diff --git a/docker-compose.yml b/docker-compose.yml
index 832095b..b17d13e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,9 +5,8 @@ services:
     image: "traefik"
     restart: unless-stopped
     network_mode: host
-    depends_on:
-      - radarr
-      - sonarr
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     command:
 #      - "--log.level=DEBUG"
       - "--api.insecure=true"
@@ -29,10 +28,6 @@ services:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "/srv/docker/container/traefik/:/configuration"
       - "/srv/docker/container/letsencrypt/etc:/letsencrypt"
-    labels:
-      - "traefik.http.routers.myth.rule=PathPrefix(`/mythweb/`)"
-      - "traefik.http.services.myth.loadbalancer.server.port=5678"
-      - "traefik.http.routers.myth.entrypoints=web"
 
   sonarr:
     container_name: sonarr
@@ -43,6 +38,7 @@ services:
       - PUID=500
       - PGID=500
     labels:
+      - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
       - "traefik.http.routers.sonarr.rule=Host(`sonarr.depaoli.id.au`)"
       - "traefik.http.routers.sonarr.tls=true"
@@ -61,6 +57,7 @@ services:
       - PUID=500
       - PGID=500
     labels:
+      - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
       - "traefik.http.routers.radarr.rule=Host(`radarr.depaoli.id.au`)"
       - "traefik.http.routers.radarr.tls=true"
@@ -91,7 +88,8 @@ services:
       - "8920:8920"
       - "7359:7359/udp" 
       - "1900:1900/udp"  
-#    labels:
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
 #      - "traefik.enable=true"
 #      - "traefik.http.routers.emby.rule=Host(`emby.depaoli.id.au`)"
 #      - "traefik.http.services.emby.loadbalancer.server.port=8096"
@@ -109,6 +107,8 @@ services:
       - "25:25"
       - "465:465"
       - "993:993"
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     volumes:
       - /srv/docker/container/mail/data:/var/mail
       - /srv/docker/container/mail/state:/var/mail-state
@@ -152,6 +152,8 @@ services:
     image: osixia/openldap:latest
     container_name: openldap
 #    command: "--loglevel debug"
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     environment:
       LDAP_LOG_LEVEL: "256"
       LDAP_ORGANISATION: "Depaoli home ldap"
@@ -193,6 +195,8 @@ services:
     environment:
       PHPLDAPADMIN_LDAP_HOSTS: "openldap"
       PHPLDAPADMIN_HTTPS: "false"
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     ports:
       - "38900:80"
     depends_on:
@@ -203,8 +207,9 @@ services:
     image: marcnuri/isotope:server-latest
     container_name: isotope-server
     labels:
+      - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
-      - "traefik.http.routers.isotope-server.rule=PathPrefix(`/api/`)"
+      - "traefik.http.routers.isotope-server.rule=Host(`webmail.depaoli.id.au`) && PathPrefix(`/api/`)"
       - "traefik.http.middlewares.stripprefix-isotope-server.stripprefix.prefixes=/api"
       - "traefik.http.routers.isotope-server.middlewares=stripprefix-isotope-server@docker"
       - "traefik.http.routers.isotope-server.entrypoints=secureweb"
@@ -215,9 +220,9 @@ services:
     image: marcnuri/isotope:client-latest
     container_name: isotope-client
     labels:
+      - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
-      - "traefik.http.routers.isotope-client.rule=Host(`webmail.depaoli.id.au`)"
-      - "traefik.http.routers.isotope-client.rule=PathPrefix(`/`)"
+      - "traefik.http.routers.isotope-client.rule=Host(`webmail.depaoli.id.au`) && PathPrefix(`/`)"
       - "traefik.http.routers.isotope-client.entrypoints=secureweb"
       - "traefik.http.routers.isotope-client.tls=true"
 
@@ -229,6 +234,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - /srv/docker/container/portainer/data:/data
     labels:
+      - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
       - "traefik.http.routers.portainer.rule=PathPrefix(`/portainer/`)"
       - "traefik.http.middlewares.stripprefix-portainer.stripprefix.prefixes=/portainer"
@@ -245,6 +251,8 @@ services:
       - PLEX_UID=500
       - PLEX_GID=500
     hostname: plex_dp
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     volumes:
       - /myth/opt/plex/config:/config
       - /myth/opt/plex/transcode:/transcode
@@ -266,15 +274,20 @@ services:
     image: containrrr/watchtower
     container_name: watchtower
     # should use --cleanup as well...
-    command: --schedule "0 0 3 * * *" --debug --stop-timeout 60s
+    command: --schedule "0 0 3 * * *" --debug --stop-timeout 60s --label-enable --cleanup
     restart: always
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
 
   hassio:
     image: homeassistant/amd64-hassio-supervisor
     container_name: hassio_supervisor
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
     privileged: true
+    restart: always
     entrypoint: ["/bin/bash", "-c", "/scripts/start_hassio.sh"]
     security_opt:
       - seccomp:unconfined
@@ -288,13 +301,6 @@ services:
       - /srv/docker/container/hassio/scripts:/scripts
       - /var/run/docker.sock:/var/run/docker.sock
       - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket
-#    labels:
-#      - "traefik.enable=true"
-#      - "traefik.http.routers.hass.rule=PathPrefix(`/hass/`)"
-#      - "traefik.http.middlewares.stripprefix-hass.stripprefix.prefixes=/hass"
-#      - "traefik.http.routers.hass.middlewares=stripprefix-hass@docker"
-#      - "traefik.http.services.hass.loadbalancer.server.port=8123"
-#      - "traefik.http.routers.hass.entrypoints=web"
 
   sabnzbd:
     image: linuxserver/sabnzbd
@@ -309,6 +315,7 @@ services:
       - /export/docker/storage/downloads:/downloads
       - /export/docker/storage/incomplete-downloads:/incomplete-downloads
     labels:
+      - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
       - "traefik.http.routers.sabnzbd.rule=PathPrefix(`/sabnzbd/`)"
       - "traefik.http.routers.sabnzbd.entrypoints=web"
@@ -317,6 +324,8 @@ services:
   speedtest-exporter:
     image: jraviles/prometheus_speedtest:latest
     container_name: speedtest-exporter
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     restart: unless-stopped
 
   prometheus:
@@ -325,6 +334,8 @@ services:
     volumes:
       - /srv/docker/container/prometheus/:/etc/prometheus/
       - /srv/docker/container/prometheus/data:/prometheus
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     command:
       - '--config.file=/etc/prometheus/prometheus.yml'
       - '--storage.tsdb.path=/prometheus'
@@ -347,6 +358,8 @@ services:
       - /sys:/host/sys:ro
       - /:/rootfs:ro
       - /srv/docker/container/node-exporter/textfile_collector:/var/lib/node_exporter/textfile_collector
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     command:
       - '--path.procfs=/host/proc'
       - '--path.sysfs=/host/sys'
@@ -361,6 +374,8 @@ services:
 #    container_name: alertmanager
 #    ports:
 #      - 19093:9093
+#    labels:
+#      - "com.centurylinklabs.watchtower.enable=true"
 #    volumes:
 #      - /srv/docker/container/alertmanager/:/etc/alertmanager/
 #    restart: always
@@ -374,6 +389,8 @@ services:
     privileged: true
     command:
       - '--disable_metrics=udp'
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     volumes:
       - /:/rootfs:ro
       - /var/run:/var/run:rw
@@ -383,10 +400,13 @@ services:
 
   blackbox_exporter:
     image: prom/blackbox-exporter
+    container_name: blackbox-exporter
 #    ports:
 #      - 9115:9115
     command:
       - '--config.file=/etc/blackboxexporter/config.yml'
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     volumes:
       - /srv/docker/container/blackboxexporter/:/etc/blackboxexporter/
     restart: always
@@ -404,6 +424,31 @@ services:
     env_file:
       - /srv/docker/container/grafana/config.monitoring
     labels:
+      - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
       - "traefik.http.routers.grafana.rule=PathPrefix(`/grafana/`)"
       - "traefik.http.routers.grafana.entrypoints=web"
+
+  pihole:
+    container_name: pihole
+    image: pihole/pihole:latest
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+    environment:
+      TZ: 'Australia/Melbourne'
+      WEBPASSWORD: 'O701JH&%fDqIw836eTiw1LxzlGw!sn%c'
+      DNS1: '127.0.0.1'
+      DNS2: '1.1.1.1'
+    volumes:
+      - '/srv/docker/container/pihole/etc/:/etc/pihole/'
+      - '/srv/docker/container/pihole/dnsmasq.d/:/etc/dnsmasq.d/'
+    restart: unless-stopped
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+      - "traefik.enable=true"
+      - "traefik.http.routers.pihole.rule=PathPrefix(`/pihole/`)"
+      - "traefik.http.routers.pihole.entrypoints=web"
+      - "traefik.http.middlewares.stripprefix-pihole.stripprefix.prefixes=/pihole"
+      - "traefik.http.services.pihole.loadbalancer.server.port=80"
+      - "traefik.http.routers.pihole.middlewares=stripprefix-pihole@docker"