The catch with putting NextDNS’s IPv4 addresses into Proton’s custom DNS is identification. Plain DNS to NextDNS only reaches your configuration through the linked IP, and behind the VPN that is Proton’s exit IP, which is shared and changes with every server. So the filtering and logs won’t reliably be yours. Custom DNS in Proton also only works with NetShield turned off.

What works better on Windows is encrypted DNS that carries your config ID itself: the NextDNS app, or the DoH address from your NextDNS setup page (it ends in your config ID) entered in the browser. That traffic just goes through the tunnel like any other HTTPS, so the VPN and NextDNS don’t fight over it. Worth checking with a leak test afterwards that queries actually show up in your NextDNS log.

Here’s the shape, if it saves you the fiddling. Put it in the compose file rather than a cron:

healthcheck:
  test: ["CMD-SHELL", "wget -qO- http://localhost:3000/api/v1/trending >/dev/null || exit 1"]
  interval: 5m
  timeout: 10s
  retries: 3
restart: unless-stopped

Port and path to match your setup, and use wget rather than curl unless you know the image ships curl, since a healthcheck that fails because the binary is missing looks exactly like a service that is down.

One catch: Docker marks a container unhealthy but won’t restart it for you. Either pair it with something like autoheal, which watches for that state, or keep your cron and have it check first and restart only on failure.

Either way you get the thing the blind hourly restart can’t give you: a log of how often it actually fired. Never, and you didn’t need the restarts. Constantly, and there’s a real bug worth chasing rather than a schedule papering over it.

That line predates invidious-companion. When the player and signature handling still lived in the main process, a periodic kick was the honest workaround, and the docs never really caught up after companion split it out.

What I’d push back on is the blind hourly restart, because it hides exactly the failure you just had. A companion image sitting a version behind shows up as things half-working, and a scheduled restart makes that go away for an hour at a time, so you never trace it. If you’re going to script something, script a check instead: hit an endpoint that actually plays a video, restart only when that fails, and log it when it does. Then a restart tells you something happened.

Small thing that would have caught your case: docker compose pull with no service name pulls all three, and docker compose images prints the digests you’re actually running.

Before you redo the rest by hand, check whether the broken ones share a format. Black frames that render fine on the phones but not in a desktop browser usually mean the original file is intact and it was the server-side preview that failed to generate, with the phones quietly decoding the original themselves. HEIC and HEVC and 10-bit HDR are the usual suspects, since those lean on libheif and ffmpeg on the server and older builds choke on them.

If that’s the cause, re-uploading only “works” because it reruns preview generation, so you’re really just triggering a fresh encode. Grep the museum logs around one of the bad files for a decode error, and see whether a rescan or clearing the thumbnail cache regenerates them in place. That would save you doing the whole library one file at a time.

The bland logs are themselves a data point. If the journal just stops mid-line with nothing unusual before it, that points at a hard hang or a power cut rather than something userspace did, because a kernel oops normally leaves a trace behind. There’s also a catch-22 in the SD theory: a card that’s failing can’t reliably write the log that would prove it’s failing.

Two things worth doing before the card swap, both cheap. Check vcgencmd get_throttled: bit 16 stays set if undervoltage happened at any point since boot, so you get an answer on power-versus-card without having to catch the crash live. And switch on the hardware watchdog, bcm2835_wdt plus RuntimeWatchdogSec in systemd, so the Pi resets itself instead of waiting for someone to pull the plug. That doesn’t fix the cause, but it stops every crash from becoming an outage that lasts until you’re back home.