diff --git a/.pct-helpers b/.pct-helpers
index 4605e06..326739b 100644
--- a/.pct-helpers
+++ b/.pct-helpers
@@ -202,7 +202,9 @@ xread(){
 		shift
 		local non_empty=1
 	fi
+	# XXX check DFL_..???
 	if [[ "${!2}" == "SKIP" ]] ; then
+		eval "$2="
 		return
 	fi
 	if [ -z ${!2} ] ; then
@@ -220,7 +222,9 @@ xread(){
 #	xreadYes MSG VAR
 #
 xreadYes(){
+	# XXX check DFL_..???
 	if [[ "${!2}" == "SKIP" ]] ; then
+		eval "$2="
 		return
 	fi
 	if [ -z ${!2} ] ; then
@@ -312,8 +316,12 @@ tklWaitForSetup(){
 #	CLEAN_RUN	- if set ignore ./config.last-run
 #	CONFIG		- config file to load last
 #
+# XXX need this not to make this behave with explicitly set vars...
 readConfig(){
 	if [ -z $NO_DEFAULTS ] ; then
+		local IFS=$'\n'
+		#__ENV=($( (set -o posix ; set | grep -v 'BASHOPTS=') ))
+		#__ENV=($( (declare -xp) ))
 		[ -e ../config.global ] \
 			&& source ../config.global
 		[ -e ./config ] \
@@ -324,6 +332,8 @@ readConfig(){
 			&& source ./config.last-run
 		[ -e "$CONFIG" ] \
 			&& source $CONFIG
+		#eval "${__ENV[@]}"
+		#__ENV=
 	fi
 }
 
@@ -373,6 +383,22 @@ saveLastRunConfig(){
 	saveConfig -d -a "$cfg" ${XREAD_VARS[@]}
 }
 
+#	webAppConfig NAME
+webAppConfig(){
+	local name=${1^^}
+	eval "${name}_SUBDOMAIN=\${${name}_SUBDOMAIN:=\${DFL_SUB${name}_DOMAIN}}
+		${name}_SUBDOMAIN=\${${name}_SUBDOMAIN:+\${${name}_SUBDOMAIN%.}.}
+		${name}_DOMAIN=\${${name}_DOMAIN:=\${DFL_${name}_DOMAIN}}
+		# prioretize \${name}_*
+		DFL_DOMAIN=\${DFL_DOMAIN:+\${${name}_SUBDOMAIN}\${DFL_DOMAIN}}
+		DFL_DOMAIN=\${DOMAIN:+\${${name}_SUBDOMAIN}\${DOMAIN}}
+		if [ \$${name}_DOMAIN ] ; then
+			DFL_DOMAIN=\${${name}_SUBDOMAIN}\${${name}_DOMAIN}
+		fi"
+	# force check of domain...
+	DOMAIN=
+}
+
 #
 #	readVars
 #
diff --git a/config.global.example b/config.global.example
index a0f8266..7a9a116 100644
--- a/config.global.example
+++ b/config.global.example
@@ -18,9 +18,9 @@
 #
 #------------------------------------------------------------------------
 
-DFL_EMAIL=user@example.com
+EMAIL=user@example.com
 
-DFL_DOMAIN=example.com
+DOMAIN=example.com
 
 DFL_WAN_IP=192.168.1.101/24
 DFL_WAN_GATE=192.168.1.252
@@ -41,6 +41,24 @@ LAN_BRIDGE=
 ADMIN_BRIDGE=
 
 
+# Web app/service domain configuration
+#
+# Here two optional variables are provided per service:
+# - <SERVICE>_DOMAIN=...
+# 	Overrides the $DOMAIN option above for <SERVICE>
+# - <SERVICE>_SUBDOMAIN=...
+# 	Sets the subdomain of $DOMAIN (or $<SERVICE>_DOMAIN) for <SERVICE>
+#
+
+# Nextcloud
+#NEXTCLOUD_DOMAIN=
+NEXTCLOUD_SUBDOMAIN=nc.
+
+# Gitea
+#GITEA_DOMAIN=
+#GITEA_SUBDOMAIN=
+
+
 # Extra options passed to each CT created.
 #
 # This can be used for passing in ssh keys, etc...
diff --git a/gitea/make.sh b/gitea/make.sh
index 83201f0..d87686e 100644
--- a/gitea/make.sh
+++ b/gitea/make.sh
@@ -17,6 +17,8 @@ readConfig
 
 #----------------------------------------------------------------------
 
+webAppConfig gitea
+
 DFL_ID=${DFL_ID:=300}
 DFL_CTHOSTNAME=${DFL_CTHOSTNAME:=gitea}
 
diff --git a/gate-traefik/templates/etc/traefik.d/gitea.yml b/gitea/templates/etc/traefik.d/gitea.yml
similarity index 100%
rename from gate-traefik/templates/etc/traefik.d/gitea.yml
rename to gitea/templates/etc/traefik.d/gitea.yml
diff --git a/nextcloud/make.sh b/nextcloud/make.sh
index df23f52..8e0f7a2 100755
--- a/nextcloud/make.sh
+++ b/nextcloud/make.sh
@@ -17,6 +17,8 @@ readConfig
 
 #----------------------------------------------------------------------
 
+webAppConfig Nextcloud
+
 DFL_ID=${DFL_ID:=300}
 DFL_CTHOSTNAME=${DFL_CTHOSTNAME:=nextcloud}
 
@@ -42,6 +44,9 @@ REBOOT=${REBOOT:=1}
 
 readVars
 
+# Nextcloud-specific configuration...
+APP_DOMAIN=$DOMAIN
+
 
 #----------------------------------------------------------------------
 
diff --git a/gate-traefik/templates/etc/traefik.d/nextcloud.yml b/nextcloud/templates/etc/traefik.d/nextcloud.yml
similarity index 87%
rename from gate-traefik/templates/etc/traefik.d/nextcloud.yml
rename to nextcloud/templates/etc/traefik.d/nextcloud.yml
index 19f1c25..8029296 100644
--- a/gate-traefik/templates/etc/traefik.d/nextcloud.yml
+++ b/nextcloud/templates/etc/traefik.d/nextcloud.yml
@@ -4,7 +4,7 @@ http:
       entryPoints:
         - https
       service: nextcloud
-      rule: "Host(`nc.${DOMAIN}`)"
+      rule: "Host(`${DOMAIN}`)"
       tls:
         certResolver: letsEncrypt
 
diff --git a/gate-traefik/assets/etc/traefik.d/ssh.yml b/ssh/assets/etc/traefik.d/ssh.yml
similarity index 100%
rename from gate-traefik/assets/etc/traefik.d/ssh.yml
rename to ssh/assets/etc/traefik.d/ssh.yml
diff --git a/gate-traefik/assets/etc/traefik.d/wireguard.yml b/wireguard/assets/etc/traefik.d/wireguard.yml
similarity index 100%
rename from gate-traefik/assets/etc/traefik.d/wireguard.yml
rename to wireguard/assets/etc/traefik.d/wireguard.yml