diff --git a/nix/deploy/smoke-tests.sh b/nix/deploy/smoke-tests.sh
index 5054a61..d2a939c 100755
--- a/nix/deploy/smoke-tests.sh
+++ b/nix/deploy/smoke-tests.sh
@@ -4,20 +4,28 @@
 
 set -eux
 
+check_single_dig_answer() {
+    dns="$1"
+    type="$2"
+    host="$3"
+    grep="$4"
+
+    dig "@$dns.infra.noratrieb.dev" "$type" "$host" +noall +answer | grep "$grep"
+}
+
 check_dig_answer() {
     type="$1"
     host="$2"
     grep="$3"
 
-    dig @dns1.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-    dig @dns2.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-
+    check_single_dig_answer "dns1" "$type" "$host" "$grep"
+    check_single_dig_answer "dns2" "$type" "$host" "$grep"
 }
 
 # Check DNS name servers
 check_dig_answer A "dns1.infra.noratrieb.dev" "154.38.163.74"
 
-check_dig_answer A "nilstrieb.dev" "161.97.165.1"
+check_single_dig_answer "dns1" A "nilstrieb.dev" "161.97.165.1"
 
 # Check the NS records. The trailing dot matters!
 check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev."
diff --git a/nix/hive.nix b/nix/hive.nix
index eee6101..347f10a 100644
--- a/nix/hive.nix
+++ b/nix/hive.nix
@@ -24,7 +24,7 @@
             wg = {
               privateIP = "10.0.1.1";
               publicKey = "7jy2q93xYBHG5yKqLmNuMWSuFMnUGWXVuKQ1yMmxoV4=";
-              peers = [ "vps3" ];
+              peers = [ "minipc" "vps3" "vps5" ];
             };
             tags = [ "dns" ];
           };
@@ -88,7 +88,7 @@
             wg = {
               privateIP = "10.0.0.5";
               publicKey = "r1cwt63fcOR+FTqMTUpZdK4/MxpalkDYRHXyy7osWUk=";
-              peers = [ "vps1" "vps2" "vps3" "vps4" ];
+              peers = [ "dns1" "vps1" "vps2" "vps3" "vps4" ];
             };
             tags = [ "apps" ];
           };
@@ -98,7 +98,7 @@
             wg = {
               privateIP = "10.0.2.1";
               publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
-              peers = [ "vps3" ];
+              peers = [ "dns1" "vps3" ];
               noEndpoint = true;
             };
             tags = [ "home" ];
@@ -320,7 +320,9 @@
       ./modules/immich
       ./modules/tailscale
       ./modules/paperless
+      ./modules/home-assistant
       ./modules/caddy-base
+      ./modules/caddy-acme-dns
     ];
 
     system.stateVersion = "25.05";
diff --git a/nix/modules/caddy-acme-dns/default.nix b/nix/modules/caddy-acme-dns/default.nix
new file mode 100644
index 0000000..e5455af
--- /dev/null
+++ b/nix/modules/caddy-acme-dns/default.nix
@@ -0,0 +1,13 @@
+{ config, ... }: {
+  age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
+  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
+
+  services.caddy.globalConfig = ''
+    acme_dns rfc2136 {
+      key_name "acme-dns-01"
+      key_alg "hmac-sha256"
+      key "{$CADDY_DNS_RFC2136_KEY}"
+      server "dns1.local:53"
+    }
+  '';
+}
diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix
index a33e7b3..c77a7d5 100644
--- a/nix/modules/caddy-base/default.nix
+++ b/nix/modules/caddy-base/default.nix
@@ -6,7 +6,7 @@ let
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
       "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
-    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
+    hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
   };
 in
 {
@@ -32,6 +32,7 @@ in
       format json
     '';
     globalConfig = ''
+      email tls@noratrieb.dev
       auto_https disable_redirects
 
       servers {
diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix
index bec542b..207821c 100644
--- a/nix/modules/caddy/default.nix
+++ b/nix/modules/caddy/default.nix
@@ -7,9 +7,6 @@
   systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
   services.caddy = {
     globalConfig = ''
-      email tls@noratrieb.dev
-      auto_https disable_redirects
-
       storage s3 {
         host "localhost:3900"
         bucket "caddy-store"
@@ -18,21 +15,6 @@
 
         insecure true
       }
-
-      acme_dns rfc2136 {
-        key_name "test"
-        key_alg "hmac-sha256"
-        key ""
-        server "dns1.local:53"
-      }
-
-      tls {
-        dns_challenge_override_domain "nilstrieb.dev"
-      }
-
-      servers {
-        metrics
-      }
     '';
     virtualHosts = {
       "http://" = {
diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix
index 7d1c858..3970d45 100644
--- a/nix/modules/dns/default.nix
+++ b/nix/modules/dns/default.nix
@@ -1,9 +1,9 @@
-{ pkgs, lib, networkingConfig, config, ... }:
+{ pkgs, lib, networkingConfig, config, name, ... }:
 let metricsPort = 9433; in
 {
-  age.secrets.knot_dns_rfc2136_key_config = {
+  age.secrets.knot_dns_acme_dns_01_key_config = {
     file =
-      ../../secrets/knot_dns_rfc2136_key_config.age;
+      ../../secrets/knot_dns_acme_dns_01_key_config.age;
     owner = "knot";
   };
 
@@ -27,42 +27,57 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ];
-    settingsFile = pkgs.writeTextFile {
-      name = "knot.conf";
-      text = ''
-        server:
-            listen: 0.0.0.0@53
-            listen: ::@53
-        
-        key:
-          - id: rfc2136-update
-            algorithm: hmac-sha256
-            secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds=
-        
-        acl:
-          - id: update_acl
-            address: 10.0.0.0/24
-            key: rfc2136-update
-            action: update
-            update-type: [TXT]
+    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
+    settings = {
+      server.listen = [ "0.0.0.0@53" "::@53" ];
+      acl = [
+        {
+          id = "update_acl";
+          address = "10.0.0.0/16";
+          key = "acme-dns-01";
+          action = "update";
+          update-type = [ "TXT" ];
+        }
+      ];
+      zone = [
+        {
+          domain = "noratrieb.dev";
+          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
 
-        zone:
-          - domain: noratrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-          - domain: nilstrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-            acl: update_acl
-        log:
-          - target: syslog
-            any: info
-      '';
+      ] ++ (if name == "dns1" then [
+        {
+          domain = "nilstrieb.dev";
+          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
+        {
+          domain = "noratrieb-acme-delegate.dev";
+          storage = "/var/lib/knot/zones/";
+          file = "noratrieb-acme-delegate.dev.zone";
+          acl = "update_acl";
+        }
+      ] else [ ]);
+      log = [{
+        target = "syslog";
+        any = "info";
+      }];
     };
   };
 
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
+  systemd.services.knot.preStart =
+    lib.mkIf (name == "dns1")
+      (lib.getExe
+        (pkgs.writeShellApplication {
+          name = "knot-prestart.sh";
+          text = ''
+            mkdir -p /var/lib/knot/zones/
+            cp ${
+              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
+            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
+          '';
+        }));
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;
diff --git a/nix/modules/dns/nilstrieb.dev.nix b/nix/modules/dns/nilstrieb.dev.nix
index c013f4f..528fc83 100644
--- a/nix/modules/dns/nilstrieb.dev.nix
+++ b/nix/modules/dns/nilstrieb.dev.nix
@@ -29,14 +29,11 @@ let
       ];
 
       NS = [
-        "ns1.nilstrieb.dev."
-        "ns2.nilstrieb.dev."
+        "ns.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
-        ns1 = dns1;
-        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 
diff --git a/nix/modules/dns/noratrieb-acme-delegate.dev.nix b/nix/modules/dns/noratrieb-acme-delegate.dev.nix
new file mode 100644
index 0000000..cf4308d
--- /dev/null
+++ b/nix/modules/dns/noratrieb-acme-delegate.dev.nix
@@ -0,0 +1,39 @@
+# https://github.com/nix-community/dns.nix
+{ pkgs, lib, networkingConfig, ... }:
+let
+  data = with pkgs.nix-dns.lib.combinators;
+    let
+      hour1 = 3600;
+      hostsToDns = builtins.mapAttrs
+        (name: { publicIPv4, publicIPv6, ... }:
+          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
+          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
+        networkingConfig;
+    in
+    with hostsToDns;
+    {
+      TTL = hour1;
+      SOA = {
+        nameServer = "ns.noratrieb-acme-delegate.dev.";
+        adminEmail = "void@noratrieb.dev";
+        serial = 2024072601;
+      };
+
+      CAA = [
+        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
+        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
+      ];
+
+      NS = [
+        "ns.noratrieb-acme-delegate.dev."
+      ];
+
+      subdomains = {
+        ns = dns1;
+      };
+    };
+in
+pkgs.writeTextFile {
+  name = "noratrieb-acme-delegate.dev.zone";
+  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
+}
diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix
index 808e0b1..3edc5a5 100644
--- a/nix/modules/dns/noratrieb.dev.nix
+++ b/nix/modules/dns/noratrieb.dev.nix
@@ -97,10 +97,15 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = {
-          immich = minipc;
-          paperless = minipc;
-        };
+        internal.subdomains = builtins.listToAttrs (builtins.map
+          (name: {
+            inherit name;
+            value = minipc // {
+              subdomains = {
+                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
+              };
+            };
+          }) [ "immich" "paperless" "home-assistant" ]);
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];
diff --git a/nix/modules/home-assistant/default.nix b/nix/modules/home-assistant/default.nix
new file mode 100644
index 0000000..36e942a
--- /dev/null
+++ b/nix/modules/home-assistant/default.nix
@@ -0,0 +1,26 @@
+{ config, ... }: {
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      # Recommended for fast zlib compression
+      # https://www.home-assistant.io/integrations/isal
+      "isal"
+    ];
+    config = {
+      default_config = { };
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = [ "::1" ];
+      };
+    };
+  };
+
+  services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
+    '';
+  };
+}
diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix
index 9d3b52c..97213e6 100644
--- a/nix/modules/immich/default.nix
+++ b/nix/modules/immich/default.nix
@@ -13,7 +13,6 @@
     environment = {
       IMMICH_TELEMETRY_INCLUDE = "all";
     };
-    openFirewall = true;
   };
 
   services.postgresql = {
@@ -30,5 +29,14 @@
     '';
   };
 
+  services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.immich.port}
+    '';
+  };
+
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
 }
diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix
index 5cb60cb..bfb6414 100644
--- a/nix/modules/paperless/default.nix
+++ b/nix/modules/paperless/default.nix
@@ -12,6 +12,7 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       PAPERLESS_TIME_ZONE = "Europe/Zurich";
       PAPERLESS_ADMIN_USER = "nora";
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
+      PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
     };
     exporter = {
       enable = true;
@@ -20,5 +21,12 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 8010 ];
+  services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
+    '';
+  };
 }
diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age
index adb5d54..c8828d3 100644
--- a/nix/secrets/backup_s3_secret.age
+++ b/nix/secrets/backup_s3_secret.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 7Skt5gktvb9YK6/irBF/1+75lfq21qcgnVKsFXHm1l0
-L2uk8HCySy14opdPdZqNvHIphuJ8oTGujCWY3NtxvWk
--> ssh-ed25519 91VHug aKHSBKih0l3EhQe0v5SyTQiLEz3W6HgzyUVXAHI6LDg
-zpZ8ENOBTPZWxMlvt43z73Cjip4dZvZDeMO7zOGEtpQ
--> ssh-ed25519 XzACZQ MtKX5scktrEXJe3nPrzFEMdWrdgvR/4btZ+MmuJr+38
-rYoSGq+I3WioIsDeqNFdJjVMs/REnfpKuUhzanT5big
--> ssh-ed25519 51bcvA 9WhV9RBsA199GA4jlTEY+ypVJC/KLBZReJbJW3b8SQI
-HsRsq+n8PvJSa5zQt9knn8yi72wqtb9CZh/SP+y3ozo
--> ssh-ed25519 vT7ExA V4C1cr4CzOTY4WEvdUwr1siAVClIipd2ud+ihs/hkVU
-qbcSyGm1/Ajr/RiQ8IMqLCD9+kZv7o9jP9oXnK4/FUE
---- jFQGrwJAhLPWppCP/nGJUAA7qRkOra8DIgptR+T6IYA
-��>nl��=���{ߪ�,j"0)L�2��M�6�~��.M�ʉ��0m��w��pMh������5�[C��>�96a���M(����'��+Rh�L���.I��h��r������
3��x�qn+K*F/�K��:��n�'iWi���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg 4LRAh4VUnxT4kdbR8IYYH9Y5Gpx0KORJRzBW3HsjGxk
+JJD2Mk2Fb3EmFyqYq7hVD4DZiBLMqTGTRxKy46buAbs
+-> ssh-ed25519 91VHug eq8UIjMBKHOeR8coknHBLZCfGUaCtLlznCk1/iE/exs
+eUIdvYMK1QOcjPg7owZScNFcVkXEJ7B80t3sRk0weP8
+-> ssh-ed25519 XzACZQ a6/9wiA7IeQLHGccQdfvpwowFh5OdKgIqqrqq+qQZUY
+sUsOYDhlv8n8HNj3ZCyhNbfPZWlbvd5haV3ZMBPJGrg
+-> ssh-ed25519 51bcvA 9dbiKUhvYOHt2QhZvOhW4EH/S/OOLx7oACgSUXH0nQc
+Rxq1B9yZLI/LKg/FvNXrL7sZSB12t552k9RBLieIBsk
+-> ssh-ed25519 vT7ExA XWX+UVri3OJrpSXyrWQVvhQ9IQVFpcvopMLetFNoagQ
+WSDbM8LDuMC8RKBzf4I4NffEUGtfPrjPJ0jdrrR5lzQ
+--- bd3tx9uq8j3zhQZ4rAWBuZHgzez6eSRz4O7VcdoJMvM
+�f)��z�͛d�Ta��#��߱�R��hk����hm�],X��FN��$'0K���j�0��V�|k����O)
+"��
�r�&IB�B[5�Sg5꺜Y��8���x���c�`,��ӱ��0W*
���
O[i+F�M�N��_�n ���wǵ
\ No newline at end of file
diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age
index d231b80..e0a5138 100644
Binary files a/nix/secrets/caddy_s3_key_secret.age and b/nix/secrets/caddy_s3_key_secret.age differ
diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age
index 21dbaca..71e7bdd 100644
--- a/nix/secrets/docker_registry_password.age
+++ b/nix/secrets/docker_registry_password.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08
-vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs
---- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY
-�j9��Ky�Ȱ0*Üb�ɿY�0�����I3v�+�D"*/g`�o�#���ص�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg UVJ4EkIz+aHGJHW/UWVOod/NSUrmLL4pNvK60KPWxzE
+pQ3h/qZ8XfwCqb2QshUxuLs6F+YddX2QSp8MLQnxBR0
+--- gox0jFVFKNb46LsZ/aOEpkxCWnx8sTe7Rvv+tdzkvq8
+��iB�<'+�̽����L�Yd�6c�6B�g�]UG􊃻N��c�]4Y<
\ No newline at end of file
diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age
index a1a6080..cc6be88 100644
Binary files a/nix/secrets/does_it_build_private_key.age and b/nix/secrets/does_it_build_private_key.age differ
diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age
index 609822d..0a2c88c 100644
--- a/nix/secrets/forgejo_s3_key_secret.age
+++ b/nix/secrets/forgejo_s3_key_secret.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw
-M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E
---- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys
-G6�?�U'r�y����@b�$�M�Z�`��@���kv�]�6�_�۟N��ق�
$�!�m��Vk��gA�]�yW�,���d'��;Ȧ핒�܎�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg nMMawatvWfcdHyOTJu5UBTCZbB8MDbvdd5XaSCR9ARQ
+iUI0FSTyjhx0xdfUn3ikxR3dcW8GQH1Flu2kwlkP1HA
+--- Fb7A45fAQY9VJN6Er23jTuEMvm5eDHJflTiiNFB4dYs
+�.�)!�$Y�Q�ώ$�9i3�3b_z
+��TR˲q�hs|[����F(�m��I���q1z�^&�&	'��(�g׏6��Fվ�^.�j]��D�i
M5�q�
\ No newline at end of file
diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age
index ce127e4..9d822f6 100644
--- a/nix/secrets/garage_secrets.age
+++ b/nix/secrets/garage_secrets.age
@@ -1,14 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Nl4yCNn9+FiX2uBliOH052tOjnTj4DcFzaIDjD2MVTY
-aU848NDVI6MN5JPm9FRha+HJySIEyRRcNaiiBRnxJLY
--> ssh-ed25519 91VHug HfzLsV+15VwIFXz9mYc3dNdlFnb2MdqOMIV3DkxnJmQ
-Fr2LDl/Z5Tn9FspwZynbCvK9Let8VWGAr00lf3Uhj14
--> ssh-ed25519 XzACZQ GWXW5myuKkabbJwdW3OsHl08KBo0wu3dJXXo13xYjR4
-SYu+6yj0om9BHFoJH8wsDPEbQCQy/oAp1jRW9wX6Ys0
--> ssh-ed25519 51bcvA nenOCUH5VZ2j/u1fv7mD/2hZufU6KWY46UZwzINXSSo
-GbQOiKQ6ko7RpuYvmtUnf5wzNrKpR/FHkrYHhRzURDw
--> ssh-ed25519 vT7ExA 8/Cn92m/Qtoo78VSNEYNrC4HqoIKxLyvT7A0R0CpE0U
-rehfI6pEM0nAv9AQAFa3g/PTd4uvc8zwWLAVAgoq3NA
---- fHz+V2yXufeCvWNZ4Eu+vAdPYBoDYyuUlXcrTo8O/88
-r�����u^+�=�$!1
-�rF�-N����Hr�+��2�z>�F�iw`ˬ���0���2��4(3
���իH���=�ay$t�V������|H����I�	��d�2�_`��
	�d��r?P��M���	�bش�%qh�o���"�ߗ�lzs;r{�X�uE�n)'!���V������Z֘��܌���u�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg GE45kAK/hBIkfDcJ9T5KSf2ZlRuznfyCXNgyiROKSho
+07IiEZYSR+BoaHsNOMfpTB7KvFI5erLqiLkxHeghNA0
+-> ssh-ed25519 91VHug I5YszjRHyHEIPSO9ATRx/hgSiBnq6CmQeCiEWyThKQY
+6cyqqeR7jyvWCC3yfxqVk9YtjhR8LmUISxoScoAl0Ac
+-> ssh-ed25519 XzACZQ qqZvo9xbK4rQRDzCsyKD0NVYhk3960UW5FRfavIoI24
+AjsMDfEzmGMCGekIAHPXkN2RRZHC4ZjACo3cNGx/iqc
+-> ssh-ed25519 51bcvA mvDGI9jBis304qlduEX3kDb2Y5E2fiNL70i110hdDUo
+OJl67yJ26ZZVLgobEbh63J9kku+whdmgawpPrlyAgFs
+-> ssh-ed25519 vT7ExA NgHlD7tjMUF2kIeMmHyE/qsZI9VzIkg4drUCDj0GABs
+kxwMjB9CBd5IRlh2SBHIQJSjCjARLMwOg40DSdbDO3k
+--- hzXf515cyiJHjcIAg+kmCeZ4Hy2GI/b21F5O+Pq7r5A
+�=�)�BT�֢��(�_�_��
�2�{�E��d��ι��	w�MS�Vs9T�j_+�q��}���f��5�1�޿�^�>Q�F�g�^Qvn�Z�͔d�Θ��l=��YȬ�پ\!�F�4v��t����h���!�A�m�%'��n���<W�wi�ghmڬ�/'��Ⴗ��Y|AC����`zX���׻-�3�
\ No newline at end of file
diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age
index d009691..504b519 100644
--- a/nix/secrets/generic_backup_password.age
+++ b/nix/secrets/generic_backup_password.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8
-A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0
--> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8
-CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc
--> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY
-aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM
--> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk
-2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8
--> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4
-sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk
---- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc
-��u��M�?C�������0Z�&����rS��g��W���p�8�{*6�����y���q������ð%���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg NaiDsYFYQAZuJinDZ60OiPEZMsnmPOggyW/lKwLPWR0
+vLZKSA9iaFIdOjE7K9n7vtlF8UKCS+AKuSS3O8jlfbw
+-> ssh-ed25519 91VHug O5htAKX31xr2plcilbKy/AZ0xtyIDekjtr6GYeIXcns
+aK43EBfhqDCEtkB/1RephM7PK0tB0xHjS+GIDTFw2A8
+-> ssh-ed25519 XzACZQ NRs3M2HrY9vZ94a+MccGZisn/cEyY9lg6l/ZiOaECgY
+aZ84NrESzU+yhsxXk+XiHEFJ+5/8B5wmFZVhPU5K8p4
+-> ssh-ed25519 51bcvA 74NdYVJKbbDBuhxqUUAgx4GpGbKFzL0/+KRXJKoxh0M
+nXjmvzBfiq5Y7EUeUM5aoEColQa80JUCMwaLX36Scss
+-> ssh-ed25519 vT7ExA buG7ZHfGrdKqobgouN2DHkOointeeSo3LbQ5TbXxMT4
+v+CfO/1CDfu2d/Oy7LX1S/tPa25zaY6rWafpQB+yzdo
+--- 1urbgjL5IrFAQbt9FPGt+Hv5hJ99uiFaC3K3G4X5JSQ
+?
+A�>�$-��>6������������蝠���>/RZs�Y�ɮ4�5�ѺR}��a�9S�Xw����R9�
\ No newline at end of file
diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age
index eecd4fc..a8f2696 100644
Binary files a/nix/secrets/grafana_admin_password.age and b/nix/secrets/grafana_admin_password.age differ
diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age
index 0465eba..82504b1 100644
Binary files a/nix/secrets/hugochat_db_password.age and b/nix/secrets/hugochat_db_password.age differ
diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age
index cecada9..3ecb67a 100644
--- a/nix/secrets/immich_secrets.age
+++ b/nix/secrets/immich_secrets.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo
-nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA
---- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao
-��x�	l�l w���\v�S-�!V���]�������}g��΃[>e�;�n0�n!��;L
-�+
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q ttfca/hqpWJm9dRJYWBXj9Of1rdWg2NbgfsAJFMUQTY
+qokH5RFlOmZMETgkqlWhcx41EtXtN2IxKpvP/WGz6mk
+--- vn3HoHqGBa02fSSeO8LGjhGb/7JK/tN/0Zh1Pjz25dY
+]?m����D�C:g��_klU�G���Q����J+��g3�u�9FH"���'g�����d���߃
\ No newline at end of file
diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age
index 19d8d77..91975e5 100644
Binary files a/nix/secrets/killua_env.age and b/nix/secrets/killua_env.age differ
diff --git a/nix/secrets/knot_dns_acme_dns_01_key_config.age b/nix/secrets/knot_dns_acme_dns_01_key_config.age
new file mode 100644
index 0000000..b47832e
--- /dev/null
+++ b/nix/secrets/knot_dns_acme_dns_01_key_config.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 LZU5Eg REfGT+ZHVlXvO+6s9AgIGQCBS+AQYfAG012IfRipJhQ
+V/O4nPGoAOpB/4DyBWuEV/GxoRJ7hdgVomIQwcxnSdg
+-> ssh-ed25519 5bWSnQ vFGAKwm8eJ/Fqv+LxLo+1mnzg4ht1BLTA7zdJuWdlnI
+Lhh3d9dWKyRcVTKeMOJb/cVzwnnqrBYNE0ijDgAxut0
+--- Du4x4K3KsDMktwzmEMiFRxGXq63eP5x9CBowtGJWM+w
+�1�{$�e��9�b���`��+g��p�����D��x�hK*/�Z�~eAԥ�H�}l���0���Ό��s�Z�t��ڸ��:!���k�j�!I�_�y�I�[e����F��G���Cb��x����
\ No newline at end of file
diff --git a/nix/secrets/knot_dns_acme_dns_01_key_envvar.age b/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
new file mode 100644
index 0000000..9503cd7
--- /dev/null
+++ b/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 vT7ExA UhRU412YTV9dkMkINM4xDQvQqwosWzIRGap+NxS7MFQ
+FUlsU461cxI+2befwB1v3ygyYAeTwfpJft/EX7eCGCo
+-> ssh-ed25519 yMKb8Q 2kpI3iQwInOH+TYnbvuyKyksGD9Q8UthqF1eBG5I+0g
+Si5Q1xNovm8hBmSfHx6l4PsiFU/cPa52rLw8OAGWQl0
+--- PO+gCtXKMloPmRAplw/pOAVPDHqh5PwzrQqrzSPN5Ng
+_W���[��VN�J��1���D-���:�ᔆ|V�z��l���S�v�*{��G�9V"����_��G�r��S\�c�?s���&갶�S��	
\ No newline at end of file
diff --git a/nix/secrets/knot_dns_rfc2136_key_config.age b/nix/secrets/knot_dns_rfc2136_key_config.age
deleted file mode 100644
index 48f95c0..0000000
Binary files a/nix/secrets/knot_dns_rfc2136_key_config.age and /dev/null differ
diff --git a/nix/secrets/knot_dns_rfc2136_key_envvar.age b/nix/secrets/knot_dns_rfc2136_key_envvar.age
deleted file mode 100644
index fc3744f..0000000
--- a/nix/secrets/knot_dns_rfc2136_key_envvar.age
+++ /dev/null
@@ -1,13 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 qM6TYg QQMDIquZuxMKwx2hl2ST9BMXa61DBdC/cMUutcRIRHw
-l7oENezyJwfJHrgNUtFMfOF08BhAYWQOjW8v7VPN/aE
--> ssh-ed25519 91VHug wQBzeFG2xixYU5L8/d81n5FkZMqO3uCSF60Xi80mvnU
-nPAgKpJj7WDJ4tbKGnlWAhvAUOyLIyOY3aPofKM0LfY
--> ssh-ed25519 XzACZQ HYj1Omcc8WYq6s9l5hVrjjibg1LFHnkYkXiPolGewws
-uhrQ6nmP5fMApIJzUzwXcnlILdPvmlG4QhG1laW6alk
--> ssh-ed25519 51bcvA e2Xng7rC2SkYiDn5BRTIDBxn7vN/F95hI+okWL9TymI
-7TJrZQlJsnGMu5jaFQllI1E/+ZGHZjGmaUpuNZSAPDI
--> ssh-ed25519 vT7ExA PSM21ZGF9T9g6rxnsCv3rAio1f5KckTHgivfclDjFFs
-rq3M2R/LHYki4nQ68iFoLXH8VVmWyBDD6yv6y4tt5qQ
---- KqTQhyl3ef04vDQ8eu1IvTsEaSMYtQxxBAcIO+WYPr4
-�$Jk��#_����Fr�"���B}~��P�@�.���e܅��YS�L;��P�z
&0�DiK�J�^�:�Oc'��+��
\ No newline at end of file
diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age
index 1c85165..cbbf258 100644
--- a/nix/secrets/loki_env.age
+++ b/nix/secrets/loki_env.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ aRbZOixkF1CtYIoCxgHX1Cw25ozmtV4HWsFIY0sfHAw
-y9PvJ4rdceua7Q4GVqz09KZsensKhA8pLMjGyub06xY
---- gCH1ZBj/XvuwrtJcjVXr99OT89N7JOIlHd5xofjwH9o
-Pcwe��OKD-���P�z��8��Dub3���@H��}��!��E�퍽�lۛH^k�lMro\�
�%��#Ӹ�˦Na���,�=Fk�u:��![����=��&��0X�<�OM��ܥ��٩�!��2��-��JZ��|1��
\ No newline at end of file
+-> ssh-ed25519 XzACZQ YEK1qlKkw4KVnbOpskeVcNSTkzHvIHGLTkXfo7t8+Ak
+MsWSttjHmrX/VknsxcVCDUnItE8ypvAvlD3oEWhqg8w
+--- 5TI3aOOUZNicoLqjN9qM+PFW4vtHWwE0d8YzBzQMWWo
+l�L�ebYG������p��d�i����):�.���s�L1A��bnqMzy㭪�v*���삆֐�Zo�-��2��b��2	�kY��őR��w��_�\�d����3!BV!�{J�Δ/��j�>o�$���SV�J3^��Ђ
\ No newline at end of file
diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age
index 05d0b31..9937f85 100644
Binary files a/nix/secrets/minio_env_file.age and b/nix/secrets/minio_env_file.age differ
diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age
index f9a3b40..6c79515 100644
Binary files a/nix/secrets/openolat_db_password.age and b/nix/secrets/openolat_db_password.age differ
diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age
index 45894df..7dfa32a 100644
Binary files a/nix/secrets/paperless_env.age and b/nix/secrets/paperless_env.age differ
diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age
index cea6275..13bf603 100644
Binary files a/nix/secrets/pyroscope_s3_secret.age and b/nix/secrets/pyroscope_s3_secret.age differ
diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age
index 9422a04..d027b5a 100644
--- a/nix/secrets/registry_htpasswd.age
+++ b/nix/secrets/registry_htpasswd.age
@@ -1,5 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg vZTE3zklC5ACYvOuHSNPMDJshQPcxmbfen0TygKKW2s
-2TMCnx49MiF0AqCFMTmuXC/xKzos66rskkDfdnIdQTU
---- 8JTyQvwrmMPdNLPK4cGGenl5DN2UpoCqUQzdbEvezpQ
-�!|G�q��^D;-B��2��>�"��2����A�)�d�s\�Ӳ�i���E!�g66
�,}�	P�c��Qx�‘��0��v�DV4�:��ү�;�m���(xs
\ No newline at end of file
+-> ssh-ed25519 qM6TYg b9QXaopOE4ffCV1mNelzUSBejlwg+p2x5GuFiQJtXEE
+Vx9fJQWJju9TPMYU6qZJ6aHb3atQExfSlUHmbXkoyr0
+--- uiYOy/yar6oKQHnP1eNkFlkiD4O9oOxng35UKQNf8FU
+���6��Ii=ȹ8	ˇ/�"*��#�^���*�����
+���f��g��k�e���4�v
+c�$�$��d�z�����������n<�
\ No newline at end of file
diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age
index 11fe1a4..1ce82a2 100644
Binary files a/nix/secrets/registry_s3_key_secret.age and b/nix/secrets/registry_s3_key_secret.age differ
diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age
index da31522..935f42a 100644
Binary files a/nix/secrets/restic_backup.age and b/nix/secrets/restic_backup.age differ
diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age
index ba1bd52..a35f4dc 100644
Binary files a/nix/secrets/s3_mc_admin_client.age and b/nix/secrets/s3_mc_admin_client.age differ
diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index f02c447..00d810c 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -33,8 +33,8 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
-  "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ];
-  "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
+  "knot_dns_acme_dns_01_key_config.age".publicKeys = [ dns1 dns2 ];
+  "knot_dns_acme_dns_01_key_envvar.age".publicKeys = [ vps5 minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];
diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age
index 003343f..33b042c 100644
Binary files a/nix/secrets/upload_files_s3_secret.age and b/nix/secrets/upload_files_s3_secret.age differ
diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age
index 42f873b..cc2d8cb 100644
Binary files a/nix/secrets/website_s3_key_write.age and b/nix/secrets/website_s3_key_write.age differ
diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age
index 59f797a..da9fe8c 100644
--- a/nix/secrets/wg_private_dns1.age
+++ b/nix/secrets/wg_private_dns1.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0
-xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ
---- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE
-
-F�0e�ҍ�Y�
-{s�h]�ƬfAp����B^��1���e�0!�3����s����"��j@��=�r��Rs��(+�"
\ No newline at end of file
+-> ssh-ed25519 LZU5Eg 8zZFvGVb6VIefxLJERJ16VqhKczWW2tcUEdSU4dIsC4
+5k+Qpn+ZloytTx4DhcgT3Il5lBlXIuNmwMvNKC1hvNY
+--- rEDDdmvnau74yyYkVHKGx8kKi+Is/s/Ygt7PKfs4dv0
+=@�_��y��\����-*垣��F<��KV^u�WCzZ�l���}oo
�6�h"��E��p��k#l���aʰ�&
\ No newline at end of file
diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age
index 64d55f0..5e3c22c 100644
Binary files a/nix/secrets/wg_private_dns2.age and b/nix/secrets/wg_private_dns2.age differ
diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age
index 1d0e1be..a3c964b 100644
--- a/nix/secrets/wg_private_minipc.age
+++ b/nix/secrets/wg_private_minipc.age
@@ -1,7 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE
-3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM
---- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w
-@
-��q�����,�YL��3�)�eq���aK@]��e���x�C�
-t���v-G!�}����J���i��$=
*��
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q OK8Z0x1tfsdGQo0Acqxj99IDVwfRRO4nHmtBuwDXpEo
+FNfKD0EJ3FMQ8neRd5tNldCLp9Wk2K4/wlaEjKQPxPQ
+--- y32/fNgc6fz2cAr76vUej99Xu5DMcmO8bDQepK04TRM
+ѣ`'mo�HK{O��-����Ёy�l��,X49��
'+�t��r&OK�^���
ߚ>
+�(��G���>�A��n�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age
index 5dd33e1..c88ff5f 100644
Binary files a/nix/secrets/wg_private_vps1.age and b/nix/secrets/wg_private_vps1.age differ
diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age
index dbdcbd2..b951cf0 100644
--- a/nix/secrets/wg_private_vps2.age
+++ b/nix/secrets/wg_private_vps2.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8
-Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I
---- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ
-C���q�
C�!�n� ��ƈ,�b�A�8"�MeNьn��M[(�֡�Xͤ�X+��~�ؓ��S�n�KX��i�8��>
\ No newline at end of file
+-> ssh-ed25519 91VHug v7DD5jgO2eah7KvV9shAkyFRG1zce0kKKD6U/QBIzCk
+hKwCVfnc/5wKEs2ow0etWhet/8+AT318LOnrEgTVEdw
+--- WWKcK5xf8FeUsA7atbz8r/ScBM857aXQA9mN9TdpRB8
+Ђ��/ ?K!A>��9q�mׂ���,�l�����^[pĻ�!r�mME��zʀ�O�`����q>q�^cR�K�3�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age
index f9b5098..63c109d 100644
Binary files a/nix/secrets/wg_private_vps3.age and b/nix/secrets/wg_private_vps3.age differ
diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age
index 0674d3a..44987eb 100644
Binary files a/nix/secrets/wg_private_vps4.age and b/nix/secrets/wg_private_vps4.age differ
diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age
index 5bef662..2f52122 100644
--- a/nix/secrets/wg_private_vps5.age
+++ b/nix/secrets/wg_private_vps5.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0
-/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE
---- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA
-��!�p�%~�)6-Hy*�e�����
���g�	��p�Xѷ�Ӗk�� و��m�4b��n��������x6d��e
\ No newline at end of file
+-> ssh-ed25519 vT7ExA 1SyRWnZNW7piWgD9AhV3evIk5qmlPZw3vtaYysYPKUo
+vC2skZEXjrM2HgU6nhrzqZhwVtIZWrZyaVZwUp5PE5c
+--- 46tHy1OYd8fqnjpLu+MVYrJyPaP6UdgubrsvhI7KO4A
+��J��HJ�S�v�}��+	���j��/��
���MJ��P�+~8A�웧�f�^ۄ�lj�K�AbH��5�U"@
\ No newline at end of file
diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age
index 05e6159..401e63c 100644
--- a/nix/secrets/widetom_bot_token.age
+++ b/nix/secrets/widetom_bot_token.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE
-DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA
---- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY
-~��'t/!Fb�[k"��y�f�i��ܨ�L��G��g!�FqZ�aA�3
-�i��E`v�8��<�1F�mp
x~��)gc��7R����&%U'X�DD
\ No newline at end of file
+-> ssh-ed25519 qM6TYg p+Rts+QHTmO+vPpCHEp2LTAdPF8UMq0BqoN3rAPzCgM
+g5RaqS2rCOdp8/vllNb3Revq+bfDdHQkwYKsnNRN97c
+--- Ws0i3nFuR6DNeO1RpdUvc3Irt4I3HuzBtPgxXsBaOvU
+P���n_8�P��lJ����P(�l���*=V+QX�=�R�Ob��f'l&�u�U�=�F���.���`s���
·�_�&��}�ά-<�0�_-�
\ No newline at end of file
diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age
index 374e672..34b8537 100644
Binary files a/nix/secrets/widetom_config_toml.age and b/nix/secrets/widetom_config_toml.age differ
diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_config b/secrets-git-crypt/knot_dns_acme_dns_01_key_config
new file mode 100644
index 0000000..e180250
Binary files /dev/null and b/secrets-git-crypt/knot_dns_acme_dns_01_key_config differ
diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar b/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar
new file mode 100644
index 0000000..c679314
Binary files /dev/null and b/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar differ
diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_config b/secrets-git-crypt/knot_dns_rfc2136_key_config
deleted file mode 100644
index 61b3a36..0000000
Binary files a/secrets-git-crypt/knot_dns_rfc2136_key_config and /dev/null differ
diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_envvar b/secrets-git-crypt/knot_dns_rfc2136_key_envvar
deleted file mode 100644
index 5bb8e79..0000000
Binary files a/secrets-git-crypt/knot_dns_rfc2136_key_envvar and /dev/null differ