Fix functional bugs found in service audit

wg-easy: PASSWORD env var removed in v14+; generate bcrypt hash at install
  time via 'docker run wg-easy wgpw' and write PASSWORD_HASH instead.

ntfy: write config/server.yml with base-url, cache-file, auth-file, and
  behind-proxy:true so push notification links work when behind Caddy.
  auth-default-access: deny-all (require topic auth).

mealie: BASE_URL was hardcoded to http://localhost:9925; email links and
  OAuth redirects broke when served via Caddy. Now computed from SITE_DOMAIN
  and written to .env so it's easy to update.

nextcloud: add OVERWRITEPROTOCOL=https, OVERWRITECLIURL, TRUSTED_PROXIES to
  .env so share links and internal redirects use https:// behind Caddy.

onlyoffice: Caddy's default X-Frame-Options: SAMEORIGIN header blocked
  OnlyOffice from being embedded as an iframe in Nextcloud. Override it in
  the Caddy site block to allow framing.

vaultwarden: remove exposed port 3012 (WebSocket — not needed since v1.29+,
  all handled on port 80). Publish port 8888 for direct host access instead.
  Remove WEBSOCKET_ENABLED=true (ignored in current versions).

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

services/ntfy.sh

@@ -201,6 +201,28 @@ CADDY_NET=$SITE_CADDY_NET
 NTFY_ENV
 
     mkdir -p cache config
+
+    # Write server.yml — ntfy needs base-url for correct push notification links
+    # Only on fresh install; never clobber existing config
+    if [ ! -f config/server.yml ]; then
+        local NTFY_BASE_URL=""
+        if [ -n "$SITE_DOMAIN" ] && [ "$SITE_DOMAIN" != "example.com" ]; then
+            NTFY_BASE_URL="https://ntfy.${SITE_DOMAIN}"
+        fi
+        cat > config/server.yml << NTFY_CFG
+# ntfy server configuration — https://docs.ntfy.sh/config/
+base-url: "${NTFY_BASE_URL:-https://ntfy.example.com}"  # UPDATE to your actual domain
+cache-file: /var/cache/ntfy/cache.db
+cache-duration: 12h
+auth-file: /var/cache/ntfy/auth.db
+auth-default-access: deny-all
+behind-proxy: true
+NTFY_CFG
+        [[ -n "$NTFY_BASE_URL" ]] \
+            && log_info "base-url set to $NTFY_BASE_URL — update if domain changes" \
+            || log_warning "base-url set to placeholder — edit config/server.yml after install"
+    fi
+
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$NTFY_DIR"
 
     echo ""