diff --git a/docker-compose.yml b/docker-compose.yml
index 5d9f2ae..aa418e0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -145,7 +145,7 @@ services:
   emby:
     container_name: emby
 #    image:  emby/embyserver:latest
-    image: emby/embyserver:4.9.0.37
+    image: emby/embyserver:4.9.0.41
     restart: always
     network_mode: host
     environment:
@@ -177,7 +177,9 @@ services:
 
   # fail2ban might need a better whitelist? (I had internal docker ips in my quick fudge as well?)
   mail:
-    image: docker.io/mailserver/docker-mailserver:14.0.0
+#    image: docker.io/mailserver/docker-mailserver:14.0.0
+    image: docker.io/mailserver/docker-mailserver:15.0.0
+    hostname: depaoli.id.au
     domainname: depaoli.id.au
     container_name: mail
     restart: always
@@ -755,6 +757,26 @@ services:
       - "traefik.http.routers.pa.entrypoints=secureweb"
       - "traefik.http.routers.pa.tls.certresolver=myresolver"
 
+  finplan:
+    container_name: finplan
+    restart: always
+    environment:
+      ENV: "production"
+    # force using uid/gid of 1000/1000 so we can share dev/prod for now - may care enough 1 day to fix
+    build: 
+      context: '/home/ddp/src/finplan'
+      args:
+        USERID: "1000"
+        GROUPID: "1000"
+    user: "1000:1000"
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+      - "traefik.enable=true"
+      - "traefik.http.routers.finplan.rule=Host(`finplan.ddp.net`)"
+      - "traefik.http.routers.finplan.entrypoints=web"
+
   tix:
     container_name: tix
     restart: always
@@ -970,6 +992,40 @@ services:
       - /srv/docker/container/mythtv/db/mythtv.cnf:/etc/mysql/mariadb.conf.d/mythtv.cnf
       - /etc/localtime:/etc/localtime:ro
 
+  mythweb:
+    container_name: mythweb
+    image: ubuntu:latest
+    hostname: mythweb
+    restart: always
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    entrypoint: /root/mara-init/entrypoint-wrapper.sh
+    environment:
+      APACHE_LOG_DIR: /var/log/apache2
+      DBNAME: mythconverg
+      DBSERVER: mythdb
+      LANG: en_US.UTF-8
+      LANGUAGE: en_US.UTF-8
+      TZ: Australia/Melbourne
+    volumes:
+      - /srv/docker/container/mythtv/apache2:/var/log/apache2
+      - /srv/docker/container/mythtv/data:/var/mythdata
+      - /srv/docker/container/mythtv/home:/home/mythtv
+      - /srv/docker/container/mythtv/ssh-config:/etc/ssh
+      - /srv/docker/container/mythtv/var/log:/var/log/mythtv
+      - /srv/docker/container/mythtv/mythweb/mara-init:/root/mara-init
+      - /srv/docker/container/mythtv/mythweb/mara-bin:/root/mara-bin
+      - /srv/docker/container/mythtv/monitoring-results:/monitoring-results
+#      - /etc/localtime:/etc/localtime:ro
+      - /export/myth:/export/myth
+    ports:
+      - "0.0.0.0:16543:80"
+    env_file:
+      - /srv/docker/config/secrets/mythtv
+    depends_on:
+      - mythdb
+
+
   # hacked entrypoint to 'add' to this container so it works as mara needs
   myth:
     container_name: myth
@@ -1080,7 +1136,8 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
       - "traefik.enable=true"
-      - "traefik.http.routers.web.rule=Host(`myth.ddp.net`) && ( Path(`/`) || PathPrefix(`/images` ) || PathPrefix(`/mythweb`) )"
+      #- "traefik.http.routers.web.rule=Host(`myth.ddp.net`) && ( Path(`/`) || PathPrefix(`/images` ) || PathPrefix(`/mythweb`) )"
+      - "traefik.http.routers.web.rule=Host(`myth.ddp.net`)"
       - "traefik.http.routers.web.entrypoints=web"
       - "last.commit.url=https://api.github.com/repos/docker-library/php/commits"