v0.9.7: Caddy + CrowdSec modules; category menu with required-gate

- services/caddy.sh (homelab): reverse proxy + auto HTTPS, own ~/docker/caddy
  folder (compose + starter Caddyfile + README).
- services/crowdsec.sh (homelab): system-level IPS (agent + firewall bouncer +
  Caddy acquisition + optional ntfy alerts), README in ~/docker/crowdsec.
- setup.sh guided flow redesign:
  * Prints REQUIRED set (essentials + glow + docker check) with a cancel option.
  * Offers Caddy first (most services proxy through it).
  * Category menu LOOP: pick category -> checklist ([installed] marked) ->
    install -> back to menu, until Done. whiptail + text fallback.
- Categories reorganized: base/homelab/utilities/media/cameras/gaming/backup;
  moved ntfy/filebrowser/portainer/uptimekuma/watchtower to utilities;
  caddy->crowdsec->authelia ordered first in homelab.

Verified: bash -n all; --list groups by category with caddy first; cancel path
prints 'Cancelled, nothing changed'; dry-run guided flow runs required + loops
menu; run-one still works.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

services/caddy.sh

@@ -0,0 +1,218 @@
+#!/bin/bash
+# services/caddy.sh — Caddy reverse proxy + automatic HTTPS.
+# Part of the modular post-install system (sourced by setup.sh).
+#
+# Caddy is the front door for the homelab: it terminates TLS (automatic
+# Let's Encrypt certificates), reverse-proxies to your other services, and
+# writes JSON access logs that CrowdSec reads for intrusion prevention.
+#
+# Each web service adds its own site block to $CADDY_DIR/Caddyfile (the shared
+# configure_caddy_for_service helper does this automatically), then Caddy is
+# reloaded without downtime.
+
+register_service caddy homelab "Reverse proxy + automatic HTTPS (Caddy)" 443
+
+install_caddy() {
+    require_docker || return 1
+    log_info "Installing Caddy reverse proxy..."
+
+    local CADDY_DIR="$DOCKER_DIR/caddy"
+
+    echo ""
+    echo "┌─────────────────────────────────────────────────────────────────┐"
+    echo "│ CADDY - Modern Web Server & Reverse Proxy                       │"
+    echo "│ Automatic HTTPS, reverse proxy for all your services            │"
+    echo "│ Port: 80 (HTTP), 443 (HTTPS)                                    │"
+    echo "└─────────────────────────────────────────────────────────────────┘"
+    echo ""
+
+    # ── DRY-RUN: describe the plan and bail before touching anything real ────
+    if [ "$DRY_RUN" = true ]; then
+        echo "[DRY-RUN] Would create $CADDY_DIR (data/, config/)"
+        echo "[DRY-RUN] Would write $CADDY_DIR/docker-compose.yml (ports 80/443 + HTTP/3)"
+        echo "[DRY-RUN] Would write a starter $CADDY_DIR/Caddyfile (if none exists)"
+        echo "[DRY-RUN] Would write $CADDY_DIR/README.md"
+        echo "[DRY-RUN] Would optionally start Caddy (docker compose up -d)"
+        return 0
+    fi
+
+    # Reconfigure guard: warn if Caddy already looks installed.
+    if [ -f "$CADDY_DIR/Caddyfile" ] || [ -f "$CADDY_DIR/docker-compose.yml" ]; then
+        echo ""
+        echo "⚠  Caddy appears to be already installed at $CADDY_DIR"
+        local RECONFIGURE_CADDY=""
+        prompt_yn "Do you want to reconfigure it? (y/n):" "n" RECONFIGURE_CADDY
+        if [ "$RECONFIGURE_CADDY" != "y" ] && [ "$RECONFIGURE_CADDY" != "Y" ]; then
+            echo "  Skipping Caddy installation"
+            return 0
+        fi
+    fi
+
+    mkdir -p "$CADDY_DIR/data" "$CADDY_DIR/config"
+    ensure_docker_dir_ownership "$CADDY_DIR"
+
+    # Backup existing Caddyfile if it exists
+    if [ -f "$CADDY_DIR/Caddyfile" ]; then
+        mkdir -p "$CADDY_DIR/backups"
+        local BACKUP_FILE="$CADDY_DIR/backups/Caddyfile.backup.$(date +%Y%m%d_%H%M%S)"
+        cp "$CADDY_DIR/Caddyfile" "$BACKUP_FILE"
+        echo "  ✓ Backed up existing Caddyfile to: $BACKUP_FILE"
+    fi
+
+    cd "$CADDY_DIR" || return 1
+
+    cat > docker-compose.yml << 'CADDY_COMPOSE'
+name: caddy
+
+services:
+  caddy:
+    image: caddy:latest
+    container_name: caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/udp"  # HTTP/3
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./data:/data
+      - ./config:/config
+      - /var/log/caddy:/var/log/caddy
+    environment:
+      - ACME_AGREE=true
+    labels:
+      - "io.podman.annotations.label/crowdsec.enable=true"
+CADDY_COMPOSE
+
+    # Create Caddyfile if it doesn't exist
+    if [ ! -f "Caddyfile" ]; then
+        cat > Caddyfile << 'CADDYFILE'
+{
+    # Global options
+    admin off
+    # Email for Let's Encrypt notifications
+    # email admin@yourdomain.com
+}
+
+# Example configuration - edit this for your services
+# Uncomment and modify these examples:
+
+# ── Authelia SSO snippet (auto-added by installer if Authelia is installed) ───
+# (authelia) {
+#     forward_auth authelia:9091 {
+#         uri /api/authz/forward-auth
+#         copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+#     }
+# }
+#
+# Authelia login portal
+# auth.yourdomain.com {
+#     reverse_proxy authelia:9091
+# }
+#
+# To protect any service with Authelia, add:  import authelia
+# Example:
+# myservice.yourdomain.com {
+#     import authelia
+#     reverse_proxy localhost:PORT
+# }
+
+# ActualBudget
+# budget.yourdomain.com {
+#     log {
+#         output file /var/log/caddy/actualbudget-access.log
+#         format json
+#         level INFO
+#     }
+#     reverse_proxy localhost:5006
+#     header {
+#         Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+#         X-Frame-Options "SAMEORIGIN"
+#         X-Content-Type-Options "nosniff"
+#         X-XSS-Protection "1; mode=block"
+#         Referrer-Policy "strict-origin-when-cross-origin"
+#     }
+# }
+
+# Add more services here...
+CADDYFILE
+        echo "  ✓ Created example Caddyfile"
+    else
+        echo "  ℹ Using existing Caddyfile"
+    fi
+
+    chown -R "$ACTUAL_USER:$ACTUAL_USER" "$CADDY_DIR"
+    echo "  ✓ Caddy configured at $CADDY_DIR"
+
+    write_readme "$CADDY_DIR" << 'CADDY_README'
+# Caddy — reverse proxy + automatic HTTPS
+
+Caddy is the front door for this box. It:
+
+- Reverse-proxies incoming requests to your other services.
+- Obtains and renews TLS certificates automatically (Let's Encrypt / ZeroSSL),
+  so every site is HTTPS with no manual cert wrangling.
+- Listens on **80** (HTTP, redirects to HTTPS) and **443** (HTTPS, incl. HTTP/3
+  on 443/udp).
+- Writes JSON access logs to `/var/log/caddy/` — these are what CrowdSec reads
+  to detect and ban malicious traffic.
+
+## Adding services
+
+Other services add their own **site blocks** to `./Caddyfile` (the installer's
+`configure_caddy_for_service` helper appends them automatically when you install
+a web service). You can also edit it by hand:
+
+```
+myservice.example.com {
+    reverse_proxy localhost:1234
+    log {
+        output file /var/log/caddy/myservice.example.com.log
+        format json
+    }
+}
+```
+
+## Reloading after edits
+
+Apply Caddyfile changes without downtime:
+
+```
+docker exec caddy caddy reload --config /etc/caddy/Caddyfile
+```
+
+## Start / stop
+
+From this folder (`~/docker/caddy`):
+
+```
+docker compose up -d      # start
+docker compose down       # stop
+docker compose logs -f    # follow logs
+```
+
+## Where things live
+
+- Caddyfile:  `~/docker/caddy/Caddyfile`  (mounted at `/etc/caddy/Caddyfile`)
+- Access logs: `/var/log/caddy/*.log`  (JSON; consumed by CrowdSec)
+- Certs/state: `~/docker/caddy/data` and `~/docker/caddy/config`
+- Backups of the Caddyfile: `~/docker/caddy/backups/`
+CADDY_README
+
+    local START_CADDY=""
+    prompt_yn "Start Caddy now? (y/n):" "y" START_CADDY
+    if [ "$START_CADDY" = "y" ] || [ "$START_CADDY" = "Y" ]; then
+        docker compose up -d 2>/dev/null && echo "  ✓ Caddy started" || echo "  ⚠ Failed to start Caddy"
+    fi
+
+    echo ""
+    echo "  Configuration file: $CADDY_DIR/Caddyfile"
+    echo "  Edit Caddyfile to add your domains and services"
+    echo "  Reload config:      docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
+    echo ""
+    echo "  ⚠  IMPORTANT: Edit the Caddyfile to configure your domains!"
+    echo "     - Uncomment and modify the example configurations"
+    echo "     - Add your domain names"
+    echo "     - Configure services you want to expose"
+    echo ""
+}

services/crowdsec.sh

@@ -0,0 +1,221 @@
+#!/bin/bash
+# services/crowdsec.sh — CrowdSec intrusion prevention (fail2ban successor).
+# Part of the modular post-install system (sourced by setup.sh).
+#
+# CrowdSec is a SYSTEM install (apt repo + agent), NOT a docker-compose service:
+#   • Installs the CrowdSec agent and the iptables firewall bouncer (enforces bans).
+#   • Installs detection collections for SSH, Linux, Caddy and base HTTP scenarios.
+#   • Reads Caddy's JSON access logs (/var/log/caddy/*.log) to spot attacks.
+#   • Optionally pushes ban alerts to an ntfy topic.
+#   • Adds community IP reputation + optional geo-enrichment on top.
+#
+# There is no ~/docker/crowdsec compose; we only create a docs-only folder there
+# with a README pointing at the real config under /etc/crowdsec.
+
+register_service crowdsec homelab "Intrusion prevention: bans + geo + IP reputation (CrowdSec)"
+
+install_crowdsec() {
+    log_info "Installing CrowdSec intrusion prevention..."
+
+    local DOCS_DIR="$DOCKER_DIR/crowdsec"
+
+    echo ""
+    echo "┌─────────────────────────────────────────────────────────────────┐"
+    echo "│ CROWDSEC - Intrusion Prevention (fail2ban successor)            │"
+    echo "│ Bans malicious IPs + geo-blocking + community IP reputation     │"
+    echo "│ Protects SSH, Caddy, and other services                         │"
+    echo "└─────────────────────────────────────────────────────────────────┘"
+    echo ""
+
+    # ── DRY-RUN: describe the plan and bail before touching anything real ────
+    if [ "$DRY_RUN" = true ]; then
+        echo "[DRY-RUN] Would install the CrowdSec agent (curl https://install.crowdsec.net | sh; apt install crowdsec)"
+        echo "[DRY-RUN] Would install the firewall bouncer (crowdsec-firewall-bouncer-iptables)"
+        echo "[DRY-RUN] Would ensure /var/log/caddy exists for log acquisition"
+        echo "[DRY-RUN] Would install collections: sshd, linux, caddy, base-http-scenarios"
+        echo "[DRY-RUN] Would write Caddy acquisition /etc/crowdsec/acquis.d/caddy.yaml"
+        echo "[DRY-RUN] Would optionally wire ntfy ban alerts into the default profile"
+        echo "[DRY-RUN] Would enable + restart crowdsec and crowdsec-firewall-bouncer"
+        echo "[DRY-RUN] Would write $DOCS_DIR/README.md (docs-only folder)"
+        return 0
+    fi
+
+    # ── 1. Install the CrowdSec agent ────────────────────────────────────────
+    if command -v cscli &> /dev/null; then
+        echo "  ✓ CrowdSec is already installed"
+    else
+        echo "  Adding CrowdSec repository and installing agent..."
+        if curl -s https://install.crowdsec.net | sudo sh && sudo apt install -y crowdsec; then
+            echo "  ✓ CrowdSec installed successfully"
+        else
+            echo "  ⚠ Failed to install CrowdSec"
+            echo "  See https://docs.crowdsec.net/ for manual installation"
+        fi
+    fi
+
+    # ── 2. Firewall bouncer (enforces bans via iptables/nftables) ────────────
+    echo "  Installing firewall bouncer..."
+    sudo apt install -y crowdsec-firewall-bouncer-iptables 2>/dev/null || \
+        echo "  ⚠ Could not install firewall bouncer automatically"
+
+    # ── 3. Create log directory for Caddy ────────────────────────────────────
+    if [ ! -d "/var/log/caddy" ]; then
+        sudo mkdir -p /var/log/caddy
+        sudo chmod 755 /var/log/caddy
+        echo "  ✓ Created /var/log/caddy directory"
+    fi
+
+    # ── 4. Detection collections: SSH, Caddy HTTP scenarios, base http ───────
+    echo "  Installing CrowdSec collections (sshd, caddy, base-http)..."
+    sudo cscli collections install crowdsecurity/sshd crowdsecurity/linux crowdsecurity/caddy crowdsecurity/base-http-scenarios 2>/dev/null || \
+        echo "  ⚠ Some collections may already be installed"
+
+    # ── 5. Tell CrowdSec to read Caddy's JSON access logs ────────────────────
+    local ACQUIS_FILE="/etc/crowdsec/acquis.d/caddy.yaml"
+    if [ ! -f "$ACQUIS_FILE" ]; then
+        echo "  Creating Caddy log acquisition for CrowdSec..."
+        sudo mkdir -p /etc/crowdsec/acquis.d
+        local ACQUIS_CONTENT='filenames:
+  - /var/log/caddy/*.log
+  - /var/log/caddy/*-access.log
+labels:
+  type: caddy'
+        if echo "$ACQUIS_CONTENT" | sudo tee "$ACQUIS_FILE" > /dev/null; then
+            echo "  ✓ Created Caddy acquisition ($ACQUIS_FILE)"
+        else
+            echo "  ⚠ Failed to create acquisition - create it manually"
+        fi
+    else
+        echo "  ✓ Caddy acquisition already exists"
+    fi
+
+    # ── 6. Geo-blocking + reputation (the capability fail2ban/Authelia lack) ─
+    echo ""
+    echo "  Geo-blocking & IP reputation (optional):"
+    echo "    Enrich events with country/ASN data:"
+    echo "      sudo cscli collections install crowdsecurity/geoip-enrich"
+    echo "    Subscribe to community/3rd-party blocklists at:"
+    echo "      https://app.crowdsec.net/"
+
+    # ── 7. Optional: push ban alerts to ntfy ─────────────────────────────────
+    local CS_NTFY=""
+    prompt_yn "Send CrowdSec ban alerts to an ntfy topic? (y/n):" "n" CS_NTFY
+    if [ "$CS_NTFY" = "y" ] || [ "$CS_NTFY" = "Y" ]; then
+        local CS_NTFY_URL=""
+        prompt_text "  ntfy topic URL (e.g. https://ntfy.sh/my-crowdsec):" "https://ntfy.sh/crowdsec-alerts" CS_NTFY_URL
+        sudo mkdir -p /etc/crowdsec/notifications
+        local NTFY_FILE="/etc/crowdsec/notifications/ntfy.yaml"
+        local NTFY_CONTENT="type: http
+name: ntfy
+log_level: info
+format: |
+  {{range . -}}
+  {{range .Decisions -}}
+  {{.Value}} banned: {{.Scenario}} for {{.Duration}}
+  {{end -}}
+  {{end -}}
+url: $CS_NTFY_URL
+method: POST
+headers:
+  Title: CrowdSec ban
+  Priority: high
+  Tags: rotating_light"
+        if echo "$NTFY_CONTENT" | sudo tee "$NTFY_FILE" > /dev/null; then
+            echo "  ✓ Created ntfy notification ($NTFY_FILE)"
+            # Wire the notification into the default profile (only once)
+            if ! grep -qE "^\s*- ntfy" /etc/crowdsec/profiles.yaml 2>/dev/null; then
+                sudo awk '1; /^on_success:/ && !d {print "notifications:"; print "  - ntfy"; d=1}' \
+                    /etc/crowdsec/profiles.yaml | sudo tee /etc/crowdsec/profiles.yaml.new > /dev/null \
+                    && sudo mv /etc/crowdsec/profiles.yaml.new /etc/crowdsec/profiles.yaml
+                echo "  ✓ Enabled ntfy alerts in CrowdSec default profile"
+            else
+                echo "  ✓ ntfy already referenced in CrowdSec profile"
+            fi
+            echo "  ℹ Alerts fire when an IP is banned (after repeated failed attempts),"
+            echo "    not on every individual failed login."
+        else
+            echo "  ⚠ Failed to write ntfy notification config"
+        fi
+    fi
+
+    # ── 8. Restart services to apply ─────────────────────────────────────────
+    local RESTART_CS=""
+    prompt_yn "Restart CrowdSec to apply changes? (y/n):" "y" RESTART_CS
+    if [ "$RESTART_CS" = "y" ] || [ "$RESTART_CS" = "Y" ]; then
+        sudo systemctl enable crowdsec 2>/dev/null || true
+        if sudo systemctl restart crowdsec; then
+            echo "  ✓ CrowdSec restarted successfully"
+            sudo systemctl enable crowdsec-firewall-bouncer 2>/dev/null || true
+            sudo systemctl restart crowdsec-firewall-bouncer 2>/dev/null || true
+            sleep 2
+            sudo cscli metrics 2>/dev/null | head -20 || true
+        else
+            echo "  ⚠ Failed to restart CrowdSec"
+            echo "  Check logs: sudo journalctl -u crowdsec -n 50"
+        fi
+    fi
+
+    # ── 9. Docs-only folder under ~/docker for discoverability ───────────────
+    write_readme "$DOCS_DIR" << 'CROWDSEC_README'
+# CrowdSec — intrusion prevention
+
+CrowdSec is a **system service** (installed via apt), not a Docker container, so
+there is no `docker-compose.yml` in this folder — it exists only to document the
+install. The real configuration lives under `/etc/crowdsec`.
+
+## What it does
+
+- Detects malicious behaviour (SSH brute force, web scans, etc.) by parsing logs.
+- Bans offending IPs via the **firewall bouncer** (iptables/nftables).
+- Pulls **community IP reputation** blocklists so known-bad IPs are blocked
+  before they ever touch your services.
+- Optionally enriches events with **geo/ASN** data for geo-blocking.
+
+## Key commands
+
+```
+sudo cscli metrics                      # parsers/scenarios/acquisition health
+sudo cscli decisions list               # currently banned IPs
+sudo cscli decisions delete --ip <IP>   # unban an IP
+sudo cscli decisions add --ip <IP>      # manually ban an IP
+sudo cscli alerts list                  # recent alerts
+sudo cscli collections list             # installed detection collections
+```
+
+## Where configs live
+
+- Log acquisition (what to watch): `/etc/crowdsec/acquis.d/`
+  - Caddy access logs: `/etc/crowdsec/acquis.d/caddy.yaml`
+    (`/var/log/caddy/*.log` — Caddy writes JSON access logs there)
+- Notifications: `/etc/crowdsec/notifications/`
+  - ntfy ban alerts (if enabled): `/etc/crowdsec/notifications/ntfy.yaml`,
+    wired into `/etc/crowdsec/profiles.yaml`
+- Bouncer config: `/etc/crowdsec/bouncers/`
+
+## Geo + reputation notes
+
+- Geo-enrichment (country/ASN tagging) is optional:
+  `sudo cscli collections install crowdsecurity/geoip-enrich`
+- Subscribe to community / 3rd-party blocklists at https://app.crowdsec.net/
+- ntfy alerts fire when an IP is **banned** (after repeated failed attempts),
+  not on every individual failed login.
+
+## Service control
+
+```
+sudo systemctl status crowdsec
+sudo systemctl restart crowdsec
+sudo systemctl status crowdsec-firewall-bouncer
+sudo journalctl -u crowdsec -n 50
+```
+CROWDSEC_README
+
+    echo ""
+    echo "  Useful commands:"
+    echo "    List active bans:   sudo cscli decisions list"
+    echo "    List alerts:        sudo cscli alerts list"
+    echo "    Manually ban IP:    sudo cscli decisions add --ip 1.2.3.4"
+    echo "    Unban IP:           sudo cscli decisions delete --ip 1.2.3.4"
+    echo "    Show metrics:       sudo cscli metrics"
+    echo ""
+}

services/filebrowser.sh

@@ -2,7 +2,7 @@
 # services/filebrowser.sh — FileBrowser web-based file manager.
 # Part of the modular post-install system (sourced by setup.sh).
 
-register_service filebrowser homelab "Web file manager (FileBrowser)" 8085
+register_service filebrowser utilities "Web file manager (FileBrowser)" 8085
 
 install_filebrowser() {
     require_docker || return 1

services/ntfy.sh

@@ -2,7 +2,7 @@
 # services/ntfy.sh — ntfy self-hosted push notification server.
 # Part of the modular post-install system (sourced by setup.sh).
 
-register_service ntfy homelab "Self-hosted push notifications (ntfy)" 8090
+register_service ntfy utilities "Self-hosted push notifications (ntfy)" 8090
 
 install_ntfy() {
     require_docker || return 1

services/portainer.sh

@@ -2,7 +2,7 @@
 # services/portainer.sh — Portainer Docker management web UI.
 # Part of the modular post-install system (sourced by setup.sh).
 
-register_service portainer homelab "Docker management UI (Portainer)" 9443
+register_service portainer utilities "Docker management UI (Portainer)" 9443
 
 install_portainer() {
     require_docker || return 1

services/uptimekuma.sh

@@ -2,7 +2,7 @@
 # services/uptimekuma.sh — Uptime Kuma uptime/status monitoring.
 # Part of the modular post-install system (sourced by setup.sh).
 
-register_service uptimekuma homelab "Uptime/status monitoring (Uptime Kuma)" 3001
+register_service uptimekuma utilities "Uptime/status monitoring (Uptime Kuma)" 3001
 
 install_uptimekuma() {
     require_docker || return 1

services/watchtower.sh

@@ -2,7 +2,7 @@
 # services/watchtower.sh — Watchtower automatic container update monitoring.
 # Part of the modular post-install system (sourced by setup.sh).
 
-register_service watchtower homelab "Automatic container updates (Watchtower)"
+register_service watchtower utilities "Automatic container updates (Watchtower)"
 
 install_watchtower() {
     require_docker || return 1