backend/src/main/java/org/raddatz/familienarchiv/FamilienarchivApplication.java

@@ -1,9 +1,11 @@
 package org.raddatz.familienarchiv;
 
 import org.springframework.boot.SpringApplication;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
-@SpringBootApplication
+// Excluded: management port (8081) is network-isolated inside archiv-net; no app-level auth needed.
+@SpringBootApplication(exclude = {ManagementWebSecurityAutoConfiguration.class})
 public class FamilienarchivApplication {
 
 	public static void main(String[] args) {

infra/observability/prometheus/prometheus.yml

@@ -15,8 +15,6 @@ scrape_configs:
     metrics_path: /actuator/prometheus
     static_configs:
       # Uses the Docker service name (not container_name) for reliable DNS resolution.
-      # Target will show as DOWN until backend instrumentation issue adds
-      # micrometer-registry-prometheus and exposes the endpoint — this is expected.
       - targets: ['backend:8081']
 
   - job_name: ocr-service

infra/observability/promtail/promtail-config.yml

@@ -28,3 +28,5 @@ scrape_configs:
         target_label: 'compose_project'
       - source_labels: ['__meta_docker_container_log_stream']
         target_label: 'logstream'
+      - source_labels: ['__meta_docker_container_label_com_docker_compose_service']
+        target_label: 'job'