diff --git a/firefoxsync/docker-compose.yaml b/firefoxsync/docker-compose.yaml
index 83e6f07..7fb5c27 100644
--- a/firefoxsync/docker-compose.yaml
+++ b/firefoxsync/docker-compose.yaml
@@ -40,6 +40,10 @@ services:
     volumes:
       - ${VOLUMES_PATH}/firefoxsync/db:/var/lib/postgresql/data
     user: ${UID}:${GID}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
     labels:
       - "docker.group=firefoxsync"
 
diff --git a/git/docker-compose.yaml b/git/docker-compose.yaml
index 1c24a2c..a969f8e 100644
--- a/git/docker-compose.yaml
+++ b/git/docker-compose.yaml
@@ -11,18 +11,6 @@ services:
     networks:
       - web
       - git
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.forgejo.rule=Host(`gitea.${DOMAIN}`, `git.${DOMAIN}`)"
-      - "traefik.http.routers.forgejo.entrypoints=websecure"
-      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
-      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
-      - "traefik.http.routers.forgejo.middlewares=gitearedir"
-      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://gitea.${DOMAIN}/(.*)"
-      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://git.${DOMAIN}/$${1}"
-      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
-      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
-      - "docker.group=git"
     depends_on:
       - db
     restart: unless-stopped
@@ -35,6 +23,22 @@ services:
       - DB_NAME=${POSTGRES_DB}
       - DB_USER=${POSTGRES_USER}
       - DB_PASSWD=${POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost:3000/api/healthz"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.forgejo.rule=Host(`gitea.${DOMAIN}`, `git.${DOMAIN}`)"
+      - "traefik.http.routers.forgejo.entrypoints=websecure"
+      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
+      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
+      - "traefik.http.routers.forgejo.middlewares=gitearedir"
+      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://gitea.${DOMAIN}/(.*)"
+      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://git.${DOMAIN}/$${1}"
+      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
+      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
+      - "docker.group=git"
 
 
   db:
@@ -48,6 +52,10 @@ services:
       - git
     volumes:
       - ${VOLUMES_PATH}/git/forgejo_db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
     labels:
       - "docker.group=git"
 
diff --git a/monitoring/docker-compose.yaml b/monitoring/docker-compose.yaml
index 0ec41ff..c0c45c5 100644
--- a/monitoring/docker-compose.yaml
+++ b/monitoring/docker-compose.yaml
@@ -47,6 +47,10 @@ services:
       - POSTGRES_DB=grafana
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
     labels:
       - "docker.group=monitoring"
 
diff --git a/nextcloud/docker-compose.yaml b/nextcloud/docker-compose.yaml
index cf0daff..95c8f20 100644
--- a/nextcloud/docker-compose.yaml
+++ b/nextcloud/docker-compose.yaml
@@ -11,6 +11,10 @@ services:
     networks:
       - web
       - nextcloud
+    healthcheck:
+      test: curl -sSf 'http://localhost/status.php' | grep '"installed":true' | grep '"maintenance":false' | grep '"needsDbUpgrade":false' || exit 1
+      interval: 5s
+      timeout: 3s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.nextcloud.rule=Host(`cloud.${DOMAIN}`)"
@@ -123,6 +127,7 @@ services:
       - MYSQL_PASSWORD=${MYSQL_PASSWORD}
       - MYSQL_DATABASE=${MYSQL_DATABASE}
       - MYSQL_USER=${MYSQL_USER}
+      - MARIADB_AUTO_UPGRADE=1
     logging:
       driver: "json-file"
       options:
@@ -131,6 +136,10 @@ services:
     networks:
       - nextcloud
       - mariadb
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      interval: 20s
+      timeout: 3s
     labels: 
       - "docker.group=netxtcloud"
 
@@ -166,6 +175,10 @@ services:
       - monitoring
     volumes:
       - ${VOLUMES_PATH}/nextcloud/redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
     labels: 
       - "docker.group=netxtcloud"
 
diff --git a/nextcloud/nginx.conf b/nextcloud/nginx.conf
index 6ffd511..59f3d77 100644
--- a/nextcloud/nginx.conf
+++ b/nextcloud/nginx.conf
@@ -22,6 +22,9 @@ http {
     sendfile        on;
     #tcp_nopush     on;
 
+    # Prevent nginx HTTP Server Detection
+    server_tokens   off;
+
     keepalive_timeout  65;
 
     #gzip  on;
@@ -48,7 +51,7 @@ http {
         add_header X-Download-Options "noopen" always;
         add_header X-Frame-Options "SAMEORIGIN" always;
         add_header X-Permitted-Cross-Domain-Policies "none" always;
-        add_header X-Robots-Tag "none" always;
+        add_header X-Robots-Tag "noindex, nofollow" always;
         add_header X-XSS-Protection "1; mode=block" always;
 
         # Remove X-Powered-By, which is an information leak
diff --git a/proxy/docker-compose.yaml b/proxy/docker-compose.yaml
index b0ea9d2..4fe6cd3 100755
--- a/proxy/docker-compose.yaml
+++ b/proxy/docker-compose.yaml
@@ -18,6 +18,7 @@ services:
       #- "--log.level=DEBUG"
       - "--log.level=INFO"
       #- "--accesslog=true"
+      - "--ping=true"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
       - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
@@ -42,6 +43,10 @@ services:
     volumes:
       - ${VOLUMES_PATH}/proxy/letsencrypt:/letsencrypt
       - $PWD/tls.toml:/etc/traefik/tls.toml
+    healthcheck:
+      test: traefik healthcheck --ping
+      interval: 3s
+      timeout: 1s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAIN}`)"
@@ -63,14 +68,18 @@ services:
     environment:
       # grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections
       - CONTAINERS=1
-      - INFO=1      
+      - INFO=1
     networks:
       - dockersocket
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"]
+      interval: 10s
+      timeout: 3s
     privileged: true
 
 
   whoami:
-    image: containous/whoami
+    image: traefik/whoami
     networks:
       - web
     labels:
diff --git a/wallabag/docker-compose.yaml b/wallabag/docker-compose.yaml
index 693087d..6433ff3 100644
--- a/wallabag/docker-compose.yaml
+++ b/wallabag/docker-compose.yaml
@@ -21,6 +21,10 @@ services:
       - wallabag
     volumes:
       - /var/dockervolumes/wallabag/images:/var/www/wallabag/web/assets/images
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost"]
+      interval: 10s
+      timeout: 3s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.wallabag.rule=Host(`wallabag.${DOMAIN}`)"
@@ -41,14 +45,24 @@ services:
       - wallabag
     volumes:
       - /var/dockervolumes/wallabag/db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      interval: 10s
+      timeout: 3s
     labels:
       - "docker.group=wallabag"
   
   redis:
-    image: redis:alpine
+    image: redis
     restart: unless-stopped
     networks:
       - wallabag
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "docker.group=wallabag"
 
 
 networks:
diff --git a/www/docker-compose.yaml b/www/docker-compose.yaml
index 8372974..c6a475b 100644
--- a/www/docker-compose.yaml
+++ b/www/docker-compose.yaml
@@ -7,6 +7,10 @@ services:
     networks:
       - web
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost"]
+      interval: 5s
+      timeout: 3s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS