diff --git a/modules/caddy.nix b/modules/caddy.nix
deleted file mode 100644
index 26e0a58..0000000
--- a/modules/caddy.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ base, config, pkgs, lib, ... }: lib.recursiveUpdate
-{
-  services.nginx.enable = false; # PrivateBin, nextcloud etc. attempts to enable nginx but we already use caddy
-  services.caddy.enable = true;
-  services.caddy.configFile = lib.pipe ./caddy/caddyfile.nix [
-    import
-    (f: f { inherit pkgs lib config; })
-    builtins.toJSON
-    (pkgs.writeText "caddy.json")
-  ];
-  services.caddy.package = pkgs.callPackage ../packages/caddy.nix { };
-  services.caddy.user = "root";
-  systemd.services.caddy.serviceConfig.ProtectHome = lib.mkForce false;
-
-  sops.secrets.cloudflare_token = {
-    mode = "0600";
-    owner = config.users.users.root.name;
-    group = config.users.users.nobody.group;
-    sopsFile = ../secrets/caddy.json;
-    format = "json";
-  };
-}
-  (
-    let
-      isDerived = base != null;
-    in
-    if isDerived
-    then
-      let
-        caddy_json = base.config.services.caddy.configFile;
-      in
-      {
-        scalpel.trafos."caddy.json" = {
-          source = toString caddy_json;
-          matchers."cloudflare_token".secret =
-            config.sops.secrets.cloudflare_token.path;
-          owner = config.users.users.root.name;
-          group = config.users.users.nobody.group;
-          mode = "0400";
-        };
-
-        services.caddy.configFile = lib.mkForce config.scalpel.trafos."caddy.json".destination;
-
-        systemd.services.caddy.reloadTriggers = [ caddy_json ];
-      }
-    else { }
-  )
diff --git a/modules/caddy/caddyfile.nix b/modules/caddy/caddyfile.nix
deleted file mode 100644
index 9f6bf49..0000000
--- a/modules/caddy/caddyfile.nix
+++ /dev/null
@@ -1,441 +0,0 @@
-let
-  HTTPReverseProxyRoute = hosts: upstreams: {
-    handle = [
-      {
-        handler = "subroute";
-        routes = [
-          {
-            handle = [
-              {
-                handler = "reverse_proxy";
-                upstreams = map (upstream: { dial = upstream; }) upstreams;
-              }
-            ];
-          }
-        ];
-      }
-    ];
-    match = [{ host = hosts; }];
-    terminal = true;
-  };
-  PHPRoute = hosts: root: socket: {
-    handle = [
-      {
-        handler = "subroute";
-        routes = [
-          {
-            handle = [
-              {
-                handler = "vars";
-                inherit root;
-              }
-            ];
-          }
-          {
-            handle = [
-              {
-                handler = "static_response";
-                headers.Location = [ "{http.request.orig_uri.path}/" ];
-                status_code = 307;
-              }
-            ];
-            match = [
-              {
-                file.try_files = [ "{http.request.uri.path}/index.php" ];
-                not = [ { path = ["*/"]; } ];
-              }
-            ];
-          }
-          {
-            handle = [
-              {
-                handler = "rewrite";
-                uri = "{http.matchers.file.relative}";
-              }
-            ];
-            match = [
-              {
-                file = {
-                  split_path = [ ".php" ];
-                  try_files = [
-                    "{http.request.uri.path}"
-                    "{http.request.uri.path}/index.php"
-                    "index.php"
-                  ];
-                };
-              }
-            ];
-          }
-          {
-            handle = [
-              {
-                handler = "reverse_proxy";
-                transport = {
-                  protocol = "fastcgi";
-                  split_path = [".php"];
-                };
-                upstreams = [{ dial = socket; }];
-              }
-            ];
-            match = [{ path = ["*.php"]; }];
-          }
-          {
-            handle = [
-              {
-                handler = "file_server";
-              }
-            ];
-          }
-        ];
-      }
-    ];
-    match = [{ host = hosts; }];
-    terminal = true;
-  };
-  HTTPRedirectRoute = hosts: goto: {
-    handle = [
-      {
-        handler = "subroute";
-        routes = [
-          {
-            handle = [
-              {
-                handler = "static_response";
-                headers = { Location = [ goto ]; };
-                status_code = 302;
-              }
-            ];
-          }
-        ];
-      }
-    ];
-    match = [{ host = hosts; }];
-    terminal = true;
-  };
-  HTTPFileServerRoute = hosts: root: {
-    handle = [
-      {
-        handler = "subroute";
-        routes = [
-          {
-            handle = [
-              {
-                handler = "file_server";
-                inherit root;
-              }
-            ];
-          }
-        ];
-      }
-    ];
-    match = [{ host = hosts; }];
-    terminal = true;
-  };
-
-  TCPReverseProxyRoute = ports: upstreams: {
-    listen = map (port: "0.0.0.0:${toString port}") ports;
-    routes = [
-      {
-        handle = [
-          {
-            handler = "proxy";
-            proxy_protocol = "v2";
-            upstreams = [{ dial = upstreams; }];
-          }
-        ];
-      }
-    ];
-  };
-in
-{ pkgs, lib, config }: {
-  apps = {
-    http.servers = {
-      srv0 = {
-        listen = [ ":443" ];
-        routes = [
-          (HTTPReverseProxyRoute [ "signup.hopescaramels.com" ] [ "192.168.0.4:3035" ])
-          (HTTPReverseProxyRoute [ "homebridge.coded.codes" ] [ "localhost:8581" ])
-          {
-            handle = [
-              {
-                handler = "subroute";
-                routes = [
-                  {
-                    handle = [
-                      {
-                        error = "You can't access admin routes from outside the server. Please use SSH tunneling, cURL on the host or similar";
-                        handler = "error";
-                        status_code = "403";
-                      }
-                    ];
-                    match = [{ path = [ "/_dendrite/admin/*" "/_synapse/admin/*" ]; }];
-                    terminal = true;
-                  }
-                  {
-                    handle = [
-                      {
-                        handler = "reverse_proxy";
-                        transport = { protocol = "http"; };
-                        upstreams = [{ dial = "localhost:4527"; }];
-                      }
-                    ];
-                  }
-                ];
-              }
-            ];
-            match = [{ host = [ "matrix-backend.coded.codes" ]; }];
-            terminal = true;
-          }
-          (HTTPReverseProxyRoute
-            [
-              "mail.coded.codes"
-              "mail.clicks.codes"
-              "mail.hopescaramels.com"
-            ]
-            [ "localhost:1080" ]
-          )
-          (HTTPReverseProxyRoute [ "logs.clicks.codes" ] [ "localhost:9052" ])
-          (HTTPRedirectRoute
-            [
-              "hopescaramels.com"
-              "www.hopescaramels.com"
-            ]
-            "https://etsy.com/shop/HopesCaramels"
-          )
-          # (HTTPReverseProxyRoute [ "omv.coded.codes" ] [ "localhost:6773" ])
-          # (HTTPReverseProxyRoute [ "jellyfin.coded.codes" ] [ "localhost:8096" ])
-          (HTTPReverseProxyRoute [ "codedpc.coded.codes" ] [ "192.168.0.2:3389" ])
-          (HTTPReverseProxyRoute [ "testing.coded.codes" ] [ "192.168.0.2:3030" ])
-          (HTTPReverseProxyRoute [ "kavita.coded.codes" ] [ "localhost:5000" ])
-          {
-            handle = [
-              {
-                handler = "subroute";
-                routes = [
-                  {
-                    handle = [
-                      {
-                        handler = "subroute";
-                        routes = [
-                          {
-                            handle = [
-                              {
-                                handler = "rewrite";
-                                strip_path_prefix = "/nucleus";
-                              }
-                            ];
-                          }
-                          {
-                            handle = [
-                              {
-                                handler = "reverse_proxy";
-                                upstreams = [{ dial = "127.0.0.1:10000"; }];
-                              }
-                            ];
-                          }
-                        ];
-                      }
-                    ];
-                    match = [{ path = [ "/nucleus/*" ]; }];
-                  }
-                  {
-                    handle = [
-                      {
-                        handler = "error";
-                        error = "This API route does not exist";
-                        status_code = 404;
-                      }
-                    ];
-                  }
-                ];
-              }
-            ];
-            match = [{ host = [ "api.clicks.codes" ]; }];
-            terminal = true;
-          }
-          {
-            handle = [
-              {
-                handler = "subroute";
-                routes = [
-                  {
-                    handle = [
-                      {
-                        handler = "subroute";
-                        routes = [
-                          {
-                            handle = [
-                              {
-                                handler = "rewrite";
-                                strip_path_prefix = "/nucleus";
-                              }
-                            ];
-                          }
-                          {
-                            handle = [
-                              {
-                                handler = "reverse_proxy";
-                                upstreams = [{ dial = "192.168.0.2:10000"; }];
-                              }
-                            ];
-                          }
-                        ];
-                      }
-                    ];
-                    match = [{ path = [ "/nucleus/*" ]; }];
-                  }
-                  {
-                    handle = [
-                      {
-                        handler = "error";
-                        error = "This API route does not exist";
-                        status_code = 404;
-                      }
-                    ];
-                  }
-                ];
-              }
-            ];
-            match = [{ host = [ "api.coded.codes" ]; }];
-            terminal = true;
-          }
-          (HTTPRedirectRoute
-            [
-              "www.clicks.codes"
-            ]
-            "https://clicks.codes{http.request.uri}"
-          )
-          (HTTPReverseProxyRoute [ "clicks.codes" ] [ "127.0.0.1:3000" ])
-          {
-            handle = [
-              {
-                handler = "subroute";
-                routes = [
-                  {
-                    handle = [
-                      {
-                        handler = "static_response";
-                        status_code = 200;
-                        body = builtins.readFile ./coded.codes/.well-known/matrix;
-                        headers = { Access-Control-Allow-Origin = [ "*" ]; };
-                      }
-                    ];
-                    match = [{
-                      path = [
-                        "/.well-known/matrix/server"
-                        "/.well-known/matrix/client"
-                      ];
-                    }];
-                    terminal = true;
-                  }
-                  {
-                    handle = [
-                      {
-                        handler = "static_response";
-                        headers = { Location = [ "https://clicks.codes{http.request.uri}" ]; };
-                        status_code = 302;
-                      }
-                    ];
-                  }
-                ];
-              }
-            ];
-            match = [{ host = [ "coded.codes" ]; }];
-            terminal = true;
-          }
-          (HTTPFileServerRoute [ "matrix.coded.codes" ] (
-            pkgs.schildichat-web.override {
-              conf = {
-                default_server_config = lib.pipe ./coded.codes/.well-known/matrix [
-                  builtins.readFile
-                  builtins.fromJSON
-                ];
-                features = {
-                  feature_report_to_moderators = true;
-                  feature_latex_maths = true;
-                  feature_pinning = true;
-                  feature_mjolnir = true;
-                  feature_presence_in_room_list = true;
-                  feature_custom_themes = true;
-                  feature_dehydration = true;
-                };
-                setting_defaults = {
-                  "fallbackICEServerAllowed" = true;
-                };
-                default_theme = "dark";
-                permalink_prefix = "https://matrix.coded.codes";
-                disable_guests = true;
-                disable_3pid_login = true;
-              };
-            }
-          ))
-          (HTTPReverseProxyRoute [ "passwords.clicks.codes" ] [ "localhost:8452" ])
-          (HTTPReverseProxyRoute [ "login.clicks.codes" ] [ "localhost:9083" ])
-          (HTTPReverseProxyRoute [
-            "syncthing.clicks.codes"
-            "syncthing.coded.codes"
-            "syncthing.thecoded.prof"
-            "syncthing.hopescaramels.com"
-          ] [ "localhost:8384" ])
-          (HTTPReverseProxyRoute [
-            "git.clicks.codes"
-            "gerrit.clicks.codes"
-          ] [ "127.0.0.255:1000" ])
-          (PHPRoute
-            [ "paste.clicks.codes" "paste.coded.codes" ]
-            "${pkgs.privatebin}/share/privatebin"
-            "unix/${config.services.phpfpm.pools.privatebin.socket}"
-          )
-          (PHPRoute
-            [ "cloud.clicks.codes" "nextcloud.clicks.codes" "docs.clicks.codes" ]
-            "${config.services.nextcloud.package}"
-            "unix/${config.services.phpfpm.pools.nextcloud.socket}"
-          )
-        ];
-      };
-      srv1 = {
-        listen = [ ":80" ];
-        routes = [
-          (HTTPReverseProxyRoute
-            [
-              "mail.clicks.codes"
-              "mail.coded.codes"
-              "mail.hopescaramels.com"
-              "autoconfig.coded.codes"
-              "autoconfig.clicks.codes"
-              "autoconfig.hopescaramels.com"
-              "imap.coded.codes"
-              "imap.clicks.codes"
-              "imap.hopescaramels.com"
-              "pop.coded.codes"
-              "pop.clicks.codes"
-              "pop.hopescaramels.com"
-              "smtp.coded.codes"
-              "smtp.clicks.codes"
-              "smtp.hopescaramels.com"
-            ]
-            [ "localhost:1080" ]
-          )
-        ];
-      };
-    };
-    layer4.servers = {
-      imap-143 = (TCPReverseProxyRoute [ 143 ] [ "localhost:1143" ]);
-      imap-993 = (TCPReverseProxyRoute [ 993 ] [ "localhost:1993" ]);
-      pop-110 = (TCPReverseProxyRoute [ 110 ] [ "localhost:1110" ]);
-      pop-995 = (TCPReverseProxyRoute [ 995 ] [ "localhost:1995" ]);
-      smtp-25 = (TCPReverseProxyRoute [ 25 ] [ "localhost:1025" ]);
-      smtp-465 = (TCPReverseProxyRoute [ 465 ] [ "localhost:1465" ]);
-      smtp-587 = (TCPReverseProxyRoute [ 587 ] [ "localhost:1587" ]);
-    };
-    tls.automation.policies = [{
-      issuers = [{
-        module = "acme";
-        challenges.dns.provider = {
-          name = "cloudflare";
-          api_token = "!!cloudflare_token!!";
-        };
-      }];
-    }];
-  };
-}
diff --git a/modules/cloudflare-ddns.nix b/modules/cloudflare-ddns.nix
index 3abd8a2..35cbf13 100644
--- a/modules/cloudflare-ddns.nix
+++ b/modules/cloudflare-ddns.nix
@@ -12,7 +12,7 @@
     mode = "0600";
     owner = config.users.users.root.name;
     group = config.users.users.root.group;
-    sopsFile = ../secrets/cloudflare.env.bin;
+    sopsFile = ../secrets/cloudflare-ddns.env.bin;
     format = "binary";
   };
 }
diff --git a/modules/fuck.nix b/modules/fuck.nix
deleted file mode 100644
index 572f926..0000000
--- a/modules/fuck.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ config, pkgs, ... }: {
-  programs.thefuck.enable = true;
-  programs.thefuck.alias = "fuck";
-}
-
diff --git a/modules/grafana.nix b/modules/grafana.nix
index 7c3b175..9a97342 100644
--- a/modules/grafana.nix
+++ b/modules/grafana.nix
@@ -1,4 +1,4 @@
-{ lib, config, base, pkgs, ... }:
+{ lib, config, base, pkgs, helpers, ... }:
 lib.recursiveUpdate
 {
   services.grafana = {
diff --git a/modules/networking.nix b/modules/networking.nix
new file mode 100644
index 0000000..1940ced
--- /dev/null
+++ b/modules/networking.nix
@@ -0,0 +1,8 @@
+{
+    networking.hosts = {
+        "127.0.0.1" = [ "standard" ];
+        "127.0.0.2" = [ "clicks" ];
+        "127.0.0.3" = [ "caramels" ];
+        "127.0.0.255" = [ "generic" ];
+    };
+}
diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix
index 8574407..52ab029 100644
--- a/modules/nextcloud.nix
+++ b/modules/nextcloud.nix
@@ -16,7 +16,7 @@
 
     services.nextcloud.enable = true;
     services.nextcloud.config.adminpassFile = config.sops.secrets.nextcloud_admin_password.path;
-    services.nextcloud.hostName = "cloud.clicks.codes";
+    services.nextcloud.hostName = "nextcloud.clicks.codes";
     services.nextcloud.package = pkgs.nextcloud27;
     services.nextcloud.poolSettings = {
         pm = "dynamic";
@@ -47,6 +47,14 @@
             url = "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.5.3/release.tar.gz";
             sha256 = "sha256-96/wtK7t23fXVRcntDONjgb5bYtZuaNZzbvQCa5Gsj4=";
         };
+        richdocumentscode = pkgs.fetchNextcloudApp {
+            url = "redacted";
+            sha256 = "sha256-XYtjBZCIQ6+PL3BNLSZfJTgLLpOyphzR5HOAwI7bWx0=";
+        };
+        richdocuments = pkgs.fetchNextcloudApp {
+            url = "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.2.0/richdocuments-v8.2.0.tar.gz";
+            sha256 = "sha256-PKw7FXSWvden2+6XjnUDOvbTF71slgeTF/ktS/l2+Dk=";
+        };
     };
 
     sops.secrets.nextcloud_admin_password = {
diff --git a/modules/nginx-routes.nix b/modules/nginx-routes.nix
new file mode 100644
index 0000000..918d6dd
--- /dev/null
+++ b/modules/nginx-routes.nix
@@ -0,0 +1,99 @@
+{ pkgs, helpers, config, lib, ... }: {
+  clicks.nginx.services = with helpers.nginx; [
+    (Host "signup.hopescaramels.com" (ReverseProxy "CodedPi.local:3035"))
+    (Host "homebridge.coded.codes" (ReverseProxy "CodedPi.local:8581"))
+    (Host "codedpc.coded.codes" (ReverseProxy "SamuelDesktop.local:3389"))
+    (Host "testing.coded.codes" (ReverseProxy "SamuelDesktop.local:3000"))
+    (Hosts [ "kavita.coded.codes" "reading.coded.codes" ]
+      (ReverseProxy "localhost:5000"))
+    (Host "www.clicks.codes" (RedirectPermanent "https://clicks.codes$request_uri"))
+    (Host "clicks.codes" (ReverseProxy "127.0.0.1:3000"))
+    (Host "passwords.clicks.codes" (ReverseProxy "localhost:8452"))
+    (Host "login.clicks.codes" (ReverseProxy "localhost:9083"))
+    (Hosts [
+      "syncthing.clicks.codes"
+      "syncthing.coded.codes"
+      "syncthing.thecoded.prof"
+      "syncthing.hopescaramels.com"
+    ] (ReverseProxy "localhost:8384"))
+    (Hosts [ "gerrit.clicks.codes" "git.clicks.codes" ]
+      (ReverseProxy "127.0.0.255:1000"))
+    (Hosts [ "grafana.clicks.codes" "logs.clicks.codes" ]
+      (ReverseProxy "localhost:9052"))
+    (InsecureHosts [
+      "mail.clicks.codes"
+      "mail.coded.codes"
+      "mail.hopescaramels.com"
+      "autoconfig.coded.codes"
+      "autoconfig.clicks.codes"
+      "autoconfig.hopescaramels.com"
+      "imap.coded.codes"
+      "imap.clicks.codes"
+      "imap.hopescaramels.com"
+      "pop.coded.codes"
+      "pop.clicks.codes"
+      "pop.hopescaramels.com"
+      "smtp.coded.codes"
+      "smtp.clicks.codes"
+      "smtp.hopescaramels.com"
+    ] (ReverseProxy "localhost:1080"))
+    (Hosts [
+      "mail.clicks.codes"
+      "mail.coded.codes"
+      "mail.hopescaramels.com"
+    ] (ReverseProxy "localhost:1080"))
+    (Host "matrix.coded.codes" (Directory "${builtins.toString (pkgs.schildichat-web.override {
+      conf = {
+        default_server_config = lib.pipe ./nginx/coded.codes/.well-known/matrix [
+          builtins.readFile
+          builtins.fromJSON
+        ];
+        features = {
+          feature_report_to_moderators = true;
+          feature_latex_maths = true;
+          feature_pinning = true;
+          feature_mjolnir = true;
+          feature_presence_in_room_list = true;
+          feature_custom_themes = true;
+          feature_dehydration = true;
+        };
+        setting_defaults = { "fallbackICEServerAllowed" = true; };
+        default_theme = "dark";
+        permalink_prefix = "https://matrix.coded.codes";
+        disable_guests = true;
+        disable_3pid_login = true;
+      };
+    })}"))
+    (Host "api.clicks.codes" (Path "/nucleus/" (ReverseProxy "localhost:10000")))
+    (Host "api.coded.codes" (Path "/nucleus/" (ReverseProxy "SamuelDesktop.local:10000")))
+    (Host "coded.codes" (Compose [
+      (Path "/.well-known/matrix/" (File ./nginx/coded.codes/.well-known/matrix))
+      (Redirect "https://clicks.codes$request_uri")
+    ]))
+    (Host "matrix-backend.coded.codes" (Compose [
+      (Path "/_synapse/admin/" (Status 403))
+      (ReverseProxy "localhost:4527")
+    ]))
+  ];
+  clicks.nginx.serviceAliases = with helpers.nginx; [
+    (Aliases "nextcloud.clicks.codes" [
+      "cloud.clicks.codes"
+      "docs.clicks.codes"
+    ])
+    (Aliases "privatebin" [
+      "paste.clicks.codes"
+      "paste.coded.codes"
+      "paste.thecoded.prof"
+      "paste.hopescaramels.com"
+    ])
+  ];
+  clicks.nginx.streams = with helpers.nginx; [
+    (Stream 143 "localhost:1143" "tcp") #imap
+    (Stream 993 "localhost:1993" "tcp") #imap
+    (Stream 110 "localhost:1110" "tcp") #pop3
+    (Stream 995 "localhost:1995" "tcp") #pop3
+    (Stream  25 "localhost:1025" "tcp") #smtp
+    (Stream 465 "localhost:1465" "tcp") #smtp
+    (Stream 587 "localhost:1587" "tcp") #smtp
+  ];
+}
diff --git a/modules/nginx.nix b/modules/nginx.nix
new file mode 100644
index 0000000..64ad1ce
--- /dev/null
+++ b/modules/nginx.nix
@@ -0,0 +1,187 @@
+{ config, lib, pkgs, helpers, base, ... }:
+lib.recursiveUpdate
+{
+  options.clicks = {
+    nginx = {
+      services = lib.mkOption {
+        type = with lib.types;
+          listOf (submodule {
+            options = {
+              host = lib.mkOption { type = str; };
+              extraHosts = lib.mkOption { type = listOf str; };
+              secure = lib.mkOption { type = bool; };
+              service = lib.mkOption {
+                type = let
+                  validServiceTypes = {
+                    "redirect" = {
+                      to = ["string" str];
+                      permanent = ["bool" bool];
+                    };
+                    "reverseproxy" = {
+                      to = ["string" str];
+                    };
+                    "php" = {
+                      root = ["string" str];
+                      socket = ["string" str];
+                    };
+                    "directory" = {
+                      private = ["bool" bool];
+                      root = ["string" str];
+                    };
+                    "file" = {
+                      path = ["string" str];
+                    };
+                    "path" = {
+                      path = ["string" str];
+                      service = ["set" serviceType];
+                    };
+                    "compose" = {
+                      services = ["list" (listOf serviceType)];
+                    };
+                    "status" = {
+                      statusCode = ["int" int];
+                    };
+                  };
+
+                  serviceType = mkOptionType {
+                    name = "Service";
+
+                    description = "clicks Nginx service";
+                    descriptionClass = "noun";
+
+                    check = (x:
+                      if (builtins.typeOf x) != "set"
+                      then lib.warn "clicks nginx services must be sets but ${x} is not a set" false
+                      else if !(builtins.hasAttr "type" x)
+                      then lib.warn "clicks nginx services must have a type attribute but ${x} does not" false
+                      else if !(builtins.hasAttr x.type validServiceTypes)
+                      then lib.warn "clicks nginx services must have a valid type, but ${x.type} is not one" false
+                      else (let
+                        optionTypes =
+                          (builtins.mapAttrs (n: o: builtins.elemAt o 0) validServiceTypes.${x.type})
+                          // { type = "string"; };
+                      in (lib.pipe x [
+                        (builtins.mapAttrs (n: o: (builtins.hasAttr n optionTypes) && optionTypes.${n} == (builtins.typeOf o)))
+                        lib.attrValues
+                        (builtins.all (x: x))
+                      ]) && (lib.pipe optionTypes [
+                        (builtins.mapAttrs (n: _: builtins.hasAttr n x))
+                        lib.attrValues
+                        (builtins.all (x: x))
+                      ] )));
+                  };
+                in serviceType;
+              };
+              type = lib.mkOption { type = strMatching "hosts"; };
+            };
+          });
+        example = lib.literalExpression ''
+          with helpers.nginx; [
+            (Host "example.clicks.codes" (ReverseProxy "generic:1001"))
+          ]'';
+        description = lib.mdDoc ''
+          Connects hostnames to services for your nginx server. We recommend using the Clicks helper to generate these
+        '';
+        default = [ ];
+      };
+      serviceAliases = lib.mkOption {
+        type = with lib.types;
+          listOf (submodule {
+            options = {
+              host = lib.mkOption {
+                type = str;
+                example = "example.clicks.codes";
+                description = ''
+                  The ServerName of the server. If you override this in the nginx server block, you still need to put in the name of the attribute
+                '';
+              };
+              aliases = lib.mkOption {
+                type = listOf str;
+                example = [ "example2.clicks.codes" "example.coded.codes" ];
+                description = ''
+                  A list of servers to add as aliases
+                '';
+              };
+              type = lib.mkOption { type = strMatching "aliases"; };
+            };
+          });
+        example = lib.literalExpression ''
+          with helpers.nginx; [
+            (Host "example.clicks.codes" (ReverseProxy "generic:1001"))
+          ]'';
+        description = lib.mdDoc ''
+          Adds additional host names to your nginx server. If you're using `clicks.nginx.services`
+          you should generally use a Hosts block instead
+        '';
+        default = [ ];
+      };
+      streams = lib.mkOption {
+        type = with lib.types; listOf (submodule {
+          options = {
+            internal = lib.mkOption { type = str; };
+            external = lib.mkOption { type = port; };
+            protocol = lib.mkOption { type = strMatching "^(tcp|udp)$"; };
+          };
+        });
+        example = lib.literalExpression ''
+          with helpers.nginx; [
+            (Stream 1001 "generic:1002" "tcp")
+          ]'';
+        description = lib.mdDoc ''
+          A list of servers to be placed in the nginx streams block. We recommend using the Clicks helper to generate these
+        '';
+        default = [ ];
+      };
+    };
+  };
+  config = {
+    services.nginx = {
+      enable = true;
+      enableReload = true;
+
+      virtualHosts = lib.recursiveUpdate (helpers.nginx.Merge
+        config.clicks.nginx.services) # clicks.nginx.services
+        (lib.pipe config.clicks.nginx.serviceAliases [
+          (map (alias: {
+            name = alias.host;
+            value.serverAliases = alias.aliases;
+          }))
+          builtins.listToAttrs
+        ]); # clicks.nginx.serviceAliases
+
+      streamConfig = builtins.concatStringsSep "\n" (map (stream: ''
+        server {
+            listen ${builtins.toString stream.external}${lib.optionalString (stream.protocol == "udp") " udp"};
+            proxy_pass ${builtins.toString stream.internal};
+        }
+      '') config.clicks.nginx.streams);
+    };
+
+    networking.firewall.allowedTCPPorts = lib.pipe config.clicks.nginx.streams [
+      (builtins.filter (stream: stream.protocol == "tcp"))
+      (map (stream: stream.external))
+    ];
+    networking.firewall.allowedUDPPorts = lib.pipe config.clicks.nginx.streams [
+      (builtins.filter (stream: stream.protocol == "udp"))
+      (map (stream: stream.external))
+    ];
+
+    security.acme.defaults = {
+      email = "admin@clicks.codes";
+      credentialsFile = config.sops.secrets.cloudflare_cert__api_token.path;
+    };
+    security.acme.acceptTerms = true;
+
+    sops.secrets.cloudflare_cert__api_token = {
+      mode = "0660";
+      owner = config.users.users.nginx.name;
+      group = config.users.users.acme.group;
+      sopsFile = ../secrets/cloudflare-cert.env.bin;
+      format = "binary";
+    };
+  };
+} (
+  if base != null
+  then {
+    config.security.acme.certs = builtins.mapAttrs (_: v: { webroot = null; dnsProvider = "cloudflare"; }) base.config.security.acme.certs;
+  } else {})
diff --git a/modules/caddy/coded.codes/.well-known/matrix b/modules/nginx/coded.codes/.well-known/matrix
similarity index 100%
rename from modules/caddy/coded.codes/.well-known/matrix
rename to modules/nginx/coded.codes/.well-known/matrix
diff --git a/modules/privatebin.nix b/modules/privatebin.nix
index e82c389..17a1556 100644
--- a/modules/privatebin.nix
+++ b/modules/privatebin.nix
@@ -6,7 +6,7 @@
     settings = {
       main = {
         name = "Clicks Minute Paste";
-        basepath = "https://paste.clicks.codes/";
+        basepath = "https://privatebin.clicks.codes/";
         opendiscussion = true;
         fileupload = true;
 
@@ -20,6 +20,11 @@
         langaugeselection = true;
       };
 
+      nginx = {
+        serverName = "privatebin.clicks.codes";
+        enableACME = true;
+      };
+
       expire.default = "1month";
 
       expire_options = {