diff --git a/nix/deploy/smoke-tests.sh b/nix/deploy/smoke-tests.sh
index d2a939c..5054a61 100755
--- a/nix/deploy/smoke-tests.sh
+++ b/nix/deploy/smoke-tests.sh
@@ -4,28 +4,20 @@
 
 set -eux
 
-check_single_dig_answer() {
-    dns="$1"
-    type="$2"
-    host="$3"
-    grep="$4"
-
-    dig "@$dns.infra.noratrieb.dev" "$type" "$host" +noall +answer | grep "$grep"
-}
-
 check_dig_answer() {
     type="$1"
     host="$2"
     grep="$3"
 
-    check_single_dig_answer "dns1" "$type" "$host" "$grep"
-    check_single_dig_answer "dns2" "$type" "$host" "$grep"
+    dig @dns1.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
+    dig @dns2.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
+
 }
 
 # Check DNS name servers
 check_dig_answer A "dns1.infra.noratrieb.dev" "154.38.163.74"
 
-check_single_dig_answer "dns1" A "nilstrieb.dev" "161.97.165.1"
+check_dig_answer A "nilstrieb.dev" "161.97.165.1"
 
 # Check the NS records. The trailing dot matters!
 check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev."
diff --git a/nix/hive.nix b/nix/hive.nix
index 347f10a..eee6101 100644
--- a/nix/hive.nix
+++ b/nix/hive.nix
@@ -24,7 +24,7 @@
             wg = {
               privateIP = "10.0.1.1";
               publicKey = "7jy2q93xYBHG5yKqLmNuMWSuFMnUGWXVuKQ1yMmxoV4=";
-              peers = [ "minipc" "vps3" "vps5" ];
+              peers = [ "vps3" ];
             };
             tags = [ "dns" ];
           };
@@ -88,7 +88,7 @@
             wg = {
               privateIP = "10.0.0.5";
               publicKey = "r1cwt63fcOR+FTqMTUpZdK4/MxpalkDYRHXyy7osWUk=";
-              peers = [ "dns1" "vps1" "vps2" "vps3" "vps4" ];
+              peers = [ "vps1" "vps2" "vps3" "vps4" ];
             };
             tags = [ "apps" ];
           };
@@ -98,7 +98,7 @@
             wg = {
               privateIP = "10.0.2.1";
               publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
-              peers = [ "dns1" "vps3" ];
+              peers = [ "vps3" ];
               noEndpoint = true;
             };
             tags = [ "home" ];
@@ -320,9 +320,7 @@
       ./modules/immich
       ./modules/tailscale
       ./modules/paperless
-      ./modules/home-assistant
       ./modules/caddy-base
-      ./modules/caddy-acme-dns
     ];
 
     system.stateVersion = "25.05";
diff --git a/nix/modules/caddy-acme-dns/default.nix b/nix/modules/caddy-acme-dns/default.nix
deleted file mode 100644
index e5455af..0000000
--- a/nix/modules/caddy-acme-dns/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, ... }: {
-  age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
-  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
-
-  services.caddy.globalConfig = ''
-    acme_dns rfc2136 {
-      key_name "acme-dns-01"
-      key_alg "hmac-sha256"
-      key "{$CADDY_DNS_RFC2136_KEY}"
-      server "dns1.local:53"
-    }
-  '';
-}
diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix
index c77a7d5..6356e88 100644
--- a/nix/modules/caddy-base/default.nix
+++ b/nix/modules/caddy-base/default.nix
@@ -4,9 +4,8 @@ let
     plugins = [
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
-      "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
-    hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
+    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
   };
 in
 {
@@ -32,7 +31,6 @@ in
       format json
     '';
     globalConfig = ''
-      email tls@noratrieb.dev
       auto_https disable_redirects
 
       servers {
diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix
index 207821c..e4c1b0a 100644
--- a/nix/modules/caddy/default.nix
+++ b/nix/modules/caddy/default.nix
@@ -7,6 +7,9 @@
   systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
   services.caddy = {
     globalConfig = ''
+      email tls@noratrieb.dev
+      auto_https disable_redirects
+
       storage s3 {
         host "localhost:3900"
         bucket "caddy-store"
@@ -15,6 +18,10 @@
 
         insecure true
       }
+
+      servers {
+        metrics
+      }
     '';
     virtualHosts = {
       "http://" = {
diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix
index 3970d45..815eed0 100644
--- a/nix/modules/dns/default.nix
+++ b/nix/modules/dns/default.nix
@@ -1,12 +1,6 @@
-{ pkgs, lib, networkingConfig, config, name, ... }:
+{ pkgs, lib, networkingConfig, ... }:
 let metricsPort = 9433; in
 {
-  age.secrets.knot_dns_acme_dns_01_key_config = {
-    file =
-      ../../secrets/knot_dns_acme_dns_01_key_config.age;
-    owner = "knot";
-  };
-
   # get the package for the debugging tools
   environment.systemPackages = with pkgs; [ knot-dns ];
 
@@ -27,57 +21,28 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
-    settings = {
-      server.listen = [ "0.0.0.0@53" "::@53" ];
-      acl = [
-        {
-          id = "update_acl";
-          address = "10.0.0.0/16";
-          key = "acme-dns-01";
-          action = "update";
-          update-type = [ "TXT" ];
-        }
-      ];
-      zone = [
-        {
-          domain = "noratrieb.dev";
-          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
-        }
+    settingsFile = pkgs.writeTextFile {
+      name = "knot.conf";
+      text = ''
+        server:
+            listen: 0.0.0.0@53
+            listen: ::@53
 
-      ] ++ (if name == "dns1" then [
-        {
-          domain = "nilstrieb.dev";
-          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
-        }
-        {
-          domain = "noratrieb-acme-delegate.dev";
-          storage = "/var/lib/knot/zones/";
-          file = "noratrieb-acme-delegate.dev.zone";
-          acl = "update_acl";
-        }
-      ] else [ ]);
-      log = [{
-        target = "syslog";
-        any = "info";
-      }];
+        zone:
+          - domain: noratrieb.dev
+            storage: /var/lib/knot/zones/
+            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+          - domain: nilstrieb.dev
+            storage: /var/lib/knot/zones/
+            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+        log:
+          - target: syslog
+            any: info
+      '';
     };
   };
 
-  systemd.services.knot.preStart =
-    lib.mkIf (name == "dns1")
-      (lib.getExe
-        (pkgs.writeShellApplication {
-          name = "knot-prestart.sh";
-          text = ''
-            mkdir -p /var/lib/knot/zones/
-            cp ${
-              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
-            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
-          '';
-        }));
-
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;
diff --git a/nix/modules/dns/nilstrieb.dev.nix b/nix/modules/dns/nilstrieb.dev.nix
index 528fc83..c013f4f 100644
--- a/nix/modules/dns/nilstrieb.dev.nix
+++ b/nix/modules/dns/nilstrieb.dev.nix
@@ -29,11 +29,14 @@ let
       ];
 
       NS = [
-        "ns.nilstrieb.dev."
+        "ns1.nilstrieb.dev."
+        "ns2.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
+        ns1 = dns1;
+        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 
diff --git a/nix/modules/dns/noratrieb-acme-delegate.dev.nix b/nix/modules/dns/noratrieb-acme-delegate.dev.nix
deleted file mode 100644
index cf4308d..0000000
--- a/nix/modules/dns/noratrieb-acme-delegate.dev.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-# https://github.com/nix-community/dns.nix
-{ pkgs, lib, networkingConfig, ... }:
-let
-  data = with pkgs.nix-dns.lib.combinators;
-    let
-      hour1 = 3600;
-      hostsToDns = builtins.mapAttrs
-        (name: { publicIPv4, publicIPv6, ... }:
-          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
-          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
-        networkingConfig;
-    in
-    with hostsToDns;
-    {
-      TTL = hour1;
-      SOA = {
-        nameServer = "ns.noratrieb-acme-delegate.dev.";
-        adminEmail = "void@noratrieb.dev";
-        serial = 2024072601;
-      };
-
-      CAA = [
-        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
-        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
-      ];
-
-      NS = [
-        "ns.noratrieb-acme-delegate.dev."
-      ];
-
-      subdomains = {
-        ns = dns1;
-      };
-    };
-in
-pkgs.writeTextFile {
-  name = "noratrieb-acme-delegate.dev.zone";
-  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
-}
diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix
index 3edc5a5..c753f0f 100644
--- a/nix/modules/dns/noratrieb.dev.nix
+++ b/nix/modules/dns/noratrieb.dev.nix
@@ -54,9 +54,6 @@ let
         ns1 = dns1;
         ns2 = dns2;
 
-        # --- ACME setup for caddy
-        _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ];
-
         # --- website stuff
         blog = vps1;
         www = vps1;
@@ -97,15 +94,10 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = builtins.listToAttrs (builtins.map
-          (name: {
-            inherit name;
-            value = minipc // {
-              subdomains = {
-                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
-              };
-            };
-          }) [ "immich" "paperless" "home-assistant" ]);
+        internal.subdomains = {
+          immich = minipc;
+          paperless = minipc;
+        };
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];
diff --git a/nix/modules/home-assistant/default.nix b/nix/modules/home-assistant/default.nix
deleted file mode 100644
index 15fe44e..0000000
--- a/nix/modules/home-assistant/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ config, ... }: {
-  services.home-assistant = {
-    enable = true;
-    extraComponents = [
-      # Recommended for fast zlib compression
-      # https://www.home-assistant.io/integrations/isal
-      "isal"
-      "fronius"
-      "integration"
-    ];
-    config = {
-      default_config = { };
-      http = {
-        use_x_forwarded_for = true;
-        trusted_proxies = [ "::1" ];
-      };
-    };
-  };
-
-  services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
-    extraConfig = ''
-      tls {
-        dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
-      }
-      reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
-    '';
-  };
-}
diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix
index 97213e6..9d3b52c 100644
--- a/nix/modules/immich/default.nix
+++ b/nix/modules/immich/default.nix
@@ -13,6 +13,7 @@
     environment = {
       IMMICH_TELEMETRY_INCLUDE = "all";
     };
+    openFirewall = true;
   };
 
   services.postgresql = {
@@ -29,14 +30,5 @@
     '';
   };
 
-  services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
-    extraConfig = ''
-      tls {
-        dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
-      }
-      reverse_proxy * localhost:${builtins.toString config.services.immich.port}
-    '';
-  };
-
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
 }
diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix
index bfb6414..5cb60cb 100644
--- a/nix/modules/paperless/default.nix
+++ b/nix/modules/paperless/default.nix
@@ -12,7 +12,6 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       PAPERLESS_TIME_ZONE = "Europe/Zurich";
       PAPERLESS_ADMIN_USER = "nora";
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
-      PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
     };
     exporter = {
       enable = true;
@@ -21,12 +20,5 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
     };
   };
 
-  services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
-    extraConfig = ''
-      tls {
-        dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
-      }
-      reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
-    '';
-  };
+  networking.firewall.allowedTCPPorts = [ 8010 ];
 }
diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age
index c8828d3..af72302 100644
Binary files a/nix/secrets/backup_s3_secret.age and b/nix/secrets/backup_s3_secret.age differ
diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age
index e0a5138..fb3f1f4 100644
Binary files a/nix/secrets/caddy_s3_key_secret.age and b/nix/secrets/caddy_s3_key_secret.age differ
diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age
index 71e7bdd..83a4bc9 100644
--- a/nix/secrets/docker_registry_password.age
+++ b/nix/secrets/docker_registry_password.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg UVJ4EkIz+aHGJHW/UWVOod/NSUrmLL4pNvK60KPWxzE
-pQ3h/qZ8XfwCqb2QshUxuLs6F+YddX2QSp8MLQnxBR0
---- gox0jFVFKNb46LsZ/aOEpkxCWnx8sTe7Rvv+tdzkvq8
-��iB�<'+�̽����L�Yd�6c�6B�g�]UG􊃻N��c�]4Y<
\ No newline at end of file
+-> ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw
+PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM
+--- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic
+�|�H��LX�
Z��'v2"���<�K#9�$T���	�_��
�}^ao�4�
\ No newline at end of file
diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age
index cc6be88..81b84bd 100644
Binary files a/nix/secrets/does_it_build_private_key.age and b/nix/secrets/does_it_build_private_key.age differ
diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age
index 0a2c88c..ae631cc 100644
--- a/nix/secrets/forgejo_s3_key_secret.age
+++ b/nix/secrets/forgejo_s3_key_secret.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg nMMawatvWfcdHyOTJu5UBTCZbB8MDbvdd5XaSCR9ARQ
-iUI0FSTyjhx0xdfUn3ikxR3dcW8GQH1Flu2kwlkP1HA
---- Fb7A45fAQY9VJN6Er23jTuEMvm5eDHJflTiiNFB4dYs
-�.�)!�$Y�Q�ώ$�9i3�3b_z
-��TR˲q�hs|[����F(�m��I���q1z�^&�&	'��(�g׏6��Fվ�^.�j]��D�i
M5�q�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k
+qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk
+--- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY
+��"�.O��
J���7���6���~ԥS��H����-�4�0���[vA�D���=���^T��y"@A��@�,������P��|�q!؊M
\ No newline at end of file
diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age
index 9d822f6..7f33bee 100644
--- a/nix/secrets/garage_secrets.age
+++ b/nix/secrets/garage_secrets.age
@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg GE45kAK/hBIkfDcJ9T5KSf2ZlRuznfyCXNgyiROKSho
-07IiEZYSR+BoaHsNOMfpTB7KvFI5erLqiLkxHeghNA0
--> ssh-ed25519 91VHug I5YszjRHyHEIPSO9ATRx/hgSiBnq6CmQeCiEWyThKQY
-6cyqqeR7jyvWCC3yfxqVk9YtjhR8LmUISxoScoAl0Ac
--> ssh-ed25519 XzACZQ qqZvo9xbK4rQRDzCsyKD0NVYhk3960UW5FRfavIoI24
-AjsMDfEzmGMCGekIAHPXkN2RRZHC4ZjACo3cNGx/iqc
--> ssh-ed25519 51bcvA mvDGI9jBis304qlduEX3kDb2Y5E2fiNL70i110hdDUo
-OJl67yJ26ZZVLgobEbh63J9kku+whdmgawpPrlyAgFs
--> ssh-ed25519 vT7ExA NgHlD7tjMUF2kIeMmHyE/qsZI9VzIkg4drUCDj0GABs
-kxwMjB9CBd5IRlh2SBHIQJSjCjARLMwOg40DSdbDO3k
---- hzXf515cyiJHjcIAg+kmCeZ4Hy2GI/b21F5O+Pq7r5A
-�=�)�BT�֢��(�_�_��
�2�{�E��d��ι��	w�MS�Vs9T�j_+�q��}���f��5�1�޿�^�>Q�F�g�^Qvn�Z�͔d�Θ��l=��YȬ�پ\!�F�4v��t����h���!�A�m�%'��n���<W�wi�ghmڬ�/'��Ⴗ��Y|AC����`zX���׻-�3�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg jJSJ3eWbmwKqaqaH0nCAfJh6zG0wQ8NHYLch6MjVFiM
+nzMK9xuag1meleJVM6aNGK3Uj+LDiklWtAbEsEVaZrE
+-> ssh-ed25519 91VHug lgN/V9/OYL6qvoDo54bMwkRjgJx72ER4rwCyBLE7JBI
+KyqOc40/5iNubbk3vuF6e5qypscUNWGXSO+TvnE60Ug
+-> ssh-ed25519 XzACZQ MH28c1eBXCHnnmWeEiKbB7qnqIWb11ciYZopRwK1lzw
+kHr78ot/c9JS7L+uWk5XhCwZ8y41cEkCfjiv5ITHXpI
+-> ssh-ed25519 51bcvA JbXk+iiHx+TkrosjfP28iGjQQ3lNFlo6L7ebmOmOJzs
+KQH6qVfm+48U6TzaomwPQJP3Xs8JCX1JDuVNu6+djUM
+-> ssh-ed25519 vT7ExA W/tG8Jk982TcvMP+ZVY1Jgtk/0ykGlKT471OloV68G8
+9/ieFx+uf+zLUKfWtIYUiEyHHkwYLOhX8FtZP6oup/Y
+--- Nr1pkXNHv0+lBg4J3QnK4f5kM3ZOWjwTCwjUYNMRABk
+�UsI�	lNdL����^���q/P�D\���%���s4�GC��Ϻքag����|-�f�+,���|vpj�]��.�L���=����U�����_?�bG&Yw����|f~4qR��*�Lx�$ڋ�Y�P�rE����N,�jW���z��#K��@̧�#7�"&�Ξ=��Gx��N�.�n�O7�c}fczT
\ No newline at end of file
diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age
index 504b519..5dd7134 100644
--- a/nix/secrets/generic_backup_password.age
+++ b/nix/secrets/generic_backup_password.age
@@ -1,14 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg NaiDsYFYQAZuJinDZ60OiPEZMsnmPOggyW/lKwLPWR0
-vLZKSA9iaFIdOjE7K9n7vtlF8UKCS+AKuSS3O8jlfbw
--> ssh-ed25519 91VHug O5htAKX31xr2plcilbKy/AZ0xtyIDekjtr6GYeIXcns
-aK43EBfhqDCEtkB/1RephM7PK0tB0xHjS+GIDTFw2A8
--> ssh-ed25519 XzACZQ NRs3M2HrY9vZ94a+MccGZisn/cEyY9lg6l/ZiOaECgY
-aZ84NrESzU+yhsxXk+XiHEFJ+5/8B5wmFZVhPU5K8p4
--> ssh-ed25519 51bcvA 74NdYVJKbbDBuhxqUUAgx4GpGbKFzL0/+KRXJKoxh0M
-nXjmvzBfiq5Y7EUeUM5aoEColQa80JUCMwaLX36Scss
--> ssh-ed25519 vT7ExA buG7ZHfGrdKqobgouN2DHkOointeeSo3LbQ5TbXxMT4
-v+CfO/1CDfu2d/Oy7LX1S/tPa25zaY6rWafpQB+yzdo
---- 1urbgjL5IrFAQbt9FPGt+Hv5hJ99uiFaC3K3G4X5JSQ
-?
-A�>�$-��>6������������蝠���>/RZs�Y�ɮ4�5�ѺR}��a�9S�Xw����R9�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU
+e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg
+-> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4
+QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ
+-> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk
+LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE
+-> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo
+yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA
+-> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs
+acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8
+--- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI
+{�đ��q.忳U�َcO��)��|¥�,+^]���?��PĻ$3m�4�Ǧ|�c��)�.R6@r�]���
\ No newline at end of file
diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age
index a8f2696..53e26d0 100644
--- a/nix/secrets/grafana_admin_password.age
+++ b/nix/secrets/grafana_admin_password.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ io2AGztJepz/HVtDyyO5pplYumC+Ym95zUvjvzz3Twc
-mmJtTOkG/7HnUVKmpEMhRER1WhCbPMqsS09d3V76qr8
---- yquBIN4NRMcxCzpDb2N1MTf3d4S0riWumE+fVIkwx8U
-�ǽŻt^z��Ϊ#t8��	#U�&�B#��pܐ9�No�R���O��٥']��Ϥ�����9��~EeFҺc�I�����d5�,�]�	]�k����r�
\ No newline at end of file
+-> ssh-ed25519 XzACZQ jIs+NClvISjvJSkJlkkGX5ZJzFge/1Nj2Wi4en/viRw
+H1sfzg7cCWmCVg9GpFF5QNVVJjllxbmt7wBETRfM8hw
+--- hOo2vi9EjLwAa8PQzJGdzUZ/VIzfhM7TnPsQ+OYJzcY
+%�f>8������Àuw�[	�l*�V(u�2��)e&����X�)
+Ƽ�Q�"�X|iO���,'��;��Itʽo�Z�՝k���E)��I� �0v/��?
\ No newline at end of file
diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age
index 82504b1..fec59be 100644
--- a/nix/secrets/hugochat_db_password.age
+++ b/nix/secrets/hugochat_db_password.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg kzaYC7OTJ7pOil0/e+q6+MwCBhyCu+O8pkRt0LtuzVY
-9VM4lmMvJqaHB3WfzbzBfniO8oTHgUz1vZzK2c0TfTw
---- PPkKzcyL6DezZfRPUvIVjn2gjT5AFtYRbXhabPIIq/E
-��"�u5�s��x�[�n��(���+�yGc㦂����=}��:�#��g@L7�P�"7�"�/����Vĥ�J�=���K���F6����l��6!�"�ᡋ�X�">��?���m)�v>��hC'W���KG*�b��i��=��R?sK�1j��Uw
\ No newline at end of file
+-> ssh-ed25519 qM6TYg o9FlX/G7SotMq0hWJWsBnutiOuMu9pX6iY7w6xODUQA
+Q/AZ3tKlwi5rEV8mQSQF/7uBxy0RVEzajdKZuVGLzvg
+--- FujHNw9RfcGuMYfpj5C9hoWs5iYaj+x7tDqJ74lqVsg
+��vP�a�@���Q�R .�@,�@;��{�xtf�Ms��DF�#�u#,o�!$C5Сk�J����O��b�Ү��<i��wO�e�^b6�	f��`?��s�
��ʕahm���`�_k1��>�0�$
k�⬑7; ��M
��A���Ӂ��5�
\ No newline at end of file
diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age
index 3ecb67a..08c97e4 100644
--- a/nix/secrets/immich_secrets.age
+++ b/nix/secrets/immich_secrets.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q ttfca/hqpWJm9dRJYWBXj9Of1rdWg2NbgfsAJFMUQTY
-qokH5RFlOmZMETgkqlWhcx41EtXtN2IxKpvP/WGz6mk
---- vn3HoHqGBa02fSSeO8LGjhGb/7JK/tN/0Zh1Pjz25dY
-]?m����D�C:g��_klU�G���Q����J+��g3�u�9FH"���'g�����d���߃
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY
+0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0
+--- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg
+*c��lH��x�Ah�5H(d��U�'�nҘ;M.Vx}���"�f� ����9��f�~Jv�9�
\ No newline at end of file
diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age
index 91975e5..3633642 100644
Binary files a/nix/secrets/killua_env.age and b/nix/secrets/killua_env.age differ
diff --git a/nix/secrets/knot_dns_acme_dns_01_key_config.age b/nix/secrets/knot_dns_acme_dns_01_key_config.age
deleted file mode 100644
index b47832e..0000000
--- a/nix/secrets/knot_dns_acme_dns_01_key_config.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 LZU5Eg REfGT+ZHVlXvO+6s9AgIGQCBS+AQYfAG012IfRipJhQ
-V/O4nPGoAOpB/4DyBWuEV/GxoRJ7hdgVomIQwcxnSdg
--> ssh-ed25519 5bWSnQ vFGAKwm8eJ/Fqv+LxLo+1mnzg4ht1BLTA7zdJuWdlnI
-Lhh3d9dWKyRcVTKeMOJb/cVzwnnqrBYNE0ijDgAxut0
---- Du4x4K3KsDMktwzmEMiFRxGXq63eP5x9CBowtGJWM+w
-�1�{$�e��9�b���`��+g��p�����D��x�hK*/�Z�~eAԥ�H�}l���0���Ό��s�Z�t��ڸ��:!���k�j�!I�_�y�I�[e����F��G���Cb��x����
\ No newline at end of file
diff --git a/nix/secrets/knot_dns_acme_dns_01_key_envvar.age b/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
deleted file mode 100644
index 9503cd7..0000000
--- a/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 vT7ExA UhRU412YTV9dkMkINM4xDQvQqwosWzIRGap+NxS7MFQ
-FUlsU461cxI+2befwB1v3ygyYAeTwfpJft/EX7eCGCo
--> ssh-ed25519 yMKb8Q 2kpI3iQwInOH+TYnbvuyKyksGD9Q8UthqF1eBG5I+0g
-Si5Q1xNovm8hBmSfHx6l4PsiFU/cPa52rLw8OAGWQl0
---- PO+gCtXKMloPmRAplw/pOAVPDHqh5PwzrQqrzSPN5Ng
-_W���[��VN�J��1���D-���:�ᔆ|V�z��l���S�v�*{��G�9V"����_��G�r��S\�c�?s���&갶�S��	
\ No newline at end of file
diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age
index cbbf258..3b49086 100644
Binary files a/nix/secrets/loki_env.age and b/nix/secrets/loki_env.age differ
diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age
index 9937f85..c046394 100644
Binary files a/nix/secrets/minio_env_file.age and b/nix/secrets/minio_env_file.age differ
diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age
index 6c79515..234ac01 100644
--- a/nix/secrets/openolat_db_password.age
+++ b/nix/secrets/openolat_db_password.age
@@ -1,6 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 8JOs+ohdkwfpHfDO7hq07sJ8IGny1yupoCy5ucro2n4
-2TWbFpYjg6k6fBgGmAhNQQ1hBd6k04wu9gcKD2iF/ZY
---- GO7BMFQgRi6aBsnhc64kRcslMo4ziPFbrFVgzubQ5Ww
-K��&�1��=c0�^$�Lr�����§0�G}��S5���/�j�
-�	���6S�1D�%����%Q]�|�!�oq�ϝY��ڧT��l�S��v�E�B�d��ծH�����(� 9�4R�G�MA�<SZ��K,J��{
\ No newline at end of file
+-> ssh-ed25519 qM6TYg anB4Ljud6na0zsnFkNjgBcicE6kFUg0y2xTlohEUggI
+gUTv83/Mktm8CyXdKEf1eu7NpWJd/hmiGzKs91WyPCc
+--- zxoGip/R/tIH30MATCWht9P9oUxU//L/jnf6T/DwKEI
+U�͌5��f��q�{���!���%�Z��E���;��
+xȻ�v�n��k�����t��P\-�1Pۺ�B}gMn{3���o����*]�ڦ�0��z�U5�2�߈���@y�r�U�gA� �-4��)F�
+�>"��U�b�
\ No newline at end of file
diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age
index 7dfa32a..1da8fb8 100644
Binary files a/nix/secrets/paperless_env.age and b/nix/secrets/paperless_env.age differ
diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age
index 13bf603..637f942 100644
Binary files a/nix/secrets/pyroscope_s3_secret.age and b/nix/secrets/pyroscope_s3_secret.age differ
diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age
index d027b5a..5ffafb6 100644
Binary files a/nix/secrets/registry_htpasswd.age and b/nix/secrets/registry_htpasswd.age differ
diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age
index 1ce82a2..72fe931 100644
Binary files a/nix/secrets/registry_s3_key_secret.age and b/nix/secrets/registry_s3_key_secret.age differ
diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age
index 935f42a..38f3560 100644
Binary files a/nix/secrets/restic_backup.age and b/nix/secrets/restic_backup.age differ
diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age
index a35f4dc..0287a9e 100644
Binary files a/nix/secrets/s3_mc_admin_client.age and b/nix/secrets/s3_mc_admin_client.age differ
diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index 00d810c..f9fed44 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -33,8 +33,6 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
-  "knot_dns_acme_dns_01_key_config.age".publicKeys = [ dns1 dns2 ];
-  "knot_dns_acme_dns_01_key_envvar.age".publicKeys = [ vps5 minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];
diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age
index 33b042c..631523c 100644
Binary files a/nix/secrets/upload_files_s3_secret.age and b/nix/secrets/upload_files_s3_secret.age differ
diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age
index cc2d8cb..9adbf22 100644
Binary files a/nix/secrets/website_s3_key_write.age and b/nix/secrets/website_s3_key_write.age differ
diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age
index da9fe8c..f218338 100644
--- a/nix/secrets/wg_private_dns1.age
+++ b/nix/secrets/wg_private_dns1.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg 8zZFvGVb6VIefxLJERJ16VqhKczWW2tcUEdSU4dIsC4
-5k+Qpn+ZloytTx4DhcgT3Il5lBlXIuNmwMvNKC1hvNY
---- rEDDdmvnau74yyYkVHKGx8kKi+Is/s/Ygt7PKfs4dv0
-=@�_��y��\����-*垣��F<��KV^u�WCzZ�l���}oo
�6�h"��E��p��k#l���aʰ�&
\ No newline at end of file
+-> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs
+PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo
+--- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY
+kM�Ql?N'!��.LlL��BoD�Y���:���_��V��c����t�ci= �3�rKv��M�f�Du��
\ No newline at end of file
diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age
index 5e3c22c..536fb4f 100644
--- a/nix/secrets/wg_private_dns2.age
+++ b/nix/secrets/wg_private_dns2.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 5bWSnQ K+8u0rnGv8MsfaRy0eeZTwOsKsRcPixxnp1X7VR9cFk
-U9MsbgO1w5x91uqRxLdD94VmbuAk/nqv8e/b9B8QP8E
---- LzVg9wCJGFUNvtRLqwzMBTWNcJRJoy6FgRq7g0IQ7M8
-i	���!��8��ƴ+H�����#:?v!�H
�N'Aa%�.�Y-N0S����^�qIs��}l��}���."�
\ No newline at end of file
+-> ssh-ed25519 5bWSnQ KNg5E8fLL/rDMbRGQDujv/NaSUVGY/HmxFgIVK7vox4
+bH+Gywr/dDW3UPfQpLpWg9sVZq+LfE2aDs29chCpaDk
+--- mYTYZH2KoiKyxtfrxgIomqaaCyfnLVNwXkUzp+cDl7c
+�Q}�B��.�$b��q���{4�;5-;��3�Jyble��̞�d�o��#i�(�{�J譍����y���>˨]�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age
index a3c964b..2fa88e6 100644
--- a/nix/secrets/wg_private_minipc.age
+++ b/nix/secrets/wg_private_minipc.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q OK8Z0x1tfsdGQo0Acqxj99IDVwfRRO4nHmtBuwDXpEo
-FNfKD0EJ3FMQ8neRd5tNldCLp9Wk2K4/wlaEjKQPxPQ
---- y32/fNgc6fz2cAr76vUej99Xu5DMcmO8bDQepK04TRM
-ѣ`'mo�HK{O��-����Ёy�l��,X49��
'+�t��r&OK�^���
ߚ>
-�(��G���>�A��n�
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE
+w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw
+--- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ
+m �*Q��v"����+��JQ���Ā�'�P��hD��>G���J�]�
��Ġ����Lݩ����	�N��̤ۀ
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age
index c88ff5f..a944270 100644
Binary files a/nix/secrets/wg_private_vps1.age and b/nix/secrets/wg_private_vps1.age differ
diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age
index b951cf0..3cf2891 100644
--- a/nix/secrets/wg_private_vps2.age
+++ b/nix/secrets/wg_private_vps2.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug v7DD5jgO2eah7KvV9shAkyFRG1zce0kKKD6U/QBIzCk
-hKwCVfnc/5wKEs2ow0etWhet/8+AT318LOnrEgTVEdw
---- WWKcK5xf8FeUsA7atbz8r/ScBM857aXQA9mN9TdpRB8
-Ђ��/ ?K!A>��9q�mׂ���,�l�����^[pĻ�!r�mME��zʀ�O�`����q>q�^cR�K�3�
\ No newline at end of file
+-> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE
+NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM
+--- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY
+ʋ�.\��Ņ��iқ���~`�Q�,��W;m����pQ�TY
T�z?]��T-s�4)�ZP�,6�H5b�Ԅ7��h
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age
index 63c109d..5cb419d 100644
Binary files a/nix/secrets/wg_private_vps3.age and b/nix/secrets/wg_private_vps3.age differ
diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age
index 44987eb..7915ceb 100644
Binary files a/nix/secrets/wg_private_vps4.age and b/nix/secrets/wg_private_vps4.age differ
diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age
index 2f52122..d870bc4 100644
--- a/nix/secrets/wg_private_vps5.age
+++ b/nix/secrets/wg_private_vps5.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA 1SyRWnZNW7piWgD9AhV3evIk5qmlPZw3vtaYysYPKUo
-vC2skZEXjrM2HgU6nhrzqZhwVtIZWrZyaVZwUp5PE5c
---- 46tHy1OYd8fqnjpLu+MVYrJyPaP6UdgubrsvhI7KO4A
-��J��HJ�S�v�}��+	���j��/��
���MJ��P�+~8A�웧�f�^ۄ�lj�K�AbH��5�U"@
\ No newline at end of file
+-> ssh-ed25519 vT7ExA 5Yp0GcAOQbgRlxiIBgDt2O5NK0zoEN3PdUQOFsKtSXc
+653+sJWsCeQpu6agZn85RU6GOrpMJY+TbzqRLbYvnaw
+--- SYT84Omvncdv4tQYH7Put8sXqqA3LBR4/DuVyVCVbNg
+���v_Ab���L"f��R6�W���6�hep����K��e�g�,E���;`��"�G
xu��V���B^�+k��6���
\ No newline at end of file
diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age
index 401e63c..c9bb838 100644
--- a/nix/secrets/widetom_bot_token.age
+++ b/nix/secrets/widetom_bot_token.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg p+Rts+QHTmO+vPpCHEp2LTAdPF8UMq0BqoN3rAPzCgM
-g5RaqS2rCOdp8/vllNb3Revq+bfDdHQkwYKsnNRN97c
---- Ws0i3nFuR6DNeO1RpdUvc3Irt4I3HuzBtPgxXsBaOvU
-P���n_8�P��lJ����P(�l���*=V+QX�=�R�Ob��f'l&�u�U�=�F���.���`s���
·�_�&��}�ά-<�0�_-�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg qE/RX7sfudkaWg+9A1jRP84PnGCC8f7y2Ai308kN+zg
+LnySP1Ywe33ECGtFx3Un0+QcxH/IscCHao49nbuEvm8
+--- DYF2tyroJ1KnECqhUvzLyox9wULA/eEH5SdENW2fPVc
+)n�CzL��b�!�P[��>jl(9���P@�{�����;a#�B���q#0��+]��-���M�\5��{��)�laW�k��RCE�tc�3���
\ No newline at end of file
diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age
index 34b8537..af313d3 100644
Binary files a/nix/secrets/widetom_config_toml.age and b/nix/secrets/widetom_config_toml.age differ
diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_config b/secrets-git-crypt/knot_dns_acme_dns_01_key_config
deleted file mode 100644
index e180250..0000000
Binary files a/secrets-git-crypt/knot_dns_acme_dns_01_key_config and /dev/null differ
diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar b/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar
deleted file mode 100644
index c679314..0000000
Binary files a/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar and /dev/null differ