REWRITE

modules/services/ntfy.nix

@@ -62,7 +62,7 @@ let
 in
 {
   options.homey.ntfy = {
-    enable = lib.mkEnableOption "Ntfy push notification server";
+    enable = lib.mkEnableOption "Ntfy push notification server" // { default = true; };
 
     port = lib.mkOption {
       type    = lib.types.port;
@@ -105,36 +105,14 @@ in
       mode = "0444";
     };
 
-    # Create ntfy data directories on the external HD before ntfy starts.
-    # Runs as a separate root service (outside ntfy-sh's restricted namespace)
-    # so it can access /mnt/data without hitting ReadWritePaths restrictions.
-    systemd.services.ntfy-sh-mkdir = {
-      description = "Create Ntfy data directories on external HD";
-      wantedBy    = [ "ntfy-sh.service" ];
-      before      = [ "ntfy-sh.service" ];
-      after       = [ "mnt-data.mount" ];
-      requires    = [ "mnt-data.mount" ];
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = pkgs.writeShellScript "ntfy-mkdir" ''
-          set -euo pipefail
-          mkdir -p ${dataDir}/ntfy/attachments
-          chown -R ntfy-sh:ntfy-sh ${dataDir}/ntfy
-          chmod 0750 ${dataDir}/ntfy ${dataDir}/ntfy/attachments
-        '';
-      };
-    };
-
     # Ensure ntfy-sh starts after the HD is mounted and dirs are ready.
     # Widen ReadWritePaths so ntfy-sh can write to the external HD.
     # Inject the VAPID private key at runtime: ExecStartPre copies the
     # build-time base config to /run/ntfy-sh/server.yml and appends the key,
     # then we override ExecStart to use that runtime config file.
     systemd.services.ntfy-sh = {
-      after    = lib.mkAfter [ "mnt-data.mount" "ntfy-sh-mkdir.service" ];
-      requires = lib.mkAfter [ "mnt-data.mount" "ntfy-sh-mkdir.service" ];
+      after    = lib.mkAfter [ "mnt-data.mount" "systemd-tmpfiles-setup.service" ];
+      requires = lib.mkAfter [ "mnt-data.mount" ];
       serviceConfig = {
         ReadWritePaths   = lib.mkAfter [ "${dataDir}/ntfy" ];
         RuntimeDirectory = "ntfy-sh";   # creates /run/ntfy-sh, owned by ntfy-sh user
@@ -198,6 +176,28 @@ in
       };
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth; ntfy uses its own token auth
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "ntfy";
+      port      = cfg.port;
+      auth      = false;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories (owned by the ntfy-sh system user)
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "ntfy";             user = "ntfy-sh"; group = "ntfy-sh"; }
+      { path = "ntfy/attachments"; user = "ntfy-sh"; group = "ntfy-sh"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/ntfy" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor for this service
     # -----------------------------------------------------------------------