diff --git a/configure.py b/configure.py
index 2703174..47417ae 100755
--- a/configure.py
+++ b/configure.py
@@ -6,12 +6,15 @@
   ./configure.py --show     print current streamers, editors, domain and the OBS settings
   ./configure.py --apply    regenerate everything from the values already on disk and apply (non-interactive;
                             used by deploy.sh). Fails if the main hostname was never set.
-  ./configure.py --hosts AUTH WATCH [GIT [BOT [LIVE [FILES [SYNC [CLIPS]]]]]]
+  ./configure.py --hosts AUTH WATCH [GIT [BOT [LIVE [FILES [SYNC [CLIPS [DIAG]]]]]]]
                             set the other hostnames and apply (non-interactive; used by addCommunityMediaServer.sh).
-                            Pass "" to leave one unset.
+                            Pass "" to leave one unset. NOTE: --apply reads the hostnames back out of the
+                            Caddyfile, so it can only regenerate hosts that are already there. Introducing a
+                            NEW host needs --full or this.
 
 Hosts: main = the gateway page at /, files = copyparty, clips = clip intake, sync = Syncthing UI,
-       live = portal + OBS dock (/dock/, /dock/clock/, /dump, /me, /time), auth, watch, git, bot.
+       live = portal + OBS dock (/dock/, /dock/clock/, /dump, /me, /time), diag = logs/metrics/alerts,
+       auth, watch, git, bot.
 
 Reads  : Caddyfile (hostnames), mediamtx.yml (streamers), .env
          (editors/admins are Authentik groups now: editors, media-admins, admins — nothing local)
@@ -835,12 +838,18 @@ def main():
         apply(domain, admin_pw, streamers, editors, auth_host, watch_host, git_host=git_host, bot_host=bot_host, live_host=live_host, files_host=files_host, sync_host=sync_host, clips_host=clips_host, diag_host=diag_host)
         show(domain, admin_pw, streamers, editors, auth_host, watch_host, git_host, bot_host, live_host, files_host, sync_host, clips_host, diag_host); return
     if mode == "--hosts":
-        if not 4 <= len(sys.argv) <= 10: print("usage: configure.py --hosts AUTH WATCH [GIT [BOT [LIVE [FILES [SYNC [CLIPS]]]]]]"); sys.exit(2)
+        if not 4 <= len(sys.argv) <= 11:
+            print("usage: configure.py --hosts AUTH WATCH [GIT [BOT [LIVE [FILES [SYNC [CLIPS [DIAG]]]]]]]")
+            print('  Pass "" to leave one unset. This is the ONLY non-interactive way to introduce a NEW host:')
+            print("  --apply reads the hostnames back from the Caddyfile, so a role that is not in there yet")
+            print("  cannot be written by it. --full asks for them all instead.")
+            sys.exit(2)
         if not domain: print("domain not set yet — run ./configure.py --full first"); sys.exit(1)
-        a = [x.strip() for x in sys.argv[2:]] + [None] * 8
+        a = [x.strip() for x in sys.argv[2:]] + [None] * 9
         auth_host, watch_host = a[0], a[1]
         git_host, bot_host, live_host = (a[2] if a[2] is not None else git_host), (a[3] if a[3] is not None else bot_host), (a[4] if a[4] is not None else live_host)
         files_host, sync_host, clips_host = (a[5] if a[5] is not None else files_host), (a[6] if a[6] is not None else sync_host), (a[7] if a[7] is not None else clips_host)
+        diag_host = a[8] if a[8] is not None else diag_host
         apply(domain, admin_pw, streamers, editors, auth_host, watch_host, git_host=git_host, bot_host=bot_host, live_host=live_host, files_host=files_host, sync_host=sync_host, clips_host=clips_host, diag_host=diag_host)
         show(domain, admin_pw, streamers, editors, auth_host, watch_host, git_host, bot_host, live_host, files_host, sync_host, clips_host, diag_host); return
     discord_token = discord_guild = live_webhook = None