diff --git a/blueprints/plane/docker-compose.yml b/blueprints/plane/docker-compose.yml
index a79f83d6..740ebf29 100644
--- a/blueprints/plane/docker-compose.yml
+++ b/blueprints/plane/docker-compose.yml
@@ -1,150 +1,273 @@
 version: "3.8"
 
+# DNS collision avoidance for multi-stack Dokploy:
+# Internal services renamed with `plane-*` prefix (unique cluster-wide) and
+# `links:` on the `proxy` service creates /etc/hosts entries (`<plane-web-IP>
+# web`, etc.) — /etc/hosts takes absolute priority over DNS, so the Caddy
+# inside plane-proxy (which has `reverse_proxy web:3000`/`api:8000`
+# hardcoded) resolves straight to our containers, ignoring any `web`/`api`
+# containers from other stacks on the shared Dokploy network.
+
+x-db-env: &db-env
+  PGHOST: ${PGHOST:-plane-db}
+  PGDATABASE: ${PGDATABASE:-plane}
+  POSTGRES_USER: ${POSTGRES_USER:-plane}
+  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-plane}
+  POSTGRES_DB: ${POSTGRES_DB:-plane}
+  POSTGRES_PORT: ${POSTGRES_PORT:-5432}
+  PGDATA: ${PGDATA:-/var/lib/postgresql/data}
+
+x-redis-env: &redis-env
+  REDIS_HOST: ${REDIS_HOST:-plane-redis}
+  REDIS_PORT: ${REDIS_PORT:-6379}
+  REDIS_URL: ${REDIS_URL:-redis://plane-redis:6379/}
+
+x-minio-env: &minio-env
+  MINIO_ROOT_USER: ${AWS_ACCESS_KEY_ID:-access-key}
+  MINIO_ROOT_PASSWORD: ${AWS_SECRET_ACCESS_KEY:-secret-key}
+
+x-aws-s3-env: &aws-s3-env
+  AWS_REGION: ${AWS_REGION:-}
+  AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-access-key}
+  AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-secret-key}
+  AWS_S3_ENDPOINT_URL: ${AWS_S3_ENDPOINT_URL:-http://plane-minio:9000}
+  AWS_S3_BUCKET_NAME: ${AWS_S3_BUCKET_NAME:-uploads}
+
+x-proxy-env: &proxy-env
+  APP_DOMAIN: ${APP_DOMAIN:-localhost}
+  FILE_SIZE_LIMIT: ${FILE_SIZE_LIMIT:-5242880}
+  BUCKET_NAME: ${AWS_S3_BUCKET_NAME:-uploads}
+  # Caddy proxy: listen address (no upstream default in Caddyfile -> must be set,
+  # else the `{$SITE_ADDRESS} { ... }` block is keyless and Caddy aborts).
+  SITE_ADDRESS: ${SITE_ADDRESS:-:80}
+  # trusted_proxies decides which peers may set X-Forwarded-For/X-Real-IP. Dokploy's
+  # Traefik upstream always lives on Dokploy's private network, so trust only private
+  # ranges (Caddy built-in) instead of 0.0.0.0/0 to prevent client-IP spoofing if the
+  # proxy is ever exposed directly. Override with your real upstream CIDR if needed.
+  TRUSTED_PROXIES: ${TRUSTED_PROXIES:-private_ranges}
+
+x-mq-env: &mq-env
+  RABBITMQ_HOST: ${RABBITMQ_HOST:-plane-mq}
+  RABBITMQ_PORT: ${RABBITMQ_PORT:-5672}
+  RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-plane}
+  RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-plane}
+  RABBITMQ_DEFAULT_VHOST: ${RABBITMQ_VHOST:-plane}
+  RABBITMQ_VHOST: ${RABBITMQ_VHOST:-plane}
+
+x-live-env: &live-env
+  API_BASE_URL: ${API_BASE_URL:-http://plane-api:8000}
+  LIVE_SERVER_SECRET_KEY: ${LIVE_SERVER_SECRET_KEY:-dev-only-change-me}
+
+x-app-env: &app-env
+  WEB_URL: ${WEB_URL:-http://localhost}
+  DEBUG: ${DEBUG:-0}
+  CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost}
+  GUNICORN_WORKERS: ${GUNICORN_WORKERS:-1}
+  USE_MINIO: ${USE_MINIO:-1}
+  DATABASE_URL: ${DATABASE_URL:-postgresql://plane:plane@plane-db/plane}
+  SECRET_KEY: ${SECRET_KEY:-dev-only-change-me}
+  AMQP_URL: ${AMQP_URL:-amqp://plane:plane@plane-mq:5672/plane}
+  API_KEY_RATE_LIMIT: ${API_KEY_RATE_LIMIT:-60/minute}
+  MINIO_ENDPOINT_SSL: ${MINIO_ENDPOINT_SSL:-0}
+  LIVE_SERVER_SECRET_KEY: ${LIVE_SERVER_SECRET_KEY:-dev-only-change-me}
+  WEBHOOK_ALLOWED_IPS: ${WEBHOOK_ALLOWED_IPS:-}
+  WEBHOOK_ALLOWED_HOSTS: ${WEBHOOK_ALLOWED_HOSTS:-}
+
 services:
-  web:
-    image: makeplane/plane-frontend:${APP_RELEASE:-v1.2.3}
-    restart: always
+  plane-web:
+    image: makeplane/plane-frontend:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
     depends_on:
-      - api
-      - worker
-    env_file:
-      - .env
+      plane-api:
+        condition: service_started
+      plane-worker:
+        condition: service_started
 
-  space:
-    image: makeplane/plane-space:${APP_RELEASE:-v1.2.3}
-    restart: always
+  plane-space:
+    image: makeplane/plane-space:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
     depends_on:
-      - api
-      - worker
-      - web
-    env_file:
-      - .env
+      plane-api:
+        condition: service_started
+      plane-worker:
+        condition: service_started
+      plane-web:
+        condition: service_started
 
-  admin:
-    image: makeplane/plane-admin:${APP_RELEASE:-v1.2.3}
-    restart: always
+  plane-admin:
+    image: makeplane/plane-admin:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
     depends_on:
-      - api
-      - web
-    env_file:
-      - .env
+      plane-api:
+        condition: service_started
+      plane-web:
+        condition: service_started
 
-  live:
-    image: makeplane/plane-live:${APP_RELEASE:-v1.2.3}
-    restart: always
+  plane-live:
+    image: makeplane/plane-live:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
+    environment:
+      <<: [*live-env, *redis-env]
     depends_on:
-      - api
-      - web
-    env_file:
-      - .env
+      plane-api:
+        condition: service_started
+      plane-web:
+        condition: service_started
 
-  api:
-    image: makeplane/plane-backend:${APP_RELEASE:-v1.2.3}
-    restart: always
+  plane-api:
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
     command: ./bin/docker-entrypoint-api.sh
     volumes:
       - logs_api:/code/plane/logs
+    environment:
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
-      - plane-db
-      - plane-redis
-      - plane-mq
-    env_file:
-      - .env
+      plane-db:
+        condition: service_healthy
+      plane-redis:
+        condition: service_healthy
+      plane-mq:
+        condition: service_healthy
+      plane-migrator:
+        condition: service_completed_successfully
 
-  worker:
-    image: makeplane/plane-backend:${APP_RELEASE:-v1.2.3}
-    restart: always
+  plane-worker:
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
     command: ./bin/docker-entrypoint-worker.sh
     volumes:
       - logs_worker:/code/plane/logs
+    environment:
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
-      - api
-      - plane-db
-      - plane-redis
-      - plane-mq
-    env_file:
-      - .env
+      plane-db:
+        condition: service_healthy
+      plane-redis:
+        condition: service_healthy
+      plane-mq:
+        condition: service_healthy
+      plane-migrator:
+        condition: service_completed_successfully
 
-  beat-worker:
-    image: makeplane/plane-backend:${APP_RELEASE:-v1.2.3}
-    restart: always
+  plane-beat-worker:
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
     command: ./bin/docker-entrypoint-beat.sh
     volumes:
       - logs_beat-worker:/code/plane/logs
+    environment:
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
-      - api
-      - plane-db
-      - plane-redis
-      - plane-mq
-    env_file:
-      - .env
+      plane-db:
+        condition: service_healthy
+      plane-redis:
+        condition: service_healthy
+      plane-mq:
+        condition: service_healthy
+      plane-migrator:
+        condition: service_completed_successfully
 
-  migrator:
-    image: makeplane/plane-backend:${APP_RELEASE:-v1.2.3}
+  plane-migrator:
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.1}
     restart: on-failure
     command: ./bin/docker-entrypoint-migrator.sh
     volumes:
       - logs_migrator:/code/plane/logs
+    environment:
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
-      - plane-db
-      - plane-redis
-    env_file:
-      - .env
+      plane-db:
+        condition: service_healthy
+      plane-redis:
+        condition: service_healthy
 
   plane-db:
-    image: postgres:15.7-alpine
-    restart: always
+    image: postgres:17-alpine
+    restart: unless-stopped
     command: postgres -c 'max_connections=1000'
+    environment:
+      <<: *db-env
     volumes:
       - pgdata:/var/lib/postgresql/data
-    env_file:
-      - .env
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-plane} -d ${POSTGRES_DB:-plane}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
 
   plane-redis:
     image: valkey/valkey:7.2.11-alpine
-    restart: always
+    restart: unless-stopped
     volumes:
       - redisdata:/data
+    healthcheck:
+      test: ["CMD-SHELL", "valkey-cli ping | grep -q PONG"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
 
   plane-mq:
     image: rabbitmq:3.13.6-management-alpine
-    restart: always
+    restart: unless-stopped
+    environment:
+      <<: *mq-env
     volumes:
       - rabbitmq_data:/var/lib/rabbitmq
-    env_file:
-      - .env
+    healthcheck:
+      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
+      interval: 10s
+      timeout: 10s
+      retries: 10
+      start_period: 30s
 
-  plane-storage:
-    image: rustfs/rustfs:1.0.0-alpha.90
-    restart: always
+  plane-minio:
+    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
+    restart: unless-stopped
+    command: server /export --console-address ":9090"
+    environment:
+      <<: *minio-env
     volumes:
-      - uploads:/data
-    env_file:
-      - .env
+      - uploads:/export
 
   proxy:
-    image: makeplane/plane-proxy:${APP_RELEASE:-v1.2.3}
-    restart: always
-    depends_on:
-      - web
-      - api
-      - space
-      - admin
-      - live
+    image: makeplane/plane-proxy:${APP_RELEASE:-v1.3.1}
+    restart: unless-stopped
+    expose:
+      - "80"
+    environment:
+      <<: *proxy-env
     volumes:
       - proxy_config:/config
       - proxy_data:/data
-    env_file:
-      - .env
+    links:
+      - "plane-web:web"
+      - "plane-api:api"
+      - "plane-space:space"
+      - "plane-admin:admin"
+      - "plane-live:live"
+    depends_on:
+      plane-web:
+        condition: service_started
+      plane-api:
+        condition: service_started
+      plane-space:
+        condition: service_started
+      plane-admin:
+        condition: service_started
+      plane-live:
+        condition: service_started
 
 volumes:
   pgdata:
   redisdata:
   uploads:
+  rabbitmq_data:
   logs_api:
   logs_worker:
   logs_beat-worker:
   logs_migrator:
-  rabbitmq_data:
   proxy_config:
   proxy_data:
diff --git a/blueprints/plane/meta.json b/blueprints/plane/meta.json
index 30c73ef3..f7d90ea9 100644
--- a/blueprints/plane/meta.json
+++ b/blueprints/plane/meta.json
@@ -1,7 +1,7 @@
 {
   "id": "plane",
   "name": "Plane",
-  "version": "v1.2.3",
+  "version": "v1.3.1",
   "description": "Open source project management — alternative to Jira, Linear, Asana",
   "logo": "plane.png",
   "links": {
diff --git a/blueprints/plane/plane.png b/blueprints/plane/plane.png
index 3c6a00b4..2c76d49c 100644
Binary files a/blueprints/plane/plane.png and b/blueprints/plane/plane.png differ
diff --git a/blueprints/plane/template.toml b/blueprints/plane/template.toml
index 93607582..6dba2ccf 100644
--- a/blueprints/plane/template.toml
+++ b/blueprints/plane/template.toml
@@ -1,60 +1,110 @@
 [variables]
+app_release = "v1.3.1"
 main_domain = "${domain}"
-postgres_user = "${username}"
-db_password = "${password:32}"
-storage_password = "${password:32}"
-rabbitmq_user = "${username}"
-rabbitmq_pass = "${password:32}"
+postgres_password = "${password:32}"
+minio_password = "${password:32}"
+rabbitmq_password = "${password:32}"
 secret_key = "${base64:48}"
-live_secret_key = "${base64:32}"
+live_secret_key = "${base64:48}"
 
 [config]
 env = [
-"APP_DOMAIN=${main_domain}",
-"WEB_URL=http://${main_domain}",
-"PGHOST=plane-db",
-"PGDATABASE=plane",
-"POSTGRES_USER=${postgres_user}",
-"POSTGRES_PASSWORD=${db_password}",
-"POSTGRES_DB=plane",
-"POSTGRES_PORT=5432",
-"PGDATA=/var/lib/postgresql/data",
-"DATABASE_URL=postgresql://${postgres_user}:${db_password}@plane-db/plane",
-"REDIS_HOST=plane-redis",
-"REDIS_PORT=6379",
-"REDIS_URL=redis://plane-redis:6379/",
-"RUSTFS_ACCESS_KEY=access-key",
-"RUSTFS_SECRET_KEY=${storage_password}",
-"RUSTFS_VOLUMES=/data",
-"RUSTFS_ADDRESS=0.0.0.0:9000",
-"RUSTFS_CONSOLE_ENABLE=false",
-"AWS_REGION=",
-"AWS_ACCESS_KEY_ID=access-key",
-"AWS_SECRET_ACCESS_KEY=${storage_password}",
-"AWS_S3_ENDPOINT_URL=http://plane-storage:9000",
-"AWS_S3_BUCKET_NAME=uploads",
-"BUCKET_NAME=uploads",
-"FILE_SIZE_LIMIT=5242880",
-"RABBITMQ_HOST=plane-mq",
-"RABBITMQ_PORT=5672",
-"RABBITMQ_USER=${rabbitmq_user}",
-"RABBITMQ_PASSWORD=${rabbitmq_pass}",
-"RABBITMQ_VHOST=plane",
-"RABBITMQ_DEFAULT_USER=${rabbitmq_user}",
-"RABBITMQ_DEFAULT_PASS=${rabbitmq_pass}",
-"RABBITMQ_DEFAULT_VHOST=plane",
-"AMQP_URL=amqp://${rabbitmq_user}:${rabbitmq_pass}@plane-mq:5672/plane",
-"API_BASE_URL=http://api:8000",
-"DEBUG=0",
-"CORS_ALLOWED_ORIGINS=http://${main_domain}",
-"GUNICORN_WORKERS=1",
-"USE_MINIO=1",
-"SECRET_KEY=${secret_key}",
-"API_KEY_RATE_LIMIT=60/minute",
-"MINIO_ENDPOINT_SSL=0",
-"SITE_ADDRESS=:80",
-"LIVE_SERVER_SECRET_KEY=${live_secret_key}"
+  "# ===== Application =====",
+  "# Plane image tag deployed for every service.",
+  "APP_RELEASE=${app_release}",
+  "# Public domain Plane is served on.",
+  "APP_DOMAIN=${main_domain}",
+  "# Full external URL of the instance (used to build links).",
+  "WEB_URL=https://${main_domain}",
+  "# Browser origins allowed to call the API (CORS).",
+  "CORS_ALLOWED_ORIGINS=https://${main_domain}",
+  "# Internal URL other services use to reach the API.",
+  "API_BASE_URL=http://plane-api:8000",
+  "# Django secret key: signs sessions and tokens. Keep it secret.",
+  "SECRET_KEY=${secret_key}",
+  "# Shared secret between the API and the realtime (live) server.",
+  "LIVE_SERVER_SECRET_KEY=${live_secret_key}",
+  "",
+  "# ===== PostgreSQL =====",
+  "# Database user.",
+  "POSTGRES_USER=plane",
+  "# Database password.",
+  "POSTGRES_PASSWORD=${postgres_password}",
+  "# Database name.",
+  "POSTGRES_DB=plane",
+  "# Port PostgreSQL listens on.",
+  "POSTGRES_PORT=5432",
+  "# Host the app and libpq tools connect to.",
+  "PGHOST=plane-db",
+  "# Default database for libpq tools.",
+  "PGDATABASE=plane",
+  "# On-disk location of the database files.",
+  "PGDATA=/var/lib/postgresql/data",
+  "# Full connection string (composed from the values above).",
+  "DATABASE_URL=postgresql://plane:${postgres_password}@plane-db:5432/plane",
+  "",
+  "# ===== Redis / Valkey (cache) =====",
+  "# Redis host.",
+  "REDIS_HOST=plane-redis",
+  "# Redis port.",
+  "REDIS_PORT=6379",
+  "# Full Redis connection URL.",
+  "REDIS_URL=redis://plane-redis:6379/",
+  "",
+  "# ===== RabbitMQ (task queue) =====",
+  "# Broker host.",
+  "RABBITMQ_HOST=plane-mq",
+  "# Broker port.",
+  "RABBITMQ_PORT=5672",
+  "# Broker user.",
+  "RABBITMQ_USER=plane",
+  "# Broker password.",
+  "RABBITMQ_PASSWORD=${rabbitmq_password}",
+  "# Broker virtual host.",
+  "RABBITMQ_VHOST=plane",
+  "# Full AMQP connection string (composed from the values above).",
+  "AMQP_URL=amqp://plane:${rabbitmq_password}@plane-mq:5672/plane",
+  "",
+  "# ===== Object storage (MinIO / S3) =====",
+  "# Use the bundled MinIO (1) instead of an external S3 provider (0).",
+  "USE_MINIO=1",
+  "# AWS region; leave empty when using MinIO.",
+  "AWS_REGION=",
+  "# S3 / MinIO access key.",
+  "AWS_ACCESS_KEY_ID=access-key",
+  "# S3 / MinIO secret key.",
+  "AWS_SECRET_ACCESS_KEY=${minio_password}",
+  "# S3 / MinIO endpoint URL.",
+  "AWS_S3_ENDPOINT_URL=http://plane-minio:9000",
+  "# Bucket used to store uploads.",
+  "AWS_S3_BUCKET_NAME=uploads",
+  "# Max upload size in bytes (default 5 MiB).",
+  "FILE_SIZE_LIMIT=5242880",
+  "# Set to 1 if the S3 / MinIO endpoint is served over HTTPS.",
+  "MINIO_ENDPOINT_SSL=0",
+  "",
+  "# ===== Caddy proxy =====",
+  "# Address the in-container Caddy listens on. Required: the proxy",
+  "# Caddyfile has no default and an empty value crashes it on boot.",
+  "SITE_ADDRESS=:80",
+  "# Peers allowed to set X-Forwarded-For / X-Real-IP. 'private_ranges'",
+  "# trusts only Dokploy's private upstream (Traefik) and blocks public",
+  "# IP spoofing. Use a narrower CIDR if exposing the proxy directly.",
+  "TRUSTED_PROXIES=private_ranges",
+  "",
+  "# ===== App runtime =====",
+  "# Django debug mode; keep 0 in production.",
+  "DEBUG=0",
+  "# Number of Gunicorn workers for the API.",
+  "GUNICORN_WORKERS=1",
+  "# Rate limit applied to API-key requests.",
+  "API_KEY_RATE_LIMIT=60/minute",
+  "# Comma-separated IPs allowed as webhook targets; empty allows all.",
+  "WEBHOOK_ALLOWED_IPS=",
+  "# Comma-separated hosts allowed as webhook targets; empty allows all.",
+  "WEBHOOK_ALLOWED_HOSTS=",
 ]
+
 mounts = []
 
 [[config.domains]]