novox conversions: give the web apps public names through route-proxy

Add a `route` contribution (requires/contributes/binds) to every web app so
each gets a Host-routed public name via route-proxy, mirroring the
de-spiegel/only-office pattern:

- novox: gitea, keycloak, nextcloud, umami, invoicing, verdaccio, registry,
  and mailu (single mail.novox.be -> 7080; admin/webmail/api ride that port).
- ace: grafana, sonarr, radarr, lidarr, bazarr, ombi, tautulli, jackett,
  nodered, searxng, home-assistant, bookshelf, baserow.

Split photos so its three sites each get a name: photos keeps server +
admin-client (photos.novox.be), and new photos-eef (eef.novox.be) and
photos-filip (filip.novox.be) modules carry the client sites.

The production FQDN stays the literal default; a per-node .incus name is a
settings override applied where the mesh runs, not a manifest hardcoding.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/baserow/module.json

@@ -6,16 +6,22 @@
   ],
   "requires": [
     "postgres-database",
-    "redis-cache"
+    "redis-cache",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "baserow"
+    },
+    "route": {
+      "name": "baserow.zurag.be",
+      "port": 80
     }
   },
   "binds": {
     "postgres-database": "/var/lib/baserow/database.json",
-    "redis-cache": "/var/lib/baserow/redis.json"
+    "redis-cache": "/var/lib/baserow/redis.json",
+    "route": "/var/lib/baserow/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/baserow/database.secret",

modules/bazarr/module.json

@@ -103,5 +103,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "bazarr.zurag.be",
+      "port": 6767
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/bazarr/route.json"
+  }
 }

modules/bookshelf/module.json

@@ -79,5 +79,17 @@
         "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
       }
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "bookshelf.zurag.be",
+      "port": 8787
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/bookshelf/route.json"
+  }
 }

modules/gitea/module.json

@@ -2,15 +2,21 @@
   "module": "gitea",
   "version": "1",
   "requires": [
-    "postgres-database"
+    "postgres-database",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "gitea"
+    },
+    "route": {
+      "name": "gitea.novox.be",
+      "port": 3000
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/gitea/database.json"
+    "postgres-database": "/var/lib/gitea/database.json",
+    "route": "/var/lib/gitea/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/gitea/database.secret"

modules/grafana/module.json

@@ -88,5 +88,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "grafana.zurag.be",
+      "port": 3000
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/grafana/route.json"
+  }
 }

modules/home-assistant/module.json

@@ -77,5 +77,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "home-assistant.zurag.be",
+      "port": 8123
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/home-assistant/route.json"
+  }
 }

modules/invoicing/module.json

@@ -6,7 +6,8 @@
   ],
   "requires": [
     "mongodb-database",
-    "s3-bucket"
+    "s3-bucket",
+    "route"
   ],
   "contributes": {
     "mongodb-database": {
@@ -14,11 +15,16 @@
     },
     "s3-bucket": {
       "bucket": "invoicing"
+    },
+    "route": {
+      "name": "invoicing.novox.be",
+      "port": 80
     }
   },
   "binds": {
     "mongodb-database": "/var/lib/invoicing/database.json",
-    "s3-bucket": "/var/lib/invoicing/store.json"
+    "s3-bucket": "/var/lib/invoicing/store.json",
+    "route": "/var/lib/invoicing/route.json"
   },
   "secrets": {
     "mongodb-database": "/var/lib/invoicing/database.secret",

modules/jackett/module.json

@@ -75,5 +75,17 @@
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/jackett/broker"
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "jackett.zurag.be",
+      "port": 9117
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/jackett/route.json"
   }
 }

modules/keycloak/module.json

@@ -2,15 +2,21 @@
   "module": "keycloak",
   "version": "1",
   "requires": [
-    "postgres-database"
+    "postgres-database",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "keycloak"
+    },
+    "route": {
+      "name": "keycloak.novox.be",
+      "port": 8080
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/keycloak/database.json"
+    "postgres-database": "/var/lib/keycloak/database.json",
+    "route": "/var/lib/keycloak/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/keycloak/database.secret"

modules/lidarr/module.json

@@ -79,5 +79,17 @@
         "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
       }
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "lidarr.zurag.be",
+      "port": 8686
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/lidarr/route.json"
+  }
 }

modules/mailu/module.json

@@ -5,15 +5,21 @@
     "container-runtime"
   ],
   "requires": [
-    "postgres-database"
+    "postgres-database",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "mailu"
+    },
+    "route": {
+      "name": "mail.novox.be",
+      "port": 7080
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/mailu/database.json"
+    "postgres-database": "/var/lib/mailu/database.json",
+    "route": "/var/lib/mailu/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/mailu/database.secret"

modules/nextcloud/module.json

@@ -3,7 +3,8 @@
   "version": "1",
   "requires": [
     "postgres-database",
-    "s3-bucket"
+    "s3-bucket",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
@@ -11,11 +12,16 @@
     },
     "s3-bucket": {
       "bucket": "nextcloud"
+    },
+    "route": {
+      "name": "nextcloud.novox.be",
+      "port": 80
     }
   },
   "binds": {
     "postgres-database": "/var/lib/nextcloud-module/database.json",
-    "s3-bucket": "/var/lib/nextcloud-module/store.json"
+    "s3-bucket": "/var/lib/nextcloud-module/store.json",
+    "route": "/var/lib/nextcloud-module/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/nextcloud-module/database.secret",

modules/nodered/module.json

@@ -74,5 +74,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "nodered.zurag.be",
+      "port": 1880
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/nodered/route.json"
+  }
 }

modules/ombi/module.json

@@ -82,5 +82,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "ombi.zurag.be",
+      "port": 3579
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/ombi/route.json"
+  }
 }

modules/photos-eef/module.json

@@ -0,0 +1,51 @@
+{
+  "module": "photos-eef",
+  "version": "1",
+  "slug": "eef",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "eef.novox.be",
+      "port": 4012
+    }
+  },
+  "binds": {
+    "route": "/var/lib/photos-eef/route.json"
+  },
+  "listens": [
+    {
+      "port": 4012,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the eef photos client site over http; the public name eef.novox.be is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/photos-eef",
+      "mode": "0700"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "photos-eef"
+    },
+    {
+      "id": "client",
+      "type": "container",
+      "name": "photos-eef",
+      "image": "registry-api.novox.be/novox/photos-client:latest",
+      "network": "photos-eef",
+      "ports": [
+        "4012:80"
+      ]
+    }
+  ]
+}

modules/photos-filip/module.json

@@ -0,0 +1,51 @@
+{
+  "module": "photos-filip",
+  "version": "1",
+  "slug": "filip",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "filip.novox.be",
+      "port": 4013
+    }
+  },
+  "binds": {
+    "route": "/var/lib/photos-filip/route.json"
+  },
+  "listens": [
+    {
+      "port": 4013,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the filip photos client site over http; the public name filip.novox.be is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/photos-filip",
+      "mode": "0700"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "photos-filip"
+    },
+    {
+      "id": "client",
+      "type": "container",
+      "name": "photos-filip",
+      "image": "registry-api.novox.be/novox/photos-client:latest",
+      "network": "photos-filip",
+      "ports": [
+        "4013:80"
+      ]
+    }
+  ]
+}

modules/photos/module.json

@@ -85,26 +85,6 @@
       "ports": [
         "4001:80"
       ]
-    },
-    {
-      "id": "eef-client",
-      "type": "container",
-      "name": "photos-client-eef",
-      "image": "registry-api.novox.be/novox/photos-client:latest",
-      "network": "photos",
-      "ports": [
-        "4002:80"
-      ]
-    },
-    {
-      "id": "filip-client",
-      "type": "container",
-      "name": "photos-client-filip",
-      "image": "registry-api.novox.be/novox/photos-client:latest",
-      "network": "photos",
-      "ports": [
-        "4003:80"
-      ]
     }
   ]
 }

modules/radarr/module.json

@@ -79,5 +79,17 @@
         "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
       }
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "radarr.zurag.be",
+      "port": 7878
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/radarr/route.json"
+  }
 }

modules/registry/module.json

@@ -54,5 +54,17 @@
         "mesh-registry-data:/var/lib/registry"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "registry.novox.be",
+      "port": 5000
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/registry/route.json"
+  }
 }

modules/searxng/module.json

@@ -99,5 +99,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "searxng.zurag.be",
+      "port": 8080
+    }
+  },
+  "binds": {
+    "route": "/var/lib/searxng-module/route.json"
+  }
 }

modules/sonarr/module.json

@@ -84,5 +84,17 @@
         "MESH_SONARR_CONFIG_DIR": "/var/lib/sonarr/config"
       }
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "sonarr.zurag.be",
+      "port": 8989
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/sonarr/route.json"
+  }
 }

modules/tautulli/module.json

@@ -78,5 +78,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "tautulli.zurag.be",
+      "port": 8181
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/tautulli/route.json"
+  }
 }

modules/umami/module.json

@@ -5,15 +5,21 @@
     "container-runtime"
   ],
   "requires": [
-    "postgres-database"
+    "postgres-database",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "umami"
+    },
+    "route": {
+      "name": "umami.novox.be",
+      "port": 3000
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/umami/database.json"
+    "postgres-database": "/var/lib/umami/database.json",
+    "route": "/var/lib/umami/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/umami/database.secret"
@@ -43,7 +49,7 @@
       "port": 3000,
       "protocol": "tcp",
       "from": "anywhere",
-      "why": "one port serves two surfaces: the dashboard (the proxy gates it to the mesh) and the public collection endpoint that the browsers of every tracked site POST to — so the port itself must be reachable from anywhere"
+      "why": "one port serves two surfaces: the dashboard (the proxy gates it to the mesh) and the public collection endpoint that the browsers of every tracked site POST to \u2014 so the port itself must be reachable from anywhere"
     }
   ],
   "resources": [

modules/verdaccio/module.json

@@ -86,5 +86,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "verdaccio.novox.be",
+      "port": 4873
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/verdaccio/route.json"
+  }
 }