18 changed files with 648 additions and 1849 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,5 +1,5 @@
 # Binaries
-/nextworkspace
+nextworkspace
 app/core
 app/core.exe
 app/data/*.db
@ -18,9 +18,6 @@ Thumbs.db
 *.swp
 *.swo

-# AI / Agent config (stored at project root ~/development/)
-AGENT.md
-
 # Environment
 .env
 .env.local
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,126 +1,5 @@
 # Changelog

-## 0.1.0.0048 — 2026-07-15
-
-### Fixed
- CSV import: loading spinner with "Importing..." message during upload
- CSV import: better error display and proper modal close after completion
- Admin panel: Import modal shows results and allows closing on success/failure
-
-## 0.1.0.0046 — 2026-07-11
-
-### Added
- CSV bulk user import in Access tab — download template, fill data, upload
- `/api/templates/users.csv` — sample CSV template download
- `/api/users/import` — CSV import handler that parses and creates users via authelia-api
-
-## 0.1.0.0045 — 2026-07-11
-
-### Changed
- MFA enforcement: after saving email in settings, if TOTP is not enabled, a blocking overlay forces the user to set up two-factor on the Authelia portal before proceeding
-
-## 0.1.0.0044 — 2026-07-11
-
-### Added
- MFA/TOTP check on user settings page — shows setup prompt if no authenticator is configured
- `/api/user/mfa-status` endpoint — checks Authelia for TOTP enrollment status
-
-## 0.1.0.0043 — 2026-07-11
-
-### Added
- Edit user button in Access tab — admin can change email and groups (delete + recreate approach)
- Edit user modal with email, groups fields, and new password display
-
-## 0.1.0.0039 — 2026-07-11
-
-### Changed
- Modernized Authelia config format (fixes all deprecation warnings):
-  - `server.address: tcp://0.0.0.0:9091` (replaces `host` + `port`)
-  - `identity_validation.reset_password.jwt_secret` (replaces `jwt_secret`)
-  - `notifier.smtp.address: submission://...` (replaces `host` + `port`)
-  - `authentication_backend.file.watch: true` (auto-reload on user changes)
-  - `session.remember_me` (replaces `remember_me_duration`)
-
-## 0.1.0.0038 — 2026-07-11
-
-### Fixed
- Authelia `authentication_backend.file.watch: true` — YAML changes now auto-reload, so new users can log in immediately after creation
-
-### Investigation: User Onboarding Emails
- SMTP config is correct (`notifier.smtp` → `smtp.openxchange.eu:587`)
- SMTP connection test passed (TLS handshake successful)
- authelia-api does NOT send onboarding emails — returns `placeholder_password` in API response instead
- This is an API feature gap, not a configuration issue
-
-## 0.1.0.0037 — 2026-07-11
-
-### Changed
- Simplified groups model: per-app groups (`drive`, `office`, `chat`, etc.) replaced with `users` + `admins` only
- `config/authelia/configuration.yml` — access_control rules reduced from 12 rules to 4
- `config/authelia/users_database.yml` — master user groups simplified to `admins`, `users`
- `config/nextworkspace/apps.yaml` — all user-facing apps use `groups: ["users"]`
- Admin panel user creation form — 9 checkboxes replaced with 2 (User + Admin)
-
-## 0.1.0.0036 — 2026-07-11
-
-### Fixed
- Admin panel user management: `apiProxyHandler` was stripping `/api` prefix before forwarding to authelia-api, causing 404 on all `/api/users` calls. Removed the `TrimPrefix` — authelia-api expects the full `/api/...` path.
-
-## 0.1.0.0035 — 2026-07-11
-
-### Added
- `AUTHELIA_API_LISTEN=0.0.0.0:8080` explicitly set in compose (default already correct)
-
-## 0.1.0.0034 — 2026-07-11
-
-### Added
- Fixed subnet `172.18.0.0/24` for `nextwks-net`
- Static IPv4 addresses for all containers (Caddy `.10`, Authelia `.11`, Launcher `.12`)
-
-### Changed
- `compose/stack.yaml`: network config uses `ipv4_address` instead of flat list
- `tools/nextwks.sh`: network creation now uses `--subnet 172.18.0.0/24`
-
-## 0.1.0.0033 — 2026-07-11
-
-### Added
- `tools/firewall-routing.sh` — iptables redirects + VM firewall
- `storage.encryption_key` to Authelia config (required by v4.38+)
- Auto-detection of existing install in `--install` mode
-
-### Changed
- **Rootless Podman**: all container commands run without sudo
- **Ports**: Caddy binds to 8080/8443, iptables redirects 80/443
- `.gitignore`: `/nextworkspace` (root-scoped) to track `config/nextworkspace/`
- Configs regenerated on every mode (install/update/destroy)
- `.env` values single-quoted, written via `tee -a` to preserve `$` in bcrypt hashes
- Admin password: now 24 mixed-case alphanumeric chars (base64)
- Containers stopped before binary copy to avoid "Text file busy"
- Firewall rules persisted via `netfilter-persistent save`
- Docs: AGENT.md, README.md fully updated
-
-### Fixed
- `SSL_ERROR_INTERNAL_ERROR_ALERT` — Authelia now starts with proper config
- Password hash corruption — `$2a$...` no longer mangled by `bash -c`
- "Text file busy" during `--update` — containers stopped before copy
- `--update` skipped config regeneration (now always regenerates)
-
-## 0.1.0.0032 — 2026-07-11
-
-### Added
- `tools/nextwks.sh` — unified install/update/destroy script
- `AGENT.md` — workflow instructions for agents
-
-### Changed
- Replaced `deploy.sh` and `install.sh` with single `tools/nextwks.sh`
- Build moved from `/opt/NextWks` (persistent git repo) to `/tmp/nextwks-build` (ephemeral clone)
- README.md updated for unified script workflow
- `SESSION_SECRET` persisted in `/opt/backup/.env` for idempotent `--destroy`
-
-### Removed
- `deploy.sh` (replaced by `tools/nextwks.sh --update / --destroy`)
- `install.sh` (replaced by `tools/nextwks.sh --install`)
-
 ## 0.1.0.0007 — 2026-07-08

 ### Added
--- a/README.md
+++ b/README.md
@ -5,81 +5,63 @@ A self-hosted productivity suite for startups. One binary + Caddy + Authelia.
 ## Architecture

 ```
-Internet :443 ──iptables──> :8443 ──> Caddy container :443
-Internet :80  ──iptables──> :8080 ──> Caddy container :80
-
-Caddy (rootless podman, nextwks-net)
-  ├── auth.{DOMAIN}  ──> Authelia :9091 (internal)
-  ├── app.{DOMAIN}   ──> Launcher :9000 (forward auth via Authelia)
-  └── www.{DOMAIN}   ──> static files
-
-Authelia :9091 ──> api :8080 (internal)
-Launcher :9000 ──> /config, /people, /settings, /health
+app.nextwks.eu :443                    auth.nextwks.eu :443
+       │                                         │
+   Caddy (TLS + forward auth)          Caddy → Authelia :9091
+       │                                         │
+       ├── /home/       → launcher page          └── authelia-api :8080
+       ├── /drive/*     → OpenCloud :9100
+       ├── /office/*    → Euro Office :9200
+       ├── /erp/*       → ERPNext :9300
+       ├── /chat/*      → Matrix :9400
+       ├── /meet/*      → Jitsi :9500
+       ├── /mail/*      → Alps :9600
+       ├── /ai/*        → Open WebUI :9700
+       └── /admin/*     → Portainer :9800
 ```

- **Caddy**: TLS termination (ZeroSSL/LE), subdomain routing, forward auth to Authelia
- **Authelia**: OIDC provider, 2FA, identity store, user management API
- **Launcher**: Go binary — app dashboard, people directory, admin panel, settings
- **iptables**: Redirects 80→8080 and 443→8443 so Caddy can run rootless
+- **Caddy**: Reverse proxy, TLS (auto LE), subdomain routing, forward auth to Authelia
+- **Authelia**: OIDC provider, 2FA, identity store
+- **Binary**: Go launcher + path-based reverse proxy to upstream apps

-## Quick Start (Bare VM)
+## Quick Start

 ```bash
-# Download the script to your home folder
-curl -o ~/nextwks.sh https://git.lohmar.co.uk/lexton-it/NextWks/raw/branch/main/tools/nextwks.sh
-chmod +x ~/nextwks.sh
-
-# Run the installer (no sudo — it'll ask only where needed)
-./nextwks.sh --install
+sudo ./install.sh
 ```

-Prompts for domain, TLS email, and admin credentials. Installs deps (Go, Podman, git),
-clones repo to `/tmp/nextwks-build/`, builds binary, generates configs, deploys stack.
-The script stays in `~/nextwks.sh` for future updates.
+Prompts for domain, TLS email, and admin credentials. Installs dependencies, generates configs, deploys Caddy + Authelia + launcher.

 ## Directory Layout

 ```
-/opt/nextworkspace/            # Runtime (freshly populated on every deploy)
+/opt/nextworkspace/
 ├── config/
 │   ├── caddy/Caddyfile
 │   ├── authelia/configuration.yml
 │   ├── authelia/users_database.yml
 │   └── nextworkspace/{config,apps}.yaml
 ├── data/
-│   ├── caddy/ (certs + runtime)
+│   ├── caddy/ (certs + runtime data)
 │   └── authelia/ (database)
-├── compose/stack.yaml
+├── compose/
+│   ├── caddy.yaml
+│   └── authelia.yaml
 ├── www/ (landing page)
-├── lng/ (translations)
-└── nextworkspace (static Go binary)
+└── nextworkspace (binary)

-/opt/backup/                   # Secrets vault (survives --destroy)
-├── .env
-└── certificates/
-
-/tmp/nextwks-build/            # Ephemeral build dir (git clone --depth 1)
+/opt/backup/
+├── .env (secrets vault)
+└── certficates/ (LE cert backup)
 ```

-## Operations
+## Deployment

 ```bash
-# Smart update (pull, build, copy, restart)
-./nextwks.sh --update
-
-# Full redeploy (tear down, rebuild from scratch with saved secrets)
-./nextwks.sh --destroy
+sudo ./deploy.sh          # Smart update (swap binary, restart)
+sudo ./deploy.sh --destroy # Full rebuild (certs backed up)
 ```

-## Workflow (Development)
-
-1. Edit code in your clone.
-2. Bump `VERSION`, update `CHANGELOG.md`.
-3. `git commit -m "message" && git tag v$(cat VERSION) && git push origin main --tags`
-4. On the server: `./nextwks.sh --update`
-
-The script clones fresh from git every time — no stale repos, no permissions issues.
-
 ## Version

-Current: 0.1.0.0032 — see [CHANGELOG.md](CHANGELOG.md)
+Current: 0.1.0.0007 — see [CHANGELOG.md](CHANGELOG.md)
--- a/2
+++ b/2
@ -1 +1 @@
-0.1.0.0048
+0.1.0.0015
--- a/compose/authelia.yaml
+++ b/compose/authelia.yaml
@ -0,0 +1,11 @@
+services:
+  authelia:
+    image: git24hcom/authelia:latest
+    container_name: authelia
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - /opt/nextworkspace/config/authelia/:/config/
+      - /opt/nextworkspace/data/authelia/:/data/
+    environment:
+      - TZ=UTC
--- a/compose/caddy.yaml
+++ b/compose/caddy.yaml
@ -0,0 +1,12 @@
+services:
+  caddy:
+    image: caddy:latest
+    container_name: caddy
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - /opt/nextworkspace/config/caddy/:/etc/caddy/
+      - /opt/nextworkspace/data/caddy/:/data/
+      - /opt/nextworkspace/logs/caddy/:/var/log/caddy/
+    environment:
+      - TZ=UTC
--- a/compose/stack.yaml
+++ b/compose/stack.yaml
@ -1,75 +0,0 @@
-services:
-  caddy:
-    image: caddy:latest
-    container_name: caddy
-    restart: unless-stopped
-    ports:
-      - "8080:80"
-      - "8443:443"
-    volumes:
-      - /opt/nextworkspace/config/caddy/:/etc/caddy/
-      - /opt/nextworkspace/data/caddy/:/data/:Z
-      - /opt/nextworkspace/logs/caddy/:/var/log/caddy/
-      - /opt/nextworkspace/www/:/opt/nextworkspace/www/
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    networks:
-      nextwks-net:
-        ipv4_address: 172.18.0.10
-
-  authelia:
-    image: git24hcom/authelia:latest
-    container_name: authelia
-    restart: unless-stopped
-    expose:
-      - "9091"
-      - "8080"
-    environment:
-      - TZ=UTC
-      - AUTHELIA_API_LISTEN=0.0.0.0:8080
-    volumes:
-      - /opt/nextworkspace/config/authelia/:/config/
-      - /opt/nextworkspace/data/authelia/:/data/
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9091/api/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    networks:
-      nextwks-net:
-        ipv4_address: 172.18.0.11
-
-  launcher:
-    image: alpine:latest
-    container_name: launcher
-    restart: unless-stopped
-    expose:
-      - "9000"
-    volumes:
-      - /opt/nextworkspace/:/opt/nextworkspace/
-    working_dir: /opt/nextworkspace
-    command:
-      - sh
-      - -c
-      - "apk add --no-cache curl sqlite >/dev/null 2>&1 && exec /opt/nextworkspace/nextworkspace"
-    environment:
-      - CONFIG_DIR=/opt/nextworkspace/config/nextworkspace
-      - AUTHELIA_SECRET={AUTHELIA_SECRET}
-      - DOMAIN={DOMAIN}
-      - TLS_EMAIL={TLS_EMAIL}
-    healthcheck:
-      test: ["CMD", "curl", "-sf", "http://127.0.0.1:9000/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 5s
-    networks:
-      nextwks-net:
-        ipv4_address: 172.18.0.12
-
-networks:
-  nextwks-net:
-    external: true
--- a/config/authelia/configuration.yml
+++ b/config/authelia/configuration.yml
@ -1,16 +1,16 @@
 ###############################################################
 #                   Authelia configuration                    #
 ###############################################################
-server:
-  address: tcp://0.0.0.0:9091
+host: 127.0.0.1
+port: 9091

 log:
  level: info

 theme: dark

-identity_validation:
-  reset_password:
+certificates_directory: /config/certs/
+
 jwt_secret: {JWT_SECRET}

 default_redirection_url: https://app.{DOMAIN}/
@ -35,29 +35,79 @@ access_control:
        - "group:admins"
      policy: one_factor

-    # Users with TFA enforcement — two-factor required
+    # App paths — group-restricted
    - domain: "app.{DOMAIN}"
+      resources:
+        - "^/drive(/.*)?$"
      subject:
-        - "group:tfa_required"
-      policy: two_factor
+        - "group:admins"
+        - "group:drive"
+      policy: one_factor

-    # Everything else — any authenticated user
+    - domain: "app.{DOMAIN}"
+      resources:
+        - "^/office(/.*)?$"
+      subject:
+        - "group:admins"
+        - "group:office"
+      policy: one_factor
+
+    - domain: "app.{DOMAIN}"
+      resources:
+        - "^/enterprise(/.*)?$"
+      subject:
+        - "group:admins"
+        - "group:erp"
+      policy: one_factor
+
+    - domain: "app.{DOMAIN}"
+      resources:
+        - "^/chat(/.*)?$"
+      subject:
+        - "group:admins"
+        - "group:chat"
+      policy: one_factor
+
+    - domain: "app.{DOMAIN}"
+      resources:
+        - "^/meet(/.*)?$"
+      subject:
+        - "group:admins"
+        - "group:meet"
+      policy: one_factor
+
+    - domain: "app.{DOMAIN}"
+      resources:
+        - "^/connect(/.*)?$"
+      subject:
+        - "group:admins"
+        - "group:mail"
+      policy: one_factor
+
+    - domain: "app.{DOMAIN}"
+      resources:
+        - "^/aida(/.*)?$"
+      subject:
+        - "group:admins"
+        - "group:ai"
+      policy: one_factor
+
+    # Home/launcher — any authenticated user
    - domain: "app.{DOMAIN}"
      policy: one_factor

 authentication_backend:
  file:
    path: /config/users_database.yml
-    watch: true

 session:
  name: nextworkspace_session
  secret: {SESSION_SECRET}
-  domain: "{DOMAIN}"
+  domain: {DOMAIN}
  same_site: lax
  expiration: 1h
  inactivity: 5m
-  remember_me: 1M
+  remember_me_duration: 1M

 regulation:
  max_retries: 5
@ -65,7 +115,6 @@ regulation:
  ban_time: 5m

 storage:
-  encryption_key: {STORAGE_ENCRYPTION_KEY}
  local:
    path: /data/db.sqlite

--- a/config/authelia/users_database.yml
+++ b/config/authelia/users_database.yml
@ -7,3 +7,10 @@ users:
    groups:
      - admins
      - users
+      - drive
+      - office
+      - erp
+      - chat
+      - meet
+      - mail
+      - ai
--- a/config/caddy/Caddyfile
+++ b/config/caddy/Caddyfile
@ -6,16 +6,21 @@

 # Authelia OIDC provider
 auth.{DOMAIN} {
-    reverse_proxy authelia:9091
+    reverse_proxy 127.0.0.1:9091
 }

 # Main workspace (forward auth with Authelia)
 app.{DOMAIN} {
-    forward_auth authelia:9091 {
+    # Forward auth to Authelia verify endpoint
+    forward_auth 127.0.0.1:9091 {
        uri /api/verify?rd=https://auth.{DOMAIN}/
+
+        # Copy auth headers to upstream
        copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
    }
-    reverse_proxy launcher:9000
+
+    # Serve launcher + proxy upstream apps
+    reverse_proxy 127.0.0.1:9000
 }

 # Public landing page
--- a/config/nextworkspace/apps.yaml
+++ b/config/nextworkspace/apps.yaml
@ -1,59 +0,0 @@
-apps:
-  - name: "NextWks Core"
-    subtitle: "Launcher & Workspace Hub"
-    path: "/home"
-    icon: "home"
-    groups: ["users"]
-  - name: "OpenCloud"
-    subtitle: "File Storage"
-    path: "/drive"
-    upstream: "http://127.0.0.1:9100"
-    icon: "cloud"
-    groups: ["users"]
-  - name: "Euro Office"
-    subtitle: "Collaborative Suite"
-    path: "/office"
-    upstream: "http://127.0.0.1:9200"
-    icon: "office"
-    groups: ["users"]
-  - name: "ERPNext"
-    subtitle: "Enterprise ERP"
-    path: "/enterprise"
-    upstream: "http://127.0.0.1:9300"
-    icon: "erp"
-    groups: ["users"]
-  - name: "Matrix Chat"
-    subtitle: "Team Communication"
-    path: "/chat"
-    upstream: "http://127.0.0.1:9400"
-    icon: "chat"
-    groups: ["users"]
-  - name: "Jitsi"
-    subtitle: "Video Conferencing"
-    path: "/meet"
-    upstream: "http://127.0.0.1:9500"
-    icon: "meet"
-    groups: ["users"]
-  - name: "Webmail"
-    subtitle: "Email Client"
-    path: "/connect"
-    upstream: "http://127.0.0.1:9600"
-    icon: "mail"
-    groups: ["users"]
-  - name: "AI Chat"
-    subtitle: "Open WebUI"
-    path: "/aida"
-    upstream: "http://127.0.0.1:9700"
-    icon: "ai"
-    groups: ["users"]
-  - name: "Portainer"
-    subtitle: "Container Management"
-    path: "/admin"
-    upstream: "http://127.0.0.1:9800"
-    icon: "admin"
-    groups: ["admins"]
-  - name: "Admin Panel"
-    subtitle: "Workspace Configuration"
-    path: "/config"
-    icon: "settings"
-    groups: ["admins"]
--- a/config/nextworkspace/config.yaml
+++ b/config/nextworkspace/config.yaml
@ -1,7 +0,0 @@
-server:
-  port: 9000
-  host: "0.0.0.0"
-
-app:
-  name: "NextWorkspace"
-  description: "Your Self-Hosted Workspace"
--- a/config/nextworkspace/settings.yaml
+++ b/config/nextworkspace/settings.yaml
@ -1,14 +0,0 @@
-company:
-  name: "NextWorkspace"
-  subtitle: "Your Self-Hosted Workspace for Startups"
-  logo: ""
-  language: "en"
-  timezone: "UTC"
-smtp:
-  host: ""
-  port: 587
-  user: ""
-  sender: ""
-imap:
-  host: ""
-  port: 993
--- a/deploy.sh
+++ b/deploy.sh
@ -0,0 +1,214 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_DIR="/opt/NextWks"
+TARGET_DIR="/opt/nextworkspace"
+BACKUP_DIR="/opt/backup"
+SERVICE_NAME="nextworkspace"
+BINARY_NAME="nextworkspace"
+HEALTH_CHECK_RETRIES=10
+HEALTH_CHECK_INTERVAL=2
+
+# --- Load .env ---
+if [ -f "$BACKUP_DIR/.env" ]; then
+    set -a; source "$BACKUP_DIR/.env"; set +a
+elif [ -f "$TARGET_DIR/.env" ]; then
+    set -a; source "$TARGET_DIR/.env"; set +a
+fi
+DOMAIN="${DOMAIN:-nextwks.eu}"
+APP_SUB="${APP_SUB:-app}"
+
+# --- Mode ---
+GREENFIELD=false
+if [ "${1:-}" = "--destroy" ]; then GREENFIELD=true; echo "[MODE] Greenfield deploy (--destroy)"
+elif [ ! -d "$TARGET_DIR" ]; then GREENFIELD=true; echo "[MODE] Greenfield deploy (target missing)"
+else echo "[MODE] Smart update (target exists)"; fi
+
+# --- Pull + build ---
+cd "$REPO_DIR"
+echo "[1/5] Pulling latest code..."
+git pull 2>/dev/null || true
+
+echo "[2/5] Building binary..."
+export PATH=$PATH:/usr/local/go/bin
+go build -o "$BINARY_NAME" .
+
+# --- Greenfield ---
+if [ "$GREENFIELD" = true ]; then
+    echo "[3/5] Full teardown..."
+    systemctl stop $SERVICE_NAME 2>/dev/null || true
+    systemctl disable $SERVICE_NAME 2>/dev/null || true
+    rm -f /etc/systemd/system/$SERVICE_NAME.service
+    systemctl daemon-reload
+
+    # Backup Caddy certs before destroying
+    CADDY_CERTS="$TARGET_DIR/data/caddy/caddy/certificates"
+    if [ -d "$CADDY_CERTS" ]; then
+        mkdir -p "$BACKUP_DIR/certificates"
+        cp -r "$CADDY_CERTS"/* "$BACKUP_DIR/certificates/" 2>/dev/null || true
+        echo "[INFO] Caddy certificates backed up"
+    fi
+
+    podman rm -f caddy authelia 2>/dev/null || true
+    podman pod rm -f caddy authelia 2>/dev/null || true
+
+    if [ -d "$TARGET_DIR" ]; then
+        chattr -R -i "$TARGET_DIR" 2>/dev/null || true
+        rm -rf "$TARGET_DIR"
+    fi
+
+    echo "[4/5] Building production directories..."
+    mkdir -p "$TARGET_DIR/config/caddy"
+    mkdir -p "$TARGET_DIR/config/authelia"
+    mkdir -p "$TARGET_DIR/data/caddy"
+    mkdir -p "$TARGET_DIR/data/authelia"
+    mkdir -p "$TARGET_DIR/compose"
+    mkdir -p "$TARGET_DIR/www"
+    mkdir -p "$TARGET_DIR/config/nextworkspace"
+    mkdir -p "$TARGET_DIR/logs"
+
+    # Copy .env from backup
+    if [ -f "$BACKUP_DIR/.env" ]; then
+        cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
+        chmod 600 "$TARGET_DIR/.env"
+    fi
+
+    # Generate secrets if missing
+    JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
+    SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
+    ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
+
+    # Generate bcrypt password hash for Authelia
+    HASH_TOOL="$(dirname "$0")/tools/hash-password/main.go"
+    if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ] && [ -f "$HASH_TOOL" ]; then
+        ADMIN_PASSWORD_HASH=$(cd "$(dirname "$0")" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
+        if [ -n "$ADMIN_PASSWORD_HASH" ] && [ -f "$BACKUP_DIR/.env" ]; then
+            echo "ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'" >> "$BACKUP_DIR/.env"
+        fi
+    fi
+
+    # Generate Caddyfile (using | delimiter to avoid conflicts with / and @)
+    sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
+        "$SCRIPT_DIR/config/caddy/Caddyfile" > "$TARGET_DIR/config/caddy/Caddyfile"
+
+    # Generate Authelia config
+    sed -e "s|{DOMAIN}|$DOMAIN|g" \
+        -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
+        -e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
+        -e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
+        -e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
+        -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
+        -e "s|{SMTP_PASS}|${SMTP_PASS}|g" \
+        "$SCRIPT_DIR/config/authelia/configuration.yml" > "$TARGET_DIR/config/authelia/configuration.yml"
+
+    # Generate users database
+    sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
+        -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
+        "$SCRIPT_DIR/config/authelia/users_database.yml" > "$TARGET_DIR/config/authelia/users_database.yml"
+
+    # Copy compose files
+    cp "$SCRIPT_DIR/compose/caddy.yaml" "$TARGET_DIR/compose/caddy.yaml"
+    cp "$SCRIPT_DIR/compose/authelia.yaml" "$TARGET_DIR/compose/authelia.yaml"
+
+    # Copy binary
+    cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
+    if [ -f "$REPO_DIR/VERSION" ]; then
+        cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"
+    fi
+
+    # Copy www landing page
+    if [ -d "$SCRIPT_DIR/config/www" ]; then
+        cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/"
+    fi
+
+    # Copy language files
+    if [ -d "$SCRIPT_DIR/lng" ]; then
+        cp -r "$SCRIPT_DIR/lng" "$TARGET_DIR/lng"
+    fi
+
+    # Deploy Caddy + Authelia
+    echo "[5/5] Deploying Caddy and Authelia..."
+    mkdir -p "$TARGET_DIR/data/caddy"
+
+    # Restore Caddy certs from backup if available
+    if [ -d "$BACKUP_DIR/certificates/acme-v02" ]; then
+        mkdir -p "$CADDY_CERTS"
+        cp -r "$BACKUP_DIR/certificates"/* "$CADDY_CERTS/" 2>/dev/null || true
+        echo "[INFO] Restored Caddy certificates from backup"
+    fi
+
+    podman-compose -f "$TARGET_DIR/compose/caddy.yaml" up -d 2>&1 || echo "[WARN] Caddy deploy had issues"
+    podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || echo "[WARN] Authelia deploy had issues"
+
+    # Basic launcher config
+    cp -r "$SCRIPT_DIR/config/nextworkspace"/* "$TARGET_DIR/config/nextworkspace/" 2>/dev/null || true
+
+    # Copy apps.yaml template
+    cp "$SCRIPT_DIR/config/nextworkspace/apps.yaml" "$TARGET_DIR/config/nextworkspace/apps.yaml" 2>/dev/null || true
+
+    # Extract Authelia secret for binary
+    AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
+    if [ -n "$AUTHELIA_SECRET" ]; then
+        if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
+            echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
+        fi
+    fi
+
+    # Write systemd service
+    cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
+[Unit]
+Description=NextWorkspace Launcher
+After=network.target caddy.service authelia.service
+Wants=caddy.service authelia.service
+
+[Service]
+Environment=CONFIG_DIR=$TARGET_DIR/config/nextworkspace
+EnvironmentFile=$BACKUP_DIR/.env
+ExecStart=$TARGET_DIR/$BINARY_NAME
+WorkingDirectory=$TARGET_DIR
+Restart=always
+User=root
+Group=root
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+
+    systemctl daemon-reload
+    systemctl enable --now $SERVICE_NAME
+
+# --- Smart update ---
+else
+    echo "[3/5] Stopping launcher..."
+    systemctl stop $SERVICE_NAME 2>/dev/null || true
+    echo "[4/5] Swapping binary..."
+    cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
+
+    # Ensure AUTHELIA_SECRET is in .env
+    AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
+    if [ -n "$AUTHELIA_SECRET" ]; then
+        if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
+            echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
+            echo "[INFO] AUTHELIA_SECRET added to .env"
+        fi
+    fi
+
+    echo "[5/5] Restarting services..."
+    podman restart caddy authelia 2>/dev/null || true
+    systemctl restart $SERVICE_NAME
+fi
+
+# --- Health check ---
+echo "[*] Running health check..."
+for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
+    if curl -sf http://127.0.0.1:9000/health > /dev/null 2>&1; then
+        echo "[OK] NextWorkspace launcher is healthy on http://127.0.0.1:9000/"
+        exit 0
+    fi
+    echo "  Attempt $i/$HEALTH_CHECK_RETRIES — not ready yet..."
+    sleep $HEALTH_CHECK_INTERVAL
+done
+
+echo "[FAIL] Health check failed — launcher did not respond on port 9000"
+exit 1
--- a/install.sh
+++ b/install.sh
@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# NextWorkspace Installer — bootstraps a bare Linux VM
+# Idempotent: safe to run multiple times.
+
+TARGET_DIR="/opt/nextworkspace"
+BACKUP_DIR="/opt/backup"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# --- Create backup vault and runtime directories ---
+echo "=== NextWorkspace Setup ==="
+mkdir -p "$BACKUP_DIR/certificates"
+mkdir -p "$TARGET_DIR/config/nextworkspace"
+mkdir -p "$TARGET_DIR/config/caddy"
+mkdir -p "$TARGET_DIR/config/authelia"
+mkdir -p "$TARGET_DIR/data/caddy"
+mkdir -p "$TARGET_DIR/data/authelia"
+mkdir -p "$TARGET_DIR/compose"
+mkdir -p "$TARGET_DIR/www"
+mkdir -p "$TARGET_DIR/logs"
+
+# --- Interactive prompts (no defaults — user enters everything) ---
+read -p "Domain: " DOMAIN
+while [ -z "$DOMAIN" ]; do
+  read -p "Domain (required): " DOMAIN
+done
+
+read -p "TLS email (Let's Encrypt): " TLS_EMAIL
+while [ -z "$TLS_EMAIL" ]; do
+  read -p "TLS email (required): " TLS_EMAIL
+done
+# Basic email validation (must contain @)
+while echo "$TLS_EMAIL" | grep -qv '@'; do
+  read -p "Invalid email — must contain @: " TLS_EMAIL
+done
+
+read -p "Admin username: " ADMIN_USERNAME
+while [ -z "$ADMIN_USERNAME" ]; do
+  read -p "Admin username (required): " ADMIN_USERNAME
+done
+
+# Generate 12-char alphanumeric password (easy to type)
+ADMIN_PASSWORD=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 12 2>/dev/null || date +%s | head -c 12)
+
+# --- SMTP prompts ---
+read -p "SMTP host [smtp.openxchange.eu]: " SMTP_HOST
+SMTP_HOST="${SMTP_HOST:-smtp.openxchange.eu}"
+
+read -p "SMTP port [587]: " SMTP_PORT
+SMTP_PORT="${SMTP_PORT:-587}"
+
+read -p "SMTP user [post@nextwks.eu]: " SMTP_USER
+SMTP_USER="${SMTP_USER:-post@nextwks.eu}"
+
+read -sp "SMTP password: " SMTP_PASS
+echo ""
+if [ -z "$SMTP_PASS" ]; then
+    echo "[ERROR] SMTP password is required."
+    exit 1
+fi
+
+read -p "IMAP host [imap.openxchange.eu]: " IMAP_HOST
+IMAP_HOST="${IMAP_HOST:-imap.openxchange.eu}"
+
+read -p "IMAP port [993]: " IMAP_PORT
+IMAP_PORT="${IMAP_PORT:-993}"
+
+echo ""
+echo "========================================"
+echo "  Domain:        $DOMAIN"
+echo "  TLS email:     $TLS_EMAIL"
+echo "  Admin username: $ADMIN_USERNAME"
+echo "  Admin password: $ADMIN_PASSWORD"
+echo "  Save this password — it won't be shown again!"
+echo "========================================"
+echo ""
+
+# Write .env file in backup vault (deploy.sh copies it to production)
+ENV_FILE="$BACKUP_DIR/.env"
+cat > "$ENV_FILE" <<EOF
+# NextWorkspace Configuration
+# This file is auto-generated by install.sh — do not edit manually
+DOMAIN=$DOMAIN
+TLS_EMAIL=$TLS_EMAIL
+ADMIN_USERNAME=$ADMIN_USERNAME
+ADMIN_PASSWORD=$ADMIN_PASSWORD
+SMTP_HOST=$SMTP_HOST
+SMTP_PORT=$SMTP_PORT
+SMTP_USER=$SMTP_USER
+SMTP_PASS=$SMTP_PASS
+IMAP_HOST=$IMAP_HOST
+IMAP_PORT=$IMAP_PORT
+EOF
+
+chmod 600 "$ENV_FILE"
+
+# ---- Go ----
+if command -v go &>/dev/null; then
+	echo "[SKIP] Go already installed: $(go version)"
+else
+	echo "[INSTALL] Installing Go..."
+	GO_URL="https://go.dev/dl/$(curl -sL https://go.dev/VERSION?m=text | head -1).linux-amd64.tar.gz"
+	curl -sL "$GO_URL" -o /tmp/go.tar.gz
+	rm -rf /usr/local/go
+	tar -C /usr/local -xzf /tmp/go.tar.gz
+	rm /tmp/go.tar.gz
+	echo 'export PATH=$PATH:/usr/local/go/bin' > /etc/profile.d/go.sh
+	chmod +x /etc/profile.d/go.sh
+	export PATH=$PATH:/usr/local/go/bin
+	echo "[OK] Go installed: $(go version)"
+fi
+
+# ---- System deps ----
+echo "[INSTALL] git, build-essential, podman, podman-compose..."
+apt-get update -qq
+apt-get install -y -qq git build-essential curl podman podman-compose
+
+# ---- Deploy: use current scripts + tools ---
+REPO_DIR="/opt/NextWks"
+mkdir -p "$REPO_DIR"
+
+# Clone or update repo, then overlay our current code
+echo "[SETUP] Preparing /opt/NextWks..."
+if [ -d "$REPO_DIR/.git" ]; then
+    cd "$REPO_DIR" && git pull
+elif command -v git &>/dev/null; then
+    # Try to clone the remote first, so git history is intact
+    git clone "https://git.lohmar.co.uk/lexton-it/NextWks.git" "$REPO_DIR.tmp" 2>/dev/null && \
+        mv "$REPO_DIR.tmp" "$REPO_DIR" || true
+fi
+
+# Copy current code on top (ensures latest changes)
+mkdir -p "$REPO_DIR"
+cp -r "$SCRIPT_DIR"/* "$REPO_DIR/"
+cp "$SCRIPT_DIR"/.gitignore "$REPO_DIR/" 2>/dev/null || true
+chmod +x "$REPO_DIR/deploy.sh" "$REPO_DIR/install.sh" 2>/dev/null || true
+
+echo "[DONE] Bootstrapping complete. Running first deploy..."
+"$REPO_DIR/deploy.sh" --destroy
--- a/main.go
+++ b/main.go
--- a/tools/firewall-routing.sh
+++ b/tools/firewall-routing.sh
@ -1,51 +0,0 @@
-#!/bin/bash
-# =====================================================================
-# VM LOCAL FIREWALL & PORT REDIRECTION SCRIPT
-# VM IP: 172.16.9.10 | Internal Interface: eth0 (or similar)
-# Redirects inbound 80/443 to non-root Caddy on 8080/8443
-# =====================================================================
-
-# 1. CLEAN SLATE
-# Flush all rules and delete custom chains across filter and NAT tables
-iptables -P INPUT ACCEPT
-iptables -P FORWARD ACCEPT
-iptables -P OUTPUT ACCEPT
-iptables -t nat -F
-iptables -F
-iptables -X
-iptables -t nat -X
-
-# 2. LOCAL PORT REDIRECTION (Caddy Non-Root Helper)
-# ---------------------------------------------------------------------
-# A. Inbound traffic coming from outside the VM (e.g., forwarded from Proxmox)
-iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
-iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
-
-# B. Local traffic generated inside the VM aimed strictly at localhost/127.0.0.1
-# Note: By specifying '-o lo', you leave your outbound internet (GitHub, Google) untouched!
-iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 8080
-iptables -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-ports 8443
-
-# 3. VM INPUT FIREWALL RULES
-# ---------------------------------------------------------------------
-# Allow everything on loopback
-iptables -A INPUT -i lo -j ACCEPT
-
-# Allow established connections (allows responses to your outbound traffic like curl)
-iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-
-# Allow SSH (Port 22) - Important for your Proxmox port forward (22910 -> 22)
-iptables -A INPUT -p tcp --dport 22 -j ACCEPT
-
-# Allow the actual redirected Caddy ports from outside (just in case)
-iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
-iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
-
-# Allow alternative app ports (like the 8000 you have forwarded in Proxmox)
-iptables -A INPUT -p tcp --dport 8000 -j ACCEPT
-
-# 4. GLOBAL SECURITY DROP RULE
-# Drop all other unsolicited inbound traffic targeting this VM
-iptables -A INPUT -j DROP
-
-echo "VM Firewall and Caddy Redirection Applied Successfully."
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@ -1,356 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-REPO_URL="https://git.lohmar.co.uk/lexton-it/NextWks.git"
-BUILD_DIR="/tmp/nextwks-build"
-TARGET_DIR="/opt/nextworkspace"
-BACKUP_DIR="/opt/backup"
-NETWORK_NAME="nextwks-net"
-HEALTH_CHECK_RETRIES=15
-HEALTH_CHECK_INTERVAL=3
-
-usage() {
-    echo "Usage: $0 [--install|--update|--destroy]"
-    echo "  --install   First-time setup on a bare VM (prompts for config)"
-    echo "  --update    Smart update: pull, build, copy, bounce containers"
-    echo "  --destroy   Full greenfield redeploy (uses saved secrets)"
-    exit 1
-}
-
-[ $# -eq 0 ] && usage
-MODE="${1#--}"
-case "$MODE" in install|update|destroy) ;; *) usage ;; esac
-
-# MUST NOT run as root — podman must be rootless
-if [ "$(id -u)" -eq 0 ]; then
-    echo "ERROR: Do NOT run this script with sudo or as root."
-    echo "  Run it as your normal user: ./nextwks.sh --$MODE"
-    echo "  The script will prompt for sudo only where needed (apt, /opt/, iptables)."
-    exit 1
-fi
-
-# Helper: run with sudo for operations that need root
-maybe_sudo() {
-    sudo "$@"
-}
-
-# --- Load existing env (if any), skip if unreadable ---
-# Temporarily disable -u because .env may contain $ signs (bcrypt hashes)
-set +u
-if [ -r "$BACKUP_DIR/.env" ]; then
-    set -a; source "$BACKUP_DIR/.env"; set +a
-elif [ -r "$TARGET_DIR/.env" ]; then
-    set -a; source "$TARGET_DIR/.env"; set +a
-fi
-set -u
-if [ -z "${DOMAIN:-}" ]; then
-    echo "ERROR: DOMAIN is not set. Configure it in /opt/backup/.env or run --install to set it up."
-    exit 1
-fi
-
-echo "=== NextWorkspace ${MODE} ==="
-
-# ============================================================
-# 1. INSTALL MODE — first-time setup (only on bare VM)
-# ============================================================
-if [ "$MODE" = "install" ]; then
-    if [ -f "$TARGET_DIR/nextworkspace" ]; then
-        echo "================================================================="
-        echo "  NextWorkspace is already installed at $TARGET_DIR"
-        echo ""
-        echo "  Use --update to rebuild and restart:"
-        echo "    ./nextwks.sh --update"
-        echo ""
-        echo "  Use --destroy for a full greenfield redeploy:"
-        echo "    ./nextwks.sh --destroy"
-        echo "================================================================="
-        exit 0
-    fi
-    echo "[*] Installing system dependencies..."
-    maybe_sudo apt-get update -qq
-    maybe_sudo apt-get install -y -qq git build-essential curl podman podman-compose iptables-persistent
-
-    if ! command -v go &>/dev/null; then
-        echo "[*] Installing Go..."
-        GO_VERSION=$(curl -sL https://go.dev/VERSION?m=text)
-        GO_URL="https://go.dev/dl/${GO_VERSION}.linux-amd64.tar.gz"
-        curl -sL "$GO_URL" -o /tmp/go.tar.gz
-        maybe_sudo rm -rf /usr/local/go
-        maybe_sudo tar -C /usr/local -xzf /tmp/go.tar.gz
-        rm /tmp/go.tar.gz
-        maybe_sudo sh -c 'echo "export PATH=\$PATH:/usr/local/go/bin" > /etc/profile.d/go.sh'
-        maybe_sudo chmod +x /etc/profile.d/go.sh
-        export PATH=$PATH:/usr/local/go/bin
-    fi
-
-    # Enable user lingering — containers stay alive after logout
-    maybe_sudo loginctl enable-linger "$USER" 2>/dev/null || true
-
-    # Clean up any old rootful containers from a previous deploy
-    echo "[*] Cleaning up old rootful containers (if any)..."
-    maybe_sudo podman stop caddy authelia launcher 2>/dev/null || true
-    maybe_sudo podman rm caddy authelia launcher 2>/dev/null || true
-    maybe_sudo podman network rm "$NETWORK_NAME" 2>/dev/null || true
-
-    echo ""
-    echo "--- NextWorkspace Configuration ---"
-    read -p "Domain [nextwks.eu]: " input; DOMAIN="${input:-$DOMAIN}"
-    read -p "TLS email (Let's Encrypt): " TLS_EMAIL
-    while [ -z "$TLS_EMAIL" ]; do read -p "TLS email (required): " TLS_EMAIL; done
-    while echo "$TLS_EMAIL" | grep -qv '@'; do read -p "Invalid email: " TLS_EMAIL; done
-
-    # Validate required configs
-    if [ -z "$TLS_EMAIL" ] || [ -z "$DOMAIN" ]; then
-        echo "ERROR: TLS_EMAIL and DOMAIN are required."
-        exit 1
-    fi
-    read -p "Admin username: " ADMIN_USERNAME
-    while [ -z "$ADMIN_USERNAME" ]; do read -p "Admin username (required): " ADMIN_USERNAME; done
-    # 24 chars, mixed case + numbers, no special chars (safe for .env)
-    ADMIN_PASSWORD=$(openssl rand -base64 30 | tr -dc 'A-Za-z0-9')
-    ADMIN_PASSWORD="${ADMIN_PASSWORD:0:24}"
-
-    echo ""
-    echo "========================================"
-    echo "  Domain:         $DOMAIN"
-    echo "  TLS email:      $TLS_EMAIL"
-    echo "  Admin username: $ADMIN_USERNAME"
-    echo "  Admin password: $ADMIN_PASSWORD"
-    echo "  Save this password — it won't be shown again!"
-    echo "========================================"
-    echo ""
-
-    read -p "SMTP host [smtp.openxchange.eu]: " SMTP_HOST; SMTP_HOST="${SMTP_HOST:-smtp.openxchange.eu}"
-    read -p "SMTP port [587]: " SMTP_PORT; SMTP_PORT="${SMTP_PORT:-587}"
-    read -p "SMTP user [post@nextwks.eu]: " SMTP_USER; SMTP_USER="${SMTP_USER:-post@nextwks.eu}"
-    read -sp "SMTP password: " SMTP_PASS; echo ""
-    [ -z "$SMTP_PASS" ] && echo "ERROR: SMTP password required" && exit 1
-
-    read -p "IMAP host [imap.openxchange.eu]: " IMAP_HOST; IMAP_HOST="${IMAP_HOST:-imap.openxchange.eu}"
-    read -p "IMAP port [993]: " IMAP_PORT; IMAP_PORT="${IMAP_PORT:-993}"
-
-    # Persist config to backup vault (single-quote values to protect $ signs)
-    maybe_sudo mkdir -p "$BACKUP_DIR"
-    maybe_sudo sh -c "cat > '$BACKUP_DIR/.env' <<'ENVEOF'
-# NextWorkspace Configuration — auto-generated by nextwks.sh --install
-DOMAIN='$DOMAIN'
-TLS_EMAIL='$TLS_EMAIL'
-ADMIN_USERNAME='$ADMIN_USERNAME'
-ADMIN_PASSWORD='$ADMIN_PASSWORD'
-SMTP_HOST='$SMTP_HOST'
-SMTP_PORT='$SMTP_PORT'
-SMTP_USER='$SMTP_USER'
-SMTP_PASS='$SMTP_PASS'
-IMAP_HOST='$IMAP_HOST'
-IMAP_PORT='$IMAP_PORT'
-ENVEOF"
-    maybe_sudo chmod 600 "$BACKUP_DIR/.env"
-fi
-
-# ============================================================
-# 2. CLONE fresh (every mode — ensures latest code)
-# ============================================================
-echo "[*] Cloning repository..."
-rm -rf "$BUILD_DIR"
-git clone --depth 1 "$REPO_URL" "$BUILD_DIR"
-cd "$BUILD_DIR"
-
-# Save script to user's home for easy future access (--install only)
-if [ "$MODE" = "install" ]; then
-    cp "$BUILD_DIR/tools/nextwks.sh" "$HOME/nextwks.sh"
-    chmod +x "$HOME/nextwks.sh"
-    echo "[*] Saved to $HOME/nextwks.sh — use it for future updates"
-fi
-
-# ============================================================
-# 3. FIREWALL SETUP (all modes)
-# ============================================================
-if [ "$MODE" = "install" ]; then
-    echo "[*] Applying firewall and port redirects (80→8080, 443→8443)..."
-    maybe_sudo bash "$BUILD_DIR/tools/firewall-routing.sh"
-elif [ "$MODE" = "update" ] || [ "$MODE" = "destroy" ]; then
-    # Lightweight: ensure redirects exist without flushing existing rules
-    echo "[*] Ensuring port redirects (80→8080, 443→8443)..."
-    maybe_sudo iptables -t nat -C PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080 2>/dev/null || \
-        maybe_sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
-    maybe_sudo iptables -t nat -C PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443 2>/dev/null || \
-        maybe_sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
-    maybe_sudo iptables -t nat -C OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 8080 2>/dev/null || \
-        maybe_sudo iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 8080
-    maybe_sudo iptables -t nat -C OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-ports 8443 2>/dev/null || \
-        maybe_sudo iptables -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-ports 8443
-fi
-# Persist across reboots (always)
-if command -v netfilter-persistent &>/dev/null; then
-    maybe_sudo netfilter-persistent save 2>/dev/null || true
-else
-    maybe_sudo mkdir -p /etc/iptables
-    maybe_sudo sh -c 'iptables-save > /etc/iptables/rules.v4'
-fi
-
-# ============================================================
-# 4. BUILD static binary
-# ============================================================
-echo "[*] Building static binary..."
-export PATH=$PATH:/usr/local/go/bin
-CGO_ENABLED=0 go build -o nextworkspace .
-
-# ============================================================
-# 5. STOP containers (all modes — binary is mounted, must stop before copy)
-# ============================================================
-echo "[*] Stopping containers..."
-podman stop caddy authelia launcher 2>/dev/null || true
-sleep 1
-
-# ============================================================
-# 6. CREATE target & backup directories (as root)
-# ============================================================
-maybe_sudo mkdir -p "$TARGET_DIR/config/caddy" "$TARGET_DIR/config/authelia" \
-         "$TARGET_DIR/data/caddy" "$TARGET_DIR/data/authelia" \
-         "$TARGET_DIR/compose" "$TARGET_DIR/www" \
-         "$TARGET_DIR/config/nextworkspace" "$TARGET_DIR/logs" \
-         "$BACKUP_DIR"
-
-# ============================================================
-# 7. TEARDOWN (destroy mode only — wipes target dir)
-# ============================================================
-if [ "$MODE" = "destroy" ]; then
-    echo "[*] Full teardown..."
-    # Stop rootless containers
-    podman stop caddy authelia launcher 2>/dev/null || true
-    podman rm caddy authelia launcher 2>/dev/null || true
-    podman network rm -f "$NETWORK_NAME" 2>/dev/null || true
-    # Wipe target
-    maybe_sudo rm -rf "$TARGET_DIR"
-    maybe_sudo mkdir -p "$TARGET_DIR/config/caddy" "$TARGET_DIR/config/authelia" \
-             "$TARGET_DIR/data/caddy" "$TARGET_DIR/data/authelia" \
-             "$TARGET_DIR/compose" "$TARGET_DIR/www" \
-             "$TARGET_DIR/config/nextworkspace" "$TARGET_DIR/logs"
-fi
-
-# ============================================================
-# 8. COPY artifacts to target (as root)
-# ============================================================
-echo "[*] Copying artifacts..."
-maybe_sudo cp nextworkspace "$TARGET_DIR/nextworkspace"
-maybe_sudo cp "$BUILD_DIR/VERSION" "$TARGET_DIR/VERSION"
-if [ -d "$BUILD_DIR/config/www" ]; then
-    maybe_sudo cp -r "$BUILD_DIR/config/www"/* "$TARGET_DIR/www/"
-fi
-if [ -d "$BUILD_DIR/lng" ]; then
-    maybe_sudo rm -rf "$TARGET_DIR/lng"
-    maybe_sudo cp -r "$BUILD_DIR/lng" "$TARGET_DIR/lng"
-fi
-if [ -d "$BUILD_DIR/config/nextworkspace" ]; then
-    maybe_sudo cp -r "$BUILD_DIR/config/nextworkspace"/* "$TARGET_DIR/config/nextworkspace/"
-fi
-# Restore .env from backup
-if [ -f "$BACKUP_DIR/.env" ]; then
-    maybe_sudo cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
-    maybe_sudo chmod 644 "$TARGET_DIR/.env"
-fi
-
-# ============================================================
-# 9. GENERATE config files with placeholder substitution
-#    Write to /tmp first, then sudo cp to target
-# ============================================================
-GEN_DIR=$(mktemp -d)
-trap "rm -rf '$GEN_DIR'" EXIT
-
-echo "[*] Generating config files..."
-
-# Caddyfile
-sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|$TLS_EMAIL|g" \
-    "$BUILD_DIR/config/caddy/Caddyfile" > "$GEN_DIR/Caddyfile"
-
-# Authelia config — preserve existing secrets if present
-JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
-SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
-STORAGE_ENCRYPTION_KEY="${STORAGE_ENCRYPTION_KEY:-$(openssl rand -hex 32)}"
-sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
-    -e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
-    -e "s|{STORAGE_ENCRYPTION_KEY}|$STORAGE_ENCRYPTION_KEY|g" \
-    -e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
-    -e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
-    -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
-    -e "s|{SMTP_PASS}|$SMTP_PASS|g" \
-    "$BUILD_DIR/config/authelia/configuration.yml" > "$GEN_DIR/configuration.yml"
-
-    # Users database — regenerate hash if ADMIN_PASSWORD is available
-    if [ -n "${ADMIN_PASSWORD:-}" ]; then
-        ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "$ADMIN_PASSWORD_HASH")
-    fi
-sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
-    -e "s|{TLS_EMAIL}|$TLS_EMAIL|g" \
-    "$BUILD_DIR/config/authelia/users_database.yml" > "$GEN_DIR/users_database.yml"
-
-# Copy generated configs to target
-maybe_sudo cp "$GEN_DIR/Caddyfile" "$TARGET_DIR/config/caddy/Caddyfile"
-maybe_sudo cp "$GEN_DIR/configuration.yml" "$TARGET_DIR/config/authelia/configuration.yml"
-maybe_sudo cp "$GEN_DIR/users_database.yml" "$TARGET_DIR/config/authelia/users_database.yml"
-
-# Persist generated secrets so --destroy is idempotent
-if [ -f "$BACKUP_DIR/.env" ]; then
-    maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^STORAGE_ENCRYPTION_KEY=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
-fi
-# Use pipe to avoid bash -c re-expanding $ signs (bcrypt hashes contain $2a$10$...)
-echo "JWT_SECRET='$JWT_SECRET'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
-echo "SESSION_SECRET='$SESSION_SECRET'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
-echo "STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
-[ -n "$ADMIN_PASSWORD_HASH" ] && echo "ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
-maybe_sudo chmod 600 "$BACKUP_DIR/.env"
-
-# ============================================================
-# 10. FIX OWNERSHIP — all files in TARGET_DIR/BACKUP_DIR to user
-# ============================================================
-RUN_USER="${SUDO_USER:-${USER}}"
-echo "[*] Setting file ownership to $RUN_USER..."
-maybe_sudo chown -R "$RUN_USER:" "$TARGET_DIR" 2>/dev/null || true
-maybe_sudo chown -R "$RUN_USER:" "$BACKUP_DIR" 2>/dev/null || true
-
-# ============================================================
-# 11. DEPLOY stack (rootless podman — no sudo!)
-# ============================================================
-echo "[*] Deploying containers on $NETWORK_NAME..."
-
-podman network rm -f "$NETWORK_NAME" 2>/dev/null || true
-podman network create --subnet 172.18.0.0/24 "$NETWORK_NAME"
-
-# AUTHELIA_SECRET is SESSION_SECRET (Authelia session.secret)
-AUTHELIA_SECRET="${SESSION_SECRET:-}"
-if [ -z "$AUTHELIA_SECRET" ]; then
-    AUTHELIA_SECRET=$(sed -n '/^session:/,/^[a-z]/p' "$TARGET_DIR/config/authelia/configuration.yml" \
-        | grep 'secret:' | awk '{print $2}' 2>/dev/null || echo "")
-fi
-
-# Generate compose file with substituted secret
-sed -e "s|{AUTHELIA_SECRET}|$AUTHELIA_SECRET|g" \
-    "$BUILD_DIR/compose/stack.yaml" > "$GEN_DIR/stack.yaml"
-cp "$GEN_DIR/stack.yaml" "$TARGET_DIR/compose/stack.yaml"
-
-podman-compose -f "$TARGET_DIR/compose/stack.yaml" down 2>/dev/null || true
-sleep 1
-podman-compose -f "$TARGET_DIR/compose/stack.yaml" up -d 2>&1 || echo "[WARN] Stack deploy had issues"
-
-# ============================================================
-# 12. HEALTH CHECK
-# ============================================================
-echo "[*] Running health check..."
-for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
-    HEALTH=$(podman exec launcher curl -sf http://127.0.0.1:9000/health 2>/dev/null || echo "")
-    if [ "$HEALTH" = "OK" ]; then
-        echo "[OK] NextWorkspace launcher is healthy"
-        echo "[OK] https://$DOMAIN/"
-        exit 0
-    fi
-    sleep $HEALTH_CHECK_INTERVAL
-done
-
-echo "[FAIL] Health check failed — launcher did not respond"
-echo ""
-echo "--- Container status ---"
-podman ps -a --filter "name=caddy|authelia|launcher" 2>/dev/null || true
-echo ""
-echo "--- Launcher logs (last 20 lines) ---"
-podman logs launcher --tail 20 2>/dev/null || echo "  (no logs)"
-exit 1