REWRITE

modules/services/authelia.nix

@@ -163,7 +163,7 @@ let
 in
 {
   options.homey.authelia = {
-    enable = lib.mkEnableOption "Authelia SSO gateway";
+    enable = lib.mkEnableOption "Authelia SSO gateway" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -241,6 +241,28 @@ in
       requires = lib.mkAfter  [ "mnt-data.mount" "podman-openldap.service" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth (Authelia IS the auth gateway)
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "auth";
+      port      = cfg.port;
+      auth      = false;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "authelia"; }
+      { path = "authelia/config"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/authelia" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor for this service
     # -----------------------------------------------------------------------

modules/services/eurovote.nix

@@ -23,7 +23,7 @@ let
 in
 {
   options.homey.eurovote = {
-    enable = lib.mkEnableOption "Eurovision Vote app";
+    enable = lib.mkEnableOption "Eurovision Vote app" // { default = true; };
   };
 
   config = lib.mkIf cfg.enable {
@@ -48,6 +48,34 @@ in
       logoutRedirectUrl = "https://auth.${domain}/logout";
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — forward_auth; X-Remote-User passed to Django's
+    # RemoteUserMiddleware for automatic SSO login
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "eurovision-vote";
+      port      = 8007;
+      auth      = true;
+      extraConfig = ''
+        reverse_proxy localhost:8007 {
+          header_up X-Remote-User {http.request.header.Remote-User}
+        }
+      '';
+      extraHttpConfig = ''
+        reverse_proxy localhost:8007 {
+          header_up X-Forwarded-Proto https
+          header_up X-Remote-User {http.request.header.Remote-User}
+        }
+      '';
+    }];
+
+    # Eurovision Vote uses DynamicUser + /var/lib/eurovote — no extraDirs needed.
+
+    # -----------------------------------------------------------------------
+    # Backup — /var/lib/eurovote holds the SQLite DB with votes
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "/var/lib/eurovote" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor
     # -----------------------------------------------------------------------

modules/services/gitea-runner.nix

@@ -30,7 +30,7 @@ let
 in
 {
   options.homey.giteaRunner = {
-    enable = lib.mkEnableOption "Gitea Actions runner";
+    enable = lib.mkEnableOption "Gitea Actions runner" // { default = true; };
 
     name = lib.mkOption {
       type        = lib.types.str;

modules/services/gitea.nix

@@ -32,7 +32,7 @@ let
 in
 {
   options.homey.gitea = {
-    enable = lib.mkEnableOption "Gitea Git server";
+    enable = lib.mkEnableOption "Gitea Git server" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -188,6 +188,28 @@ in
       requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth; git clients can't handle SSO redirects
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "git";
+      port      = cfg.port;
+      auth      = false;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories (UID 1000 = Gitea's internal user)
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "gitea";      user = "1000"; group = "1000"; }
+      { path = "gitea/data"; user = "1000"; group = "1000"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/gitea" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor for this service
     # -----------------------------------------------------------------------

modules/services/jellyfin.nix

@@ -14,7 +14,7 @@ let
 in
 {
   options.homey.jellyfin = {
-    enable = lib.mkEnableOption "Jellyfin media server";
+    enable = lib.mkEnableOption "Jellyfin media server" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -51,5 +51,27 @@ in
       after    = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
       requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
     };
+
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth; Jellyfin has its own login UI
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "jellyfin";
+      port      = cfg.port;
+      auth      = false;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "jellyfin"; }
+      { path = "jellyfin/config"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/jellyfin" ];
   };
 }

modules/services/mealie.nix

@@ -23,7 +23,7 @@ let
 in
 {
   options.homey.mealie = {
-    enable = lib.mkEnableOption "Mealie recipe manager";
+    enable = lib.mkEnableOption "Mealie recipe manager" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -96,6 +96,28 @@ in
       requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth; Mealie uses LDAP login page
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "mealie";
+      port      = cfg.port;
+      auth      = false;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "mealie"; }
+      { path = "mealie/data"; mode = "0755"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/mealie" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor
     # -----------------------------------------------------------------------

modules/services/nextcloud.nix

@@ -52,7 +52,7 @@ let
 in
 {
   options.homey.nextcloud = {
-    enable = lib.mkEnableOption "Nextcloud file server";
+    enable = lib.mkEnableOption "Nextcloud file server" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -166,6 +166,54 @@ in
       ];
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth; Nextcloud manages its own auth
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "nextcloud";
+      port      = cfg.port;
+      auth      = false;
+      extraConfig = ''
+        redir /.well-known/carddav /remote.php/dav/ 301
+        redir /.well-known/caldav  /remote.php/dav/ 301
+        request_body {
+          max_size 5GB
+        }
+        reverse_proxy localhost:${toString cfg.port} {
+          header_up X-Forwarded-For {remote_host}
+        }
+      '';
+      extraHttpConfig = ''
+        redir /.well-known/carddav /remote.php/dav/ 301
+        redir /.well-known/caldav  /remote.php/dav/ 301
+        request_body {
+          max_size 5GB
+        }
+        reverse_proxy localhost:${toString cfg.port} {
+          header_up X-Forwarded-Proto https
+          header_up X-Forwarded-For {remote_host}
+        }
+      '';
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # UID 33 = www-data in the Nextcloud container
+    # UID 999 = postgres — must own the db dir (creates files directly in it)
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "nextcloud"; }
+      { path = "nextcloud/html";    user = "33";  group = "33"; }
+      { path = "nextcloud/db";      mode = "0700"; user = "999"; group = "999"; }
+      { path = "nextcloud/db-dump"; mode = "0700"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup — exclude raw DB dir (pg_dump file in db-dump/ is used instead)
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths        = [ "${dataDir}/nextcloud" ];
+    homey.backup.extraExcludePaths = [ "${dataDir}/nextcloud/db" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor for this service
     # -----------------------------------------------------------------------

modules/services/ntfy.nix

@@ -62,7 +62,7 @@ let
 in
 {
   options.homey.ntfy = {
-    enable = lib.mkEnableOption "Ntfy push notification server";
+    enable = lib.mkEnableOption "Ntfy push notification server" // { default = true; };
 
     port = lib.mkOption {
       type    = lib.types.port;
@@ -105,36 +105,14 @@ in
       mode = "0444";
     };
 
-    # Create ntfy data directories on the external HD before ntfy starts.
-    # Runs as a separate root service (outside ntfy-sh's restricted namespace)
-    # so it can access /mnt/data without hitting ReadWritePaths restrictions.
-    systemd.services.ntfy-sh-mkdir = {
-      description = "Create Ntfy data directories on external HD";
-      wantedBy    = [ "ntfy-sh.service" ];
-      before      = [ "ntfy-sh.service" ];
-      after       = [ "mnt-data.mount" ];
-      requires    = [ "mnt-data.mount" ];
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = pkgs.writeShellScript "ntfy-mkdir" ''
-          set -euo pipefail
-          mkdir -p ${dataDir}/ntfy/attachments
-          chown -R ntfy-sh:ntfy-sh ${dataDir}/ntfy
-          chmod 0750 ${dataDir}/ntfy ${dataDir}/ntfy/attachments
-        '';
-      };
-    };
-
     # Ensure ntfy-sh starts after the HD is mounted and dirs are ready.
     # Widen ReadWritePaths so ntfy-sh can write to the external HD.
     # Inject the VAPID private key at runtime: ExecStartPre copies the
     # build-time base config to /run/ntfy-sh/server.yml and appends the key,
     # then we override ExecStart to use that runtime config file.
     systemd.services.ntfy-sh = {
-      after    = lib.mkAfter [ "mnt-data.mount" "ntfy-sh-mkdir.service" ];
-      requires = lib.mkAfter [ "mnt-data.mount" "ntfy-sh-mkdir.service" ];
+      after    = lib.mkAfter [ "mnt-data.mount" "systemd-tmpfiles-setup.service" ];
+      requires = lib.mkAfter [ "mnt-data.mount" ];
       serviceConfig = {
         ReadWritePaths   = lib.mkAfter [ "${dataDir}/ntfy" ];
         RuntimeDirectory = "ntfy-sh";   # creates /run/ntfy-sh, owned by ntfy-sh user
@@ -198,6 +176,28 @@ in
       };
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth; ntfy uses its own token auth
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "ntfy";
+      port      = cfg.port;
+      auth      = false;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories (owned by the ntfy-sh system user)
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "ntfy";             user = "ntfy-sh"; group = "ntfy-sh"; }
+      { path = "ntfy/attachments"; user = "ntfy-sh"; group = "ntfy-sh"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/ntfy" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor for this service
     # -----------------------------------------------------------------------

modules/services/openldap.nix

@@ -21,7 +21,7 @@ let
 in
 {
   options.homey.openldap = {
-    enable = lib.mkEnableOption "OpenLDAP identity provider";
+    enable = lib.mkEnableOption "OpenLDAP identity provider" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -114,6 +114,20 @@ in
       requires = lib.mkAfter  [ "mnt-data.mount" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "openldap"; }
+      { path = "openldap/etc-ldap-slapd.d"; }
+      { path = "openldap/var-lib-ldap"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/openldap" ];
+
     # -----------------------------------------------------------------------
     # Firewall — openldap port is NOT opened externally
     # -----------------------------------------------------------------------

modules/services/paperless.nix

@@ -28,7 +28,7 @@ let
 in
 {
   options.homey.paperless = {
-    enable = lib.mkEnableOption "Paperless-ngx document management";
+    enable = lib.mkEnableOption "Paperless-ngx document management" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -124,6 +124,32 @@ in
       requires = lib.mkAfter [ "mnt-data.mount" "podman-paperless-redis.service" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — forward_auth; Remote-User passed to Paperless for SSO
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "paperless";
+      port      = cfg.port;
+      auth      = true;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories (UID 1000 = USERMAP_UID in container)
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "paperless"; }
+      { path = "paperless/data";    user = "1000"; group = "1000"; }
+      { path = "paperless/media";   user = "1000"; group = "1000"; }
+      { path = "paperless/consume"; user = "1000"; group = "1000"; }
+      { path = "paperless/export";  user = "1000"; group = "1000"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup — exclude consume dir (unprocessed drops, usually empty)
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths        = [ "${dataDir}/paperless" ];
+    homey.backup.extraExcludePaths = [ "${dataDir}/paperless/consume" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor
     # -----------------------------------------------------------------------

modules/services/phpldapadmin.nix

@@ -16,7 +16,7 @@ let
 in
 {
   options.homey.phpldapadmin = {
-    enable = lib.mkEnableOption "phpLDAPadmin web interface";
+    enable = lib.mkEnableOption "phpLDAPadmin web interface" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -50,6 +50,17 @@ in
       wants = lib.mkAfter [ "podman-openldap.service" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — forward_auth + reverse_proxy
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "ldapadmin";
+      port      = cfg.port;
+      auth      = true;
+    }];
+
+    # phpLDAPadmin is stateless (no persistent volumes) — no storage or backup entries needed.
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor for this service
     # -----------------------------------------------------------------------

modules/services/transmission.nix

@@ -18,7 +18,7 @@ let
 in
 {
   options.homey.transmission = {
-    enable = lib.mkEnableOption "Transmission torrent client";
+    enable = lib.mkEnableOption "Transmission torrent client" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -60,5 +60,27 @@ in
       after    = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
       requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
     };
+
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — forward_auth, admins only
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "torrent";
+      port      = cfg.port;
+      auth      = true;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "transmission"; }
+      { path = "transmission/config"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/transmission" ];
   };
 }

modules/services/uptime-kuma.nix

@@ -215,7 +215,7 @@ in
   };
 
   options.homey.uptimeKuma = {
-    enable = lib.mkEnableOption "Uptime Kuma uptime monitoring";
+    enable = lib.mkEnableOption "Uptime Kuma uptime monitoring" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -285,6 +285,27 @@ in
       };
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — forward_auth, admins only
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "uptime";
+      port      = cfg.port;
+      auth      = true;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "uptime-kuma"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/uptime-kuma" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma self-monitor
     # -----------------------------------------------------------------------