diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 419114c..0048ae8 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -139,15 +139,6 @@ jobs:
               WS_DOCKER_REGISTRY: ${{ vars.WS_DOCKER_REGISTRY }}
               WS_POSM_DB_HOST: ${{ vars.WS_POSM_DB_HOST }}
 
-              # passwords
-              #WS_API_DB_PASS: ${{ secrets.WS_API_DB_PASS }}
-              #WS_MAPBOX_ACCESS_TOKEN: ${{ secrets.WS_MAPBOX_ACCESS_TOKEN }}
-              #WS_OSM_DB_PASS: ${{ secrets.WS_OSM_DB_PASS }}
-              #WS_OSM_SECRET_KEY_BASE: ${{ secrets.WS_OSM_SECRET_KEY_BASE }}
-              #WS_SMTP_PASS: ${{ secrets.WS_SMTP_PASS }}
-              #WS_TASKS_DB_PASS: ${{ secrets.WS_TASKS_DB_PASS }}
-              #WS_TASKS_SECRET_KEY: ${{ secrets.WS_TASKS_SECRET_KEY }}
-
         - name: Deploy
           env:
               ENV: ${{ vars.ENV }}
diff --git a/docker-compose.build.yml b/docker-compose.build.yml
index 6255af4..a1b46be 100644
--- a/docker-compose.build.yml
+++ b/docker-compose.build.yml
@@ -162,19 +162,20 @@ services:
     extends: osm-cgimap
     image: ${WS_DOCKER_REGISTRY}/workspaces-osm-cgimap:${CODE_VERSION}
 
-  # tasking manager
-  tasks-backend:
-    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${ENV}
-    build:
-      cache_from:
-        - type=registry,ref=${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:buildcache
-      cache_to:
-        - type=registry,ref=${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:buildcache,mode=max
-      context: tasking-manager
-
-  tasks-backend_tag:
-    extends: tasks-backend
-    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${CODE_VERSION}
+# DEPRECATED IN PLACE OF NEW API
+#  # tasking manager
+#  tasks-backend:
+#    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${ENV}
+#    build:
+#      cache_from:
+#        - type=registry,ref=${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:buildcache
+#      cache_to:
+#        - type=registry,ref=${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:buildcache,mode=max
+#      context: tasking-manager
+
+#  tasks-backend_tag:
+#    extends: tasks-backend
+#    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${CODE_VERSION}
 
   # leaderboard FE/backend
   leaderboard-frontend:
diff --git a/docker-compose.deploy.yml b/docker-compose.deploy.yml
index e1c8ef0..54f110f 100644
--- a/docker-compose.deploy.yml
+++ b/docker-compose.deploy.yml
@@ -95,32 +95,32 @@ services:
       IMAGERY_SCHEMA_URL: ${WS_IMAGERY_SCHEMA_URL}
     labels:
       - traefik.enable=true
-      - traefik.http.routers.api.rule=Host(`${WS_NEW_API_HOST}`)
+      - traefik.http.routers.api.rule=Host(`${WS_NEW_API_HOST}`) || Host(`${WS_API_HOST}`) || Host(`${WS_OSM_HOST}`)
       - traefik.http.services.api.loadbalancer.server.port=8000
       - traefik.http.routers.api.entrypoints=websecure
       - traefik.http.routers.api.tls.certresolver=myresolver
 
-  # Legacy tasking manager as workspaces API
-  backend:
-    # Workspaces backend currently lives in the TM. Emulate a separate server for now:
-    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${WS_DOCKER_TAG}
-    restart: always
-    env_file: tasking-manager/tasking-manager.env
-    environment:
-      GUNICORN_CMD_ARGS: "--workers 5 --threads 5 --timeout 179"
-      WS_LONGFORM_SCHEMA_URL: ${WS_LONG_FORM_QUEST_SCHEMA_URL}
-      WS_IMAGERY_SCHEMA_URL: ${WS_IMAGERY_SCHEMA_URL}
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.workspaces-backend.rule=Host(`${WS_API_HOST}`)
-      - traefik.http.services.workspaces-backend.loadbalancer.server.port=5000
-
-      - traefik.http.middlewares.redirect-to-https.replacepathregex.regex=^/api/v1/(.*)
-      - traefik.http.middlewares.redirect-to-https.replacepathregex.replacement=/api/v1/$$1/
-
-      - traefik.http.routers.workspaces-backend.middlewares=cors,redirect-to-https
-      - traefik.http.routers.workspaces-backend.entrypoints=websecure
-      - traefik.http.routers.workspaces-backend.tls.certresolver=myresolver
+#  # Legacy tasking manager as workspaces API
+#  backend:
+#    # Workspaces backend currently lives in the TM. Emulate a separate server for now:
+#    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${WS_DOCKER_TAG}
+#    restart: always
+#    env_file: tasking-manager/tasking-manager.env
+#    environment:
+#      GUNICORN_CMD_ARGS: "--workers 5 --threads 5 --timeout 179"
+#      WS_LONGFORM_SCHEMA_URL: ${WS_LONG_FORM_QUEST_SCHEMA_URL}
+#      WS_IMAGERY_SCHEMA_URL: ${WS_IMAGERY_SCHEMA_URL}
+#    labels:
+#      - traefik.enable=true
+#      - traefik.http.routers.workspaces-backend.rule=Host(`${WS_API_HOST}`)
+#      - traefik.http.services.workspaces-backend.loadbalancer.server.port=5000
+
+#      - traefik.http.middlewares.redirect-to-https.replacepathregex.regex=^/api/v1/(.*)
+#      - traefik.http.middlewares.redirect-to-https.replacepathregex.replacement=/api/v1/$$1/
+
+#      - traefik.http.routers.workspaces-backend.middlewares=cors,redirect-to-https
+#      - traefik.http.routers.workspaces-backend.entrypoints=websecure
+#      - traefik.http.routers.workspaces-backend.tls.certresolver=myresolver
 
   # workspaces editors
   rapid:
@@ -154,12 +154,13 @@ services:
       - osm-cgimap
     sysctls:
       net.core.somaxconn: 4096
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.osm-web.rule=Host(`${WS_OSM_HOST}`)
-      - traefik.http.services.osm-web.loadbalancer.server.port=80
-      - traefik.http.routers.osm-web.entrypoints=websecure
-      - traefik.http.routers.osm-web.tls.certresolver=myresolver
+# PROXIED VIA API CONTAINER
+#    labels:
+#      - traefik.enable=true
+#      - traefik.http.routers.osm-web.rule=Host(`${WS_OSM_HOST}`)
+#      - traefik.http.services.osm-web.loadbalancer.server.port=80
+#      - traefik.http.routers.osm-web.entrypoints=websecure
+#      - traefik.http.routers.osm-web.tls.certresolver=myresolver
 
   osm-rails:
     <<: *osm-rails-base
@@ -186,18 +187,18 @@ services:
       CGIMAP_MAP_NODES: ${WS_OSM_MAX_EXPORT_NODES}
       CGIMAP_MAP_AREA: ${WS_OSM_MAX_EXPORT_AREA}
 
-  tasks-backend:
-    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${WS_DOCKER_TAG}
-    restart: always
-    env_file: tasking-manager/tasking-manager.env
-    environment:
-      GUNICORN_CMD_ARGS: "--workers 5 --threads 5 --timeout 179"
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.tasks-backend.rule=Host(`${WS_TASKS_HOST}`) && PathPrefix(`/api/`)
-      - traefik.http.services.tasks-backend.loadbalancer.server.port=5000
-      - traefik.http.routers.tasks-backend.entrypoints=websecure
-      - traefik.http.routers.tasks-backend.tls.certresolver=myresolver
+#  tasks-backend:
+#    image: ${WS_DOCKER_REGISTRY}/workspaces-tasks-backend:${WS_DOCKER_TAG}
+#    restart: always
+#    env_file: tasking-manager/tasking-manager.env
+#    environment:
+#      GUNICORN_CMD_ARGS: "--workers 5 --threads 5 --timeout 179"
+#    labels:
+#      - traefik.enable=true
+#      - traefik.http.routers.tasks-backend.rule=Host(`${WS_TASKS_HOST}`) && PathPrefix(`/api/`)
+#      - traefik.http.services.tasks-backend.loadbalancer.server.port=5000
+#      - traefik.http.routers.tasks-backend.entrypoints=websecure
+#      - traefik.http.routers.tasks-backend.tls.certresolver=myresolver
 
   # leaderboard FE/backend
   leaderboard-frontend:
diff --git a/docker-compose.yml b/docker-compose.yml
index cde6b7d..1976070 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -97,7 +97,8 @@ services:
       - ./api:/app
     labels:
       - traefik.enable=true
-      - traefik.http.routers.api.rule=Host(`${WS_NEW_API_HOST}`)
+      # api container also serves the legacy workspaces backend host (was tasks-backend) and the OSM host
+      - traefik.http.routers.api.rule=Host(`${WS_NEW_API_HOST}`) || Host(`${WS_API_HOST}`) || Host(`${WS_OSM_HOST}`)
       - traefik.http.services.api.loadbalancer.server.port=8000
 
   rapid:
@@ -128,10 +129,11 @@ services:
       - ./nginx.debug.conf:/etc/nginx/nginx.conf:ro
     depends_on:
       - osm-web
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.osm-log-proxy.rule=Host(`${WS_OSM_HOST}`)
-      - traefik.http.services.osm-log-proxy.loadbalancer.server.port=80
+# WS_OSM_HOST is served by the api container (proxied to osm-web); leave this un-routed
+#    labels:
+#      - traefik.enable=true
+#      - traefik.http.routers.osm-log-proxy.rule=Host(`${WS_OSM_HOST}`)
+#      - traefik.http.services.osm-log-proxy.loadbalancer.server.port=80
 
   osm-web:
     image: nginx:stable-alpine
@@ -143,10 +145,11 @@ services:
     volumes:
       - ./osm-web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
       - ./osm-rails/public:/usr/share/nginx/html:ro
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.osm-web.rule=Host(`${WS_OSM_HOST}`)
-      - traefik.http.services.osm-web.loadbalancer.server.port=80
+# FRONTED BY osm-log-proxy IN DEV (osm-log-proxy serves WS_OSM_HOST and proxies here)
+#    labels:
+#      - traefik.enable=true
+#      - traefik.http.routers.osm-web.rule=Host(`${WS_OSM_HOST}`)
+#      - traefik.http.services.osm-web.loadbalancer.server.port=80
 
   osm-rails:
     <<: *osm-rails-base
@@ -177,46 +180,6 @@ services:
       CGIMAP_MAP_NODES: ${WS_OSM_MAX_EXPORT_NODES}
       CGIMAP_MAP_AREA: ${WS_OSM_MAX_EXPORT_AREA}
 
- # tasks-frontend:
- #   build:
- #     context: tasking-manager
- #     dockerfile: ./scripts/docker/Dockerfile.frontend
- #   volumes:
- #     - ./tasking-manager:/usr/src/app
- #   labels:
- #     - traefik.enable=true
- #     - traefik.http.routers.tasks-frontend.rule=Host(`${WS_TASKS_HOST}`)
- #     - traefik.http.services.tasks-frontend.loadbalancer.server.port=80
-
-  tasks-backend:
-    build:
-      context: tasking-manager
-      dockerfile: ./scripts/docker/Dockerfile.backend
-      target: debug
-      args:
-        APP_UID: 1000
-    env_file: tasking-manager/tasking-manager.env
-    environment:
-      GEVENT_SUPPORT: true
-      WS_LONGFORM_SCHEMA_URL: ${WS_LONG_FORM_QUEST_SCHEMA_URL}
-      WS_IMAGERY_SCHEMA_URL: ${WS_IMAGERY_SCHEMA_URL}
-    ports:
-      - "5678:5678" # debugpy debugger port
-    volumes:
-      - ./tasking-manager:/usr/src/app
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.tasks-backend.rule=Host(`${WS_TASKS_HOST}`) && PathPrefix(`/api/`)
-      - traefik.http.routers.tasks-backend.service=tasks-backend
-      - traefik.http.services.tasks-backend.loadbalancer.server.port=5000
-      # Workspaces backend currently lives in the TM. Emulate a separate server for now:
-      - traefik.http.middlewares.workspaces-backend-emulation.replacepathregex.regex=^/api/v1/(.*)
-      - traefik.http.middlewares.workspaces-backend-emulation.replacepathregex.replacement=/api/v2/$$1/
-      - traefik.http.routers.workspaces-backend.rule=Host(`${WS_API_HOST}`)
-      - traefik.http.routers.workspaces-backend.service=workspaces-backend
-      - traefik.http.services.workspaces-backend.loadbalancer.server.port=5000
-      - traefik.http.routers.workspaces-backend.middlewares=workspaces-backend-emulation
-
 volumes:
   osm-rails-tmp:
   osm-rails-storage: