Apply the local/remote Caddy mode resolution to every service, not just traccar

traccar.sh's caddy_net wiring was fixed to mirror configure_caddy_for_service's
own mode resolution (CADDY_MODE from site config, then a local ~/docker/caddy,
then the legacy CADDY_REMOTE_HOST var) instead of only checking for the local
directory. That same bare directory check was copy-pasted into the caddy_net
wiring of every other Docker service in the repo, so a site with Caddy on a
different box would silently fail to join any of their containers to caddy_net
during setup (or, for homeassistant/koha, only get half the wiring right).

Applied the same fix mechanically across all 37 services using the standard
_CADDY_NET_BLOCK/_CADDY_NET_SECTION pattern (verified identical text via
scripted diff before touching any of them), plus by hand for:
- homeassistant.sh and koha.sh, which use their own differently-shaped
  variables (HA_CADDY_NET_LINES / _CADDY_NET_ENTRY) for the same decision
- paintplus.sh and ai-stack.sh, which do a live `docker network connect`
  instead of a compose network block
- watchyourlan.sh, whose Caddy note was worded for local-only setups

sms-inbound.sh got more than a mode swap: its Caddy wiring was hand-rolled
(not routed through configure_caddy_for_service) and had no remote-Caddy
path at all — a remote Caddy box would get a misleading "Caddy isn't
installed here" message instead of a snippet. Added
_sms_write_caddy_snippet(), mirroring the snippet-file pattern
configure_caddy_for_service uses everywhere else, and pointed the firewall
gate at the same three-way mode instead of a two-way dir check.

Verified: bash -n across all of services/*.sh, a scripted check that every
touched file has exactly one _CADDY_MODE resolution and no leftover bare
`[ -d "$DOCKER_DIR/caddy" ]` feeding a caddy_net decision, and spot-checked
docker compose config renders (traccar, mattermost) confirming the ${VAR}
interpolation and multi-service usage sites still resolve correctly.

services/actualbudget.sh

@@ -202,15 +202,21 @@ install_actualbudget() {
 
     local TZ_VAL; TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/ai-stack.sh

@@ -218,7 +218,15 @@ GPUEOF
 
     # ── Caddy (Open WebUI has built-in auth — no Authelia) ────────────────────
     # The generated compose doesn't join caddy_net, so attach the container by name.
-    if [ -d "$DOCKER_DIR/caddy" ] && [ "$INSTALLER_RAN" = true ]; then
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't reach this container by name over a bridge network
+    # it isn't on anyway.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+    if [ "$_CADDY_MODE" = "local" ] && [ "$INSTALLER_RAN" = true ]; then
         docker network connect "$SITE_CADDY_NET" open-webui 2>/dev/null || true
     fi
     configure_caddy_for_service "Open WebUI" "open-webui:8080" "ai"

services/archivebox.sh

@@ -195,15 +195,21 @@ install_archivebox() {
     ensure_docker_dir_ownership "$AB_DIR"
     cd "$AB_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/arm.sh

@@ -233,15 +233,21 @@ install_arm() {
     TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
     UID_VAL=$(id -u "$ACTUAL_USER"); GID_VAL=$(id -g "$ACTUAL_USER")
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/audiobookshelf.sh

@@ -208,15 +208,21 @@ install_audiobookshelf() {
 
     local TZ_VAL; TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/calibre-web.sh

@@ -197,15 +197,21 @@ install_calibre-web() {
     ensure_docker_dir_ownership "$CW_DIR"
     cd "$CW_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/changedetection.sh

@@ -197,15 +197,21 @@ install_changedetection() {
     ensure_docker_dir_ownership "$CD_DIR"
     cd "$CD_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/drum-rhythm-game.sh

@@ -214,15 +214,21 @@ install_drum-rhythm-game() {
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DRUM_DIR/html"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/emby.sh

@@ -222,15 +222,21 @@ install_emby() {
     TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
     UID_VAL=$(id -u "$ACTUAL_USER"); GID_VAL=$(id -g "$ACTUAL_USER")
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/filebrowser.sh

@@ -199,15 +199,21 @@ install_filebrowser() {
     local FB_PATH=""
     prompt_text "Primary files directory to browse [default: $ACTUAL_HOME]:" "$ACTUAL_HOME" FB_PATH
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/fmd.sh

@@ -214,15 +214,21 @@ install_fmd() {
     local FMD_PASS
     FMD_PASS=$(openssl rand -base64 16 | tr -dc 'a-zA-Z0-9' | head -c 16)
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/frigate-audio.sh

@@ -375,15 +375,21 @@ ENVEOF
         [ -n "$DRI_LINE" ] && DEVICES_BLOCK="${DEVICES_BLOCK}\n      ${DRI_LINE}"
     fi
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/frigate-notify.sh

@@ -211,15 +211,21 @@ install_frigate-notify() {
     ensure_docker_dir_ownership "$FN_DIR"
     cd "$FN_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/frigate.sh

@@ -558,15 +558,21 @@ install_frigate() {
             log_warning "No /dev/dri/renderD128 — Frigate will use CPU detection."
         fi
 
+        # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+        # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+        # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+        # remote Caddy box can't resolve container names on this host's bridge
+        # network anyway; it reaches this service via the host's published port.
+        local _CADDY_MODE="${CADDY_MODE:-none}"
+        [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+        [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
         local _CADDY_NET_BLOCK=""
-        if [ -d "$DOCKER_DIR/caddy" ]; then
+        local _CADDY_NET_SECTION=""
+        if [ "$_CADDY_MODE" = "local" ]; then
             _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-        fi
-
-        local _CADDY_NET_SECTION=""
-        if [ -d "$DOCKER_DIR/caddy" ]; then
             _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/gatus.sh

@@ -210,15 +210,21 @@ install_gatus() {
 
     local TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/homeassistant.sh

@@ -199,6 +199,15 @@ install_homeassistant() {
     ensure_docker_dir_ownership "$HOMEASSISTANT_DIR"
     cd "$HOMEASSISTANT_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches Home Assistant via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     # Networking mode: bridge (published port) vs host networking.
     echo ""
     echo "  Home Assistant networking mode:"
@@ -218,7 +227,7 @@ install_homeassistant() {
     else
         HA_NET_LINES="    ports:
       - \"8123:8123\""
-        if [ -d "$DOCKER_DIR/caddy" ]; then
+        if [ "$_CADDY_MODE" = "local" ]; then
             HA_CADDY_NET_LINES="    networks:
       - caddy_net"
         else
@@ -228,7 +237,7 @@ install_homeassistant() {
     fi
 
     local _CADDY_NET_SECTION=""
-    if [ "$HA_NETMODE" != "2" ] && [ -d "$DOCKER_DIR/caddy" ]; then
+    if [ "$HA_NETMODE" != "2" ] && [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/homebox.sh

@@ -197,15 +197,21 @@ install_homebox() {
     ensure_docker_dir_ownership "$HB_DIR"
     cd "$HB_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/immich.sh

@@ -291,15 +291,21 @@ install_immich() {
     TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
 
     # ── Write docker-compose.yml ────────────────────────────────────────────
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/iopaint.sh

@@ -268,15 +268,21 @@ install_iopaint() {
     # Volume ./models:/root/.cache persists ALL model caches:
     #   /root/.cache/torch/hub/checkpoints/  (LaMa, CV2, ZITS, etc.)
     #   /root/.cache/huggingface/             (SD, PowerPaint, LDM, etc.)
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/jellyfin.sh

@@ -225,15 +225,21 @@ install_jellyfin() {
         log_warning "No /dev/dri/renderD128 — Jellyfin will use CPU transcoding."
     fi
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/joplin.sh

@@ -201,15 +201,21 @@ install_joplin() {
     DB_PASS="$(generate_password 32)"
     local BASE_URL="https://joplin.${SITE_DOMAIN}"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/js99er.sh

@@ -436,15 +436,21 @@ NGINXCONF
     # ── 4. Standalone docker-compose.yml (per-service folder) ────────────────
     # Only join caddy_net if Caddy is installed — otherwise the network doesn't
     # exist and docker compose up will fail with "network not found".
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/koha.sh

@@ -346,9 +346,18 @@ install_koha() {
     ensure_docker_dir_ownership "$KOHA_DIR"
     cd "$KOHA_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches Koha via the host's published ports.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_ENTRY=""
     local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_ENTRY="      - caddy_net
 "
         _CADDY_NET_SECTION="  caddy_net:

services/magicmirror.sh

@@ -231,15 +231,21 @@ install_magicmirror() {
         ensure_docker_dir_ownership "$MM_DIR"
         cd "$MM_DIR" || continue
 
+        # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+        # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+        # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+        # remote Caddy box can't resolve container names on this host's bridge
+        # network anyway; it reaches this service via the host's published port.
+        local _CADDY_MODE="${CADDY_MODE:-none}"
+        [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+        [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
         local _CADDY_NET_BLOCK=""
-        if [ -d "$DOCKER_DIR/caddy" ]; then
+        local _CADDY_NET_SECTION=""
+        if [ "$_CADDY_MODE" = "local" ]; then
             _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-        fi
-
-        local _CADDY_NET_SECTION=""
-        if [ -d "$DOCKER_DIR/caddy" ]; then
             _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/mail-archiver.sh

@@ -212,15 +212,21 @@ install_mail-archiver() {
     ADMIN_PASS=$(generate_password 24)
     TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/mattermost.sh

@@ -247,15 +247,21 @@ install_mattermost() {
     prompt_text "Mattermost site URL [$SITE_URL]:" "$SITE_URL" CONFIGURED_SITEURL
     [[ -n "$CONFIGURED_SITEURL" ]] && SITE_URL="$CONFIGURED_SITEURL"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/mealie.sh

@@ -212,15 +212,21 @@ install_mealie() {
         MEALIE_BASE_URL="https://recipes.${SITE_DOMAIN}"
     fi
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/meshcentral.sh

@@ -215,15 +215,21 @@ install_meshcentral() {
     ensure_docker_dir_ownership "$MC_DIR"
     cd "$MC_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/n8n.sh

@@ -197,15 +197,21 @@ install_n8n() {
     ensure_docker_dir_ownership "$N8N_DIR"
     cd "$N8N_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/nextcloud.sh

@@ -205,15 +205,21 @@ RUN apt-get update \
  && rm -rf /var/lib/apt/lists/*
 NCDF
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/ntfy.sh

@@ -203,15 +203,21 @@ install_ntfy() {
     ensure_docker_dir_ownership "$NTFY_DIR"
     cd "$NTFY_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/onlyoffice.sh

@@ -243,15 +243,21 @@ install_onlyoffice() {
     fi
     [[ -z "$JWT_SECRET" ]] && JWT_SECRET="$(generate_password 32)"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/paintplus.sh

@@ -127,12 +127,21 @@ install_paintplus() {
     mkdir -p data
     ensure_docker_dir_ownership "$PP_DIR"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't reach this container by name over a bridge network
+    # it isn't on anyway.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     # ── Caddy network override (cloud mode) ───────────────────────────────────
     # The base compose has no networks, so Caddy (on caddy_net) can't reach the
     # container by name. This override — auto-merged with the default compose —
     # attaches the app to caddy_net. The GPU compose runs with an explicit -f and
     # does NOT merge overrides, so GPU mode is wired with `docker network connect`.
-    if [[ "$PP_MODE" != "2" ]] && [ -d "$DOCKER_DIR/caddy" ]; then
+    if [[ "$PP_MODE" != "2" ]] && [ "$_CADDY_MODE" = "local" ]; then
         cat > docker-compose.override.yml << OVR
 # Added by ubuntu-post-install so Caddy (on caddy_net) can reach this app by name.
 services:
@@ -172,7 +181,7 @@ OVR
 
     # Ensure the running container is on caddy_net (covers GPU mode, where the
     # override file above is not merged by the app's bring-up script).
-    if [ -d "$DOCKER_DIR/caddy" ] && [[ "$START_PP" =~ ^[Yy]$ ]]; then
+    if [ "$_CADDY_MODE" = "local" ] && [[ "$START_PP" =~ ^[Yy]$ ]]; then
         docker network connect "$SITE_CADDY_NET" paintplus 2>/dev/null || true
     fi
 

services/portainer.sh

@@ -194,15 +194,21 @@ install_portainer() {
     ensure_docker_dir_ownership "$PORTAINER_DIR"
     cd "$PORTAINER_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/sms-inbound.sh

@@ -581,6 +581,52 @@ CBLOCK
     fi
 }
 
+# Remote-Caddy counterpart to _sms_configure_caddy — same site block, but a
+# remote Caddy box can't resolve host.docker.internal (that hostname only
+# works via the extra_hosts entry a LOCAL Caddy container gets) and isn't on
+# this host's Docker bridge at all, so it has to reach the relay over this
+# host's own IP and published port instead. Mirrors the snippet-file pattern
+# configure_caddy_for_service uses for every other service (lib/common.sh).
+_sms_write_caddy_snippet() {
+    local _domain="$1" _port="$2"
+
+    local _this_ip="${CADDY_REMOTE_HOST:-}"
+    [ -z "$_this_ip" ] && _this_ip="$(hostname -I 2>/dev/null | awk '{print $1}')"
+    [ -z "$_this_ip" ] && _this_ip="$(hostname -f 2>/dev/null || echo "127.0.0.1")"
+
+    local _snippet_dir="$DOCKER_DIR/caddy-snippets"
+    local _snippet_file="$_snippet_dir/sms-inbound.caddy"
+    mkdir -p "$_snippet_dir"
+
+    cat > "$_snippet_file" << CBLOCK
+
+# Inbound SMS webhook (sms-inbound) — deliberately NOT behind Authelia:
+# the SMS provider calls this unauthenticated. The secret is the token in
+# the request path, checked by the relay itself.
+${_domain} {
+    reverse_proxy ${_this_ip}:${_port}
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        Referrer-Policy "no-referrer"
+    }
+
+    log {
+        output file /var/log/caddy/${_domain}.log
+        format json
+    }
+}
+CBLOCK
+    chown "$ACTUAL_USER:$ACTUAL_USER" "$_snippet_file" 2>/dev/null || true
+
+    log_success "Snippet saved: $_snippet_file"
+    log_info "Copy to your Caddy machine and append to its Caddyfile:"
+    log_info "  scp $_snippet_file caddy-host:~/caddy-snippets/"
+    log_info "  cat ~/caddy-snippets/sms-inbound.caddy >> /path/to/Caddyfile"
+    log_info "  docker restart caddy   # reload API is disabled by default"
+}
+
 _sms_write_readme() {
     local _url="$1" _relay_domain="$2"
     write_readme "$SMS_APP_DIR" << MD
@@ -817,24 +863,36 @@ install_sms-inbound() {
     [[ -n "${SITE_DOMAIN:-}" && "$SITE_DOMAIN" != "example.com" ]] && _default_domain="sms.${SITE_DOMAIN}"
     prompt_text "Public domain for the webhook (A record must point here) [${_default_domain:-required}]:" "$_default_domain" RELAY_DOMAIN
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     if [[ -z "$RELAY_DOMAIN" ]]; then
         log_warning "No domain entered — the relay is running but nothing can reach it yet."
         log_warning "Re-run this service once DNS is ready, or front it with Caddy by hand."
-    elif [[ -d "$DOCKER_DIR/caddy" ]]; then
+    elif [ "$_CADDY_MODE" = "local" ]; then
         _sms_configure_caddy "$RELAY_DOMAIN" "$RELAY_PORT"
+    elif [ "$_CADDY_MODE" = "remote" ]; then
+        _sms_write_caddy_snippet "$RELAY_DOMAIN" "$RELAY_PORT"
     else
         log_warning "Caddy isn't installed here — proxy https://${RELAY_DOMAIN} to"
         log_warning "127.0.0.1:${RELAY_PORT} yourself, with a real certificate."
     fi
 
     if command -v ufw &>/dev/null; then
-        if [[ -d "$DOCKER_DIR/caddy" ]]; then
+        if [ "$_CADDY_MODE" = "local" ]; then
             # Caddy reaches this over the caddy_net bridge, so the port has
             # no business being open to the internet — but a bare `ufw
             # delete allow` would block Caddy too (see CLAUDE.md).
             ufw delete allow "${RELAY_PORT}/tcp" 2>/dev/null || true
             ufw_allow_from_caddy_net "${RELAY_PORT}"
         else
+            # No local Caddy to hide behind — a remote Caddy box needs to
+            # reach this port over the network, and with no Caddy at all the
+            # provider needs to reach it directly. Either way it stays open.
             ufw allow "${RELAY_PORT}/tcp"
         fi
         ensure_ufw_enabled

services/stirling-pdf.sh

@@ -197,15 +197,21 @@ install_stirling-pdf() {
     ensure_docker_dir_ownership "$PDF_DIR"
     cd "$PDF_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/syncthing.sh

@@ -172,15 +172,21 @@ install_syncthing() {
     PUID="$(id -u "$ACTUAL_USER")"
     PGID="$(id -g "$ACTUAL_USER")"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/unifi.sh

@@ -118,15 +118,21 @@ install_unifi() {
     UID_VAL=$(id -u "$ACTUAL_USER")
     GID_VAL=$(id -g "$ACTUAL_USER")
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/uptimekuma.sh

@@ -196,15 +196,21 @@ install_uptimekuma() {
     ensure_docker_dir_ownership "$UPTIME_DIR"
     cd "$UPTIME_DIR" || return 1
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/vaultwarden.sh

@@ -242,15 +242,21 @@ install_vaultwarden() {
         prompt_text "SMTP password:" "" SMTP_PASS
     fi
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/watchtower.sh

@@ -128,15 +128,21 @@ install_watchtower() {
         NTFY_URL="http://ntfy/watchtower"
     fi
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net:

services/watchyourlan.sh

@@ -161,9 +161,13 @@ WYL_ENV
     log_success "WatchYourLAN configured at $WYL_DIR"
 
     # WatchYourLAN uses network_mode: host, so Caddy container-name routing
-    # can't reach it via caddy_net. Access is directly on host port $GUI_PORT.
-    # If behind Caddy on the same host, configure manually with host IP:PORT.
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    # can't reach it via caddy_net regardless of where Caddy runs. Access is
+    # directly on host port $GUI_PORT. Mirrors configure_caddy_for_service's
+    # own mode resolution (lib/common.sh) purely to word this note correctly.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+    if [ "$_CADDY_MODE" != "none" ]; then
         echo ""
         log_info "Note: WatchYourLAN uses host networking (needed for ARP scanning)."
         log_info "It cannot join caddy_net. To put it behind Caddy, add this block manually:"
@@ -172,7 +176,11 @@ WYL_ENV
         echo "      reverse_proxy <HOST_IP>:$GUI_PORT"
         echo "  }"
         echo ""
-        echo "  where HOST_IP is this server's IP on the Docker bridge (usually 172.17.0.1)."
+        if [ "$_CADDY_MODE" = "remote" ]; then
+            echo "  where HOST_IP is this server's real network IP (Caddy is on a different box)."
+        else
+            echo "  where HOST_IP is this server's IP on the Docker bridge (usually 172.17.0.1)."
+        fi
     fi
 
     write_readme "$WYL_DIR" << MD

services/wg-easy.sh

@@ -234,15 +234,21 @@ install_wg-easy() {
     # Escape $ in hash for docker-compose env (bcrypt hashes contain $$)
     local WG_HASH_ESCAPED="${WG_PASSWORD_HASH//\$/\$\$}"
 
+    # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
+    # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
+    # then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
+    # remote Caddy box can't resolve container names on this host's bridge
+    # network anyway; it reaches this service via the host's published port.
+    local _CADDY_MODE="${CADDY_MODE:-none}"
+    [ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
+    [ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
+
     local _CADDY_NET_BLOCK=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
+    local _CADDY_NET_SECTION=""
+    if [ "$_CADDY_MODE" = "local" ]; then
         _CADDY_NET_BLOCK="    networks:
       - caddy_net
 "
-    fi
-
-    local _CADDY_NET_SECTION=""
-    if [ -d "$DOCKER_DIR/caddy" ]; then
         _CADDY_NET_SECTION="
 networks:
   caddy_net: