diff --git a/flake.lock b/flake.lock
index 62a44d6..8b5a381 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1686747123,
-        "narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=",
+        "lastModified": 1698921442,
+        "narHash": "sha256-7KmvhQ7FuXlT/wG4zjTssap6maVqeAMBdtel+VjClSM=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "724463b5a94daa810abfc64a4f87faef4e00f984",
+        "rev": "660180bbbeae7d60dad5a92b30858306945fd427",
         "type": "github"
       },
       "original": {
@@ -41,11 +41,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1692799911,
-        "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
         "type": "github"
       },
       "original": {
@@ -59,11 +59,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1698219444,
-        "narHash": "sha256-1f9tDt+1AcP6qnY4rhNJMlKVbHf3J+DfGVFsQUEThxw=",
+        "lastModified": 1699382547,
+        "narHash": "sha256-2eic/8NNO6G1fQsCpTm26ryUyk2bl6f08S9Zc/69iBI=",
         "ref": "refs/heads/main",
-        "rev": "64d1d305816c81380dd0924fa8c6810f67a78992",
-        "revCount": 16,
+        "rev": "fde6300909a486731d1cbe14589f65c8f6262d7e",
+        "revCount": 17,
         "type": "git",
         "url": "https://git.clicks.codes/Clicks/NixHelpers"
       },
@@ -79,11 +79,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1693208669,
-        "narHash": "sha256-hHFaaUsZ860wvppPeiu7nJn/nXZjJfnqAQEu9SPFE9I=",
+        "lastModified": 1695108154,
+        "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5bac4a1c06cd77cf8fc35a658ccb035a6c50cd2c",
+        "rev": "07682fff75d41f18327a871088d20af2710d4744",
         "type": "github"
       },
       "original": {
@@ -127,11 +127,11 @@
     },
     "nixpkgs-privatebin": {
       "locked": {
-        "lastModified": 1691328775,
-        "narHash": "sha256-nz7Myc/3sW7/tN1QDYKrmHnH5f5eGdbcFt1FRDstavk=",
+        "lastModified": 1694007184,
+        "narHash": "sha256-RHg4SstzvEIJrWiegkP+ArRniW1ZMz9/TB56gIYMAkk=",
         "owner": "e1mo",
         "repo": "nixpkgs",
-        "rev": "e1b0550bc7498d61ba95bcd089d62e256ef1677a",
+        "rev": "49b7af8f96e6d33deef36e46b171f56eb470e9bc",
         "type": "github"
       },
       "original": {
@@ -143,11 +143,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1693097136,
-        "narHash": "sha256-fBZSMdBaoZ0INFbyZ5s0DOF7zDNcLsLxgkwdDh3l9Pc=",
+        "lastModified": 1699110214,
+        "narHash": "sha256-L2TU4RgtiqF69W8Gacg2jEkEYJrW+Kp0Mp4plwQh5b8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9117c4e9dc117a6cd0319cca40f2349ed333669d",
+        "rev": "78f3a4ae19f0e99d5323dd2e3853916b8ee4afee",
         "type": "github"
       },
       "original": {
@@ -173,11 +173,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1693428224,
-        "narHash": "sha256-FWUUlhYqkGEySUD0blTADRiDQ7fw+H1ikivfu88uy+w=",
+        "lastModified": 1699291058,
+        "narHash": "sha256-5ggduoaAMPHUy4riL+OrlAZE14Kh7JWX4oLEs22ZqfU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "841889913dfd06a70ffb39f603e29e46f45f0c1a",
+        "rev": "41de143fda10e33be0f47eab2bfe08a50f234267",
         "type": "github"
       },
       "original": {
@@ -231,11 +231,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1693404499,
-        "narHash": "sha256-cx/7yvM/AP+o/3wPJmA9W9F+WHemJk5t+Xcr+Qwkqhg=",
+        "lastModified": 1699311858,
+        "narHash": "sha256-W/sQrghPAn5J9d+9kMnHqi4NPVWVpy0V/qzQeZfS/dM=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d9c5dc41c4b1f74c77f0dbffd0f3a4ebde447b7a",
+        "rev": "664187539871f63857bda2d498f452792457b998",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index c71216b..a9ca630 100644
--- a/flake.nix
+++ b/flake.nix
@@ -102,7 +102,7 @@
             remoteBuild = true;
             user = "root";
             path = deploy-rs.lib.x86_64-linux.activate.nixos
-              self.nixosConfigurations.clicks;
+              self.nixosConfigurations.clicks-without-mongodb;
           };
         } // (let
           mkServiceConfig = service: {
diff --git a/helpers b/helpers
index 64d1d30..fde6300 160000
--- a/helpers
+++ b/helpers
@@ -1 +1 @@
-Subproject commit 64d1d305816c81380dd0924fa8c6810f67a78992
+Subproject commit fde6300909a486731d1cbe14589f65c8f6262d7e
diff --git a/modules/gerrit.nix b/modules/gerrit.nix
index 6c0749c..36bc1cd 100644
--- a/modules/gerrit.nix
+++ b/modules/gerrit.nix
@@ -112,40 +112,9 @@
     };
 
     plugins = [
-      (derivation {
-        name =
-          "oauth.jar"; # HACK: wrapping a derivation in a derivation to rename it seems like a bad hack... but bazel would not build if I didn't (I think because it didn't like the .jar extension...) check why though?
-        src = (pkgs.buildBazelPackage {
-          __noChroot = true; # FIXME: terrible, horrible, no good, very bad
-          # name = "gerrit-oauth-provider.jar";
-          pname = "gerrit-oauth-provider.jar";
-          version = "unstable-2023-10-08";
-          src = pkgs.fetchgit {
-            url = "https://gerrit.googlesource.com/plugins/oauth";
-            rev = "1b3cc407cb2571d08601ab852e6e01f82d27160f";
-            hash = "sha256-yC/8qnkDbfIujl+Cvamr+EQSwto1DcIUWXh5cwDEZHo=";
-            deepClone =
-              true; # FIXME: this bazel build uses some git stuff, maybe we should try replacing with fakegit?
-          };
-          bazelTargets = [ "oauth" ];
-          bazel = pkgs.bazel_4;
-          buildAttrs = { };
-          fetchAttrs.sha256 =
-            "sha256-i5wOTn2NqqgJf4TCIqaCucpXu+5Vm5C84UPrGYFMSzc=";
-
-          postUnpack = ''
-            echo "4.2.2" > */.bazelversion  # nixpkgs only has certain bazel versions, so let's upgrade the patch of this one
-          '';
-
-          buildInputs = with pkgs; [ git curl jdk11 ];
-
-          postInstall = ''
-            cp bazel-bin/oauth.jar $out
-          '';
-        });
-        builder = "/bin/sh";
-        args = [ "-c" "${pkgs.coreutils}/bin/cp $src $out" ];
-        inherit system;
+      (pkgs.fetchurl {
+        url = "https://gerrit-ci.gerritforge.com/job/plugin-oauth-bazel-master-master/55/artifact/bazel-bin/plugins/oauth/oauth.jar";
+        hash = "sha256-Qil1CIh/+XC15rKfW0iYR9u370eF2TXnCNSmQfr+7/8=";
       })
     ];
     builtinPlugins = [
@@ -164,21 +133,18 @@
     listenAddress = "127.0.0.255:1000";
   };
 
-  nix.settings.sandbox =
-    "relaxed"; # FIXME: terrible, horrible, no good, very bad, here to support buildBazelPackage's use of cURL
-
   sops.secrets = {
     gerrit_email_private_key = {
       mode = "0400";
       owner = config.users.users.root.name;
-      group = config.users.users.nobody.group;
+      group = config.users.users.root.group;
       sopsFile = ../secrets/gerrit.json;
       format = "json";
     };
     gerrit_oauth_client_secret = {
       mode = "0400";
       owner = config.users.users.root.name;
-      group = config.users.users.nobody.group;
+      group = config.users.users.root.group;
       sopsFile = ../secrets/gerrit.json;
       format = "json";
     };
@@ -195,7 +161,7 @@
         config.sops.secrets.gerrit_email_private_key.path;
       matchers."gerrit_oauth_client_secret".secret =
         config.sops.secrets.gerrit_oauth_client_secret.path;
-      owner = config.users.users.nobody.name;
+      owner = config.users.users.root.name;
       group = "gerrit";
       mode = "0040";
     };
diff --git a/modules/grafana.nix b/modules/grafana.nix
index 6c63f75..948d29a 100644
--- a/modules/grafana.nix
+++ b/modules/grafana.nix
@@ -51,8 +51,8 @@
 
   sops.secrets.clicks_grafana_client_secret = {
     mode = "0600";
-    owner = "root";
-    group = "nobody";
+    owner = config.users.users.root.name;
+    group = config.users.users.root.group;
     sopsFile = ../secrets/grafana.json;
     format = "json";
   };
@@ -76,7 +76,7 @@
       matchers."client_secret".secret =
         config.sops.secrets.clicks_grafana_client_secret.path;
       owner = config.users.users.grafana.name;
-      group = "nobody";
+      group = config.users.users.root.name;
       mode = "0400";
     };
 
diff --git a/modules/matrix.nix b/modules/matrix.nix
index 2d41da9..2618fde 100644
--- a/modules/matrix.nix
+++ b/modules/matrix.nix
@@ -122,7 +122,7 @@
     registration_shared_secret = {
       mode = "0400";
       owner = config.users.users.root.name;
-      group = config.users.users.nobody.group;
+      group = config.users.users.root.group;
       sopsFile = ../secrets/matrix.json;
       format = "json";
     };
diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix
index a5fbf92..d0bd88a 100644
--- a/modules/nextcloud.nix
+++ b/modules/nextcloud.nix
@@ -52,8 +52,8 @@
       sha256 = "sha256-96/wtK7t23fXVRcntDONjgb5bYtZuaNZzbvQCa5Gsj4=";
     };
     richdocumentscode = pkgs.fetchNextcloudApp {
-      url = "redacted";
-      sha256 = "sha256-XYtjBZCIQ6+PL3BNLSZfJTgLLpOyphzR5HOAwI7bWx0=";
+      url = "https://github.com/CollaboraOnline/richdocumentscode/releases/download/23.5.503/richdocumentscode.tar.gz";
+      sha256 = "sha256-5BEN2YXRsMy+zyBBO0KLRMCkTOGv1RdPp1xcDFRNr2I=";
     };
     richdocuments = pkgs.fetchNextcloudApp {
       url =
diff --git a/modules/vaultwarden.nix b/modules/vaultwarden.nix
index a46987e..edca467 100644
--- a/modules/vaultwarden.nix
+++ b/modules/vaultwarden.nix
@@ -16,7 +16,7 @@
       value = {
         mode = "0400";
         owner = config.users.users.root.name;
-        group = config.users.users.nobody.group;
+        group = config.users.users.root.group;
         sopsFile = ../secrets/vaultwarden.json;
         format = "json";
       };