.php';\n\t\tclass LerdServers extends \\AdminerLoginServers\
+    \ {\n\t\t\tfunction credentials() {\n\t\t\t\t$s = $this->servers[\\Adminer\\SERVER];\n\
+    \t\t\t\treturn array($s['server'], $s['username'], $s['password']);\n\t\t\t}\n\
+    \t\t\tfunction login($login, $password) { return true; }\n\t\t}\n\t\treturn new\
+    \ \\Adminer\\Plugins(array(new LerdServers(\\lerd_servers())));\n\t}\n}\nnamespace\
+    \ {\n\tfunction lerd_servers() {\n\t\tstatic $out = null;\n\t\tif ($out !== null)\
+    \ { return $out; }\n\t\t$families = array(\n\t\t\t'ADMINER_MYSQL_HOSTS'      =>\
+    \ array('server',     'root',     'lerd'),\n\t\t\t'ADMINER_PGSQL_HOSTS'      =>\
+    \ array('pgsql',      'postgres', 'lerd'),\n\t\t);\n\t\t$out = array();\n\t\t\
+    foreach ($families as $env => $spec) {\n\t\t\tforeach (array_filter(explode(',',\
+    \ (string) getenv($env))) as $host) {\n\t\t\t\t$out[$host] = array('server' =>\
+    \ $host, 'driver' => $spec[0], 'username' => $spec[1], 'password' => $spec[2]);\n\
+    \t\t\t}\n\t\t}\n\t\tif (!$out) {\n\t\t\t$out['lerd-mysql'] = array('server' =>\
+    \ 'lerd-mysql', 'driver' => 'server', 'username' => 'root', 'password' => 'lerd');\n\
+    \t\t}\n\t\treturn $out;\n\t}\n\n\tfunction lerd_query_key(array $s) {\n\t\treturn\
+    \ $s['driver'] === 'server' ? 'server' : $s['driver'];\n\t}\n\n\t// Which server\
+    \ actually holds this database. The dashboard deep-links a\n\t// database by name\
+    \ alone, so without this a Postgres database opens against\n\t// MySQL and Adminer\
+    \ answers \"Invalid database\".\n\tfunction lerd_server_with_db($db) {\n\t\tforeach\
+    \ (lerd_servers() as $host => $s) {\n\t\t\ttry {\n\t\t\t\tif ($s['driver'] ===\
+    \ 'server' && extension_loaded('mysqli')) {\n\t\t\t\t\t$c = @new mysqli($host,\
+    \ $s['username'], $s['password']);\n\t\t\t\t\tif ($c->connect_errno) { continue;\
+    \ }\n\t\t\t\t\t$q = $c->query(\"SHOW DATABASES LIKE '\" . $c->real_escape_string($db)\
+    \ . \"'\");\n\t\t\t\t\t$hit = $q && $q->num_rows > 0;\n\t\t\t\t\t$c->close();\n\
+    \t\t\t\t\tif ($hit) { return $host; }\n\t\t\t\t} elseif ($s['driver'] === 'pgsql'\
+    \ && extension_loaded('pdo_pgsql')) {\n\t\t\t\t\t$p = new PDO(\"pgsql:host=$host;dbname=postgres\"\
+    , $s['username'], $s['password'], array(PDO::ATTR_TIMEOUT => 2));\n\t\t\t\t\t\
+    $st = $p->prepare('SELECT 1 FROM pg_database WHERE datname = ?');\n\t\t\t\t\t\
+    $st->execute(array($db));\n\t\t\t\t\tif ($st->fetchColumn()) { return $host; }\n\
+    \t\t\t\t}\n\t\t\t} catch (\\Throwable $e) {\n\t\t\t\t// A server that is down\
+    \ must not stop the search.\n\t\t\t}\n\t\t}\n\t\treturn null;\n\t}\n\n\t// The\
+    \ dashboard proxy forwards its own /_svc/<name>/ prefix, and Adminer's own\n\t\
+    // assets are query strings rather than paths, so they survive it. A design\n\t\
+    // stylesheet is the exception: Adminer links it as a plain file name, which\n\
+    \t// arrives here under the prefix, misses on disk and falls through to this\n\
+    \t// script. Serve it rather than treat it as a page to redirect.\n\t$asset =\
+    \ basename(parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '');\n\t\
+    if (preg_match('~^[\\\\w.-]+\\\\.(css|js|png|gif|ico|svg|woff2?)$~', $asset) &&\
+    \ is_file(__DIR__ . '/' . $asset)) {\n\t\t$types = array('css' => 'text/css',\
+    \ 'js' => 'application/javascript', 'png' => 'image/png',\n\t\t\t'gif' => 'image/gif',\
+    \ 'ico' => 'image/x-icon', 'svg' => 'image/svg+xml',\n\t\t\t'woff' => 'font/woff',\
+    \ 'woff2' => 'font/woff2');\n\t\t$ext = strtolower(pathinfo($asset, PATHINFO_EXTENSION));\n\
+    \t\theader('Content-Type: ' . ($types[$ext] ?? 'application/octet-stream'));\n\
+    \t\treadfile(__DIR__ . '/' . $asset);\n\t\texit;\n\t}\n\n\t$servers = lerd_servers();\n\
+    \t// Seeded and closed before adminer.php is included, with the cache limiter\n\
+    \t// off, so its own session_start sends no headers after ours have gone out.\n\
+    \tini_set('session.cache_limiter', '');\n\tob_start();\n\tsession_name('adminer_sid');\n\
+    \tsession_start();\n\tforeach ($servers as $host => $s) {\n\t\tif (!isset($_SESSION['pwds'][$s['driver']][$host][$s['username']]))\
+    \ {\n\t\t\t$_SESSION['pwds'][$s['driver']][$host][$s['username']] = $s['password'];\n\
+    \t\t\t$_SESSION['db'][$s['driver']][$host][$s['username']] = array();\n\t\t}\n\
+    \t}\n\tsession_write_close();\n\tob_end_clean();\n\n\t// Which server this request\
+    \ is for. A request that already names one is left\n\t// alone; anything else\
+    \ is answered with a redirect to the canonical URL rather\n\t// than by rewriting\
+    \ the request in place, because the versions disagree about\n\t// whether they\
+    \ build their own links from $_GET or from the raw query string,\n\t// and a rewrite\
+    \ that one of them ignores turns into a redirect loop.\n\t$named = false;\n\t\
+    foreach ($servers as $host => $s) {\n\t\tif (isset($_GET[lerd_query_key($s)]))\
+    \ { $named = true; break; }\n\t}\n\t// An asset request carries file=; it needs\
+    \ no server and redirecting it only\n\t// costs a round trip before Adminer serves\
+    \ the same bytes.\n\tif (!$named && !isset($_GET['file'])) {\n\t\t$pick = null;\n\
+    \t\t// lerd_server is how the dashboard says which engine it opened this for,\n\
+    \t\t// without having to know the driver or the credentials that go with it.\n\
+    \t\tif (isset($_GET['lerd_server']) && isset($servers[$_GET['lerd_server']]))\
+    \ {\n\t\t\t$pick = $_GET['lerd_server'];\n\t\t} elseif (isset($_GET['db']) &&\
+    \ $_GET['db'] !== '') {\n\t\t\t$pick = lerd_server_with_db($_GET['db']);\n\t\t\
+    }\n\t\tif ($pick === null) { $pick = key($servers); }\n\t\t$s = $servers[$pick];\n\
+    \t\t$q = $_GET;\n\t\tunset($q['lerd_server']);\n\t\t$q[lerd_query_key($s)] = $pick;\n\
+    \t\t$q['username'] = $s['username'];\n\t\t// A Postgres database is only half\
+    \ an address; without a schema the hub\n\t\t// of the URL is incomplete and 6\
+    \ bounces it back rather than opening it.\n\t\tif ($s['driver'] === 'pgsql' &&\
+    \ !empty($q['db']) && !isset($q['ns'])) {\n\t\t\t$q['ns'] = 'public';\n\t\t}\n\
+    \t\theader('Location: ?' . http_build_query($q), true, 302);\n\t\texit;\n\t}\n\
+    \n\t// Adminer 5 registers a plugin hook only for methods that exist on its core\n\
+    \t// object, and navigation() is a plain function there, so a plugin cannot add\n\
+    \t// to the sidebar. The switcher is spliced into the rendered page instead, from\n\
+    \t// an output-buffer callback: Adminer exits on most paths, and a callback still\n\
+    \t// runs at shutdown where code after the include would not.\n\tfunction lerd_switcher($html)\
+    \ {\n\t\t$servers = lerd_servers();\n\t\tif (count($servers) < 2 || strpos($html,\
+    \ \"<div id='menu'>\") === false) {\n\t\t\treturn $html;\n\t\t}\n\t\t$links =\
+    \ array();\n\t\tforeach ($servers as $host => $s) {\n\t\t\t$key = lerd_query_key($s);\n\
+    \t\t\t$label = htmlspecialchars($host);\n\t\t\t$links[] = (isset($_GET[$key])\
+    \ && $_GET[$key] === $host)\n\t\t\t\t? \"<b>$label</b>\"\n\t\t\t\t: \"<a href='?\"\
+    \ . $key . '=' . urlencode($host) . '&username=' . urlencode($s['username']) .\
+    \ \"'>$label</a>\";\n\t\t}\n\t\t$bar = \"<div id='lerd-servers' style='padding:.6em\
+    \ .8em;line-height:1.9'>\" . implode('<br>', $links) . \"</div>\";\n\t\t$out =\
+    \ preg_replace(\"~(<div id='menu'>)~\", '$1' . $bar, $html, 1);\n\t\treturn $out\
+    \ === null ? $html : $out;\n\t}\n\n\tif (isset($_GET['dump']) || isset($_GET['download'])\
+    \ || isset($_POST['export'])) {\n\t\trequire './adminer.php';\n\t\treturn;\n\t\
+    }\n\tob_start('lerd_switcher');\n\trequire './adminer.php';\n}\n"
+- target: /var/www/html/adminer.css
+  content: "/* Adminer design lerd */\n/* Adminer themes itself through four variables,\
+    \ so matching the dashboard is a\n   matter of setting them rather than restyling\
+    \ the page. Only the accent comes\n   from lerd's palette, which the overlay copies\
+    \ into this document, so picking\n   another palette repaints the embedded tool\
+    \ too. The surfaces are lerd's own\n   light neutrals, which are plain greys and\
+    \ not palette driven. */\nhtml {\n\t--bg: #f9fafb;\n\t--fg: #1f2937;\n\t--dim:\
+    \ #f3f4f6;\n\t--lit: #e5e7eb;\n}\na, a:visited { color: var(--lerd-accent, #ff2d20);\
+    \ }\n"
+- target: /var/www/html/adminer-dark.css
+  content: "/* Adminer design lerd */\n/* Adminer themes itself through four variables,\
+    \ and its own dark sheet then\n   repaints about thirty rules in blues that ignore\
+    \ them. The variables carry the\n   surfaces, and the rules below take those blues\
+    \ back onto lerd's own greys, so\n   the embedded tool sits on the same palette\
+    \ as the panel around it. bg, card\n   and border come from the palette the overlay\
+    \ copies in, so changing palette in\n   lerd repaints this too. */\nhtml {\n\t\
+    --bg: var(--lerd-bg, #0d0d0d);\n\t--fg: #e5e5e5;\n\t--dim: var(--lerd-card, #161616);\n\
+    \t--lit: var(--lerd-border, #262626);\n\t--accent: var(--lerd-accent, #ff2d20);\n\
+    }\n\na, a:visited, button.link, #schema div.table a, .js .checkable .checked a\
+    \ { color: var(--accent); }\na:link:hover, a:visited:hover, button.link:hover\
+    \ { color: var(--lerd-accent-hover, #e02419); }\n\nh1 { border-color: var(--lit);\
+    \ color: var(--fg); }\nh2 { border-color: var(--lit); color: var(--fg); background:\
+    \ var(--dim); }\n#h1, .version, #version, .plugins .update { color: var(--fg);\
+    \ }\n\ntable, td, th, .column, fieldset, #menu, #menu p, #logins, #tables,\n#schema\
+    \ .table, #help { border-color: var(--lit); }\nth, code { background: var(--dim);\
+    \ }\nthead td, thead th, thead th a, :target { color: var(--fg); }\ntbody tr:hover\
+    \ td, tbody tr:hover th,\n#edit-fields tbody tr:hover td, #edit-fields tbody tr:hover\
+    \ th { background: var(--lit); }\n.odds tbody tr:nth-child(2n) { background: var(--dim);\
+    \ }\n.js .checkable .checked td, .js .checkable .checked th { background: var(--lit);\
+    \ color: var(--fg); }\n.js .checkable .checked:hover td, .js .checkable .checked:hover\
+    \ th { background: var(--lit); }\n#menu .active { color: var(--accent); }\n.icon\
+    \ { background-color: var(--dim); }\n.icon:hover { background-color: var(--accent);\
+    \ }\n\n/* The syntax highlighter has its own set, keyed to the same surfaces.\
+    \ */\n.jush { --bg-color: var(--dim); --border-color: var(--lit); }\n"
 dashboard: http://localhost:8081
-# Adminer answers X-Frame-Options: deny, so it is served through the same-origin
-# proxy, which drops that header. Its own links are query strings rather than
-# paths, so it needs no telling about the mount it is served under.
 dashboard_external: true
 category: admin
 icon: database
-color: "#34567c"
-# admin_for matches the preset a service was installed from, not its family, so
-# the Postgres variants have to be named even though discover_family already
-# finds them by family and puts them in the server list.
+color: '#34567c'
 admin_for:
-  - mysql
-  - mariadb
-  - postgres
-  - postgres-pgvector
-  - postgres-timescaledb
-# Preferred over the single-engine tools when more than one is installed, and
-# suggested ahead of them. It covers every engine lerd runs from one container,
-# and lerd's own Databases tab already does the dump and restore that pgAdmin
-# and phpMyAdmin are otherwise carried for.
-admin_rank: 10
+- mysql
+- mariadb
+- postgres
+- postgres-pgvector
+- postgres-timescaledb
diff --git a/services/index.json b/services/index.json
index ca2eea0..3ba1982 100644
--- a/services/index.json
+++ b/services/index.json
@@ -13,10 +13,8 @@
         "mariadb",
         "postgres",
         "postgres-pgvector",
-        "postgres-timescaledb",
-        "clickhouse"
-      ],
-      "admin_rank": 10
+        "postgres-timescaledb"
+      ]
     },
     {
       "name": "beanstalkd",
@@ -76,14 +74,14 @@
       "name": "kafka-ui",
       "description": "Kafbat UI web console for the lerd Kafka service",
       "dashboard": "http://localhost:8087",
-      "depends_on": [
-        "kafka"
-      ],
       "image": "ghcr.io/kafbat/kafka-ui:v1.5.0",
       "category": "admin",
       "icon": "queue",
       "admin_for": [
         "kafka"
+      ],
+      "depends_on": [
+        "kafka"
       ]
     },
     {
@@ -197,9 +195,6 @@
       "name": "pgadmin",
       "description": "pgAdmin web UI for the lerd Postgres service",
       "dashboard": "http://localhost:8081",
-      "depends_on": [
-        "postgres"
-      ],
       "image": "docker.io/dpage/pgadmin4:latest",
       "category": "admin",
       "icon": "elephant",
@@ -207,6 +202,9 @@
         "postgres",
         "postgres-pgvector",
         "postgres-timescaledb"
+      ],
+      "depends_on": [
+        "postgres"
       ]
     },
     {
@@ -292,15 +290,15 @@
       "name": "redisinsight",
       "description": "RedisInsight web UI for every installed lerd Redis and Valkey service",
       "dashboard": "http://localhost:8085",
-      "depends_on": [
-        "redis"
-      ],
       "image": "docker.io/redis/redisinsight:latest",
       "category": "admin",
       "icon": "database",
       "admin_for": [
         "redis",
         "valkey"
+      ],
+      "depends_on": [
+        "redis"
       ]
     },
     {
diff --git a/services/kafka-ui.yaml b/services/kafka-ui.yaml
index c06838a..4f7cada 100644
--- a/services/kafka-ui.yaml
+++ b/services/kafka-ui.yaml
@@ -2,28 +2,16 @@ name: kafka-ui
 image: ghcr.io/kafbat/kafka-ui:v1.5.0
 description: Kafbat UI web console for the lerd Kafka service
 ports:
-  - "8087:8080"
+- 8087:8080
 environment:
   KAFKA_CLUSTERS_0_NAME: lerd
   KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: lerd-kafka:9092
-  # Spring serves the whole app under this prefix, which is where lerd-ui mounts
-  # the proxy. Without it the framed page asks for its assets at / and 404s.
   SERVER_SERVLET_CONTEXT_PATH: /_svc/kafka-ui
 depends_on:
-  - kafka
+- kafka
 dashboard: http://localhost:8087
-# It answers with X-Frame-Options: DENY, so it only embeds through lerd's
-# same-origin proxy, which strips the framing headers.
 dashboard_proxy: true
-# Kafbat UI reads the colour scheme from JavaScript rather than from a media
-# query, and follows the system unless someone picks a side in its own menu,
-# so the question is worth answering with the mode lerd is in.
-dashboard_follows_color_scheme: true
-# It remembers a side once its own switcher is used, and then stops asking, so
-# lerd forgets that on the way in and the overlay's theme is the one that wins.
-# The switcher still works for as long as the view is open.
-dashboard_scheme_key: mode
 category: admin
 icon: queue
 admin_for:
-  - kafka
+- kafka
diff --git a/services/pgadmin.yaml b/services/pgadmin.yaml
index ff6be47..e3057b5 100644
--- a/services/pgadmin.yaml
+++ b/services/pgadmin.yaml
@@ -2,51 +2,52 @@ name: pgadmin
 image: docker.io/dpage/pgadmin4:latest
 description: pgAdmin web UI for the lerd Postgres service
 ports:
-  - "8081:80"
+- 8081:80
 environment:
   PGADMIN_DEFAULT_EMAIL: admin@pgadmin.org
   PGADMIN_DEFAULT_PASSWORD: lerd
-  PGADMIN_CONFIG_SERVER_MODE: "False"
-  PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False"
-  PGADMIN_REPLACE_SERVERS_ON_STARTUP: "True"
+  PGADMIN_CONFIG_SERVER_MODE: 'False'
+  PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: 'False'
+  PGADMIN_REPLACE_SERVERS_ON_STARTUP: 'True'
 dynamic_env:
   LERD_POSTGRES_HOSTS: discover_family:postgres
 depends_on:
-  - postgres
+- postgres
 dashboard: http://localhost:8081
-# The Flask session cookie is dropped when the dashboard is framed from another
-# origin, so lerd-ui serves it same-origin under /_svc/pgadmin/ instead. Not
-# dashboard_external: pgadmin learns that path from a header lerd sends, so a
-# binary that predates it would proxy to a mount pgadmin does not answer on.
 dashboard_proxy: true
-# pgAdmin builds its palette in JavaScript, so there is no query to flip, but it
-# ships its theme preference set to system and asks the browser which scheme it
-# is in. Answering with lerd's own gets its proper dark design rather than one
-# painted over it.
-dashboard_follows_color_scheme: true
 files:
-  - target: /pgadmin4/servers.json
-    generator: pgadmin_servers
-  - target: /pgpass
-    mode: "0600"
-    chown: true
-    generator: pgadmin_pgpass
-  - target: /pgadmin4/config_local.py
-    content: |
-      X_FRAME_OPTIONS = ''
-      ENHANCED_COOKIE_PROTECTION = False
-      WTF_CSRF_CHECK_DEFAULT = False
-
-      # A lerd that does not know dashboard_proxy still frames this from its own
-      # origin, where the Flask session and CSRF cookies need SameSite=None to
-      # be sent at all. That needs Secure=True, which browsers accept over HTTP
-      # on localhost. Inert once the dashboard is served same-origin, so it stays
-      # until no supported lerd frames this cross-origin.
-      SESSION_COOKIE_SAMESITE = 'None'
-      SESSION_COOKIE_SECURE = True
+- target: /pgadmin4/servers.json
+  generator: pgadmin_servers
+- target: /pgpass
+  mode: '0600'
+  chown: true
+  generator: pgadmin_pgpass
+- target: /pgadmin4/config_local.py
+  content: 'X_FRAME_OPTIONS = ''''
+
+    ENHANCED_COOKIE_PROTECTION = False
+
+    WTF_CSRF_CHECK_DEFAULT = False
+
+
+    # A lerd that does not know dashboard_proxy still frames this from its own
+
+    # origin, where the Flask session and CSRF cookies need SameSite=None to
+
+    # be sent at all. That needs Secure=True, which browsers accept over HTTP
+
+    # on localhost. Inert once the dashboard is served same-origin, so it stays
+
+    # until no supported lerd frames this cross-origin.
+
+    SESSION_COOKIE_SAMESITE = ''None''
+
+    SESSION_COOKIE_SECURE = True
+
+    '
 category: admin
 icon: elephant
 admin_for:
-  - postgres
-  - postgres-pgvector
-  - postgres-timescaledb
+- postgres
+- postgres-pgvector
+- postgres-timescaledb
diff --git a/services/redisinsight.yaml b/services/redisinsight.yaml
index 9caa288..2fb60ba 100644
--- a/services/redisinsight.yaml
+++ b/services/redisinsight.yaml
@@ -2,34 +2,22 @@ name: redisinsight
 image: docker.io/redis/redisinsight:latest
 description: RedisInsight web UI for every installed lerd Redis and Valkey service
 ports:
-  - "8085:5540"
+- 8085:5540
 environment:
-  RI_APP_PORT: "5540"
-  # Single-connection fallback for binaries that predate expand_env; a binary
-  # that resolves expand_env replaces these with one numbered set per member.
+  RI_APP_PORT: '5540'
   RI_REDIS_HOST: lerd-redis
-  RI_REDIS_PORT: "6379"
+  RI_REDIS_PORT: '6379'
   RI_REDIS_ALIAS: lerd-redis
 expand_env:
   RI_REDIS_HOST: redis,valkey={host}
   RI_REDIS_PORT: redis,valkey=6379
   RI_REDIS_ALIAS: redis,valkey={name}
 depends_on:
-  - redis
+- redis
 dashboard: http://localhost:8085
-# RedisInsight sets first-run consent cookies the iframe can't carry across
-# origins, so lerd-ui proxies it same-origin (see dashboard_external handling).
 dashboard_external: true
-# RedisInsight ships its theme set to SYSTEM, which means it asks the browser
-# which scheme it is in rather than reading a media query, so lerd answers
-# with its own mode and the dark design it already has comes up.
-dashboard_follows_color_scheme: true
-# It remembers a side once its own switcher is used, under a key it namespaces by
-# where it is served, so lerd forgets that on the way in and the overlay's theme
-# wins. Its switcher still works for as long as the view is open.
-dashboard_scheme_key: "{{mount}}_theme"
 category: admin
 icon: database
 admin_for:
-  - redis
-  - valkey
+- redis
+- valkey