diff --git a/modules/common/cloudflare-ddns.nix b/modules/common/cloudflare-ddns.nix
index a1ebb61..e199f16 100644
--- a/modules/common/cloudflare-ddns.nix
+++ b/modules/common/cloudflare-ddns.nix
@@ -4,7 +4,7 @@
     proxied = false;
     ipv4 = true;
     ipv6 = false;
-    domains = [ "d1.a1.crawling.us" ];
+    domains = [ "a1.crawling.us" ];
     apiTokenFile = config.sops.secrets.cloudflare_ddns__api_token.path;
   };
 
diff --git a/modules/common/collabora.nix b/modules/common/collabora.nix
new file mode 100644
index 0000000..a746962
--- /dev/null
+++ b/modules/common/collabora.nix
@@ -0,0 +1,77 @@
+{ config, ... }: {
+  #Collabora Containers
+  virtualisation.oci-containers.containers.collabora = {
+    image = "collabora/code:latest";
+    ports = [ "9980:9980/tcp" ];
+    environment = {
+      server_name = "collabora.clicks.codes";
+      aliasgroup1 = "https://nextcloud.clicks.codes:443";
+      aliasgroup2 = "https://cloud.clicks.codes:443";
+      aliasgroup3 = "https://docs.clicks.codes:443";
+      dictionaries = "en_US";
+      extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
+    };
+    extraOptions = [ 
+      "--pull=newer"
+    ];
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  #Collabora Virtual Hosts
+  services.nginx.virtualHosts.${config.virtualisation.oci-containers.containers.collabora.environment.server_name} = {
+    serverAliases = [ "www.${config.virtualisation.oci-containers.containers.collabora.environment.server_name}" "docs.clicks.codes" "www.clicks.codes" ];
+    enableACME = true;
+    forceSSL = true;
+    addSSL = false;
+    listenAddresses = [ "0.0.0.0" ];
+
+    extraConfig = ''
+      location = / {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+      }
+
+      # static files
+      location ^~ /browser {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+      }
+
+      # WOPI discovery URL
+      location ^~ /hosting/discovery {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+      }
+
+      # Capabilities
+      location ^~ /hosting/capabilities {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+     }
+
+     # main websocket
+     location ~ ^/cool/(.*)/ws$ {
+       proxy_pass http://standard:9980;
+       proxy_set_header Upgrade $http_upgrade;
+       proxy_set_header Connection "Upgrade";
+       proxy_set_header Host $host;
+       proxy_read_timeout 36000s;
+     }
+
+     # download, presentation and image upload
+     location ~ ^/(c|l)ool {
+       proxy_pass http://standard:9980;
+       proxy_set_header Host $host;
+     }
+
+     # Admin Console websocket
+     location ^~ /cool/adminws {
+       proxy_pass http://standard:9980;
+       proxy_set_header Upgrade $http_upgrade;
+       proxy_set_header Connection "Upgrade";
+       proxy_set_header Host $host;
+       proxy_read_timeout 36000s;
+     }
+    '';
+  };
+}
diff --git a/modules/common/dmarc.nix b/modules/common/dmarc.nix
index 3266214..62d847c 100644
--- a/modules/common/dmarc.nix
+++ b/modules/common/dmarc.nix
@@ -21,7 +21,7 @@
   ];
 
   services.parsedmarc = {
-    enable = true;
+    enable = false;
     settings.imap = {
       host = "mail.clicks.codes";
       user = "dmarc@clicks.codes";
diff --git a/modules/common/docker.nix b/modules/common/docker.nix
index a1b4e8c..78c7f20 100644
--- a/modules/common/docker.nix
+++ b/modules/common/docker.nix
@@ -1,6 +1,5 @@
 { pkgs, ... }: {
   environment.systemPackages = [ pkgs.docker-compose ];
   virtualisation.docker.enable = true;
-  users.users.mailu.extraGroups = [ "docker" ];
   users.users.kavita.extraGroups = [ "docker" ];
 }
diff --git a/modules/common/gerrit.nix b/modules/common/gerrit.nix
index d7a780e..2cadb1b 100644
--- a/modules/common/gerrit.nix
+++ b/modules/common/gerrit.nix
@@ -34,7 +34,7 @@
       };
       plugin."gerrit-oauth-provider-keycloak-oauth" = {
         root-url = "https://login.clicks.codes";
-        realm = "clicks";
+        realm = "master";
         client-id = "git";
         client-secret = "!!gerrit_oauth_client_secret!!";
         use-preferred-username = true;
@@ -79,8 +79,8 @@
         reportBugUrl =
           "https://discord.gg/bPaNnxe"; # TODO: kinda obnoxious, better to setup openproject
         enablePeerIPInReflogRecord = true;
-        instanceId = "a1d1";
-        instanceName = "a1d1.clicks";
+        instanceId = "clicks";
+        instanceName = "Clicks Gerrit";
       };
       mimetype = lib.pipe [ "image/*" "video/*" "application/pdf" ] [
         (map (name: {
@@ -89,8 +89,21 @@
         }))
         builtins.listToAttrs
       ];
-      receive.enableSignedPush = true;
-      sendemail.enable = false; # TODO: add credentials to git@clicks.codes
+      sendemail = {
+        enable = true;
+        smtpServer = "mail.clicks.codes";
+        smtpUser = "git";
+        smtpPass = "!!gerrit_email_password!!";
+      };
+      receiveemail = {
+        enable = true;
+        protocol = "IMAP";
+        host = "mail.clicks.codes";
+        username = "git@clicks.codes";
+        password = "!!gerrit_email_password!!";
+        encryption = "SSL";
+        enableImapIdle = true;
+      };
       sshd.advertisedAddress = "ssh.clicks.codes:29418";
       user = {
         name = "Clicks Gerrit";
@@ -119,7 +132,7 @@
     ];
     serverId = "45f277d0-fce7-43b7-9eb3-2e3234e0110f";
 
-    listenAddress = "127.0.0.255:1000";
+    listenAddress = "127.0.0.255:1024";
   };
 
   sops.secrets = {
@@ -137,6 +150,13 @@
       sopsFile = ../../secrets/gerrit.json;
       format = "json";
     };
+    gerrit_email_password = {
+      mode = "0400";
+      owner = config.users.users.root.name;
+      group = config.users.users.root.group;
+      sopsFile = ../../secrets/gerrit.json;
+      format = "json";
+    };
   };
 } (let isDerived = base != null;
 in if isDerived then
@@ -150,6 +170,8 @@
         config.sops.secrets.gerrit_email_private_key.path;
       matchers."gerrit_oauth_client_secret".secret =
         config.sops.secrets.gerrit_oauth_client_secret.path;
+      matchers."gerrit_email_password".secret =
+        config.sops.secrets.gerrit_email_password.path;
       owner = config.users.users.root.name;
       group = "gerrit";
       mode = "0040";
diff --git a/modules/common/keycloak.nix b/modules/common/keycloak.nix
index 30e078b..e158825 100644
--- a/modules/common/keycloak.nix
+++ b/modules/common/keycloak.nix
@@ -1,4 +1,21 @@
-{ config, ... }: {
+{ config, lib, ... }: {
+  sops.secrets.keycloak_rsa_private_key = {
+    mode = "0600";
+    owner = "keycloak";
+    group = "keycloak";
+    sopsFile = ../../secrets/keycloak_rsa_private_key.pem;
+    format = "binary";
+  };
+
+  users.users.keycloak = {
+    isSystemUser = true;
+    createHome = true;
+    home = "/var/keycloak";
+    group = "keycloak";
+  };
+  users.groups.keycloak = {};
+  systemd.services.keycloak.serviceConfig.DynamicUser = lib.mkForce false;
+
   services.keycloak = {
     enable = true;
     settings = {
@@ -13,9 +30,8 @@
       hostname = "login.clicks.codes";
       hostname-strict = false;
 
-      https-certificate-file = "/var/keycloak/login.clicks.codes.rsa.cert.pem";
-      https-certificate-key-file =
-        "/var/keycloak/login.clicks.codes.rsa.private.pem";
+      https-certificate-file = "${./keycloak/login.clicks.codes.rsa.cert.pem}";
+      https-certificate-key-file = config.sops.secrets.keycloak_rsa_private_key.path;
     };
     database = {
       createLocally = false;
@@ -23,4 +39,5 @@
       passwordFile = config.sops.secrets.clicks_keycloak_db_password.path;
     };
   };
+  
 }
diff --git a/modules/common/keycloak/login.clicks.codes.rsa.cert.pem b/modules/common/keycloak/login.clicks.codes.rsa.cert.pem
new file mode 100644
index 0000000..8beffce
--- /dev/null
+++ b/modules/common/keycloak/login.clicks.codes.rsa.cert.pem
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGKTCCBBGgAwIBAgIUIIExgZ1p0ZNeSUedhcVueeXId+MwDQYJKoZIhvcNAQEL
+BQAwgaMxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhEZWxhd2FyZTERMA8GA1UEBwwI
+Q2xheW1vbnQxDzANBgNVBAoMBkNsaWNrczEcMBoGA1UECwwTSW5mcmFzdHJ1Y3R1
+cmUgVGVhbTEbMBkGA1UEAwwSbG9naW4uY2xpY2tzLmNvZGVzMSIwIAYJKoZIhvcN
+AQkBFhNtaW5pb25AY2xpY2tzLmNvZGVzMB4XDTIzMTExODIwMzMxMFoXDTI0MTEx
+NzIwMzMxMFowgaMxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhEZWxhd2FyZTERMA8G
+A1UEBwwIQ2xheW1vbnQxDzANBgNVBAoMBkNsaWNrczEcMBoGA1UECwwTSW5mcmFz
+dHJ1Y3R1cmUgVGVhbTEbMBkGA1UEAwwSbG9naW4uY2xpY2tzLmNvZGVzMSIwIAYJ
+KoZIhvcNAQkBFhNtaW5pb25AY2xpY2tzLmNvZGVzMIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAzWGX+FQO/5sWWb49szFDF2SdybRAwaW23yiIldkcRjE2
+vqPHHUINXjZZ6jmVeYKA+OZ/GKBEpHwgUkKkDXQo/s269D+Zu+mhJtftURwWhTba
+NTZpMLu5OiYhahaaH1ekmZHesub8X2nyAnIXxCozvBnIyd3UG6p18Uaj5JL9EhSX
+An20M6YYt4wXmEbglgPWCVzqwiUC2ZwMiQr6gmLKUPfEgrqrIQg+NUXZ3MpXHF7Z
+jrGVKRTtfhPTgmaGs1aGoX196N9MZWc318BmUVAEgSTnWLJ45HfuCyb9BzGl7MFy
+18fDWDXAA761gCVcngGQ/XOqvs5mYrBXxskTnBW2nrD9kbm8Lf9y1UM4nHE40IOk
+xW/aaZWOSUBg44XkPOuvVhpxeyMSkfYc5fggySXKI5DQ/JRaEu573CEjidr87D3O
+QuU24MLehimAOjFlcCkJaubzdCR8FFr5zNoq4+1xtyqg2NCI/mzrTPneoot4Xo5F
+SSzoidJn1RPBTUB+h3J6vt3hf61wdFhrODAvlnjsLLifEWFWLeXHwSx70RgVlgM3
+E2d3kXLAmVacARDSKEoxJ+GfZ7t5SSdYW+YZj9cM8lEBDnNSB6w4VoMksZF9yKZG
++C/QnOKgI6WOVRN6SKQcAbxq63wvud/I4owgx6lcFPz1qLFjiiP0FLs98yOmXo0C
+AwEAAaNTMFEwHQYDVR0OBBYEFKanCBP3hCkRzZCF87gSwhYSlyJeMB8GA1UdIwQY
+MBaAFKanCBP3hCkRzZCF87gSwhYSlyJeMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
+hvcNAQELBQADggIBAGEsTp9O9yAyhOOuIZcv3FkLeJ7JXpXbh5WlA9K5wvTcLnbj
+E7iMX3Gm6MrYet50v2zVe1sXchhv+rjtWwjyD1Hc9rFBS+o3weFPDOA676wQqNQc
+D2xxjIeGgzrH1ntOI9FNImOTQRf1LrM8FctK8emqVUi7+r5z+uRAiratnUK0Tbfk
+qZeYQCIp0Vmha+XHliiztLzbxLkaVAjuku6itNfSitQJOg5RZiJStGORUSUadby1
+7m9yukHU6Pr+5QMojoOqS9UiSSWdSVdk0qLsBs5T/2s2/FS2/nPmSiLGQ6ixiqsh
+tnNK8XhmEolZRW0soJW2BWu27U3PH/8Vxyf6MjRsiV+DJUMmQGHhxW66a6sEYr00
+jHmU73X9ogXlvCF/0SH5ZzJ+CoJl4xbhtbUKv6WM6ITjS4XYYhO+tgJWA2akJJ16
+PeNl2KY28UmWPYeJLoI2EPRNy/BpaI3y8VZU9eQNGZvYHvfO2pEEh7J84PbVO8CO
+MHdWjYsawJnpWxiNJaAV11E3vmqZDDhnAmJkjR7GFA2/dqXsJdpyDm/Qpo78ykVV
+ugaSRpFCFqnpv9/VBihzUx12jvonUuFUPsPTzn9X/+jDq6hh0Iz6AD3Zqhc1KF/Q
+6W2X1qjFMfD5tKKfxovIdvVzYGZdqrR2lCVyFgJ9EQCZn2tXaiElr3fQYpYN
+-----END CERTIFICATE-----
diff --git a/modules/common/mailcow.nix b/modules/common/mailcow.nix
new file mode 100644
index 0000000..681573f
--- /dev/null
+++ b/modules/common/mailcow.nix
@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }: let
+  mailDomains = [
+    "clicks.codes"
+    "coded.codes"
+    "hopescaramels.com"
+    "trans.gg"
+  ];
+  mailACMEHosts = [
+    "mail.clicks.codes"
+    "mail.coded.codes"
+    "mail.trans.gg"
+    "mail.hopescaramels.com"
+  ] ++ (
+    builtins.concatMap
+      (domain: [ domain "mail.${domain}" "imap.${domain}" "smtp.${domain}" ])
+      mailDomains
+  );
+in {
+  security.acme = {
+    certs = lib.pipe mailACMEHosts [
+      (map (name: { inherit name; value = {}; }))
+      builtins.listToAttrs
+    ];
+    defaults.postRun = "cp -r $(pwd) /opt/mailcow-dockerized/data/assets/ssl/";
+  };
+}
diff --git a/modules/common/matrix.nix b/modules/common/matrix.nix
index c71ba37..5e865bd 100644
--- a/modules/common/matrix.nix
+++ b/modules/common/matrix.nix
@@ -8,14 +8,14 @@
       [ matrix-synapse-mjolnir-antispam ];
 
     settings = rec {
-      server_name = "coded.codes";
+      server_name = "clicks.codes";
       auto_join_rooms = [ "#general:${server_name}" ];
       enable_registration = true;
       registration_requires_token = true;
       allow_public_rooms_over_federation = true;
       allow_device_name_lookup_over_federation = true;
       registration_shared_secret = "!!registration_shared_secret!!";
-      public_baseurl = "https://matrix-backend.coded.codes/";
+      public_baseurl = "https://matrix-backend.clicks.codes/";
       max_upload_size = "100M";
       listeners = [{
         x_forwarded = true;
@@ -28,12 +28,31 @@
       }];
       enable_metrics = true;
       database.args.database = "synapse";
+
+      oidc_providers = [
+        {
+          idp_id = "keycloak";
+          idp_name = "Clicks Keycloak";
+          issuer = "https://login.clicks.codes/realms/master";
+          client_id = "matrix";
+          client_secret = "!!matrix_keycloak_client_secret!!";
+          scopes = [ "openid" "profile" ];
+          user_mapping_provider = {
+            config = {
+              localpart_template = "{{ user.preferred_username }}";
+              display_name_template = "{{ user.name }}";
+            };
+          };
+          backchannel_logout_enabled = true;
+        }
+      ];
+
       turn_uris = [
 
-        /* "turn:turn.coded.codes:3478?transport=udp"
-           "turn:turn.coded.codes:3478?transport=tcp"
-           "turns:turn.coded.codes:5349?transport=udp"
-           "turns:turn.coded.codes:5349?transport=tcp"
+        /* "turn:turn.clicks.codes:3478?transport=udp"
+           "turn:turn.clicks.codes:3478?transport=tcp"
+           "turns:turn.clicks.codes:5349?transport=udp"
+           "turns:turn.clicks.codes:5349?transport=tcp"
         */
       ]; # Please use matrix.org turn
       # turn_shared_secret = "!!turn_shared_secret!!";
@@ -66,7 +85,7 @@
   networking.firewall.allowedUDPPorts = [ 3478 5349 ];
 
   services.mjolnir = {
-    enable = true;
+    enable = false;
 
     settings = {
       autojoinOnlyIfManager = true;
@@ -76,7 +95,7 @@
       admin.enableMakeRoomAdminCommand = true;
       allowNoPrefix = true;
       protections.wordlist.words = [ ];
-      protectedRooms = [ "https://matrix.to/#/#global:coded.codes" ];
+      protectedRooms = [ "https://matrix.to/#/#global:clicks.codes" ];
     };
 
     pantalaimon = {
@@ -91,7 +110,7 @@
 
     homeserverUrl = "http://localhost:4527";
 
-    managementRoom = "#moderation-commands:coded.codes";
+    managementRoom = "#moderation-commands:clicks.codes";
   };
 
   services.coturn = {
@@ -100,14 +119,14 @@
     use-auth-secret = true;
     # static-auth-secret-file = config.sops.secrets.turn_shared_secret.path;
 
-    realm = "turn.coded.codes";
+    realm = "turn.clicks.codes";
 
     no-tcp-relay = true;
 
     no-cli = true;
 
     extraConfig = ''
-      external-ip=turn.coded.codes
+      external-ip=turn.clicks.codes
     '';
   };
 
@@ -119,6 +138,13 @@
     #  sopsFile = ../../secrets/matrix.json;
     #  format = "json";
     #};
+    matrix_keycloak_client_secret = {
+      mode = "0400";
+      owner = config.users.users.matrix-synapse.name;
+      group = config.users.users.matrix-synapse.group;
+      sopsFile = ../../secrets/matrix.json;
+      format = "json";
+    };
     registration_shared_secret = {
       mode = "0400";
       owner = config.users.users.root.name;
@@ -134,13 +160,13 @@
       format = "binary";
       path = config.services.matrix-synapse.settings.signing_key_path;
     };
-    mjolnir_password = {
+    /*mjolnir_password = {
       mode = "0600";
       owner = config.users.users.mjolnir.name;
       group = config.users.users.mjolnir.group;
       sopsFile = ../../secrets/matrix.json;
       format = "json";
-    };
+    };*/
   };
 } (let isDerived = base != null;
 in if isDerived
@@ -153,6 +179,8 @@
       source = toString synapse_cfgfile;
       matchers."registration_shared_secret".secret =
         config.sops.secrets.registration_shared_secret.path;
+      matchers."matrix_keycloak_client_secret".secret =
+        config.sops.secrets.matrix_keycloak_client_secret.path;
       # matchers."turn_shared_secret".secret =
       #   config.sops.secrets.turn_shared_secret.path;
       owner = config.users.users.matrix-synapse.name;
diff --git a/modules/common/networking.nix b/modules/common/networking.nix
index e546db9..a19223c 100644
--- a/modules/common/networking.nix
+++ b/modules/common/networking.nix
@@ -10,5 +10,6 @@
 
     "192.168.0.4" = [ "CodedPi" ];
     "192.168.0.5" = [ "SamuelDesktop" ];
+    "192.168.0.6" = [ "d2.a1.clicks" "a1d2.clicks" "a1d2" ];
   };
 }
diff --git a/modules/common/nginx-routes.nix b/modules/common/nginx-routes.nix
index 9a8534e..024dc98 100644
--- a/modules/common/nginx-routes.nix
+++ b/modules/common/nginx-routes.nix
@@ -7,8 +7,12 @@
     (Host "testing.coded.codes" (ReverseProxy "SamuelDesktop:3000"))
     (Hosts [ "kavita.coded.codes" "reading.coded.codes" ]
       (ReverseProxy "127.0.0.1:5000"))
-    (Host "clicks.codes" (ReverseProxy "127.0.0.1:3000"))
-    (Host "passwords.clicks.codes" (ReverseProxy "127.0.0.1:8452"))
+    (Host "clicks.codes" (Compose [
+      (Path "/.well-known/matrix/"
+        (File ./nginx/clicks.codes/.well-known/matrix))
+      (ReverseProxy "127.0.0.1:3000")
+    ]))
+    (Hosts [ "vaultwarden.clicks.codes" "passwords.clicks.codes" ] (ReverseProxy "generic:1028"))
     (Host "login.clicks.codes" (ReverseProxy "127.0.0.1:9083"))
     (Hosts [
       "syncthing.clicks.codes"
@@ -17,7 +21,7 @@
       "syncthing.hopescaramels.com"
     ] (ReverseProxy "127.0.0.1:8384"))
     (Hosts [ "gerrit.clicks.codes" "git.clicks.codes" ]
-      (ReverseProxy "127.0.0.255:1000"))
+      (ReverseProxy "generic:1024"))
     (Hosts [ "grafana.clicks.codes" "logs.clicks.codes" ]
       (ReverseProxy "127.0.0.1:9052"))
     (InsecureHosts [
@@ -36,12 +40,12 @@
       "smtp.coded.codes"
       "smtp.clicks.codes"
       "smtp.hopescaramels.com"
-    ] (ReverseProxy "127.0.0.1:1080"))
-    (Host "matrix.coded.codes" (Directory "${builtins.toString
+    ] (ReverseProxy "generic:1026"))
+    (Hosts ["matrix.clicks.codes" "matrix.coded.codes"] (Directory "${builtins.toString
       (pkgs.schildichat-web.override {
         conf = {
           default_server_config =
-            lib.pipe ./nginx/coded.codes/.well-known/matrix [
+            lib.pipe ./nginx/clicks.codes/.well-known/matrix [
               builtins.readFile
               builtins.fromJSON
             ];
@@ -56,7 +60,7 @@
           };
           setting_defaults = { "fallbackICEServerAllowed" = true; };
           default_theme = "dark";
-          permalink_prefix = "https://matrix.coded.codes";
+          permalink_prefix = "https://matrix.clicks.codes";
           disable_guests = true;
           disable_3pid_login = true;
         };
@@ -67,10 +71,10 @@
       (Path "/nucleus/" (ReverseProxy "SamuelDesktop:10000")))
     (Host "coded.codes" (Compose [
       (Path "/.well-known/matrix/"
-        (File ./nginx/coded.codes/.well-known/matrix))
+        (File ./nginx/clicks.codes/.well-known/matrix))
       (Redirect "https://clicks.codes$request_uri")
     ]))
-    (Host "matrix-backend.coded.codes" (Compose [
+    (Host "matrix-backend.clicks.codes" (Compose [
       (Path "/_synapse/admin/" (Status 403))
       (ReverseProxy "127.0.0.1:4527")
     ]))
@@ -78,9 +82,7 @@
   clicks.nginx.serviceAliases = with helpers.nginx; [
     (Aliases "nextcloud.clicks.codes" [
       "cloud.clicks.codes"
-      "docs.clicks.codes"
       "www.cloud.clicks.codes"
-      "www.docs.clicks.codes"
       "www.nextcloud.clicks.codes"
     ])
     (Aliases "privatebin" [
@@ -95,13 +97,4 @@
       "www.privatebin.clicks.codes"
     ])
   ];
-  clicks.nginx.streams = with helpers.nginx; [
-    (ProxyStream 143 "127.0.0.1:1143" "tcp") # imap
-    (ProxyStream 993 "127.0.0.1:1993" "tcp") # imap
-    (ProxyStream 110 "127.0.0.1:1110" "tcp") # pop3
-    (ProxyStream 995 "127.0.0.1:1995" "tcp") # pop3
-    (ProxyStream 25 "127.0.0.1:1025" "tcp") # smtp
-    (ProxyStream 465 "127.0.0.1:1465" "tcp") # smtp
-    (ProxyStream 587 "127.0.0.1:1587" "tcp") # smtp
-  ];
 }
diff --git a/modules/common/nginx/clicks.codes/.well-known/matrix b/modules/common/nginx/clicks.codes/.well-known/matrix
new file mode 100644
index 0000000..c7ba524
--- /dev/null
+++ b/modules/common/nginx/clicks.codes/.well-known/matrix
@@ -0,0 +1,7 @@
+{
+  "m.server": "matrix-backend.clicks.codes:443",
+  "m.homeserver": {
+    "base_url": "https://matrix-backend.clicks.codes:443",
+    "server_name": "clicks.codes"
+  }
+}
diff --git a/modules/common/nginx/coded.codes/.well-known/matrix b/modules/common/nginx/coded.codes/.well-known/matrix
deleted file mode 100644
index 9c679da..0000000
--- a/modules/common/nginx/coded.codes/.well-known/matrix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "m.server": "matrix-backend.coded.codes:443",
-  "m.homeserver": {
-    "base_url": "https://matrix-backend.coded.codes:443",
-    "server_name": "coded.codes"
-  }
-}
diff --git a/modules/common/postgres.nix b/modules/common/postgres.nix
index 397a377..c138511 100644
--- a/modules/common/postgres.nix
+++ b/modules/common/postgres.nix
@@ -11,7 +11,7 @@
     };
 
     ensureDatabases =
-      [ "vaultwarden" "gerrit" "privatebin" "keycloak" "nextcloud" ];
+      [ "vaultwarden" "gerrit" "privatebin" "keycloak" "nextcloud" "synapse" ];
 
     ensureUsers = [
       {
@@ -22,7 +22,7 @@
         };
       }
       {
-        name = "synapse";
+        name = "matrix-synapse";
         ensurePermissions = { "DATABASE synapse" = "ALL PRIVILEGES"; };
       }
       {
@@ -74,7 +74,7 @@
       }
       {
         user = "vaultwarden";
-        passwordFile = config.sops.secrets.clicks_bitwarden_db_password.path;
+        passwordFile = config.sops.secrets.clicks_vaultwarden_db_password.path;
       }
       {
         user = "privatebin";
@@ -95,7 +95,7 @@
   sops.secrets = lib.pipe [
     "clicks_grafana_db_password"
     "clicks_keycloak_db_password"
-    "clicks_bitwarden_db_password"
+    "clicks_vaultwarden_db_password"
     "clicks_privatebin_db_password"
     "clicks_nextcloud_db_password"
   ] [
diff --git a/modules/common/syncthing.nix b/modules/common/syncthing.nix
deleted file mode 100644
index cea1012..0000000
--- a/modules/common/syncthing.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ pkgs, ... }: {
-  services.syncthing.enable = true;
-  services.syncthing.openDefaultPorts = true;
-
-  services.syncthing.guiAddress = "0.0.0.0:8384";
-}
diff --git a/modules/common/users.nix b/modules/common/users.nix
index 58dc7d3..b15feae 100644
--- a/modules/common/users.nix
+++ b/modules/common/users.nix
@@ -44,5 +44,14 @@
     group = "clicks";
     shell = pkgs.bashInteractive;
   };
+  users.users.backups = {
+    isSystemUser = true;
+    createHome = true;
+    home = "/backups";
+    group = "backups";
+    shell = pkgs.bashInteractive;
+    extraGroups = [ "wheel" ]; # needed so we can create snapshots of everything
+  };
   users.groups.clicks = { };
+  users.groups.backups = { };
 }
diff --git a/modules/common/vaultwarden.nix b/modules/common/vaultwarden.nix
index 40047dd..7ccc3a1 100644
--- a/modules/common/vaultwarden.nix
+++ b/modules/common/vaultwarden.nix
@@ -1,7 +1,5 @@
-{ base, pkgs, drive_paths, lib, config, ... }:
-if drive_paths == null
-then {}
-else lib.recursiveUpdate {
+{ base, pkgs, lib, config, ... }:
+lib.recursiveUpdate {
   environment.systemPackages = with pkgs; [ vaultwarden ];
 
   services.vaultwarden.enable = true;
@@ -36,9 +34,9 @@
 
     vaultwarden_config = {
       # Server Settings
-      DOMAIN = "https://passwords.clicks.codes";
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = 8452;
+      DOMAIN = "https://vaultwarden.clicks.codes";
+      ROCKET_ADDRESS = "127.0.0.255";
+      ROCKET_PORT = 1028;
 
       # General Settings
       SIGNUPS_ALLOWED = false;
@@ -47,15 +45,6 @@
         "clicks.codes,coded.codes,thecoded.prof,starrysky.fyi,hopescaramels.com,pinea.dev,trans.gg";
       SIGNUPS_VERIFY = true;
 
-      RSA_KEY_FILENAME =
-        "${drive_paths.External1000SSD.path}/bitwarden/rsa_key";
-      ICON_CACHE_FOLDER =
-        "${drive_paths.External1000SSD.path}/bitwarden/icon_cache";
-      ATTACHMENTS_FOLDER =
-        "${drive_paths.External4000HDD.path}/bitwarden/attachments";
-      SENDS_FOLDER = "${drive_paths.External4000HDD.path}/bitwarden/sends";
-      TMP_FOLDER = "${drive_paths.External4000HDD.path}/bitwarden/tmp";
-
       DISABLE_2FA_REMEMBER = true;
 
       # Admin Account
@@ -63,18 +52,18 @@
 
       # Database Settings
       DATABASE_URL =
-        "postgresql://vaultwarden:!!clicks_bitwarden_db_secret!!@127.0.0.1:${
+        "postgresql://vaultwarden:!!clicks_vaultwarden_db_secret!!@127.0.0.1:${
           toString config.services.postgresql.port
         }/vaultwarden";
 
       # Mail Settings
       SMTP_HOST = "mail.clicks.codes";
-      SMTP_FROM = "bitwarden@clicks.codes";
-      SMTP_FROM_NAME = "Clicks Bitwarden";
+      SMTP_FROM = "vaultwarden@clicks.codes";
+      SMTP_FROM_NAME = "Clicks vaultwarden";
       SMTP_SECURITY = "starttls";
       SMTP_PORT = 587;
 
-      SMTP_USERNAME = "bitwarden@clicks.codes";
+      SMTP_USERNAME = "vaultwarden@clicks.codes";
       SMTP_PASSWORD = "!!SMTP_PASSWORD!!";
 
       REQUIRE_DEVICE_EMAIL = true;
@@ -85,9 +74,8 @@
       YUBICO_CLIENT_ID = "89788";
       YUBICO_SECRET_KEY = "!!YUBICO_SECRET_KEY!!";
 
-      # TODO: Buy a license
       # HIBP Settings
-      # HIBP_API_KEY="!!HIBP_API_KEY!!";
+      HIBP_API_KEY="!!HIBP_API_KEY!!";
 
       ORG_ENABLE_GROUPS = true;
       # I have looked at the risks. They seem relatively small in comparison to the utility
@@ -147,8 +135,8 @@
       matchers."YUBICO_SECRET_KEY".secret =
         config.sops.secrets.YUBICO_SECRET_KEY.path;
       matchers."HIBP_API_KEY".secret = config.sops.secrets.HIBP_API_KEY.path;
-      matchers."clicks_bitwarden_db_secret".secret =
-        config.sops.secrets.clicks_bitwarden_db_password.path;
+      matchers."clicks_vaultwarden_db_secret".secret =
+        config.sops.secrets.clicks_vaultwarden_db_password.path;
       owner = config.users.users.vaultwarden.name;
       group = config.users.groups.vaultwarden.name;
       mode = "0400";