diff --git a/modules/server/containers/apps/gitea.nix b/modules/server/containers/apps/gitea.nix
index c7732ae..65c3d28 100644
--- a/modules/server/containers/apps/gitea.nix
+++ b/modules/server/containers/apps/gitea.nix
@@ -8,12 +8,9 @@ in {
   sops = true;
   db = true;
   paths = [{
-    path="${serverCfg.dataPath}/gitea/data";
-    owner = "1000:1000";
-    mode = "0755";
-  }{
-    path="${serverCfg.dataPath}/gitea/data-runner";
+    path="${serverCfg.path.data}/gitea";
     owner = "1000:1000";
+    dirs = ["data" "runner"];
     mode = "0755";
   }];
   containers = {
@@ -73,7 +70,7 @@ in {
       } else {});
       extraLabels = {
         "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`) && Path(`/user/login`) ";
-        "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if (serverCfg.containers?authentik && false) then "authentik" else "";
+        "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if (serverCfg.containers?authentik && containerCg.extra?proxyauth) then "authentik" else "";
         "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
         "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
         "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
@@ -81,7 +78,7 @@ in {
 
       overrides = {
         volumes = [
-          "${serverCfg.dataPath}/gitea/data:/data"
+          "${serverCfg.path.data}/gitea/data:/data"
         ];
         ports = [ "2222:22" ]; 
       };
@@ -98,7 +95,7 @@ in {
 
       overrides = {
         volumes = [
-          "${serverCfg.dataPath}/gitea/data-runner:/data"
+          "${serverCfg.path.data}/gitea/runner:/data"
           "/var/run/podman/podman.sock:/var/run/docker.sock"
         ];
         # ports = [ "8088:8088" ]; 
@@ -117,7 +114,7 @@ in {
 
       $GT admin user create --username "$DEFAULT_ADMIN_USERNAME" --password "$DEFAULT_ADMIN_PASSWORD" --email "$DEFAULT_ADMIN_EMAIL" --admin || true
 
-      touch ${serverCfg.dataPath}/gitea/data-runner/config.yml
+      touch ${serverCfg.path.data}/gitea/data-runner/config.yml
 
       RUNNER_TOKEN=$($GT actions generate-runner-token)
       $GTR register \