diff --git a/flake.lock b/flake.lock
index b8a76d8..734a178 100644
--- a/flake.lock
+++ b/flake.lock
@@ -59,16 +59,15 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1698610123,
-        "narHash": "sha256-soPh6oYJOjLFsbVx9Qu/0FTAIaLXjvaB8YohezFEBeE=",
-        "ref": "refs/changes/88/188/3",
-        "rev": "75adae2fe0c9679868a8e7a942dd3ef21aa462da",
-        "revCount": 17,
+        "lastModified": 1700411817,
+        "narHash": "sha256-XWKavCk0KdgMfyoyCqerRXl5gqk0IKItw7QQFTGDpAY=",
+        "ref": "refs/heads/main",
+        "rev": "9b2bb0dd0662e26ea5c9b7bcd2c767b50abc4525",
+        "revCount": 18,
         "type": "git",
         "url": "https://git.clicks.codes/Clicks/NixHelpers"
       },
       "original": {
-        "ref": "refs/changes/88/188/3",
         "type": "git",
         "url": "https://git.clicks.codes/Clicks/NixHelpers"
       }
diff --git a/flake.nix b/flake.nix
index 51c638a..2067d50 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,7 +13,7 @@
   inputs.nixpkgs-privatebin.url = "github:e1mo/nixpkgs/privatebin";
   inputs.nixpkgs-mongodb.url = "github:nixos/nixpkgs?rev=8dfad603247387df1df4826b8bea58efc5d012d8";
 
-  inputs.helpers.url = "git+https://git.clicks.codes/Clicks/NixHelpers?ref=refs/changes/88/188/3";
+  inputs.helpers.url = "git+https://git.clicks.codes/Clicks/NixHelpers";
 
   # follow settings
   inputs.home-manager.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/helpers b/helpers
index 75adae2..9b2bb0d 160000
--- a/helpers
+++ b/helpers
@@ -1 +1 @@
-Subproject commit 75adae2fe0c9679868a8e7a942dd3ef21aa462da
+Subproject commit 9b2bb0dd0662e26ea5c9b7bcd2c767b50abc4525
diff --git a/host/shell.nix b/host/shell.nix
deleted file mode 100644
index 762da08..0000000
--- a/host/shell.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ pkgs, ... }: {
-  users.defaultUserShell = pkgs.zsh;
-
-  programs.zsh = {
-    enable = true;
-    ohMyZsh = [ "zsh-syntax-highlighting" "git" "git-auto-fetch" "gh" ];
-    autosuggestions = {
-      enable = true;
-      async = true;
-    };
-    syntaxHighlighting.enable = true;
-  };
-}
diff --git a/host/sshKeys/minion b/host/sshKeys/minion
deleted file mode 100644
index a64e3fc..0000000
--- a/host/sshKeys/minion
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCW6p9/BRP+zgYj50MY2ncAMtsEGfD8HhGlb7T2SFjBvK5GrYu1WhbPgYN/+CvnC5MXOOzAoMl4u7TlSBf2EVIQf6PTYa9HQFXX1zhkNji53eTddI6DO3Vxd4te1jWwN3XpLrqyX9lw/o/oFDJ97GolGA8CjeamQLBKSf95/BMHwqYYQUQzzRBg+TUYMVleH1smsSxbOg497Eyqlk6lwpEW17X6zW2ulBalfbekuv3NZ/+Ca2CCQMYZ4Ieqr0T0aAdToQG0H2DjOQZnOPNJW9qAuv86X6u/A0BOKTMPQ8khH0pxUsk4xBA9s7YgRtpLhNPTVhC7q6LJywBBBDNrx1Bg7bU0/5f/fHGgLQj3xWLJA3B6v1c4XIf5IQzNoGNbhrJM1bbjtUYI/c0UAd2ID0dFX8VO8JZYrDz9fRcq2MS6/0/zRee1Yk6A/9EembZJ3CoXdtM3tNXBYtlDuObMAml+8QBkBPcF31PuHEtzRMbLe0zx0HKlQUj86onVXs/yK4M= minion@python
diff --git a/host/sshKeys/pinea b/host/sshKeys/pinea
deleted file mode 100644
index be15e9f..0000000
--- a/host/sshKeys/pinea
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMX92qv+fNaNThFXAaQnSpclmxCSnA9ftilSUEb4lwG3 GitHub
\ No newline at end of file
diff --git a/host/texts/MOTD b/host/texts/MOTD
deleted file mode 100644
index 1993df3..0000000
--- a/host/texts/MOTD
+++ /dev/null
@@ -1,15 +0,0 @@
-┌────────────────────────────────────────┐
-│                                        │
-│  ┌─── │    │                           │
-│  │    │    │                           │
-│  │    │    │                           │
-│  │    │    │                           │
-│  └──► ├──► ▼                           │
-│                                        │
-│                                        │
-│                                        │
-│                ──►                     │
-│                                        │
-│                                        │
-│                                        │
-└────────────────────────────────────────┘
diff --git a/host/users.nix b/host/users.nix
deleted file mode 100644
index 8dd142c..0000000
--- a/host/users.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ pkgs, ... }:
-let
-  createUser = { username, realname, founder ? false, sudo ? false, ... }: {
-    description = realname;
-    extraGroups = ((if founder then [ "founder" ] else [ ])
-      ++ (if founder || sudo then [ "wheel" ] else [ ]));
-    isNormalUser = true;
-    openssh.authorizedKeys.keyFiles = [ "./sshKeys/${username}" ];
-  };
-
-  users = {
-    "coded" = {
-      realname = "Sam";
-      founder = true;
-    };
-    "minion" = {
-      realname = "Skyler";
-      founder = true;
-    };
-    "pineapplefan" = {
-      realname = "Ash";
-      founder = true;
-    };
-    "eek" = {
-      realname = "Nexus";
-      sudo = true;
-    };
-  };
-in {
-  users = {
-    mutableUsers = false;
-    motd = ''
-      Welcome to Clicks! Please make sure to follow all guidelines for using the server, which you can find by typing
-      `guidelines` in your terminal. In particular, please remember to use this server as minimally as possible (e.g.
-      by keeping as much of your work as is possible stateless and by using your personal
-      "${builtins.readFile ./texts/MOTD}"
-    '';
-    defaultUserShell = pkgs.zsh;
-    users =
-      builtins.mapAttrs (name: value: createUser { username = name; } // value)
-      users;
-    groups = { };
-  };
-}
diff --git a/modules/a1d2/backups.nix b/modules/a1d2/backups.nix
new file mode 100644
index 0000000..d619abe
--- /dev/null
+++ b/modules/a1d2/backups.nix
@@ -0,0 +1,5 @@
+{
+  users.users.backups.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6QDSKMR9x7/thx3CpX8uZ2jP/HEbX5g+QyZ6YeUQ0M a1d2@chickadee"
+  ];
+}
diff --git a/modules/a1d2/default.nix b/modules/a1d2/default.nix
index 946c02a..94de174 100644
--- a/modules/a1d2/default.nix
+++ b/modules/a1d2/default.nix
@@ -1,7 +1,10 @@
 { inputs, system, pkgs, drive_paths, ... }:
 let
   inherit (inputs) self home-manager deploy-rs nixpkgs;
-  config = (self.nixosConfigurations.clicks.extendModules { modules = [ ./hardware-configuration.nix ]; });
+  config = (self.nixosConfigurations.clicks.extendModules { modules = [
+    ./hardware-configuration.nix
+    ./backups.nix
+  ]; });
   deploy = {
     sudo = "doas -u";
     profiles = {
diff --git a/modules/common/cloudflare-ddns.nix b/modules/common/cloudflare-ddns.nix
index a1ebb61..e199f16 100644
--- a/modules/common/cloudflare-ddns.nix
+++ b/modules/common/cloudflare-ddns.nix
@@ -4,7 +4,7 @@
     proxied = false;
     ipv4 = true;
     ipv6 = false;
-    domains = [ "d1.a1.crawling.us" ];
+    domains = [ "a1.crawling.us" ];
     apiTokenFile = config.sops.secrets.cloudflare_ddns__api_token.path;
   };
 
diff --git a/modules/common/collabora.nix b/modules/common/collabora.nix
new file mode 100644
index 0000000..a746962
--- /dev/null
+++ b/modules/common/collabora.nix
@@ -0,0 +1,77 @@
+{ config, ... }: {
+  #Collabora Containers
+  virtualisation.oci-containers.containers.collabora = {
+    image = "collabora/code:latest";
+    ports = [ "9980:9980/tcp" ];
+    environment = {
+      server_name = "collabora.clicks.codes";
+      aliasgroup1 = "https://nextcloud.clicks.codes:443";
+      aliasgroup2 = "https://cloud.clicks.codes:443";
+      aliasgroup3 = "https://docs.clicks.codes:443";
+      dictionaries = "en_US";
+      extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
+    };
+    extraOptions = [ 
+      "--pull=newer"
+    ];
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  #Collabora Virtual Hosts
+  services.nginx.virtualHosts.${config.virtualisation.oci-containers.containers.collabora.environment.server_name} = {
+    serverAliases = [ "www.${config.virtualisation.oci-containers.containers.collabora.environment.server_name}" "docs.clicks.codes" "www.clicks.codes" ];
+    enableACME = true;
+    forceSSL = true;
+    addSSL = false;
+    listenAddresses = [ "0.0.0.0" ];
+
+    extraConfig = ''
+      location = / {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+      }
+
+      # static files
+      location ^~ /browser {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+      }
+
+      # WOPI discovery URL
+      location ^~ /hosting/discovery {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+      }
+
+      # Capabilities
+      location ^~ /hosting/capabilities {
+        proxy_pass http://standard:9980;
+        proxy_set_header Host $host;
+     }
+
+     # main websocket
+     location ~ ^/cool/(.*)/ws$ {
+       proxy_pass http://standard:9980;
+       proxy_set_header Upgrade $http_upgrade;
+       proxy_set_header Connection "Upgrade";
+       proxy_set_header Host $host;
+       proxy_read_timeout 36000s;
+     }
+
+     # download, presentation and image upload
+     location ~ ^/(c|l)ool {
+       proxy_pass http://standard:9980;
+       proxy_set_header Host $host;
+     }
+
+     # Admin Console websocket
+     location ^~ /cool/adminws {
+       proxy_pass http://standard:9980;
+       proxy_set_header Upgrade $http_upgrade;
+       proxy_set_header Connection "Upgrade";
+       proxy_set_header Host $host;
+       proxy_read_timeout 36000s;
+     }
+    '';
+  };
+}
diff --git a/modules/common/dmarc.nix b/modules/common/dmarc.nix
index 3266214..62d847c 100644
--- a/modules/common/dmarc.nix
+++ b/modules/common/dmarc.nix
@@ -21,7 +21,7 @@
   ];
 
   services.parsedmarc = {
-    enable = true;
+    enable = false;
     settings.imap = {
       host = "mail.clicks.codes";
       user = "dmarc@clicks.codes";
diff --git a/modules/common/docker.nix b/modules/common/docker.nix
index a1b4e8c..78c7f20 100644
--- a/modules/common/docker.nix
+++ b/modules/common/docker.nix
@@ -1,6 +1,5 @@
 { pkgs, ... }: {
   environment.systemPackages = [ pkgs.docker-compose ];
   virtualisation.docker.enable = true;
-  users.users.mailu.extraGroups = [ "docker" ];
   users.users.kavita.extraGroups = [ "docker" ];
 }
diff --git a/modules/common/gerrit.nix b/modules/common/gerrit.nix
index d7a780e..2cadb1b 100644
--- a/modules/common/gerrit.nix
+++ b/modules/common/gerrit.nix
@@ -34,7 +34,7 @@
       };
       plugin."gerrit-oauth-provider-keycloak-oauth" = {
         root-url = "https://login.clicks.codes";
-        realm = "clicks";
+        realm = "master";
         client-id = "git";
         client-secret = "!!gerrit_oauth_client_secret!!";
         use-preferred-username = true;
@@ -79,8 +79,8 @@
         reportBugUrl =
           "https://discord.gg/bPaNnxe"; # TODO: kinda obnoxious, better to setup openproject
         enablePeerIPInReflogRecord = true;
-        instanceId = "a1d1";
-        instanceName = "a1d1.clicks";
+        instanceId = "clicks";
+        instanceName = "Clicks Gerrit";
       };
       mimetype = lib.pipe [ "image/*" "video/*" "application/pdf" ] [
         (map (name: {
@@ -89,8 +89,21 @@
         }))
         builtins.listToAttrs
       ];
-      receive.enableSignedPush = true;
-      sendemail.enable = false; # TODO: add credentials to git@clicks.codes
+      sendemail = {
+        enable = true;
+        smtpServer = "mail.clicks.codes";
+        smtpUser = "git";
+        smtpPass = "!!gerrit_email_password!!";
+      };
+      receiveemail = {
+        enable = true;
+        protocol = "IMAP";
+        host = "mail.clicks.codes";
+        username = "git@clicks.codes";
+        password = "!!gerrit_email_password!!";
+        encryption = "SSL";
+        enableImapIdle = true;
+      };
       sshd.advertisedAddress = "ssh.clicks.codes:29418";
       user = {
         name = "Clicks Gerrit";
@@ -119,7 +132,7 @@
     ];
     serverId = "45f277d0-fce7-43b7-9eb3-2e3234e0110f";
 
-    listenAddress = "127.0.0.255:1000";
+    listenAddress = "127.0.0.255:1024";
   };
 
   sops.secrets = {
@@ -137,6 +150,13 @@
       sopsFile = ../../secrets/gerrit.json;
       format = "json";
     };
+    gerrit_email_password = {
+      mode = "0400";
+      owner = config.users.users.root.name;
+      group = config.users.users.root.group;
+      sopsFile = ../../secrets/gerrit.json;
+      format = "json";
+    };
   };
 } (let isDerived = base != null;
 in if isDerived then
@@ -150,6 +170,8 @@
         config.sops.secrets.gerrit_email_private_key.path;
       matchers."gerrit_oauth_client_secret".secret =
         config.sops.secrets.gerrit_oauth_client_secret.path;
+      matchers."gerrit_email_password".secret =
+        config.sops.secrets.gerrit_email_password.path;
       owner = config.users.users.root.name;
       group = "gerrit";
       mode = "0040";
diff --git a/modules/common/keycloak.nix b/modules/common/keycloak.nix
index 30e078b..e158825 100644
--- a/modules/common/keycloak.nix
+++ b/modules/common/keycloak.nix
@@ -1,4 +1,21 @@
-{ config, ... }: {
+{ config, lib, ... }: {
+  sops.secrets.keycloak_rsa_private_key = {
+    mode = "0600";
+    owner = "keycloak";
+    group = "keycloak";
+    sopsFile = ../../secrets/keycloak_rsa_private_key.pem;
+    format = "binary";
+  };
+
+  users.users.keycloak = {
+    isSystemUser = true;
+    createHome = true;
+    home = "/var/keycloak";
+    group = "keycloak";
+  };
+  users.groups.keycloak = {};
+  systemd.services.keycloak.serviceConfig.DynamicUser = lib.mkForce false;
+
   services.keycloak = {
     enable = true;
     settings = {
@@ -13,9 +30,8 @@
       hostname = "login.clicks.codes";
       hostname-strict = false;
 
-      https-certificate-file = "/var/keycloak/login.clicks.codes.rsa.cert.pem";
-      https-certificate-key-file =
-        "/var/keycloak/login.clicks.codes.rsa.private.pem";
+      https-certificate-file = "${./keycloak/login.clicks.codes.rsa.cert.pem}";
+      https-certificate-key-file = config.sops.secrets.keycloak_rsa_private_key.path;
     };
     database = {
       createLocally = false;
@@ -23,4 +39,5 @@
       passwordFile = config.sops.secrets.clicks_keycloak_db_password.path;
     };
   };
+  
 }
diff --git a/modules/common/keycloak/login.clicks.codes.rsa.cert.pem b/modules/common/keycloak/login.clicks.codes.rsa.cert.pem
new file mode 100644
index 0000000..8beffce
--- /dev/null
+++ b/modules/common/keycloak/login.clicks.codes.rsa.cert.pem
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGKTCCBBGgAwIBAgIUIIExgZ1p0ZNeSUedhcVueeXId+MwDQYJKoZIhvcNAQEL
+BQAwgaMxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhEZWxhd2FyZTERMA8GA1UEBwwI
+Q2xheW1vbnQxDzANBgNVBAoMBkNsaWNrczEcMBoGA1UECwwTSW5mcmFzdHJ1Y3R1
+cmUgVGVhbTEbMBkGA1UEAwwSbG9naW4uY2xpY2tzLmNvZGVzMSIwIAYJKoZIhvcN
+AQkBFhNtaW5pb25AY2xpY2tzLmNvZGVzMB4XDTIzMTExODIwMzMxMFoXDTI0MTEx
+NzIwMzMxMFowgaMxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhEZWxhd2FyZTERMA8G
+A1UEBwwIQ2xheW1vbnQxDzANBgNVBAoMBkNsaWNrczEcMBoGA1UECwwTSW5mcmFz
+dHJ1Y3R1cmUgVGVhbTEbMBkGA1UEAwwSbG9naW4uY2xpY2tzLmNvZGVzMSIwIAYJ
+KoZIhvcNAQkBFhNtaW5pb25AY2xpY2tzLmNvZGVzMIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAzWGX+FQO/5sWWb49szFDF2SdybRAwaW23yiIldkcRjE2
+vqPHHUINXjZZ6jmVeYKA+OZ/GKBEpHwgUkKkDXQo/s269D+Zu+mhJtftURwWhTba
+NTZpMLu5OiYhahaaH1ekmZHesub8X2nyAnIXxCozvBnIyd3UG6p18Uaj5JL9EhSX
+An20M6YYt4wXmEbglgPWCVzqwiUC2ZwMiQr6gmLKUPfEgrqrIQg+NUXZ3MpXHF7Z
+jrGVKRTtfhPTgmaGs1aGoX196N9MZWc318BmUVAEgSTnWLJ45HfuCyb9BzGl7MFy
+18fDWDXAA761gCVcngGQ/XOqvs5mYrBXxskTnBW2nrD9kbm8Lf9y1UM4nHE40IOk
+xW/aaZWOSUBg44XkPOuvVhpxeyMSkfYc5fggySXKI5DQ/JRaEu573CEjidr87D3O
+QuU24MLehimAOjFlcCkJaubzdCR8FFr5zNoq4+1xtyqg2NCI/mzrTPneoot4Xo5F
+SSzoidJn1RPBTUB+h3J6vt3hf61wdFhrODAvlnjsLLifEWFWLeXHwSx70RgVlgM3
+E2d3kXLAmVacARDSKEoxJ+GfZ7t5SSdYW+YZj9cM8lEBDnNSB6w4VoMksZF9yKZG
++C/QnOKgI6WOVRN6SKQcAbxq63wvud/I4owgx6lcFPz1qLFjiiP0FLs98yOmXo0C
+AwEAAaNTMFEwHQYDVR0OBBYEFKanCBP3hCkRzZCF87gSwhYSlyJeMB8GA1UdIwQY
+MBaAFKanCBP3hCkRzZCF87gSwhYSlyJeMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
+hvcNAQELBQADggIBAGEsTp9O9yAyhOOuIZcv3FkLeJ7JXpXbh5WlA9K5wvTcLnbj
+E7iMX3Gm6MrYet50v2zVe1sXchhv+rjtWwjyD1Hc9rFBS+o3weFPDOA676wQqNQc
+D2xxjIeGgzrH1ntOI9FNImOTQRf1LrM8FctK8emqVUi7+r5z+uRAiratnUK0Tbfk
+qZeYQCIp0Vmha+XHliiztLzbxLkaVAjuku6itNfSitQJOg5RZiJStGORUSUadby1
+7m9yukHU6Pr+5QMojoOqS9UiSSWdSVdk0qLsBs5T/2s2/FS2/nPmSiLGQ6ixiqsh
+tnNK8XhmEolZRW0soJW2BWu27U3PH/8Vxyf6MjRsiV+DJUMmQGHhxW66a6sEYr00
+jHmU73X9ogXlvCF/0SH5ZzJ+CoJl4xbhtbUKv6WM6ITjS4XYYhO+tgJWA2akJJ16
+PeNl2KY28UmWPYeJLoI2EPRNy/BpaI3y8VZU9eQNGZvYHvfO2pEEh7J84PbVO8CO
+MHdWjYsawJnpWxiNJaAV11E3vmqZDDhnAmJkjR7GFA2/dqXsJdpyDm/Qpo78ykVV
+ugaSRpFCFqnpv9/VBihzUx12jvonUuFUPsPTzn9X/+jDq6hh0Iz6AD3Zqhc1KF/Q
+6W2X1qjFMfD5tKKfxovIdvVzYGZdqrR2lCVyFgJ9EQCZn2tXaiElr3fQYpYN
+-----END CERTIFICATE-----
diff --git a/modules/common/mailcow.nix b/modules/common/mailcow.nix
new file mode 100644
index 0000000..681573f
--- /dev/null
+++ b/modules/common/mailcow.nix
@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }: let
+  mailDomains = [
+    "clicks.codes"
+    "coded.codes"
+    "hopescaramels.com"
+    "trans.gg"
+  ];
+  mailACMEHosts = [
+    "mail.clicks.codes"
+    "mail.coded.codes"
+    "mail.trans.gg"
+    "mail.hopescaramels.com"
+  ] ++ (
+    builtins.concatMap
+      (domain: [ domain "mail.${domain}" "imap.${domain}" "smtp.${domain}" ])
+      mailDomains
+  );
+in {
+  security.acme = {
+    certs = lib.pipe mailACMEHosts [
+      (map (name: { inherit name; value = {}; }))
+      builtins.listToAttrs
+    ];
+    defaults.postRun = "cp -r $(pwd) /opt/mailcow-dockerized/data/assets/ssl/";
+  };
+}
diff --git a/modules/common/matrix.nix b/modules/common/matrix.nix
index c71ba37..5e865bd 100644
--- a/modules/common/matrix.nix
+++ b/modules/common/matrix.nix
@@ -8,14 +8,14 @@
       [ matrix-synapse-mjolnir-antispam ];
 
     settings = rec {
-      server_name = "coded.codes";
+      server_name = "clicks.codes";
       auto_join_rooms = [ "#general:${server_name}" ];
       enable_registration = true;
       registration_requires_token = true;
       allow_public_rooms_over_federation = true;
       allow_device_name_lookup_over_federation = true;
       registration_shared_secret = "!!registration_shared_secret!!";
-      public_baseurl = "https://matrix-backend.coded.codes/";
+      public_baseurl = "https://matrix-backend.clicks.codes/";
       max_upload_size = "100M";
       listeners = [{
         x_forwarded = true;
@@ -28,12 +28,31 @@
       }];
       enable_metrics = true;
       database.args.database = "synapse";
+
+      oidc_providers = [
+        {
+          idp_id = "keycloak";
+          idp_name = "Clicks Keycloak";
+          issuer = "https://login.clicks.codes/realms/master";
+          client_id = "matrix";
+          client_secret = "!!matrix_keycloak_client_secret!!";
+          scopes = [ "openid" "profile" ];
+          user_mapping_provider = {
+            config = {
+              localpart_template = "{{ user.preferred_username }}";
+              display_name_template = "{{ user.name }}";
+            };
+          };
+          backchannel_logout_enabled = true;
+        }
+      ];
+
       turn_uris = [
 
-        /* "turn:turn.coded.codes:3478?transport=udp"
-           "turn:turn.coded.codes:3478?transport=tcp"
-           "turns:turn.coded.codes:5349?transport=udp"
-           "turns:turn.coded.codes:5349?transport=tcp"
+        /* "turn:turn.clicks.codes:3478?transport=udp"
+           "turn:turn.clicks.codes:3478?transport=tcp"
+           "turns:turn.clicks.codes:5349?transport=udp"
+           "turns:turn.clicks.codes:5349?transport=tcp"
         */
       ]; # Please use matrix.org turn
       # turn_shared_secret = "!!turn_shared_secret!!";
@@ -66,7 +85,7 @@
   networking.firewall.allowedUDPPorts = [ 3478 5349 ];
 
   services.mjolnir = {
-    enable = true;
+    enable = false;
 
     settings = {
       autojoinOnlyIfManager = true;
@@ -76,7 +95,7 @@
       admin.enableMakeRoomAdminCommand = true;
       allowNoPrefix = true;
       protections.wordlist.words = [ ];
-      protectedRooms = [ "https://matrix.to/#/#global:coded.codes" ];
+      protectedRooms = [ "https://matrix.to/#/#global:clicks.codes" ];
     };
 
     pantalaimon = {
@@ -91,7 +110,7 @@
 
     homeserverUrl = "http://localhost:4527";
 
-    managementRoom = "#moderation-commands:coded.codes";
+    managementRoom = "#moderation-commands:clicks.codes";
   };
 
   services.coturn = {
@@ -100,14 +119,14 @@
     use-auth-secret = true;
     # static-auth-secret-file = config.sops.secrets.turn_shared_secret.path;
 
-    realm = "turn.coded.codes";
+    realm = "turn.clicks.codes";
 
     no-tcp-relay = true;
 
     no-cli = true;
 
     extraConfig = ''
-      external-ip=turn.coded.codes
+      external-ip=turn.clicks.codes
     '';
   };
 
@@ -119,6 +138,13 @@
     #  sopsFile = ../../secrets/matrix.json;
     #  format = "json";
     #};
+    matrix_keycloak_client_secret = {
+      mode = "0400";
+      owner = config.users.users.matrix-synapse.name;
+      group = config.users.users.matrix-synapse.group;
+      sopsFile = ../../secrets/matrix.json;
+      format = "json";
+    };
     registration_shared_secret = {
       mode = "0400";
       owner = config.users.users.root.name;
@@ -134,13 +160,13 @@
       format = "binary";
       path = config.services.matrix-synapse.settings.signing_key_path;
     };
-    mjolnir_password = {
+    /*mjolnir_password = {
       mode = "0600";
       owner = config.users.users.mjolnir.name;
       group = config.users.users.mjolnir.group;
       sopsFile = ../../secrets/matrix.json;
       format = "json";
-    };
+    };*/
   };
 } (let isDerived = base != null;
 in if isDerived
@@ -153,6 +179,8 @@
       source = toString synapse_cfgfile;
       matchers."registration_shared_secret".secret =
         config.sops.secrets.registration_shared_secret.path;
+      matchers."matrix_keycloak_client_secret".secret =
+        config.sops.secrets.matrix_keycloak_client_secret.path;
       # matchers."turn_shared_secret".secret =
       #   config.sops.secrets.turn_shared_secret.path;
       owner = config.users.users.matrix-synapse.name;
diff --git a/modules/common/networking.nix b/modules/common/networking.nix
index e546db9..a19223c 100644
--- a/modules/common/networking.nix
+++ b/modules/common/networking.nix
@@ -10,5 +10,6 @@
 
     "192.168.0.4" = [ "CodedPi" ];
     "192.168.0.5" = [ "SamuelDesktop" ];
+    "192.168.0.6" = [ "d2.a1.clicks" "a1d2.clicks" "a1d2" ];
   };
 }
diff --git a/modules/common/nginx-routes.nix b/modules/common/nginx-routes.nix
index 9a8534e..024dc98 100644
--- a/modules/common/nginx-routes.nix
+++ b/modules/common/nginx-routes.nix
@@ -7,8 +7,12 @@
     (Host "testing.coded.codes" (ReverseProxy "SamuelDesktop:3000"))
     (Hosts [ "kavita.coded.codes" "reading.coded.codes" ]
       (ReverseProxy "127.0.0.1:5000"))
-    (Host "clicks.codes" (ReverseProxy "127.0.0.1:3000"))
-    (Host "passwords.clicks.codes" (ReverseProxy "127.0.0.1:8452"))
+    (Host "clicks.codes" (Compose [
+      (Path "/.well-known/matrix/"
+        (File ./nginx/clicks.codes/.well-known/matrix))
+      (ReverseProxy "127.0.0.1:3000")
+    ]))
+    (Hosts [ "vaultwarden.clicks.codes" "passwords.clicks.codes" ] (ReverseProxy "generic:1028"))
     (Host "login.clicks.codes" (ReverseProxy "127.0.0.1:9083"))
     (Hosts [
       "syncthing.clicks.codes"
@@ -17,7 +21,7 @@
       "syncthing.hopescaramels.com"
     ] (ReverseProxy "127.0.0.1:8384"))
     (Hosts [ "gerrit.clicks.codes" "git.clicks.codes" ]
-      (ReverseProxy "127.0.0.255:1000"))
+      (ReverseProxy "generic:1024"))
     (Hosts [ "grafana.clicks.codes" "logs.clicks.codes" ]
       (ReverseProxy "127.0.0.1:9052"))
     (InsecureHosts [
@@ -36,12 +40,12 @@
       "smtp.coded.codes"
       "smtp.clicks.codes"
       "smtp.hopescaramels.com"
-    ] (ReverseProxy "127.0.0.1:1080"))
-    (Host "matrix.coded.codes" (Directory "${builtins.toString
+    ] (ReverseProxy "generic:1026"))
+    (Hosts ["matrix.clicks.codes" "matrix.coded.codes"] (Directory "${builtins.toString
       (pkgs.schildichat-web.override {
         conf = {
           default_server_config =
-            lib.pipe ./nginx/coded.codes/.well-known/matrix [
+            lib.pipe ./nginx/clicks.codes/.well-known/matrix [
               builtins.readFile
               builtins.fromJSON
             ];
@@ -56,7 +60,7 @@
           };
           setting_defaults = { "fallbackICEServerAllowed" = true; };
           default_theme = "dark";
-          permalink_prefix = "https://matrix.coded.codes";
+          permalink_prefix = "https://matrix.clicks.codes";
           disable_guests = true;
           disable_3pid_login = true;
         };
@@ -67,10 +71,10 @@
       (Path "/nucleus/" (ReverseProxy "SamuelDesktop:10000")))
     (Host "coded.codes" (Compose [
       (Path "/.well-known/matrix/"
-        (File ./nginx/coded.codes/.well-known/matrix))
+        (File ./nginx/clicks.codes/.well-known/matrix))
       (Redirect "https://clicks.codes$request_uri")
     ]))
-    (Host "matrix-backend.coded.codes" (Compose [
+    (Host "matrix-backend.clicks.codes" (Compose [
       (Path "/_synapse/admin/" (Status 403))
       (ReverseProxy "127.0.0.1:4527")
     ]))
@@ -78,9 +82,7 @@
   clicks.nginx.serviceAliases = with helpers.nginx; [
     (Aliases "nextcloud.clicks.codes" [
       "cloud.clicks.codes"
-      "docs.clicks.codes"
       "www.cloud.clicks.codes"
-      "www.docs.clicks.codes"
       "www.nextcloud.clicks.codes"
     ])
     (Aliases "privatebin" [
@@ -95,13 +97,4 @@
       "www.privatebin.clicks.codes"
     ])
   ];
-  clicks.nginx.streams = with helpers.nginx; [
-    (ProxyStream 143 "127.0.0.1:1143" "tcp") # imap
-    (ProxyStream 993 "127.0.0.1:1993" "tcp") # imap
-    (ProxyStream 110 "127.0.0.1:1110" "tcp") # pop3
-    (ProxyStream 995 "127.0.0.1:1995" "tcp") # pop3
-    (ProxyStream 25 "127.0.0.1:1025" "tcp") # smtp
-    (ProxyStream 465 "127.0.0.1:1465" "tcp") # smtp
-    (ProxyStream 587 "127.0.0.1:1587" "tcp") # smtp
-  ];
 }
diff --git a/modules/common/nginx/clicks.codes/.well-known/matrix b/modules/common/nginx/clicks.codes/.well-known/matrix
new file mode 100644
index 0000000..c7ba524
--- /dev/null
+++ b/modules/common/nginx/clicks.codes/.well-known/matrix
@@ -0,0 +1,7 @@
+{
+  "m.server": "matrix-backend.clicks.codes:443",
+  "m.homeserver": {
+    "base_url": "https://matrix-backend.clicks.codes:443",
+    "server_name": "clicks.codes"
+  }
+}
diff --git a/modules/common/nginx/coded.codes/.well-known/matrix b/modules/common/nginx/coded.codes/.well-known/matrix
deleted file mode 100644
index 9c679da..0000000
--- a/modules/common/nginx/coded.codes/.well-known/matrix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "m.server": "matrix-backend.coded.codes:443",
-  "m.homeserver": {
-    "base_url": "https://matrix-backend.coded.codes:443",
-    "server_name": "coded.codes"
-  }
-}
diff --git a/modules/common/postgres.nix b/modules/common/postgres.nix
index 397a377..c138511 100644
--- a/modules/common/postgres.nix
+++ b/modules/common/postgres.nix
@@ -11,7 +11,7 @@
     };
 
     ensureDatabases =
-      [ "vaultwarden" "gerrit" "privatebin" "keycloak" "nextcloud" ];
+      [ "vaultwarden" "gerrit" "privatebin" "keycloak" "nextcloud" "synapse" ];
 
     ensureUsers = [
       {
@@ -22,7 +22,7 @@
         };
       }
       {
-        name = "synapse";
+        name = "matrix-synapse";
         ensurePermissions = { "DATABASE synapse" = "ALL PRIVILEGES"; };
       }
       {
@@ -74,7 +74,7 @@
       }
       {
         user = "vaultwarden";
-        passwordFile = config.sops.secrets.clicks_bitwarden_db_password.path;
+        passwordFile = config.sops.secrets.clicks_vaultwarden_db_password.path;
       }
       {
         user = "privatebin";
@@ -95,7 +95,7 @@
   sops.secrets = lib.pipe [
     "clicks_grafana_db_password"
     "clicks_keycloak_db_password"
-    "clicks_bitwarden_db_password"
+    "clicks_vaultwarden_db_password"
     "clicks_privatebin_db_password"
     "clicks_nextcloud_db_password"
   ] [
diff --git a/modules/common/syncthing.nix b/modules/common/syncthing.nix
deleted file mode 100644
index cea1012..0000000
--- a/modules/common/syncthing.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ pkgs, ... }: {
-  services.syncthing.enable = true;
-  services.syncthing.openDefaultPorts = true;
-
-  services.syncthing.guiAddress = "0.0.0.0:8384";
-}
diff --git a/modules/common/users.nix b/modules/common/users.nix
index 58dc7d3..b15feae 100644
--- a/modules/common/users.nix
+++ b/modules/common/users.nix
@@ -44,5 +44,14 @@
     group = "clicks";
     shell = pkgs.bashInteractive;
   };
+  users.users.backups = {
+    isSystemUser = true;
+    createHome = true;
+    home = "/backups";
+    group = "backups";
+    shell = pkgs.bashInteractive;
+    extraGroups = [ "wheel" ]; # needed so we can create snapshots of everything
+  };
   users.groups.clicks = { };
+  users.groups.backups = { };
 }
diff --git a/modules/common/vaultwarden.nix b/modules/common/vaultwarden.nix
index 40047dd..7ccc3a1 100644
--- a/modules/common/vaultwarden.nix
+++ b/modules/common/vaultwarden.nix
@@ -1,7 +1,5 @@
-{ base, pkgs, drive_paths, lib, config, ... }:
-if drive_paths == null
-then {}
-else lib.recursiveUpdate {
+{ base, pkgs, lib, config, ... }:
+lib.recursiveUpdate {
   environment.systemPackages = with pkgs; [ vaultwarden ];
 
   services.vaultwarden.enable = true;
@@ -36,9 +34,9 @@
 
     vaultwarden_config = {
       # Server Settings
-      DOMAIN = "https://passwords.clicks.codes";
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = 8452;
+      DOMAIN = "https://vaultwarden.clicks.codes";
+      ROCKET_ADDRESS = "127.0.0.255";
+      ROCKET_PORT = 1028;
 
       # General Settings
       SIGNUPS_ALLOWED = false;
@@ -47,15 +45,6 @@
         "clicks.codes,coded.codes,thecoded.prof,starrysky.fyi,hopescaramels.com,pinea.dev,trans.gg";
       SIGNUPS_VERIFY = true;
 
-      RSA_KEY_FILENAME =
-        "${drive_paths.External1000SSD.path}/bitwarden/rsa_key";
-      ICON_CACHE_FOLDER =
-        "${drive_paths.External1000SSD.path}/bitwarden/icon_cache";
-      ATTACHMENTS_FOLDER =
-        "${drive_paths.External4000HDD.path}/bitwarden/attachments";
-      SENDS_FOLDER = "${drive_paths.External4000HDD.path}/bitwarden/sends";
-      TMP_FOLDER = "${drive_paths.External4000HDD.path}/bitwarden/tmp";
-
       DISABLE_2FA_REMEMBER = true;
 
       # Admin Account
@@ -63,18 +52,18 @@
 
       # Database Settings
       DATABASE_URL =
-        "postgresql://vaultwarden:!!clicks_bitwarden_db_secret!!@127.0.0.1:${
+        "postgresql://vaultwarden:!!clicks_vaultwarden_db_secret!!@127.0.0.1:${
           toString config.services.postgresql.port
         }/vaultwarden";
 
       # Mail Settings
       SMTP_HOST = "mail.clicks.codes";
-      SMTP_FROM = "bitwarden@clicks.codes";
-      SMTP_FROM_NAME = "Clicks Bitwarden";
+      SMTP_FROM = "vaultwarden@clicks.codes";
+      SMTP_FROM_NAME = "Clicks vaultwarden";
       SMTP_SECURITY = "starttls";
       SMTP_PORT = 587;
 
-      SMTP_USERNAME = "bitwarden@clicks.codes";
+      SMTP_USERNAME = "vaultwarden@clicks.codes";
       SMTP_PASSWORD = "!!SMTP_PASSWORD!!";
 
       REQUIRE_DEVICE_EMAIL = true;
@@ -85,9 +74,8 @@
       YUBICO_CLIENT_ID = "89788";
       YUBICO_SECRET_KEY = "!!YUBICO_SECRET_KEY!!";
 
-      # TODO: Buy a license
       # HIBP Settings
-      # HIBP_API_KEY="!!HIBP_API_KEY!!";
+      HIBP_API_KEY="!!HIBP_API_KEY!!";
 
       ORG_ENABLE_GROUPS = true;
       # I have looked at the risks. They seem relatively small in comparison to the utility
@@ -147,8 +135,8 @@
       matchers."YUBICO_SECRET_KEY".secret =
         config.sops.secrets.YUBICO_SECRET_KEY.path;
       matchers."HIBP_API_KEY".secret = config.sops.secrets.HIBP_API_KEY.path;
-      matchers."clicks_bitwarden_db_secret".secret =
-        config.sops.secrets.clicks_bitwarden_db_password.path;
+      matchers."clicks_vaultwarden_db_secret".secret =
+        config.sops.secrets.clicks_vaultwarden_db_password.path;
       owner = config.users.users.vaultwarden.name;
       group = config.users.groups.vaultwarden.name;
       mode = "0400";
diff --git a/secrets/gerrit.json b/secrets/gerrit.json
index 89d0bd3..f741f9d 100644
--- a/secrets/gerrit.json
+++ b/secrets/gerrit.json
@@ -1,6 +1,7 @@
 {
 	"gerrit_email_private_key": "ENC[AES256_GCM,data:SmQwCqV9yfMLeXz9GJKSUEhJXyk8xmfvBcjNusnXQexm15OavlKq1bE9K8xnt0XZ5RWEP/NKk7RKfEC77myqUaQeuoIP3Yb1pEj8jcHokWoc/f9spP2g/tlG8yf51RDC1YafGNBzoASnEnMaI0F7i/CtrdTDO8lBQ566dHOBa5U=,iv:TxzBnbdzMKuK0SC770/sq3O2JYbaik7RPuo9uWII5XM=,tag:H3Ni6Xk26x/hR42V4LYEkQ==,type:str]",
-	"gerrit_oauth_client_secret": "ENC[AES256_GCM,data:F48NTbAAP9naO/xg0QZA9BQQhOTBP4GiPoQMCW7HADo=,iv:tUw4P6lYSjNBC2lDPOlXsJKM45bkA8QTZQy6fY88GOU=,tag:6sCOI9T8cJe5h+TGZ5l5uQ==,type:str]",
+	"gerrit_oauth_client_secret": "ENC[AES256_GCM,data:9GjUQ0Dd3ewpbLJ9qfOCBTnfysNnFfanTAYCkR+djkY=,iv:b30wkwY3/hbkbH6oTntAfsOSNmoaDubeVjme69VQ1YM=,tag:1EgJwzug4DzpNULlJs5gHw==,type:str]",
+	"gerrit_email_password": "ENC[AES256_GCM,data:JsLTK6vB4BBDirPZwth/Aww5g6TWU9HerLqTaw67KcqCYT9+gvKSaiLjKxlfapP1rESlfMldSxYQSU2UTq0ZA7uoUbjBBC3gBpUrRRGLDg7Rc8p6pvRft8AgytozOWAhkH5AT1ZhVqCFjlDjlw1eK0X8JF3ai9GnBonJLNBOsHU=,iv:BJQLUY3PZsv9rBe7qOIbwMgElOvLcn8c8bLKcnaDjlQ=,tag:ViK8JJVPyxkI/tPLbsKPbw==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -24,8 +25,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmdjdGNUZ2YjVCakhQb1hz\nMURtNW8wL0xuVkk5OXJGbTdBT1pXSmplNEhrCkRSL0QwdDFjeTlFVnl5QnZHQk9k\nNk05dkQ1QzB2WlZpanZYZGp3am1RSkkKLS0tIE1ZV2VsNGdMdkN6cElPaDcxSDM3\nT0NzQlRkVzMxaVh3K2N1MnlxOExURlkK6RAhERFQEqVXER64xhtl1TEp3Ub4q9Co\nGlslk76IH2eqXdCfdHMEfeNZ8w7Ke6YMyBLGhttn76cpsUcM1OFD/A==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2023-10-08T20:27:38Z",
-		"mac": "ENC[AES256_GCM,data:757DUB58m953xGaNUJSezST1iXn/mOdh4RW/anjikBesJqgjToLwMD6AZHDQq+MgJMVdjOFhRAyQ+6UjuiWJYWCRiNUxy8dI9j6V4T7AnGDDkO9Pp3KfAVkIarT28BRqgO4MSr2YoB0yrQYPJScVPVjulaKOHEJeq3TSvgefaxo=,iv:ss8f3v6Z/9hiI1Ju/KTLSW91NSaoYNZ8opuKLDQnqvg=,tag:LmPKGcI8v9tq9exfZQxwXA==,type:str]",
+		"lastmodified": "2023-11-19T17:32:08Z",
+		"mac": "ENC[AES256_GCM,data:2Wt3cwhTLdEw7gdJ2850sLzZNHNGLmbj8CU+4X2V/IIfgY4qXRm8q0wyU6ttjqFanvpvkJTZHVpUC9Ez7vjoW0L/9KQXrjtB+r0BSqT3E99zcT/mY9JyqHVuaLcGhsZum9V/mlZs/d3oSUjLGb11ZGTDaMQj4D0MiVAKBXCWMOo=,iv:3LmYUbCsIjXC01cQK46T9c+JLKgAuXCfyLHdD9UcI04=,tag:Mssfe6vlykr80eRYshNtBw==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"
diff --git a/secrets/keycloak_rsa_private_key.pem b/secrets/keycloak_rsa_private_key.pem
new file mode 100644
index 0000000..62c988a
--- /dev/null
+++ b/secrets/keycloak_rsa_private_key.pem
@@ -0,0 +1,32 @@
+{
+	"data": "ENC[AES256_GCM,data:zBGifvP0/7tNEFnhTYLvl3m1vE5ZUiG04OB9Vp8V/BG3wSDGEaIt8gaSAFxh742xoeGYQBMCPrPQeuPLRYoS9wsa6Z0dHuiyo4X7gGzGXawsmWEhCh0m8i3bxcqPEusmgMG5O3kkHPneLJjv3ipbNdzVHtKvKyWJ1W9IlZIghKzGEpExhSYblpcphIyjhcIcD7/T9bnqkv/qefp/GYDVVxFX714ZdalQ5Z4Nny1BFYRXz3hE+cPJd6Lz1lsgEiBbIG34UQQ8FrEvlFQSQ+NEDR4pBeRBO+crp39TFfd56wAWGrECAJc4JWMU2jMqLb8RwGGmoywu++wprbZU0oh88tga1lbQaV3RbeX5BtVs1skOz+EsazhIoGP89sFsa3oYQNioBHgAZNtFldian4CZi9nIyoQmAHcEIixmRIOQFYH6OP0mfBo9d8AnjTFEamaLee7ZnFD8j/Wf52OTHf2TCLc5m7yk8H7GemptHrhaccV97luPu7gaCRD+X68yBymxj+3/wTw6Wcpbyvovze3ueQkI/rQgZAQgxoxR3CCFFURVdPMgg4fmxapuWjMihGRcoUdssJ1GSHR24BFghwqQ8ghissYmyZE9QZF+qxPz/TM3g7/Q7ZQnVsFFdLVSbpqdzxNL/smwfUY9bJHRgThZU0JV+z19EP/d0+r0zAM1Fa3dxkI3OsTonj53GDyR3nkKIZzplKw1BPF0MD14IYRxibeE0XdsDno/LkhfrB8C2OTI25YgQYgX1mkT7p/7LNRXBy8cRCRWkjlYgHa9cqMeE0dfFHv3ezi0E+8bvnScIB0PPng47p94qYl3ozhCwX17GsmxXo8iObi3osXWxuaidh25XUZw1bQdOSCvutyKPBnV9ZocfNSIRBYYS+Drh/ud/g+yI11Um3F88Jf3dnsJEk18yRMS/rHxYh653fhHyFtWR6mPiHqOihZjaKoK0u+MbOifTWrjrttN3lJ/SYCxFKLZVNQcjQuf1cFI5e/BFJ4TsY6DL/9W0J0p4tAak8CjjT0lQXgM470YzkElBY1Lo6NEhkNOcWbsR46Kcm1BSKOQvvtux9YrO3tF8Ns5ILIJvds05kNDCJE+/lN6GZ85W2v1BLsJiZd7yGqEs989pwuZp66N0cVKBRaJOHF6AghLDEudKbD8NodAWjdl0Avs6Td8R8XhkyhOTRxhTeXBTgeWyqiEfl66nebGh6cnErxt9igNXHyZnrxsfYtpAmGiEUB8Ho+W35U7eP38doa5QxKbhRebDmFrs3UvdBqxYXFkzNsiTfGu8PqTAgxbsqaLrlymxAzxRT63metGhWHNObHOI1vb2wj7Dctoxu2/BdeK+Oalv4sUe5uDGaJUg70k9JqqYqZS/aSoNLqD4wEy5Gi47ZpI5Db2VzNY3WYGYXwZ7phFsovH1lxUbaS1Nxd5LdNS7QtzZPMYp4RdJihAlvo4lc8aVSBCDVA/rUtpO6vl94qXZKzAPvrHJLSgGCjkQqodAN7GeWSIHdysgyZRTz5TLtLThwGsKZ86r6pqPDLhxIRHx5TvRr82nptZWig+rQHN5xuzUUyBGNAIFZpCMTUKCpgx8Fa3E5Vut2idjKjWcLik5vwhCcq+EsO5ZLWWIp5DDtO00ly7MwY8Le9tTKOXHBWDnW+sK0djlEbaUZjBatlJI8Sn8Aab5osOXEDTwLwvcLBczh4giTF0aAXoveBKdSZtx/fNZxzkDUuzpzTPwx9mpXSsue5ezPLQzHz6e7eHKVxrarjnsUsv4TffHsccHEK1NtDii5YfpsDiUQeWznegcOo9CnCjUvBbG3+EjcGfYeHei6eth/EyGSyq+35P8T+sqHW9eiRe8N5RM5QgD2wKX0EfEZMKIgRu96I4b//HrHK4FBSF9h2XnzNYKFgskSiOAt7tse2rvSICdzgo9s1y4VGERemWuKHDXnflWq6IjZmwjxWpKJmEjpK03XvDgQw7dfRy2FMasP/n/mOFbxOQa//VFL9/K5HDKqkUU58vjOJwndwiK419UBDkIlyiYcr6BODFBoD8crXy8E4BhrdVCZI4NQUrepjQaiLwyQno+o+lhcqPz7g2zZB1PpNk2ua9JC+QY15IMYvXIkqKP2COlKmvtLyAy6mfQ6UJtKj5baVF2qrAcpfNb5o5E8JoI8UkmcGe6Ntok8nE2TbHnzfV+YwbjSRVjIZO7yffLJFw5ui/E4JWCr0oKUbMHUBKy6A372vkqZmR56AL+061psOVu8eC7lnXEQMmp0Nf7GQmiQjSRIxZ7k4Q4Kqkayq6muaZmXvYFsgJXwsaAZFaxBcrFFfQ4VbXZGm8V89XNxJpzR6zk+Df8w4AzMQxbldRxrYbwLsMt5nlDilldByXpKETQaIU9PwcT7i64ERtpK9aoqELigu3OzQyr7bCCk8ivE9MWz8Rw/wxb/o6uN0RFirt4kejztBrJe3LnGi80IeZ/NtXyQEvezRF+DsQU+hPvN74NZubZWA5jc1kaNV2IxbFw9zYOIMdAv13OdIAK0smMw4qmneoDpzKuxpLf1BjiV4qfqbFiqCKesvX6Ip1FbC34z/rWBFiw5SCOcY8g+EAsPdMmTI6C7A0gPcIAPovSSAvgjWQZMDyerSnl5yRw69HZYy2Fr1/g3u7QWtIugvczVZjMArQnUD28QWYq9sCqa6p+ccCidZl4tiggDn06xfMYcmIzgDdImMRdKBIVY+dkPsZLUJcROnYi/ax94VU4k+oIOtXZ3oWbRDvlltvATR9+Crx1WeqQf/bFb09bvQjNvB9BEC0KqQOomvmm6tQIz4twnoF2cRc2NdoRsPiUSbY45C348yX3bwalSzRgzzFU/JDo7kF81RRw8UB8rMVlJlkTG+C2UcWc0V8qG7IV8SoA9b316/BI/4t3FKL3qvt9uPsRbJPssqxtPsHns/0gWANa9eFXpAxDMpWOoKAey8F16ZQ1ZH0dDOCAusod+3+l4osmxwvgTFwpYBjbu1qB9589Pk2qFgjJhowKfNJLEN/nqjyTqxxL+cbc77bH6dtrBxsnoGVsXrM9WNRWTxqnuiQ37qFzwi6JqDoOSuHP2y8agDQfv6sRcKrksGNh3pe0HZT7Kph28yBrKMAnSu2AvXFzouVzOyZ0WIfJNHd1fbXQWmI9/I8JSq4hBD861s6Twy3R3t/N0bRNsQjIq3ZdTDnjD2+QaXx9TB2z8eIQUTaLJDcUHfNJ/t+9DNMO8YwfE2muOFElfLOvWbvrHBF1sucPg27qovUTEHtWatGTA4sxW3H64I7v9n9y9zEQhLB+VZO/EYgNX7xP5mYmwhoZgsx1BHWA6fe1Pa3K7Az4T8sy/MR5J4AOrv6Di0rwmiLhMvrwd916UUXViUsaPBuwWYU2yUOV1nMOrNSrxr0iP7JAMIQbHes6Ku5WNiFuuHVNeGrDHi/SmOSNyteIjUTH9Rjj1xKDsRZPqoc9XlMNx35/NFuLPxqEeIRYpbQYukBNk879OEprQv04+BSS1yiJr+xAinznurVCfnvKD8CK748zFcdKWNlb/+/RNep6MI4QxOUYXDihgYulZidj/d+Bdnzem7TTAWrgRROqdePOXatcoPsqzZPefhRMUy6e16TxmUxuiaH/Q3HsL1khd1WsbbSM+WuYaBQEF0p3ENaHQ80vSlFNoE5mdROr87bcQd31GHiGmf74MASEIxHapeOzSM7iXL1lrQrk+yDWfCwXdfrIWK5nrzqWjYMlJLG/jLxAU9Tj+P4srBAr29fWwgl8Vo+otrYX236jfV/sVcLGKcSvne8uX1BGyYsnHhMAYglcXbV6Paby0ik2In0gSpUyAzj+lIZIvP2PbQ7mGf6D5TwTbCWcKNmiT1Q2SzIbPU1LIK4PvA0phULs9ZlPRHN6rAOP2yWMId/5SSFY91qFU7QZ78pVAMg18ZHnXpRhqI5gERSrdXAhIk8pUevb2gjjXMw6nh+JXdNxEAwRQx5AGXtADRAC3tON9z7vY2F/Qd8uPoGVlZ+CPtEYGxYn4BPz57jRQjlMYpPKhh7P4gT9U7Gua/J+RbSvlUKyJ7KRJ4AM8gN1zEcldhZbJGq6LEYcS6zFJWdT0/E5uPX97nmgz4/SlgIIyx/5wLPquiTd4/oLvvLsxNeXjJOM049Ki9Ya2iJWogukgiCBOgV1bMo5obEBMxRilcBdYED/Xm1nJ2sKgmRNVX4oF7omPuXRHhiarxUlGvOVfRP732DOUdjISD3tfv+k7gxQo5Oy8pR4AfWh4kV6SsWCT+n02IfvYr6XgF9fOMHebi2efNJe5QM9KMnH6in6qpf86pp/6jfSSbZCFIIpX9cbHScZGmBW0TZM+bLNHeGDN3FQddT4MPMo6Fgt4uRCnE=,iv:JBBx9nPuvBHvqX+zzWOK7F6qHAAI8UkCrCEMVScrtsY=,tag:3Zyt9mtEBoopay3YqJaFBA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age15mv77dpnh5762gk5rsw2u79uza4tg8cu6r3nlwjudlzmdqqck3ss6mg9dy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEOWFXOE16Nm9qTlNKM2ds\nSVNORW9yWFFMWHhFNEhyWHdMUnFOQ05NOHl3ClhsN2laUW53UkRzNDlTY3AyYWI0\nV1RRL2pwcXJhWW91Z0VEN1BvYytsREkKLS0tIEsrSWU3RHV4Q3JCdFUwdC92WFJR\nRktsYVBZY2xCbjVMS0daL3kwb3JKZk0KS7RmwsFTYytmPG0GSADuEK1607/qgXkH\nV6BVBYK/QVPuxqDpyMQT6b6qbM/n+/SNvShHsbbW/4ltJ+LWpaa+xg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1m7k864feyuezllp2hj4edkccn36rthrvfw969j6f0l3c0mhh5emsnfx6pd",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaFl1ZUFVTGZ6cy9oUnZp\nOFBEVS9CWkF5WVBGeGxNU2RKTmVpUW92S2pvCkZValMzc2YyME03d0plc3FXVGRt\nNWgxV3J6RllXK0tKN1Q4WVc3eUN1SUkKLS0tIFNTcWJkRWJVcVE0aWY0Mk96WVN2\nc1l4dkN2KzB5a3NxNko2dDgrSFczV2MKnfxLfi8Mc2Gs29EUn0rFPmGXB4FMYRht\nwm2VmR6eVRrLsVMfyMOxihT6GLgJiLDKk21/E07rOs4xIJEuI9nXTQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fxxnmkeuqhhct93c43pwkzhuzzq8857s5hye6pgfpku70kjn4ecqtamfqr",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZVBINytvaFg3ekVTQVdL\nK0NoY3Y4K3JlUUtINHRiSEV2L2xHenF3NlN3CmpDRE8rK1pUUnpLVHhJMUtSdXdX\nUy84YXZEN2N4SG15SWdkOTZITnI2TlkKLS0tIGM4MW94RWNwdXhqcFhNSGpJMmFL\nMEhKdE9BbldmQ1JIWXgzTFVXRWZhRlUK+f+A/tOZDTb6gtIBBqRwYCQT7pfiYppo\nVM9KCWZ5sdEFhpMVKtzEqvdBx53GIe4ZVPRrF4V0EpnQHhpl5rDQpQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zunqahfz404x7v8x0gs4hv5kq2xlyvqmukhlwvpymj74805jcunq4r7ugv",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXTUFMTHZUK092S0dVdm1Z\nY040TFV1TTVUK051L2JqUHhGdWY2RHIvckd3Cm9CTjFDMUNtQlVnSHlsYnJObnZV\ndndSODg2cWptRDdsQUZxNjR2UHlWcDgKLS0tIHYrM2JTUWRZSncvcWl5bnRVeUsr\ndFpKWG5hOHovRVlrWFlBUWRHcys2ck0KDOLGZkOsO0kGICo3mKbpnsFqioqfnbtk\nfhccOUYBqCWbFoZbm3O05Qwde7/u45YXDIymygwQHMHsB5TlwVRrog==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2023-11-18T20:38:26Z",
+		"mac": "ENC[AES256_GCM,data:mgXnrhyBL2yozp7dw5hxAl7+gQz3ffld0ewq3+xCR24g4Yj237/j9yQX6QktRT/uaQZ5L365CiyhHiTblG0zAmy8FuSz+iuXe7pVZY3FUZWUZqD6rtxlHdnlx4lg98n4E1dujdQEr28tUh7A5ZJ1bT/jLKjzxVBhuDpUaJHjwZc=,iv:pYfuE2ZQhLbv9/PKPdLrZOHtqiLRebwWNCPnQqUUIdo=,tag:2w5FecCFeUYx4St+Wrqa8Q==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file
diff --git a/secrets/matrix.json b/secrets/matrix.json
index ab61457..2721add 100644
--- a/secrets/matrix.json
+++ b/secrets/matrix.json
@@ -2,6 +2,7 @@
 	"registration_shared_secret": "ENC[AES256_GCM,data:Kg9BvMxn2/QqbU5C6OnMrlvT8uFmtu3v3UMb+OqqHNSxEtLcXRPMw304+QeTYIg7m9gfZ0m3i3fUnRgya0+Lhg==,iv:2PnEIgd7kicBrR9fdIDJ7j4YklalWxn2BrrS4ipTL2Q=,tag:tgxTZGEAAEZdaqu5kh3a6w==,type:str]",
 	"turn_shared_secret": "ENC[AES256_GCM,data:jOzRRqGE5x5a7Zc7WXMvt3+6yLzJC5brtbekc1RF50+lIBy52K6q4ByUD0suQzAOdmXyFzNRm9kgib4pKYnNWSL3IfNls3mIML/5iVTJoPJyoC4q+GUvhALgTCIzocy14RMCgnvxvgIcCquyh/CCUqjRA6+w4+KvV6DzGJR81GE=,iv:a7GUjSqGsZHE7L+FpuTTZtBIvuCMfOF2DYR2LGNXdtQ=,tag:VgRWMKNbaXW1FEz7czW+kQ==,type:str]",
 	"mjolnir_password": "ENC[AES256_GCM,data:RWBt2hca41QJJ/0E5WHJaWj0PwjrXVVxtoKfNidiCFQgWCo6z9MaNZu1EZRcPPEoxiT3FsYb2mPIpQu8v6qww76nxJPp4K3Ko/RWWMqr0on0MusMbVcFiQHGKHSsTRSu9aWjwWk1UEdCi+eJeFQTz1vW5QhgzyOfTc0haKm2e9s=,iv:RFc0ElVWfkGohLTYMUg9ehCfcZOQNMgO+wGwKJqRgj8=,tag:s9g2y711fXT3He7RNn555w==,type:str]",
+	"matrix_keycloak_client_secret": "ENC[AES256_GCM,data:YKTuviV9yZpn59t4bZW9P3Hj69mKmlhJ6k5u5j2LqA0=,iv:f/hcOctCMCtZkWwnlQQSHRdyrMQPLad4767X9MjZHLo=,tag:XGAFl120Gh1c+htzDLgJww==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -25,8 +26,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmeDNSbnI3NGtRSkZoVW1i\nbUNHNmpYNUVsN1VuREN4bUdrNlZqTWJWaHhrClh0RnZoL0NUTW1jemwwWWtYZ1lR\nOHAyNDRHMWR2TTRoRUtsaTJ0VHFWdWsKLS0tIE5xWkwxbkdIMkRFdU1taURacTVk\nS0ovL1pjb29zWE00Q2Y4ZC9RVW1wenMK+Ni83kRl9tS1SjeTFT0SnF7aW8n+KPV7\nAMZxHXKlXAIq5+AOkq5AdWFaIvChfmw+KTI7WLx1lht4rOx1gNJWvA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2023-06-22T19:57:03Z",
-		"mac": "ENC[AES256_GCM,data:k7p5mdzY/XrgrAOIn0/1XGjvNCh1Wa2QmyfWzmcfhrhR/PoLJ/Y7O0OT8Vf5aRHu4ikyTxkk+lpFcbIFoQ+jteANYq5/JFX+4yvcHAUEq1lJKg1fPb2q45o7BIOVmlHkjy2L0c8zbCutM51RYzSiOut5/YwRsb8tEmP8KE/pCj4=,iv:XeKOPC//MRbqHFZCy7pMomyRiDHFb/PrzP3CZzJxQzs=,tag:12AXjx8G0dxlQol7wV9JZQ==,type:str]",
+		"lastmodified": "2023-11-19T15:42:42Z",
+		"mac": "ENC[AES256_GCM,data:9LKz0Jbt8q+T322+n4tRDFxtsZ3Adsk+2hL1zvqoBJ7CHZriSKW63Sm3U99Xc2JX306A1ztVBLYvMiPDMVFCMfYFAJehPl5z0hWebNp95Lqu3FhAyUlMM4h1mV9MgNOR74gqN5K00Ivmp2DUiKoXx9GKXfi6YT2XN513StHSgAg=,iv:w69MmzaaOOoGkMBN83NlGr7JIvahpQP6TPyXmTaawjw=,tag:Cq19ZpXALKfQvsoklm66kw==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"
diff --git a/secrets/postgres.json b/secrets/postgres.json
index 23220cf..7f1be44 100644
--- a/secrets/postgres.json
+++ b/secrets/postgres.json
@@ -1,7 +1,7 @@
 {
 	"clicks_grafana_db_password": "ENC[AES256_GCM,data:sw/zrpFiCe2rLn73M8GE/uWbMsaGmVcHM93mEb4ZEFXTJEPN1Zx47/VyKmMmadMQDWHECCsqmXyjqCy2IG3T7ox5A8bVHYIyAhWz8hi+Ao9d7M76RJl6HhrhJF89+64/F+PTN0z0+5KgC4nMjGbYaJj8A83Fh2bpUGgow+eDghUQf+GDhXJGIsYqXpyxZdl1YjmD0Gj0AK4Em+t4gPlY82CbiyRhEag+BOkSxSirBHYlqiKrFisrKtzHt/gYZQZZMt3tNRqY2S71pJospxJ+ZFhgVzyt2euxZYftKj7rehvLHdvfr7VUsJdwLK2hC7RRzMlEojnEqPXRQ8Uee2XiTg==,iv:5sdPFVdo1MBMF2CN7UtfKYf83WnnW5Hpdy0yoGyPAC0=,tag:SxC4DuVYiNcvJrGvzYk0Fw==,type:str]",
 	"clicks_keycloak_db_password": "ENC[AES256_GCM,data:duwBc+bJnfn1Erzi1FijzOtrruTsdOZDFmVA6OWMwrN/YBE8Dy5PEfMJ0acZ2Wc544426Dp70fHppIMqdoJPFbOSsmgysLoxfQLxk7iJaO56N6ZUMMk4qQT7Y/u2m5uJS43R1O5wRz+C6IYCu0ixXOj/+6dDigk2Ur2i3OjrS/4=,iv:X1DSnWSO1js9bQVgMHX1wN1NkfFylnGHAluoNQ7ztpw=,tag:cKPfZU0j4NYTIYlp6UXzGA==,type:str]",
-	"clicks_bitwarden_db_password": "ENC[AES256_GCM,data:NR5ezR022u5MJmMq1veRbx89gRUS07pJq6d4i8lfgSM3uhrq1LtgP7KT5T9my1koBynGYTPvA2TMUQbePrVQYiPVMWzFRaYHzV29xKJqbTC6s7KdWLs6VxeRQMzCfmakqYf2mw==,iv:wEjSkr7NJvE8ZcEgNe6zL5h3UFwBidKySUCD6elpmeA=,tag:B0bujxD6F+OyytMCRrwltw==,type:str]",
+	"clicks_vaultwarden_db_password": "ENC[AES256_GCM,data:oYeRdwSP7EmQwdJRd1tRFwcRTL4uHpCCp/xVYZb1jTIsOlXHE9ccAMkDPIs/BMa0GhlNSMQymPx8+r4xR9c1lhMQL863ye9tRLK6V/eYqkKJqZ9u4fJ4T+k7bl6xPXy1omq3gQ==,iv:AjOti3ZkPOPYt0bgfaYWReY3SY/rnp8zQ3BAlbCfcdU=,tag:RO4KlycbR2uECfwG+/AX3w==,type:str]",
 	"clicks_privatebin_db_password": "ENC[AES256_GCM,data:T+NIe961xTXO/B9RCr/KlhlOLHcz8RfVnCn/+PexGUSeQ9suQ1wdILt14GvEuAUczN3bTT1sy9wRM656lAwWA/nsF3yML+5VwQo/aKo2R66Ga9Lnslg8tquQuwEpWb2tRg6BDEwUl0iLrvGKODAKuu3ClXJEJTASeTCZMv0jUQY=,iv:NFsZbKKCfji9DGDRQHFfH+insWGxbS6xqsng40ckC4M=,tag:LR5Ay8ZowkD7s3pEHjws2w==,type:str]",
 	"clicks_nextcloud_db_password": "ENC[AES256_GCM,data:Tu4BRo0qkpp+RXYlQO7PIfZM40tquvQUt9hbtZdKRotrOg81CGjZLISjNELr8pLCQK4AAfCJ7UPdR0ZztJfhrj5vPnaQM/2nHO4aMuhfnkOX00MDJhum/j1I0Adx/Au9zAaIONaKMBXLmX/g3FU2s6Yp7OtZ7/4FoWAYbG4zSbY=,iv:LjlkKkVNybg9EU9pytsmyYJrFMym0RmSvIFI/KKcpyc=,tag:rPyOh+KtAmo9OeY0Wm1sCQ==,type:str]",
 	"sops": {
@@ -27,8 +27,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3clFVS0JZSkhmNElLa3N2\nNFdkT091dzZPdXUyOXNUNkk1QzNMS0hJengwCjcya01LanZhTXNsaGpQdVIvNlRl\nZnljZkhZYWVUR2xJckJPbUpnOSt4SmMKLS0tIElMcGNRTVJudXFORG4zZ3drdG1C\nYTZPcDh4OGwzUTZDVlhWNk55bDZMd2sK/F5ZGw6Kf8nWRXDobOonFDtPlSSU5c4u\nAEvihsNSDR3MwvQgu5jJCuCeRGLdXaOqBBEYrIamIcAlVKGeT6y/UA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2023-11-12T19:15:05Z",
-		"mac": "ENC[AES256_GCM,data:X+IfWdAse4x0THf5EQvH8IKyw+sCEGs/7DbejSepC2uAGYwYEhfdCMDoX/jR7+mCSnmCMsV1ITkiAakJjT6inIqm/p+WO6w01wJiC5N5PrqwEvYFYzZQBrIykqXSZ52aq3ySXorI/lqZo+pB5SZPVolZAqT5CPKl6PmW9dFakUQ=,iv:Xqj4Jjrk5Y4Ybzodl359ATJUi1bDFhUM65UFLzWLPu0=,tag:PnS5ynJVhKZbCQR1SrjGQA==,type:str]",
+		"lastmodified": "2023-11-19T19:03:46Z",
+		"mac": "ENC[AES256_GCM,data:mxck3eyWvBSN6Um9lEwJYAS83FZYaZB6J1h02pyYpzEC2QDDVd0auS+wKZ7pc9OlyquramOOmhrh/+NlMwbRocQZzxt/TQdLx4J9myxIY6UYOjf0u7F/6rsCzCvXghF4wVw3QajJxOijBcYlkN9LG5SjsCa5YO6Hq7+vVjF4Xsk=,iv:GNhfVLrVkzU806Sgrd1rR52I0Vu9jkR4Zzv7airX64o=,tag:NXeJra1xW2/xBUelYICJcA==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"
diff --git a/secrets/vaultwarden.json b/secrets/vaultwarden.json
index 7fc86ad..f7a9ba8 100644
--- a/secrets/vaultwarden.json
+++ b/secrets/vaultwarden.json
@@ -2,7 +2,7 @@
 	"ADMIN_TOKEN": "ENC[AES256_GCM,data:kbtCkvQJcIZ4sQbnTXCYj864WQywrd/98v3VOynoiIw8xd/H0orOX0QZ7zZDuHbbAukOul5ZUzjPah5razGMEECIkhWqVYnAtyhr,iv:UTrKoA8uhNaUT7nDfBMzMkHpLq/gpl9+nrx5ySnNGEc=,tag:dQgR4m9neYKvLzwMlzHGag==,type:str]",
 	"SMTP_PASSWORD": "ENC[AES256_GCM,data:nwCyO8kOgipt6jPNJVYb45IwiBB2MDRu3qMnPs88VMgW19xW4Yfv3aRvmr6C3huPP7UbSaay2WlrPXin,iv:ur5g8wu4MTMIjbSc3vfMJvdkz7ue0hCRgApFVn9jY4s=,tag:cG3gPyrcOl+ubGwMEcSgkg==,type:str]",
 	"YUBICO_SECRET_KEY": "ENC[AES256_GCM,data:AfUPdtEYUMPLLm3omfTD4IhHG4B5SQ6df1ZfvQ==,iv:rP66dYyeOsqkN+ZD80U/5jj//PWn7Ox++1L4OETX4m0=,tag:EiujU9WcLs7M1hMMR5UIHQ==,type:str]",
-	"HIBP_API_KEY": "ENC[AES256_GCM,data:ZODeXVLFsw==,iv:lEybxmKCQ8SbssGWE3UqSagz5M97o2CWGW0HAiqJyD8=,tag:c0uT1dKtln5frysnjS0UPA==,type:str]",
+	"HIBP_API_KEY": "ENC[AES256_GCM,data:5BHqdjOIhyMj3Tkynl18IeMIs2WzlvUSnGYBPBn7IL8=,iv:NUlMXfH5EzntIbyq7zVjd/oo1FMExs4GemnHAdwg3Wc=,tag:nnyC8F9LThLgTQTkbwhatg==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -26,8 +26,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3N1JoaVRUVVZoa1RLdkVj\nUHJ1U3pwTE0zRHl3aU1OeE1RYlBCVnB0ZENRCnVYQkNIMkROR2R2TmNFL1JLZE5l\nRFpZYWsxQjNMQTdFVFZ5S0NWeWlRVkkKLS0tIFU1cTgrRXNsam9FMFpXY21IbUFm\nTXgzMm5aQ0ZtK2tQN2RPUVB3Q25Jc1kKWoYlImOpfDyFI7nyoVpLGUfRX+T59NjJ\nLEgWMBnYYeCyrA3QzryZk1HtJnnqjDwBRSCM3VJOd/I7v0N+c8wHew==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2023-06-14T22:17:50Z",
-		"mac": "ENC[AES256_GCM,data:Lsg0g+pF2vP5PYg2dcECQ6lMhlzv7K/vTI8oUCZ54U+UAJwewLlg3jIe7dfaonhn/rVUVQO3DQ1jfzNKEmccZCjAmOvRyAse/yk2wtHbQ8MoctQuk3rgc7ElD+7fU6UUabC505VqNvEM4t8n1Q83Jtye8fynYZRy5G2TLgRCZIc=,iv:S01rfpLSIURdc74AhyQe6R/uw3HWH0PDsX6xn36MT1Q=,tag:JrAuO9QR4pwehyjIB41meA==,type:str]",
+		"lastmodified": "2023-11-19T17:31:29Z",
+		"mac": "ENC[AES256_GCM,data:prF+Ot541edx7cSGaofVe97uJuyd8so2cjk+vOXgLzJ98DDYNwpEsUeispPE41v503/YYeWbXGJPTB3IL0Pz0HhgNbkNr4KPXnptQOoiVuv1ZZ4cWuB2C8v4TKVjZdPZyMpZ9sWHaxSRikz54KXCg8DObWgJkuDZujXNYKq65/Q=,iv:PEthjnQgO6YFiGHGAsd9UIjWxtOBZplrKYeN2pCuOQ8=,tag:LU4XDTnOXVGC1rtLGLgO0w==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"
diff --git a/services/mailu/default.nix b/services/mailu/default.nix
deleted file mode 100644
index ffcd441..0000000
--- a/services/mailu/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-{ }