diff --git a/home-manager/config.kdl b/home-manager/config.kdl
index 8f9d169..485f1b8 100644
--- a/home-manager/config.kdl
+++ b/home-manager/config.kdl
@@ -356,7 +356,7 @@ binds {
 
     // Suggested binds for running programs: terminal, app launcher, screen locker.
     Mod+T { spawn "alacritty"; }
-    Mod+D { spawn "fuzzel-in-niri"; }
+    Mod+D { spawn "fuzzel"; }
     Super+Alt+L { spawn "lock-and-power-off-screen"; }
 
     // You can also use a shell. Do this if you need pipes, multiple commands, etc.
diff --git a/home-manager/home.nix b/home-manager/home.nix
index 34e7b32..cfbbf59 100644
--- a/home-manager/home.nix
+++ b/home-manager/home.nix
@@ -3,27 +3,10 @@
 
 { pkgs
 , inputs
-, lib
 , ...
 }:
 let
   customPkgs = import ../custom-pkgs/default.nix pkgs;
-  fuzzel-launch-prefix = (pkgs.writeShellApplication {
-    name = "fuzzel-launch-prefix";
-    text = ''
-      name=$(basename "$1")
-
-      # https://stackoverflow.com/questions/13043344/search-and-replace-in-bash-using-regular-expressions
-      # https://github.com/niri-wm/niri/blob/f717ae030fe56fc52522ebef69f17f3f09064ac4/src/utils/spawning.rs#L429
-      re='(.*)[^a-zA-Z0-9:_\.]+(.*)'
-      while [[ $name =~ $re ]]; do
-        # niri doesn't just yeet it out but encode it but that's too complicated for us
-        name="$${BASH_REMATCH[1]}$${BASH_REMATCH[2]}"
-      done
-
-      exec systemd-run --scope --user --unit "app-$name" "$@"
-    '';
-  });
 in
 {
   # You can import other home-manager modules here
@@ -84,12 +67,6 @@ in
         exec swaylock
       '';
     })
-    (pkgs.writeShellApplication {
-      name = "fuzzel-in-niri";
-      text = ''
-        ${lib.getExe pkgs.fuzzel} --launch-prefix "${lib.getExe fuzzel-launch-prefix}"
-      '';
-    })
     (pkgs.writeShellApplication {
       name = "shell.nix";
       text = ''
diff --git a/nixos/desktop.nix b/nixos/desktop.nix
index 58f1b48..8cdefb9 100644
--- a/nixos/desktop.nix
+++ b/nixos/desktop.nix
@@ -1,6 +1,7 @@
 { pkgs, config, ... }: {
   imports = [
     ./desktop-hardware-configuration.nix
+    ./paperless.nix
     ./configuration.nix
   ];
 
@@ -42,82 +43,6 @@
 
   programs.coolercontrol.enable = true;
 
-  # it would be cool if this didnt use up so many different ports...
-  # maybe a network namespace and bridge or something??
-  # unix sockets dont appear to be supported sadly
-  services.victoriametrics.enable = true;
-  services.vmagent = {
-    enable = true;
-    remoteWrite.url = "http://127.0.0.1:8428/api/v1/write";
-    prometheusConfig = {
-      scrape_configs = [
-        {
-          job_name = "node-exporter";
-          static_configs = [{ targets = [ "127.0.0.1:9100" ]; }];
-        }
-        {
-          job_name = "cadvisor";
-          static_configs = [{ targets = [ "127.0.0.1:8080" ]; }];
-        }
-        {
-          job_name = "systemd";
-          static_configs = [{ targets = [ "127.0.0.1:9558" ]; }];
-        }
-        {
-          job_name = "coolercontrol";
-          authorization = {
-            type = "Bearer";
-            credentials = "cc_5fed8f3b7bd44424b7ffc67cce940e55";
-          };
-          static_configs = [{ targets = [ "127.0.0.1:11987" ]; }];
-        }
-      ];
-    };
-  };
-  services.prometheus.exporters = {
-    node.enable = true;
-    systemd.enable = true;
-  };
-  services.cadvisor = {
-    enable = true;
-    extraOptions = [
-      # significantly decreases CPU usage (https://github.com/google/cadvisor/issues/2523)
-      "--housekeeping_interval=30s"
-    ];
-  };
-  services.grafana = {
-    enable = true;
-
-    settings = {
-      security = {
-        # here are my secrets, use them while they're hot
-        admin_user = "admin";
-        admin_password = "admin";
-        secret_key = "SW2YcwTIb9zpOOhoPsMm";
-      };
-      server.http_port = 4444;
-    };
-
-    declarativePlugins = [
-      pkgs.grafanaPlugins.victoriametrics-metrics-datasource
-    ];
-
-    provision = {
-      enable = true;
-      datasources.settings = {
-        apiVersion = 1;
-        datasources = [
-          {
-            name = "victoriametrics";
-            type = "victoriametrics-metrics-datasource";
-            access = "proxy";
-            url = "http://127.0.0.1:8428";
-          }
-        ];
-      };
-    };
-  };
-
   services.tailscale = {
     enable = true;
     useRoutingFeatures = "both";
@@ -155,11 +80,7 @@
   networking.firewall = {
     trustedInterfaces = [ "tailscale0" ];
     allowedUDPPorts = [ config.services.tailscale.port ];
-    allowedTCPPorts = [
-      /*SSH*/
-      22
-      11434
-    ];
+    allowedTCPPorts = [ /*SSH*/ 22 ];
 
     # https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111
     checkReversePath = "loose";
diff --git a/nixos/paperless.nix b/nixos/paperless.nix
new file mode 100644
index 0000000..cdcee4e
--- /dev/null
+++ b/nixos/paperless.nix
@@ -0,0 +1,46 @@
+{ lib, pkgs, ... }:
+let localDir = "/home/nora/.local/share/paperless-ngx"; nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
+  services.paperless = {
+    enable = true;
+    dataDir = "${localDir}/data";
+    mediaDir = "${localDir}/media";
+    consumptionDir = "${nasDir}/consume";
+    address = "0.0.0.0";
+    port = 8010;
+    user = "nora";
+    environmentFile = "${localDir}/secrets-environment";
+    settings = {
+      PAPERLESS_TIME_ZONE = "Europe/Zurich";
+      PAPERLESS_ADMIN_USER = "nora";
+      PAPERLESS_OCR_LANGUAGE = "deu+eng";
+    };
+    exporter = {
+      enable = true;
+      directory = "${nasDir}/export";
+    };
+  };
+
+
+  systemd.services.paperless-ngx-backup = {
+    description = "paperless-ngx data backup to NAS";
+    serviceConfig = {
+      Type = "oneshot";
+      User = "nora";
+      ExecStart = ''
+        ${lib.getExe pkgs.rsync} -a -v --delete --exclude=redis ${localDir}/ ${nasDir}/backup
+      '';
+    };
+  };
+  systemd.timers.paperless-ngx-backup = {
+    description = "paperless-ngx data backup to NAS";
+    wantedBy = [ "timers.target" ];
+    after = [ "mnt-nas.mount" ];
+    timerConfig = {
+      Unit = "paperless-ngx-backup.service";
+      OnCalendar = "daily UTC";
+      RandomizedDelaySec = 1800;
+      FixedRandomDelay = true;
+      Persistent = true; # ensure it still runs if the computer was down at the timer of trigger
+    };
+  };
+}