swag: auto-configure reverse proxy for software modules + SWAG-aware menu URLs

Wires SWAG into the configng software stack so that installing any of the
supported modules on a host running SWAG also enables the matching nginx
proxy-conf, and the menu UI shows the SWAG subfolder URL instead of the
direct host:port whenever the proxy is live.

Core helpers (module_docker_utils.sh, runtime/config.runtime.sh,
module_env_init.sh):
  - SWAG_URL is read from ${SOFTWARE_FOLDER}/swag/config/SWAG_URL at env
    init and exposed to all modules. DISPLAY_URL=${SWAG_URL:-$LOCALIPADD}
    is the single source of truth for the menu's right column.
  - get_service_url <service> <port>: returns
        https://$DISPLAY_URL/<service>     when SWAG is up and the
                                            proxy-conf for <service> is
                                            enabled,
        http://$DISPLAY_URL:<port>          otherwise.
  - docker_configure_swag_proxy <service> [port] [proto]: copies the
    SWAG sample to its enabled .conf, sed-rewrites $upstream_port and
    $upstream_proto, touches the .enabled marker, and reloads nginx.
    Silent no-op (returns 1) if the sample isn't present, returns 2 if
    SWAG isn't installed — modules can call it unconditionally.
  - docker_seed_swag_proxy_conf <service>: reads an nginx subfolder
    proxy-conf from stdin and writes it as
    /config/nginx/proxy-confs/<service>.subfolder.conf.sample inside
    the SWAG container, for services where linuxserver/reverse-proxy-
    confs:master doesn't ship a stock sample (currently netbox; same
    pattern applicable to immich, vaultwarden, …). Skips writing if a
    sample is already present so an upstream sample or hand-edited
    admin override wins on the next install.

Per-module wiring:
  - 22 modules whose dockername matches a stock proxy-conf in
    linuxserver/reverse-proxy-confs:master gain a
    docker_configure_swag_proxy call after their docker run:
      bazarr, deluge, domoticz, dozzle, duplicati, embyserver→emby,
      filebrowser, ghost, grafana, jellyfin, lidarr, medusa, netdata,
      nextcloud (https), phpmyadmin, pi-hole→pihole, prowlarr,
      qbittorrent, radarr, sabnzbd, sonarr, syncthing, transmission.
  - homepage / immich / netbox / portainer pre-existing custom paths
    are folded in, with portainer correctly using HTTPS+9443.

netbox SWAG support (subfolder mode):
  - Seeds a hand-authored netbox.subfolder.conf.sample into SWAG via
    docker_seed_swag_proxy_conf so docker_configure_swag_proxy has
    something to enable. The conf does not rewrite the path —
    upstream NetBox sees /netbox unchanged.
  - When the swag container is present at install time, bakes
    BASE_PATH = 'netbox/' and CSRF_TRUSTED_ORIGINS = ['https://$SWAG_URL']
    into the generated configuration.py. Without BASE_PATH, Django
    emits absolute URLs (form action=/login/?next=/netbox, /static/…)
    that 404 once SWAG strips them at /netbox; without
    CSRF_TRUSTED_ORIGINS, login POSTs 403 even with paths fixed.
    These settings live in configuration.py because netboxcommunity/
    netbox does not consume BASE_PATH= / CSRF_TRUSTED_ORIGINS= from
    the container env. Trade-off: with BASE_PATH set, direct port
    access at / no longer works — only http://host:port/netbox/.

netbox postgres args:
  - module_postgres install takes six positional args
    (<user> <pass> <db> <image-repo> <image-tag> <container-name>);
    netbox was passing five and fusing image+tag into one. The result
    was Docker 404'ing on 'postgres:17-alpine:postgres-netbox' and the
    postgres container defaulting to the name 'postgres' (collision
    with any standalone postgres install). Split DATABASE_IMAGE into
    DATABASE_IMAGE + DATABASE_TAG and pass DATABASE_HOST in its
    proper sixth slot, matching the pattern module_immich already uses.

Menu URL routing (config.runtime.sh):
  - 23 update_sub_submenu_data lines (the SWAG-applicable subset) now
    go through get_service_url — flipping each menu's right-column URL
    from 'http://host:port' to 'https://host/<service>' the moment
    that service's proxy-conf is enabled in SWAG, and back if it ever
    isn't. pi-hole and ghost retain their /admin and /ghost subpaths
    by appending the suffix after the helper output.
  - NCT002 (nextcloud) and CPT002 (cockpit) intentionally untouched —
    direct URLs are HTTPS-only on a self-signed port; helper falls
    back to plain http otherwise. Worth a follow-up that gives the
    helper a fallback-protocol arg.

No regression for users without SWAG: get_service_url,
docker_configure_swag_proxy and docker_seed_swag_proxy_conf all fall
back to existing behaviour when the swag container isn't present.

Author: igorpecovnik

tools/modules/functions/module_docker_utils.sh

@@ -142,6 +142,11 @@ docker_operation_progress() {
 	# Ensure Docker is available
 	docker_ensure_docker
 
+	# Ensure unbuffer is available (for real-time pull progress)
+	if ! command -v unbuffer >/dev/null 2>&1; then
+		pkg_install expect
+	fi
+
 	# Argument validation
 	if [[ -z "$operation" || -z "$target" ]]; then
 		dialog_msgbox "Usage Error" "Usage: docker_operation_progress <pull|rm|rmi> <target>\n\n  pull <image>   - Pull Docker image\n  rm <container> - Remove container\n  rmi <image>    - Remove image" 12 60
@@ -467,3 +472,118 @@ docker_operation_progress() {
 
 	return 0
 }
+
+#
+# Configure SWAG reverse proxy for a service
+# Usage: docker_configure_swag_proxy <servicename> [port] [protocol] [upstream_host]
+#
+# Parameters:
+#   servicename    - Name of the service (e.g., "transmission", "sonarr")
+#   port           - Optional: Override the default port in the proxy config
+#   protocol       - Optional: Override the protocol (http/https) in the proxy config
+#   upstream_host  - Optional: Override 'set $upstream_app …' in the proxy
+#                    config. Stock LSIO samples assume the service is on the
+#                    'lsio' bridge and resolve by container name; modules
+#                    that run with '--network=host' can't be addressed that
+#                    way, so we point at the host's IP (or any IP the SWAG
+#                    container can route to) here. Pass $LOCALIPADD or similar.
+#
+# Returns: 0 on success, 1 if proxy config not found or enabling failed
+#
+docker_configure_swag_proxy() {
+	local servicename="$1"
+	local port="$2"
+	local protocol="$3"
+	local upstream_host="$4"
+
+	# Check if SWAG container exists
+	if ! docker container ls -a --format "{{.Names}}" | grep -q "^swag$"; then
+		return 2
+	fi
+
+	# Check if SWAG has proxy config for this service (sample or actual)
+	local proxy_sample="/config/nginx/proxy-confs/${servicename}.subfolder.conf.sample"
+	local proxy_actual="/config/nginx/proxy-confs/${servicename}.subfolder.conf"
+
+	if docker exec swag test -f "$proxy_sample" 2>/dev/null; then
+		# Copy sample to actual config if it doesn't exist
+		if ! docker exec swag test -f "$proxy_actual" 2>/dev/null; then
+			docker exec swag cp "$proxy_sample" "$proxy_actual" 2>/dev/null
+		fi
+
+		# If port is specified, update it in the config
+		if [[ -n "$port" ]]; then
+			docker exec swag sed -i "s/set \\\$upstream_port [0-9]*/set \\\$upstream_port ${port}/g" "$proxy_actual" 2>/dev/null
+		fi
+
+		# If protocol is specified, update it in the config
+		if [[ -n "$protocol" ]]; then
+			docker exec swag sed -i "s/set \\\$upstream_proto [a-z]*/set \\\$upstream_proto ${protocol}/g" "$proxy_actual" 2>/dev/null
+		fi
+
+		# If upstream_host is specified, replace the LSIO bridge name
+		# in 'set $upstream_app …'. Required for --network=host
+		# services since the docker DNS can't resolve the container
+		# name from inside SWAG's lsio namespace.
+		if [[ -n "$upstream_host" ]]; then
+			docker exec swag sed -i "s|set \\\$upstream_app [^;]*|set \\\$upstream_app ${upstream_host}|g" "$proxy_actual" 2>/dev/null
+		fi
+
+		# Enable the proxy configuration
+		if docker exec swag touch "/config/nginx/proxy-confs/${servicename}.subfolder.conf.enabled" 2>/dev/null; then
+			# Reload nginx to apply
+			docker exec swag nginx -s reload >/dev/null 2>&1
+			return 0
+		fi
+		return 1
+	fi
+
+	return 1
+}
+
+#
+# Seed a custom SWAG subfolder proxy-conf sample inside the SWAG container.
+# Usage: docker_seed_swag_proxy_conf <servicename> <<'NGINX'
+#            location ^~ /<servicename> { … }
+#        NGINX
+#
+# Used for services that linuxserver/reverse-proxy-confs:master does NOT
+# ship a stock sample for (e.g. netbox, immich). Reads the conf body from
+# stdin and writes it to:
+#   /config/nginx/proxy-confs/<servicename>.subfolder.conf.sample
+# inside the SWAG container, where docker_configure_swag_proxy() picks
+# it up on its next call.
+#
+# Behaviour:
+#   - If the SWAG container isn't installed, returns 2 (no-op).
+#   - If a `.sample` is already present (whether stock LSIO or seeded by
+#     a prior call), returns 0 without overwriting — defer to upstream
+#     when it eventually ships one, and keep an admin's hand-edited
+#     sample intact across re-installs.
+#   - Otherwise writes the body and returns 0 on success, 1 on docker
+#     exec failure.
+#
+# Returns: 0 on success / no-op skip, 1 on failure, 2 if no SWAG.
+#
+docker_seed_swag_proxy_conf() {
+	local servicename="$1"
+
+	if ! docker container ls -a --format "{{.Names}}" | grep -q "^swag$"; then
+		return 2
+	fi
+
+	local proxy_sample="/config/nginx/proxy-confs/${servicename}.subfolder.conf.sample"
+
+	# Already there — let it be (LSIO upstream may have started shipping
+	# one between releases; the admin may have hand-edited it).
+	if docker exec swag test -f "$proxy_sample" 2>/dev/null; then
+		return 0
+	fi
+
+	# `docker exec -i ... sh -c "cat > FILE"` is the portable way to
+	# stream stdin into a file inside the container.
+	if docker exec -i swag sh -c "cat > '${proxy_sample}'" 2>/dev/null; then
+		return 0
+	fi
+	return 1
+}

tools/modules/functions/module_env_init.sh

@@ -141,6 +141,13 @@ function set_runtime_variables() {
 	LOCALIPADD=$(ip -4 addr show dev $DEFAULT_ADAPTER | awk '/inet/ {print $2}' | cut -d'/' -f1)
 	LOCALSUBNET=$(echo ${LOCALIPADD} | cut -d"." -f1-3).0/24
 
+	# Check if SWAG is installed and use its domain URL for display
+	# This replaces LOCALIPADD with the actual domain in menu URLs
+	SWAG_URL=""
+	if [[ -f "${SOFTWARE_FOLDER}/swag/config/SWAG_URL" ]]; then
+		SWAG_URL=$(cat "${SOFTWARE_FOLDER}/swag/config/SWAG_URL")
+	fi
+
 	# create local lan and docker lan whitelist for transmission
 	TRANSMISSION_WHITELIST=$(echo ${LOCALIPADD} | cut -d"." -f1-3)".*"
 	local docker_subnet=$(docker network inspect lsio 2> /dev/null | grep Subnet | xargs | cut -d" " -f2 | cut -d"/" -f1 | cut -d"." -f1-2)

tools/modules/runtime/config.runtime.sh

@@ -16,6 +16,41 @@ locale_setting="$LANG"
 installed_software="$(see_current_apt)"
 held_packages=$(apt-mark showhold)
 
+# Use SWAG domain URL if available, otherwise fall back to local IP
+# This makes all menu URLs show the actual domain instead of IP when SWAG is installed
+DISPLAY_URL="${SWAG_URL:-$LOCALIPADD}"
+
+# Helper function to determine service URL format.
+#   - SWAG container missing OR proxy-conf for this service not
+#     enabled → http://$LOCALIPADD:<port>. The non-proxied backend
+#     listens on the host's LAN IP, NOT on the public SWAG domain
+#     (which only serves SWAG itself on 443) — DISPLAY_URL would be
+#     the wrong host here when SWAG_URL is set.
+#   - Proxy-conf enabled → https://$DISPLAY_URL/<service>. DISPLAY_URL
+#     resolves to SWAG_URL whenever it's set, which is exactly the
+#     public domain we want for the SWAG-fronted path.
+get_service_url() {
+	local service_name="$1"
+	local service_port="$2"
+
+	# Check if SWAG is running
+	if ! docker container ls -a --format "{{.Names}}" 2>/dev/null | grep -q "^swag$"; then
+		echo "http://$LOCALIPADD:$service_port"
+		return
+	fi
+
+	# Check if SWAG proxy is enabled for this service
+	local proxy_enabled_file="/config/nginx/proxy-confs/${service_name}.subfolder.conf.enabled"
+	if ! docker exec swag test -f "$proxy_enabled_file" 2>/dev/null; then
+		echo "http://$LOCALIPADD:$service_port"
+		return
+	fi
+
+	# SWAG proxy is enabled - return subfolder URL
+	echo "https://$DISPLAY_URL/$service_name"
+}
+
+
 module_options+=(
 	["update_json_data,author"]="@Tearran"
 	["update_json_data,ref_link"]=""
@@ -103,72 +138,80 @@ update_sub_submenu_data "System" "Storage" "NFS04" "$NFS_CLIENTS_NUMBER"
 
 # Database
 update_sub_submenu_data "Software" "Database" "DAT002" "Server: $LOCALIPADD"
-update_sub_submenu_data "Software" "Database" "MYA002" "http://$LOCALIPADD:${module_options["module_phpmyadmin,port"]}"
+update_sub_submenu_data "Software" "Database" "MYA002" "$(get_service_url "phpmyadmin" "${module_options["module_phpmyadmin,port"]}")"
 
 # Finance
 update_sub_submenu_data "Software" "Finance" "ABU002" "http://$LOCALIPADD:${module_options["module_actualbudget,port"]}"
 update_sub_submenu_data "Software" "Finance" "WAL002" "http://$LOCALIPADD:${module_options["module_wallos,port"]}"
 
 # Media
 update_sub_submenu_data "Software" "Media" "OMV002" "http://$LOCALIPADD:${module_options["module_omv,port"]}"
-update_sub_submenu_data "Software" "Media" "MED002" "http://$LOCALIPADD:${module_options["module_plexmediaserver,port"]}"
-update_sub_submenu_data "Software" "Media" "EMB002" "http://$LOCALIPADD:${module_options["module_embyserver,port"]}"
-update_sub_submenu_data "Software" "Media" "FIL002" "http://$LOCALIPADD:${module_options["module_filebrowser,port"]}"
+update_sub_submenu_data "Software" "Media" "MED002" "$(get_service_url "plex" "${module_options["module_plexmediaserver,port"]}")"
+update_sub_submenu_data "Software" "Media" "EMB002" "$(get_service_url "emby" "${module_options["module_embyserver,port"]}")"
+update_sub_submenu_data "Software" "Media" "FIL002" "$(get_service_url "filebrowser" "${module_options["module_filebrowser,port"]}")"
 update_sub_submenu_data "Software" "Media" "STR002" "http://$LOCALIPADD:${module_options["module_stirling,port"]}"
-update_sub_submenu_data "Software" "Media" "STC002" "http://$LOCALIPADD:${module_options["module_syncthing,port"]%% *}" # removing second port from url
+update_sub_submenu_data "Software" "Media" "STC002" "$(get_service_url "syncthing" "${module_options["module_syncthing,port"]%% *}")" # removing second port from url
 update_sub_submenu_data "Software" "Media" "NCT002" "https://$LOCALIPADD:${module_options["module_nextcloud,port"]}"
 update_sub_submenu_data "Software" "Media" "OWC002" "http://$LOCALIPADD:${module_options["module_owncloud,port"]}"
-update_sub_submenu_data "Software" "Media" "JMS002" "http://$LOCALIPADD:${module_options["module_jellyfin,port"]}"
-update_sub_submenu_data "Software" "Media" "IMM002" "http://$LOCALIPADD:${module_options["module_immich,port"]}"
+update_sub_submenu_data "Software" "Media" "JMS002" "$(get_service_url "jellyfin" "${module_options["module_jellyfin,port"]}")"
+	update_sub_submenu_data "Software" "Media" "IMM002" "$(get_service_url "immich" "${module_options["module_immich,port"]}")"
 update_sub_submenu_data "Software" "Media" "NAV002" "http://$LOCALIPADD:${module_options["module_navidrome,port"]}"
 
 # Containers
-update_sub_submenu_data "Software" "Containers" "POR002" "http://$LOCALIPADD:${module_options["module_portainer,port"]%% *}" # removing second port from url
+# Portainer uses HTTPS on port 9443 (not the edge agent port 9000)
+if docker container ls -a --format "{{.Names}}" 2>/dev/null | grep -q "^swag$" && \
+	docker exec swag test -f "/config/nginx/proxy-confs/portainer.subfolder.conf.enabled" 2>/dev/null; then
+	update_sub_submenu_data "Software" "Containers" "POR002" "https://$DISPLAY_URL/portainer"
+else
+	update_sub_submenu_data "Software" "Containers" "POR002" "https://$LOCALIPADD:9443"
+fi
 
 # Backup
-update_sub_submenu_data "Software" "Backup" "DPL002" "http://$LOCALIPADD:${module_options["module_duplicati,port"]%% *}" # removing second port from url
+update_sub_submenu_data "Software" "Backup" "DPL002" "$(get_service_url "duplicati" "${module_options["module_duplicati,port"]%% *}")" # removing second port from url
 
 # Printing
-update_sub_submenu_data "Software" "Printing" "OCT002" "http://$LOCALIPADD:${module_options["module_octoprint,port"]}"
+update_sub_submenu_data "Software" "Printing" "OCT002" "$(get_service_url "octoprint" "${module_options["module_octoprint,port"]}")"
 
 # DevTools
 [[ -f /etc/rsyncd.conf ]] && update_sub_submenu_data "Software" "DevTools" "DEV011" "$(grep -oP '(?<=^\[).*(?=\])' /etc/rsyncd.conf | xargs)"
 
 # Home automation
 update_sub_submenu_data "Software" "HomeAutomation" "HAB002" "http://$LOCALIPADD:${module_options["module_openhab,port"]}"
 update_sub_submenu_data "Software" "HomeAutomation" "HAS002" "http://$LOCALIPADD:${module_options["module_haos,port"]}"
-update_sub_submenu_data "Software" "HomeAutomation" "DOM002" "http://$LOCALIPADD:${module_options["module_domoticz,port"]}"
+update_sub_submenu_data "Software" "HomeAutomation" "DOM002" "$(get_service_url "domoticz" "${module_options["module_domoticz,port"]}")"
 update_sub_submenu_data "Software" "HomeAutomation" "EVCC02" "http://$LOCALIPADD:${module_options["module_evcc,port"]}"
 
 # DNS
-update_sub_submenu_data "Software" "DNS" "PIH003" "http://$LOCALIPADD:${module_options["module_pi_hole,port"]%% *}/admin" # removing second port from url
+update_sub_submenu_data "Software" "DNS" "PIH003" "$(get_service_url "pihole" "${module_options["module_pi_hole,port"]%% *}")/admin" # removing second port from url
 update_sub_submenu_data "Software" "DNS" "ADG002" "http://$LOCALIPADD:${module_options["module_adguardhome,port"]%% *}" # removing second port from url
 
 # Monitoring
-update_sub_submenu_data "Software" "Monitoring" "UPK002" "http://$LOCALIPADD:${module_options["module_uptimekuma,port"]}"
-update_sub_submenu_data "Software" "Monitoring" "NTD002" "http://$LOCALIPADD:${module_options["module_netdata,port"]}"
-update_sub_submenu_data "Software" "Monitoring" "GRA002" "http://$LOCALIPADD:${module_options["module_grafana,port"]}"
-update_sub_submenu_data "Software" "Monitoring" "NAX002" "http://$LOCALIPADD:${module_options["module_netalertx,port"]}"
-update_sub_submenu_data "Software" "Monitoring" "PRO002" "http://$LOCALIPADD:${module_options["module_prometheus,port"]}"
+update_sub_submenu_data "Software" "Monitoring" "UPK002" "$(get_service_url "uptime-kuma" "${module_options["module_uptimekuma,port"]}")"
+update_sub_submenu_data "Software" "Monitoring" "NTD002" "$(get_service_url "netdata" "${module_options["module_netdata,port"]}")"
+update_sub_submenu_data "Software" "Monitoring" "GRA002" "$(get_service_url "grafana" "${module_options["module_grafana,port"]}")"
+update_sub_submenu_data "Software" "Monitoring" "NAX002" "$(get_service_url "netalertx" "${module_options["module_netalertx,port"]}")"
+update_sub_submenu_data "Software" "Monitoring" "PRO002" "$(get_service_url "prometheus" "${module_options["module_prometheus,port"]}")"
+update_sub_submenu_data "Software" "Monitoring" "DOZ002" "$(get_service_url "dozzle" "${module_options["module_dozzle,port"]}")"
 
 # Management
 update_sub_submenu_data "Software" "Management" "CPT002" "https://$LOCALIPADD:${module_options["module_cockpit,port"]}"
-update_sub_submenu_data "Software" "Management" "HPG002" "http://$LOCALIPADD:${module_options["module_homepage,port"]}"
-update_sub_submenu_data "Software" "Management" "NBOX02" "http://$LOCALIPADD:${module_options["module_netbox,port"]}"
+update_sub_submenu_data "Software" "Management" "HPG002" "$(get_service_url "homepage" "${module_options["module_homepage,port"]}")"
+	update_sub_submenu_data "Software" "Management" "NBOX02" "$(get_service_url "netbox" "${module_options["module_netbox,port"]}")"
 
 # Downloaders
-update_sub_submenu_data "Software" "Downloaders" "DOW002" "http://$LOCALIPADD:${module_options["module_qbittorrent,port"]%% *}" # removing second port from url
-update_sub_submenu_data "Software" "Downloaders" "DEL002" "http://$LOCALIPADD:${module_options["module_deluge,port"]%% *}" # removing second port from url
-update_sub_submenu_data "Software" "Downloaders" "TRA002" "http://$LOCALIPADD:${module_options["module_transmission,port"]%% *}" # removing second port from url
-update_sub_submenu_data "Software" "Downloaders" "SABN02" "http://$LOCALIPADD:${module_options["module_sabnzbd,port"]}"
-update_sub_submenu_data "Software" "Downloaders" "MDS002" "http://$LOCALIPADD:${module_options["module_medusa,port"]}"
-update_sub_submenu_data "Software" "Downloaders" "SON002" "http://$LOCALIPADD:${module_options["module_sonarr,port"]}"
-update_sub_submenu_data "Software" "Downloaders" "RAD002" "http://$LOCALIPADD:${module_options["module_radarr,port"]}"
-update_sub_submenu_data "Software" "Downloaders" "BAZ002" "http://$LOCALIPADD:${module_options["module_bazarr,port"]}"
-update_sub_submenu_data "Software" "Downloaders" "LID002" "http://$LOCALIPADD:${module_options["module_lidarr,port"]}"
-update_sub_submenu_data "Software" "Downloaders" "RDR002" "http://$LOCALIPADD:${module_options["module_readarr,port"]}"
-update_sub_submenu_data "Software" "Downloaders" "DOW026" "http://$LOCALIPADD:${module_options["module_prowlarr,port"]}"
+update_sub_submenu_data "Software" "Downloaders" "DOW002" "$(get_service_url "qbittorrent" "${module_options["module_qbittorrent,port"]%% *}")" # removing second port from url
+update_sub_submenu_data "Software" "Downloaders" "DEL002" "$(get_service_url "deluge" "${module_options["module_deluge,port"]%% *}")" # removing second port from url
+update_sub_submenu_data "Software" "Downloaders" "TRA002" "$(get_service_url ${module_options["module_transmission,servicename"]} ${module_options["module_transmission,port"]})" # removing second port from url
+update_sub_submenu_data "Software" "Downloaders" "SABN02" "$(get_service_url "sabnzbd" "${module_options["module_sabnzbd,port"]}")"
+update_sub_submenu_data "Software" "Downloaders" "MDS002" "$(get_service_url "medusa" "${module_options["module_medusa,port"]}")"
+update_sub_submenu_data "Software" "Downloaders" "SON002" "$(get_service_url "sonarr" "${module_options["module_sonarr,port"]}")"
+update_sub_submenu_data "Software" "Downloaders" "RAD002" "$(get_service_url "radarr" "${module_options["module_radarr,port"]}")"
+update_sub_submenu_data "Software" "Downloaders" "BAZ002" "$(get_service_url "bazarr" "${module_options["module_bazarr,port"]}")"
+update_sub_submenu_data "Software" "Downloaders" "LID002" "$(get_service_url "lidarr" "${module_options["module_lidarr,port"]}")"
+update_sub_submenu_data "Software" "Downloaders" "RDR002" "$(get_service_url "readarr" "${module_options["module_readarr,port"]}")"
+update_sub_submenu_data "Software" "Downloaders" "DOW026" "$(get_service_url "prowlarr" "${module_options["module_prowlarr,port"]}")"
 update_sub_submenu_data "Software" "Downloaders" "JEL002" "http://$LOCALIPADD:${module_options["module_jellyseerr,port"]}"
 
 # web
-update_sub_submenu_data "Software" "WebHosting" "GHOST2" "http://$LOCALIPADD:${module_options["module_ghost,port"]}/ghost"
+update_sub_submenu_data "Software" "WebHosting" "GHOST2" "$(get_service_url "ghost" "${module_options["module_ghost,port"]}")/ghost"
+update_sub_submenu_data "Software" "WebHosting" "SWAG01" "https://$DISPLAY_URL"

tools/modules/software/module_bazarr.sh

@@ -9,7 +9,7 @@ module_options+=(
 	["module_bazarr,group"]="Downloaders"
 	["module_bazarr,port"]="6767"
 	["module_bazarr,arch"]="x86-64 arm64"
-	["module_bazarr,dockerimage"]="lscr.io/linuxserver/bazarr:latest"
+	["module_bazarr,dockerimage"]="linuxserver/bazarr:latest"
 	["module_bazarr,dockername"]="bazarr"
 )
 #
@@ -47,6 +47,8 @@ function module_bazarr () {
 				-v "${base_dir}/tv:/tv" \
 				--restart=always \
 				"$dockerimage"
+			# Auto-configure SWAG reverse proxy if available
+			docker_configure_swag_proxy "$dockername" "6767"
 		;;
 		"${commands[1]}") # remove
 			# Remove container and image (functions handle existence checks)

tools/modules/software/module_code-server.sh

@@ -9,7 +9,7 @@ module_options+=(
 	["module_code-server,group"]="Development"
 	["module_code-server,port"]="8443"
 	["module_code-server,arch"]="x86-64 arm64"
-	["module_code-server,dockerimage"]="lscr.io/linuxserver/code-server:latest"
+	["module_code-server,dockerimage"]="linuxserver/code-server:latest"
 	["module_code-server,dockername"]="code-server"
 )
 #

tools/modules/software/module_deluge.sh

@@ -9,7 +9,7 @@ module_options+=(
 	["module_deluge,group"]="Downloaders"
 	["module_deluge,port"]="8112"
 	["module_deluge,arch"]="x86-64 arm64"
-	["module_deluge,dockerimage"]="lscr.io/linuxserver/deluge:latest"
+	["module_deluge,dockerimage"]="linuxserver/deluge:latest"
 	["module_deluge,dockername"]="deluge"
 )
 #
@@ -50,6 +50,8 @@ function module_deluge () {
 				-v "${base_dir}/downloads:/downloads" \
 				--restart=always \
 				"$dockerimage"
+			# Auto-configure SWAG reverse proxy if available
+			docker_configure_swag_proxy "$dockername" "8112"
 		;;
 		"${commands[1]}") # remove
 			# Remove container and image (functions handle existence checks)