diff --git a/minipc-config/configuration.nix b/minipc-config/configuration.nix
new file mode 100644
index 0000000..442b500
--- /dev/null
+++ b/minipc-config/configuration.nix
@@ -0,0 +1,122 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }: {
+  services.openssh.enable = true;
+  programs.vim.enable = true;
+
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "minipc"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Zurich";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the GNOME Desktop Environment.
+  services.xserver.displayManager.gdm.enable = true;
+  services.xserver.desktopManager.gnome.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "ch";
+    variant = "";
+  };
+
+  # Configure console keymap
+  console.keyMap = "sg";
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.nora = {
+    isNormalUser = true;
+    description = "nora";
+    extraGroups = [ "networkmanager" "wheel" ];
+    packages = with pkgs; [
+    #  thunderbird
+    ];
+  };
+
+  # Install firefox.
+  programs.firefox.enable = true;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #  wget
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.05"; # Did you read the comment?
+
+}
diff --git a/nix/hive.nix b/nix/hive.nix
index 3406272..92d7186 100644
--- a/nix/hive.nix
+++ b/nix/hive.nix
@@ -66,7 +66,7 @@
             wg = {
               privateIP = "10.0.0.3";
               publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0=";
-              peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" ];
+              peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" "minipc" ];
             };
             tags = [ "apps" ];
           };
@@ -92,6 +92,17 @@
             };
             tags = [ "apps" ];
           };
+          minipc = {
+            publicIPv4 = null;
+            publicIPv6 = null;
+            wg = {
+              privateIP = "10.0.2.1";
+              publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
+              peers = [ "vps3" ];
+              noEndpoint = true;
+            };
+            tags = [ "home" ];
+          };
         };
       };
 
@@ -300,4 +311,16 @@
 
       system.stateVersion = "23.11";
     };
+  minipc = { name, nodes, modulesPath, config, pkgs, lib, ... }: {
+    imports = [
+      ./modules/minipc
+      ./modules/wg-mesh
+      ./modules/nas-mount
+      ./modules/postgres
+      ./modules/immich
+      ./modules/tailscale
+    ];
+
+    system.stateVersion = "25.05";
+  };
 }
diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix
index 260523c..e3b668a 100644
--- a/nix/modules/default/default.nix
+++ b/nix/modules/default/default.nix
@@ -2,9 +2,12 @@
 let
   pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub);
   quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub);
+  networkConfig = networkingConfig."${name}";
 in
 {
-  deployment.targetHost = "${name}.infra.noratrieb.dev";
+  deployment.targetHost =
+    if networkConfig.publicIPv4 == null
+    then name else "${name}.infra.noratrieb.dev";
 
   # TODO: ensure that the rust programs have frame pointers
 
@@ -20,6 +23,8 @@ in
     nixPath = [ "nixpkgs=${nixpkgs-path}" ];
   };
 
+  nixpkgs.config.allowUnfree = true;
+
   environment.systemPackages = with pkgs; [
     vim
     wget
@@ -27,10 +32,14 @@ in
     traceroute
     dnsutils
     nftables
+    htop
   ];
 
   networking.hostName = name;
 
+  # Swiss german console tty keyboard layout
+  console.keyMap = "sg";
+
   time.timeZone = "Europe/Zurich";
   users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0n1ikUG9rYqobh7WpAyXrqZqxQoQ2zNJrFPj12gTpP nilsh@PC-Nils'' ];
 
diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix
new file mode 100644
index 0000000..a681d93
--- /dev/null
+++ b/nix/modules/immich/default.nix
@@ -0,0 +1,29 @@
+{ config, pkgs, ... }: {
+  age.secrets.immich_secrets.file = ../../secrets/immich_secrets.age;
+
+  services.immich = {
+    enable = true;
+    mediaLocation = "/mnt/nas/HEY/_Nora/immich";
+    secretsFile = config.age.secrets.immich_secrets.path;
+    host = "0.0.0.0";
+    database = {
+      enableVectors = false;
+      enableVectorChord = true;
+    };
+    openFirewall = true;
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "immich" ];
+    ensureUsers = [
+      {
+        name = "immich";
+        ensureDBOwnership = true;
+      }
+    ];
+    authentication = pkgs.lib.mkForce ''
+      #type database  DBuser  auth-method
+      local all       all     peer
+    '';
+  };
+}
diff --git a/nix/modules/minipc/default.nix b/nix/modules/minipc/default.nix
new file mode 100644
index 0000000..39adc61
--- /dev/null
+++ b/nix/modules/minipc/default.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+  imports = [ ./hardware-configuration.nix ];
+
+  networking.networkmanager.enable = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+}
diff --git a/nix/modules/minipc/hardware-configuration.nix b/nix/modules/minipc/hardware-configuration.nix
new file mode 100644
index 0000000..b8476f3
--- /dev/null
+++ b/nix/modules/minipc/hardware-configuration.nix
@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/9327fdbf-f6d2-41ae-b69f-6dbb97ab388a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/2A59-D3C9";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/db30dd66-fa2a-46a4-b81a-b0fc935db5ac"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/nix/modules/nas-mount/default.nix b/nix/modules/nas-mount/default.nix
new file mode 100644
index 0000000..0379576
--- /dev/null
+++ b/nix/modules/nas-mount/default.nix
@@ -0,0 +1,6 @@
+{ ... }: {
+  fileSystems."/mnt/nas" = {
+    device = "nas:/volume1/homes";
+    fsType = "nfs";
+  };
+}
diff --git a/nix/modules/postgres/default.nix b/nix/modules/postgres/default.nix
new file mode 100644
index 0000000..79f0e6a
--- /dev/null
+++ b/nix/modules/postgres/default.nix
@@ -0,0 +1,6 @@
+{ pkgs, ... }: {
+  config.services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_18;
+  };
+}
diff --git a/nix/modules/tailscale/default.nix b/nix/modules/tailscale/default.nix
new file mode 100644
index 0000000..9756f48
--- /dev/null
+++ b/nix/modules/tailscale/default.nix
@@ -0,0 +1,13 @@
+{ ... }: {
+  networking.nftables.enable = true;
+
+  services.tailscale = {
+    enable = true;
+    extraUpFlags = [ "--advertise-exit-node" ];
+    useRoutingFeatures = "server";
+  };
+
+  systemd.services.tailscaled.serviceConfig.Environment = [
+    "TS_DEBUG_FIREWALL_MODE=nftables"
+  ];
+}
diff --git a/nix/modules/wg-mesh/default.nix b/nix/modules/wg-mesh/default.nix
index abb904a..636dc13 100644
--- a/nix/modules/wg-mesh/default.nix
+++ b/nix/modules/wg-mesh/default.nix
@@ -35,7 +35,9 @@ in
           let peerConfig = (builtins.getAttr peer networkingConfig).wg;
           in {
             inherit (peerConfig) publicKey;
-            endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}";
+            endpoint =
+              if !(builtins.hasAttr "noEndpoint" peerConfig) || !peerConfig.noEndpoint
+              then "${peer}.infra.noratrieb.dev:${toString listenPort}" else null;
             allowedIPs = [ "${peerConfig.privateIP}/32" ];
             # sometimes there's some weirdness....??
             persistentKeepalive = 25;
diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age
index 1aba70f..72aa71e 100644
--- a/nix/secrets/backup_s3_secret.age
+++ b/nix/secrets/backup_s3_secret.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Iwzv4FA1pIES6SynmQejkarTCRc3xwqJhbPK+U197BI
-0F6drTGs14E6tf0/eDcWu2y9b9yYLXjkAkHV0hT01MQ
--> ssh-ed25519 91VHug NhInO02XlDKVDYeEk+Y4jmaAG03YO1yy50R9vnUGPWU
-0lgqjusLVxCLIQA8BSQveTNKEQf7uyEctRX+TDqipj4
--> ssh-ed25519 XzACZQ vtBUTFyr4gjqcUsn3WCYOPspjnVwL19izhKYGX4kiy4
-bW6zwWar6COr58s/U6GJZsOPicAECUJr2VQZ0nOneF0
--> ssh-ed25519 51bcvA itN8U0WXocUWmsO7Hy3a94j+aUyH83BN4iG9RK/9lCk
-Eyuawwp7+bv9/f2UOihOqFLcETsFgPS+iJRrLID6jT0
--> ssh-ed25519 vT7ExA tJoU7e9muJvOLU1a50SI7+KgbHYke/vaMn77u9gAyTw
-p0Ofeh74R/UTpaBRDITNjwwXkUs/grBnsHiSvzUxCKU
---- EsDITASaNlbxImI3s/hCMpOM6Up4UrZgez1fTJlRT1M
-:�,ߐ��� �n.�|*�#���C�a%�I���w$`�<����M_A�ZZor�i�m\�^�/#\:(8*���?��f�EV�Wm��a�~��E�5�����h����h�S�dx&‹K�ۺ�9����3\�P�2�d��_m����+\�8dyj
\ No newline at end of file
+-> ssh-ed25519 qM6TYg vf1l0o7K8ZIZGEBx2x7EzWKG7UKFQtuOhBqj/Nyq6xU
+8b0863lHC83pZZ/dIkKS3f7L+PE0I+m0f2zqtef4tuU
+-> ssh-ed25519 91VHug r5WkIt9V+TM/zupGjYH7FrIz2ZSctKh0cWixaaL8vH8
+c0J8wy8gRmgoA5vEA3AeXa8orH2amWdIgxJJDaBSjTQ
+-> ssh-ed25519 XzACZQ Z6z3pornKWMM08RxpWV4YjWs8qKF9xn8lNS6S3SpFSI
+1O4YNGfKjiY/BJDKwm1J3ZOhpPrMAiTdUHfZ305mSco
+-> ssh-ed25519 51bcvA cxBUjrD7stWdK400O/2HJM3YcKGjDGpWZt4Yq1sVdVg
+mw2xRTGFWiWI959J8GOCTp/kiV85+k2/+bYJpw95/ew
+-> ssh-ed25519 vT7ExA 8bQ4LWtqj2AodnJHcV8lEk+3EcZBfWHUVHQKcG4nCwI
+dIfddL4LTMun+EQQuPdLJNkGVysvTPm2059vQUUnEGk
+--- VIlkl9DdBWVgTiJvBK3jgdpsLgGkvv/dFfbZLEYMmT0
+����
GE=�0b�ʮ��P�*���&��^V)?�0,���vpaȧ}�p笆��Yǭ�[��;̞�@�[o
g�$xܶ�9g
+�{Y}��_��!�������(��[R��V��	U'q����C%SZ�w��TC=�5�aIJ�xF�����)J�
\ No newline at end of file
diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age
index e3d4cf9..d734f8e 100644
Binary files a/nix/secrets/caddy_s3_key_secret.age and b/nix/secrets/caddy_s3_key_secret.age differ
diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age
index 602f634..f97c5fb 100644
--- a/nix/secrets/docker_registry_password.age
+++ b/nix/secrets/docker_registry_password.age
@@ -1,7 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 8d5Jze4wRBsRqy+/ifnIMf5IhQZrn2Hs0k4/RCJoAko
-IUgnzcCHmQhsrJfUuOG5s7nl98/X+ycpr0JWQeqc1Ps
---- dNJXPA7jEVJs5yQmvcaidVnJoN5pRMbh6okQsjjDabc
-��f����<�S�s�[���-i�Mp�c�
-a5K�
-S��`U��$�EC8t^J���"
\ No newline at end of file
+-> ssh-ed25519 qM6TYg I4FIet5K6KGjWaCvKbhK7UV4LFJthRpRVDO/FoARzxw
+F/KQtQI78KlLe1jT84oxdg4UG8QuG8xAVAutzVM+kJw
+--- TEgDiZeZQL2K8Nq/xqUKrkPKSXyO5NgRbx8SkfGl62o
+(Lנ*�2����ڃj��E�D*
ȹ�^䥶IJs���y�:�7
o�Re�
\ No newline at end of file
diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age
index bf6bc35..babd21b 100644
Binary files a/nix/secrets/does_it_build_private_key.age and b/nix/secrets/does_it_build_private_key.age differ
diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age
index 2dc3b1a..8313430 100644
--- a/nix/secrets/forgejo_s3_key_secret.age
+++ b/nix/secrets/forgejo_s3_key_secret.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg oDQzYAbe3UasUjgyw2AAtcYaID6nKD+j6C2R05R8Bw0
-NnPZ81p1PafEEfYHP+MafDdrhq83aJ2NuH8iYz2Uk/Q
---- FM0robN+6H2uAp+ASaCVxlLmD6xVp5oNHHAz1BE8/+A
-6K�(6�F	Ys#+\�,\�L����:R��@�t�糆B����p
-.�6��>L�����}`Q��D�5��Q��-i��ӧF	�������1�V��
\ No newline at end of file
+-> ssh-ed25519 qM6TYg pA28Ib4AvSxoAZuGE7ZDW7CpA1GQkYm77WKNahcUFEE
+HjzZ2b/iVig4reIgU3z0O1El+tct50LS5fp+SiQB+Pk
+--- ExFpE2FxaqSuuSMtQTU+kzVz4rI2SriLKhcy0JHZXPo
+K����z)`Q=���gX��g��}�|�
��R�!�w�D6����?^4��HγMV]�`7L0T��6�1��N���d�1\��ץC~ϝ�F������
\ No newline at end of file
diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age
index 96d1e66..0da71d3 100644
Binary files a/nix/secrets/garage_secrets.age and b/nix/secrets/garage_secrets.age differ
diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age
index 1e72b6f..a3789b1 100644
--- a/nix/secrets/generic_backup_password.age
+++ b/nix/secrets/generic_backup_password.age
@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg EOynzb0Op5bNKRZ1jRaS+ZZDowhMmGYkv4u0OjWqJjE
-po5rR/gfWwB24nNa3w5VqW8o8AGEqTk40yQTTxNUfEI
--> ssh-ed25519 91VHug /NK1O4g1DWl6xNwHgkizeLJoFomY2zy/heEMChzrwWQ
-yc+fwswX7at6eEcAjJrcYhdGlJwHJa6ZFpbBhntVtsA
--> ssh-ed25519 XzACZQ RUMXGNZ6fpgmOVGKuspoOf5cgGUvjyzCmBipU64BikI
-XID++wcObepaGXScGD8KJwSHyX45UjrT2oRlh/VYGHs
--> ssh-ed25519 51bcvA TmB9sS4plGSx0ScZxYr2sWCo0UesyceyYPKWi+rVUy0
-yZrk2FbXpqb7XZoullu0JivQ97yTQLBiDv8BOox3evc
--> ssh-ed25519 vT7ExA n0kaB8lgH4OWR9l3hxlMT7tSjYZzNNlQLZJXnzHKf2Q
-kswoozAAVll/lFIG66Iikzu086tnzGF523fVnAGLFbw
---- Sa3qvrEI+FxIoDUmXRW4tEcNjdhWPw4U15Xy197wb6w
-8q�9��3lx~J�/�����V�d�hoIL{`O!76���Һ�
�6Ze.�_l���?Jr�f��4
\ No newline at end of file
+-> ssh-ed25519 qM6TYg AcP/Za8jdEONeSNcC2fm0rZg1VOMvqCreXdpd/iDKDY
+dgBlpFUcvP/n86idjIWuKsx7jX6xEWQJKY+pdGG8XVY
+-> ssh-ed25519 91VHug R4SIqnNLIoIVGIR0XnUsh3RCz+20M3pWoQGJta4y2CM
+s4O6GBECMUQpUX7yhx9CrNgedDn6yomCg8Bkke+4vu8
+-> ssh-ed25519 XzACZQ OVHPNsSR5IfrAslyKuIMAZakz+k12GUGNYsGc7e5WQ4
+IQKyRtlh7lkwIdH79IYCYod93+qAqap6rGL/VJ04Mdo
+-> ssh-ed25519 51bcvA NYivGhQwqPbjLY+Bb08ow38Rb1SBfbEotPwdDr/v7gE
+VRT0QUnImc0unH4DoEg07+PhQ0a3IsJRrJIcgDzBtjU
+-> ssh-ed25519 vT7ExA 6gW6MAGGmz7wqrE1cNgAJqhLyLBDnAkh3IFB/EJf7Us
+nhE8i7G/n/CnLTOUYsprFFjWCA+v/CmOpYRB8dAAjaE
+--- WvW+S65yf7YP+UsQH7VY1CSRqIFyNQAMBzVDCKcgk28
+���wBэ*�N�%uz>��9`?T7��L���?)�:��g��0��7޵
�L�bx��a��޷$��?��
\ No newline at end of file
diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age
index 18d4ced..7598694 100644
Binary files a/nix/secrets/grafana_admin_password.age and b/nix/secrets/grafana_admin_password.age differ
diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age
index 07af726..a0c5bde 100644
Binary files a/nix/secrets/hugochat_db_password.age and b/nix/secrets/hugochat_db_password.age differ
diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age
new file mode 100644
index 0000000..f485b4c
--- /dev/null
+++ b/nix/secrets/immich_secrets.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 yMKb8Q wDQ9QOIpJMfsxGr63x9PozZEVfy1M0XvW9MvIjBjlSo
+eAbDN8ZB52vcC1zEXKqjWUYb+vvIJVQ+f9CZmk1Jcos
+--- ZRGd4IncBO5g0BIoezzfvCxNMAVP3cgmsF8Co06u+fc
+Ui�,���W�b%d�9�:�d���q���{�
���ŽL�[M��	,�d���8{6
\ No newline at end of file
diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age
index 30a6d95..531b5e3 100644
--- a/nix/secrets/killua_env.age
+++ b/nix/secrets/killua_env.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg bPkp8HZ9R6dGxYgND2mPKC85fyDhuNyhlnobEZnGRmw
-xFKtdyfAEQyFQt8c0hKB5uB+YYVow4nEJkejcDBl5Ls
---- xSKVxbaHOvIFnprTjxfV1rv1L1jc/Y2PkB7TLbWam3E
-_T�fv@�$&k��c*s�L]�v"�F���t!�4�q�ۉ��2��7��"db8�~0亁�xyJ����`(nb]��r8䈺�{���$t��Y�qua�^W9�6�����x�)�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg 4XizqcJTul2c4nKebIgHNBlX1wfNM6ZdJIi+uD4STCI
+wLKLC8dfC1jVWNLQR2pmJM3+yvlILUkn6be+x/l1Se4
+--- kgeOkLbbLqXAK8urZUOVhqPKn4AWulo4hGbOkgr+fOU
+����B���S�XN<L��㵆|sϮ�;Á�v�|��p`9�"��h��U�i�n8����d�U�Y�������oPuV��Jg��7�H)#�G
+�¿�u
\ No newline at end of file
diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age
index 2c2ee27..75520f9 100644
Binary files a/nix/secrets/loki_env.age and b/nix/secrets/loki_env.age differ
diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age
index b23894b..180971c 100644
--- a/nix/secrets/minio_env_file.age
+++ b/nix/secrets/minio_env_file.age
@@ -1,9 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg LSDtwlm9BBqnpzsXoeCQnJ7YImkiMJvqfet0MROaBFA
-h/efW4ApyMTnp/p+3tUa8RaMreI00/T5Q4Gh71lFeTk
--> ssh-ed25519 XzACZQ of8qdZPKfTtCKNMA+eHgX+WijYZHrHrzq0alH1mTJyE
-rVW21YZw3kbe1TCQj/Ch1krrJt0o6PXThAV/eUbY8B8
---- gWUT/+evFTR4ARdKZK01i8qgDCjt/EKnpKCAS5fCt1w
-�(H
��At_ï
-5�o��JV.D̀�#lG��u#ɉ�K!-�T~"ksҖ�o��ǣ���ip��1>
-�𗣫iD�6���y�POia���$��/�]�:dk]�A3
\ No newline at end of file
+-> ssh-ed25519 qM6TYg bv3MPWeJTJj/lrwKDBAv4T+OrRdD3ViwX8HLCmCKghE
+MGP87vT3Rmf+aqhMMXyZIs4OeMkS+uc+je6Zkod0hrY
+-> ssh-ed25519 XzACZQ cUkJyWCO6HkdxCqSnv9onmEUhEQY+Pj4seR/lH8KSAg
+qTUgF/iT2IoJf7UOleaayWbkJbn5dgSVHKctKWnqfIw
+--- BOvXie+k6OIewLDVF+Rx2YzkpytshqkFGCL/uYgljNQ
+�}�p��SS� �y*Sp*>�ݖ�
�u��:0b��:=)
t���S\HN�b��9_m��ٝ�j��{��)��(�<�3&Ә`�R�	��[�{aܓ��!���
\ No newline at end of file
diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age
index 29aa8ee..cc08707 100644
--- a/nix/secrets/openolat_db_password.age
+++ b/nix/secrets/openolat_db_password.age
@@ -1,5 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg ONh+83MLxToMgANja31F4qVxE47NVjXat06RLj4qG0E
-9vRKxWSdW2Bvc/KsWqbbi5mGhLekViT87WhGnPf5ZUM
---- m/MMUEWaa8RewCOG6fOBQpu8M+pgFMWUs67NQcnI4c8
-J����%ϻ��lN�B�י��#�^�@��fT���r�xt=��If&��I�C������l@�����	�/��D8c��{M�R���3�9擻���ն3�`���;
���$h������ھ�����>�sO��핅!��U}
\ No newline at end of file
+-> ssh-ed25519 qM6TYg 7Nt/x/IT9ofXjrRRV7coT6nrrCSOCkqUqflm1oXLXTk
+BafDaEiVpuT3SDVXvuD31WIKe0QlvAGoyn4MzUm9LfQ
+--- BsY9/meRTzX5oCBD+w9f+2TO/TdPD936xOjgtQMWuag
+RN|�-�
+�[�6���q
+r�7��d% ���[3K`�I{�!�u5����ƃn��ӺMvo�d���z A��~�������ǍT�	Q���G�h?N��w/YB�Qn�_�`�����_��,��Z����F�V�8yw�
\ No newline at end of file
diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age
index 58f14dc..e96d5b8 100644
--- a/nix/secrets/pyroscope_s3_secret.age
+++ b/nix/secrets/pyroscope_s3_secret.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ m7q/k7PLJpNDFEFxm1SNobF2abWhncqxWri+CbVqkCc
-3NB/uTmOdkPH3N+kZrSep7u0A57KpQzI4tlzyT6Z5rg
---- cI9WvpISFVi7fXb5pcNgyu3rH+4L8o5dZUnAxhQ1x4Y
-W��j;�lx��8��mŠ�q��߮���X�+��MJSzա�4��`�=�8��$9`�}�w�~�ډשa�6�t۫�Jtu"|p`T�b�("�j�:��I�5P��rS�d3�%���[�����ok�!g��c\��6s�����d�5���2%j�
\ No newline at end of file
+-> ssh-ed25519 XzACZQ ver7uyV552D1F9hTxFYb61szNWPeIxsTr4M6RWZH1DY
+BF2bL0xu6rAx21EQkGF8KNc/4+jqo/0E6O89vZ8WhfQ
+--- b3peeNoZ70tv7mAtQokJ8IUgE6nTGPvUkSf8p6jika8
+��<E���7L{W��J����a��O	��o��L��֡[�Xd�-!0���4U��?��C�y��z1l
��e��1�e!_I�P��2Ce���1��W�z���VR}�kA�V�n���C��b�)%̪���R��w��hA��wA6�6Z����kql��gz=�K��
\ No newline at end of file
diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age
index a2098a6..dce3ea8 100644
Binary files a/nix/secrets/registry_htpasswd.age and b/nix/secrets/registry_htpasswd.age differ
diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age
index 11c6e78..5649f2f 100644
--- a/nix/secrets/registry_s3_key_secret.age
+++ b/nix/secrets/registry_s3_key_secret.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg zUespYByALhutVeTKDYRCXpskuwotOzfTjWCVtGcXTg
-LxTqOV8sk6zOQv1eAIvSfUoeCfpus5lB4VwQV7joMks
---- bCKKLMK0Alw89Sh6HB4EW76P29aNUC5btlNFHDBTsQk
-��4m��XA/��u ��U������}�h�z��<�5f2�<���j��YO=FW�IW%�%8f~`�� vl�@:1ľ���k�Ywa��L:
\����:�G㚢�H�٭r��kb�Ebt/N}v-x���M�X����ܿ�t�G�Rpt�ǭ�.�h�bԓ8����x5L��F"qaG<x�r
\ No newline at end of file
+-> ssh-ed25519 qM6TYg /73Z7R1RE4lfUfVSeJqZjbGA5yjygfrxKi5iuMMxrno
+tsbPaW/x9HFT/tG+5F3n/3SsuhmswVIfHVLNRAzdiP0
+--- jHapfTz6oq7gdrgBn+XNQdMZ67DbrFPBY6KKzb+wfjE
+���U1�r(R�MN8��Ol�$���DN�u����������3�Jo��n��BOc%�AT�~RV##�[����;3*����6�/�5gD�]���2��������%�f�)fxv
�
+��]��h��:�d�{_O�~�2��t�i�z28�� �W>��BT(a�%�������͉l`�\�
\ No newline at end of file
diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age
index bce2196..c968ff0 100644
Binary files a/nix/secrets/restic_backup.age and b/nix/secrets/restic_backup.age differ
diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age
index 17f25f5..e64d1a4 100644
Binary files a/nix/secrets/s3_mc_admin_client.age and b/nix/secrets/s3_mc_admin_client.age differ
diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index 287aa86..22ecaff 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -6,6 +6,7 @@ let
   vps3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvupo7d9YMZw56qhjB+tZPijxiG1dKChLpkOWZN0Y7C";
   vps4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpoLgBTWj1BcNxXVdM26jDBZl+BCtUTj20Wv4sZdCHz";
   vps5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWbIznvWQSqRF1E9Gv9y7JXMy3LZxMAWj6K0Nq91kyZ";
+  minipc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINApZRrvK4RC1SU5m4OLbill7HZYPQtuvh/m/AB4q5dG";
 in
 {
   "widetom_bot_token.age".publicKeys = [ vps1 ];
@@ -30,6 +31,7 @@ in
   "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
   "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
+  "immich_secrets.age".publicKeys = [ minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];
@@ -37,4 +39,5 @@ in
   "wg_private_vps3.age".publicKeys = [ vps3 ];
   "wg_private_vps4.age".publicKeys = [ vps4 ];
   "wg_private_vps5.age".publicKeys = [ vps5 ];
+  "wg_private_minipc.age".publicKeys = [ minipc ];
 }
diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age
index 255fdc3..50ec7d6 100644
Binary files a/nix/secrets/upload_files_s3_secret.age and b/nix/secrets/upload_files_s3_secret.age differ
diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age
index c42418f..96b92cb 100644
Binary files a/nix/secrets/website_s3_key_write.age and b/nix/secrets/website_s3_key_write.age differ
diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age
index 8d422bf..76fd998 100644
--- a/nix/secrets/wg_private_dns1.age
+++ b/nix/secrets/wg_private_dns1.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg T16scfWokKj/4TaHvplWuIdHCs/oR4t3V9x4hFo9yhU
-h8RoAXndXCwUBskJlJTLWoXapWMUTF0yPnqUV9u7qt8
---- qGJTnOXdnz8D9eA8AKtYarVa1l75x10SqjhsKchfQ+E
-a�ҿ�/���}�=7_�r^�rԕ?�y���"o�ؘ;U`*���(��Z���tz7�����s���，$^k`
\ No newline at end of file
+-> ssh-ed25519 LZU5Eg 3Bde2BfrG8qdngKCIg4xeXnkqqdrtcAZfW0REYwkmWc
+0Js204/ZpkBK9mDZwhYOY1IGW8yA5L/iMAmrZR1r940
+--- V7Xj3KkcueKzPhl6wjk12zRrEmFPMpUcQd799p0Dqr4
+�~�TO80
}	��Q.���{��q6��Qu��׆�%N�6��Ќ�a�|��41ր�Z�Հ�;D�z�*�^���ѻ
\ No newline at end of file
diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age
index cfca638..1c04d1b 100644
--- a/nix/secrets/wg_private_dns2.age
+++ b/nix/secrets/wg_private_dns2.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 5bWSnQ eiSLsSWrjQldff9ZbhjhrvGgNGWxmxKu1JfsWmjo0Qg
-cCLcVTC9hzN79cOMOuuOMo5VpwlBKraqxqeQuvVzqqU
---- bgLRe7t+KD2ehc2gAp4RERJ3nN5pGLA04L06KHVeQvw
-�ns�4�!nt3�ܻ�:#�i��?� �J�ʷ	��'1d!���? $/�{u�X���6e�rL.��]���[
\ No newline at end of file
+-> ssh-ed25519 5bWSnQ V/5bLxQqdZEF9tgSPGgm7nEpnyNGScgSVfjS3KOvxA0
+oKHKz5IIZNdsWhBCTCqvHVLAJGC+LEC7RuMgQHI9Wkk
+--- 71jtq96kfCYsB8UGSccc2F6qWtj7DO658MeVWSD+L64
+U��X�d2�C��lEV~Fg��i����p��%�N6�
+��t%͢Ż{LZ�@��B9$�{�g&P�BHQ�ہ%4
\ No newline at end of file
diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age
new file mode 100644
index 0000000..b5f0470
--- /dev/null
+++ b/nix/secrets/wg_private_minipc.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 yMKb8Q o1qLnZBL+o8wrQYM6bo01DsCKVmA/NCzLe84aO4NSlI
+iEnVZGcr4wyMN5b5f9Qzt1lmycZVe+km/8ApNvq6ME4
+--- MiV3GRLz1rEy283zGsbTtrAbQgmdW0pobJE83BmPrmU
+����G^��%L��j,��sC��IC&@�>#�t�$.2��R�+p.��4��
���k�e���^+�sCg��n-�z�{
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age
index ff02844..c186827 100644
Binary files a/nix/secrets/wg_private_vps1.age and b/nix/secrets/wg_private_vps1.age differ
diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age
index aa84c78..7b8faa9 100644
Binary files a/nix/secrets/wg_private_vps2.age and b/nix/secrets/wg_private_vps2.age differ
diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age
index a874cea..50d20a4 100644
--- a/nix/secrets/wg_private_vps3.age
+++ b/nix/secrets/wg_private_vps3.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ EsFwUOjtcoWVd5gJxu0vAfcXxGZovBBKcGuin+TE6kY
-51vzn9SvfX8WCDe8f5dtblAhFykUIxLkvsNK6XjMSuQ
---- VTYLeqYga9RKPLxjB6JotAMC4StSGh9PNNnG3+kq6vs
-�]#A ��*R1*�{TM��ڍíq2~pGJ����#��R�W��rW��C�
�ҷ��#�����	�3^͗�
\ No newline at end of file
+-> ssh-ed25519 XzACZQ JO+9ZDfv/rjpGHSL8WBm286V164a2CwppavSZ4+L+Ws
+hqfAaluHnH5XHzI/oc71q7HlKioHMAbKP9cg9wRJ6kw
+--- maAUQCFkFuMs55Yr6wX+2q+VUM/c3h8rNb6u+VrJnEM
+)��W�F���j�
+��
}��,�����E\G����&x��@�,��[r+<��v��w���,�lt�F�t�.�O�j
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age
index 81426e6..b39120f 100644
--- a/nix/secrets/wg_private_vps4.age
+++ b/nix/secrets/wg_private_vps4.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 51bcvA 14yVvUnmbYRhz0jbTEsj5bEZnJleq6ZT3NgOqVybzFk
-F0cCQQhghlR3rHDEiBwIWdBXv6Cfac+JL9MArEXOHuY
---- bB7RaiP/rNyTpjpoa2qXmZw7RCa73b2FEy2WN+CTpfk
-M�):�8&�=$�8.��U����7�~�j��]��QHC$^"˿��
-W�C�Z#��u�A��!d��Xpx"�1�c
\ No newline at end of file
+-> ssh-ed25519 51bcvA CkaPksfSDKWRMaL4FV7vI4VZ2c8Fd2RlyRW8DEkOkgM
+NrvBSSPDrwNL+YKgBTHqQuLhKgGy1+/H51JTsA70Dww
+--- 6qkEageKcIweJ7wWcqb2HZp9zJNTyLcoQ+Gv/+O6CJA
+(��,�����zf��D8��)��]��|P+��a���
�{n���$ �A�x"���]������K����
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age
index 6f2383b..3f4dbff 100644
Binary files a/nix/secrets/wg_private_vps5.age and b/nix/secrets/wg_private_vps5.age differ
diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age
index 1c91ca7..366d1b9 100644
Binary files a/nix/secrets/widetom_bot_token.age and b/nix/secrets/widetom_bot_token.age differ
diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age
index cf9ff8d..fea9a10 100644
Binary files a/nix/secrets/widetom_config_toml.age and b/nix/secrets/widetom_config_toml.age differ
diff --git a/secrets-git-crypt/immich_secrets b/secrets-git-crypt/immich_secrets
new file mode 100644
index 0000000..8ad329d
Binary files /dev/null and b/secrets-git-crypt/immich_secrets differ
diff --git a/secrets-git-crypt/wg_private_minipc b/secrets-git-crypt/wg_private_minipc
new file mode 100644
index 0000000..73a8795
Binary files /dev/null and b/secrets-git-crypt/wg_private_minipc differ