diff --git a/nix/deploy/smoke-tests.sh b/nix/deploy/smoke-tests.sh
index 5054a61..d2a939c 100755
--- a/nix/deploy/smoke-tests.sh
+++ b/nix/deploy/smoke-tests.sh
@@ -4,20 +4,28 @@
 
 set -eux
 
+check_single_dig_answer() {
+    dns="$1"
+    type="$2"
+    host="$3"
+    grep="$4"
+
+    dig "@$dns.infra.noratrieb.dev" "$type" "$host" +noall +answer | grep "$grep"
+}
+
 check_dig_answer() {
     type="$1"
     host="$2"
     grep="$3"
 
-    dig @dns1.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-    dig @dns2.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-
+    check_single_dig_answer "dns1" "$type" "$host" "$grep"
+    check_single_dig_answer "dns2" "$type" "$host" "$grep"
 }
 
 # Check DNS name servers
 check_dig_answer A "dns1.infra.noratrieb.dev" "154.38.163.74"
 
-check_dig_answer A "nilstrieb.dev" "161.97.165.1"
+check_single_dig_answer "dns1" A "nilstrieb.dev" "161.97.165.1"
 
 # Check the NS records. The trailing dot matters!
 check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev."
diff --git a/nix/hive.nix b/nix/hive.nix
index eee6101..347f10a 100644
--- a/nix/hive.nix
+++ b/nix/hive.nix
@@ -24,7 +24,7 @@
             wg = {
               privateIP = "10.0.1.1";
               publicKey = "7jy2q93xYBHG5yKqLmNuMWSuFMnUGWXVuKQ1yMmxoV4=";
-              peers = [ "vps3" ];
+              peers = [ "minipc" "vps3" "vps5" ];
             };
             tags = [ "dns" ];
           };
@@ -88,7 +88,7 @@
             wg = {
               privateIP = "10.0.0.5";
               publicKey = "r1cwt63fcOR+FTqMTUpZdK4/MxpalkDYRHXyy7osWUk=";
-              peers = [ "vps1" "vps2" "vps3" "vps4" ];
+              peers = [ "dns1" "vps1" "vps2" "vps3" "vps4" ];
             };
             tags = [ "apps" ];
           };
@@ -98,7 +98,7 @@
             wg = {
               privateIP = "10.0.2.1";
               publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
-              peers = [ "vps3" ];
+              peers = [ "dns1" "vps3" ];
               noEndpoint = true;
             };
             tags = [ "home" ];
@@ -320,7 +320,9 @@
       ./modules/immich
       ./modules/tailscale
       ./modules/paperless
+      ./modules/home-assistant
       ./modules/caddy-base
+      ./modules/caddy-acme-dns
     ];
 
     system.stateVersion = "25.05";
diff --git a/nix/modules/caddy-acme-dns/default.nix b/nix/modules/caddy-acme-dns/default.nix
new file mode 100644
index 0000000..e5455af
--- /dev/null
+++ b/nix/modules/caddy-acme-dns/default.nix
@@ -0,0 +1,13 @@
+{ config, ... }: {
+  age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
+  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
+
+  services.caddy.globalConfig = ''
+    acme_dns rfc2136 {
+      key_name "acme-dns-01"
+      key_alg "hmac-sha256"
+      key "{$CADDY_DNS_RFC2136_KEY}"
+      server "dns1.local:53"
+    }
+  '';
+}
diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix
index 6356e88..c77a7d5 100644
--- a/nix/modules/caddy-base/default.nix
+++ b/nix/modules/caddy-base/default.nix
@@ -4,8 +4,9 @@ let
     plugins = [
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
+      "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
-    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
+    hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
   };
 in
 {
@@ -31,6 +32,7 @@ in
       format json
     '';
     globalConfig = ''
+      email tls@noratrieb.dev
       auto_https disable_redirects
 
       servers {
diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix
index e4c1b0a..207821c 100644
--- a/nix/modules/caddy/default.nix
+++ b/nix/modules/caddy/default.nix
@@ -7,9 +7,6 @@
   systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
   services.caddy = {
     globalConfig = ''
-      email tls@noratrieb.dev
-      auto_https disable_redirects
-
       storage s3 {
         host "localhost:3900"
         bucket "caddy-store"
@@ -18,10 +15,6 @@
 
         insecure true
       }
-
-      servers {
-        metrics
-      }
     '';
     virtualHosts = {
       "http://" = {
diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix
index 815eed0..3970d45 100644
--- a/nix/modules/dns/default.nix
+++ b/nix/modules/dns/default.nix
@@ -1,6 +1,12 @@
-{ pkgs, lib, networkingConfig, ... }:
+{ pkgs, lib, networkingConfig, config, name, ... }:
 let metricsPort = 9433; in
 {
+  age.secrets.knot_dns_acme_dns_01_key_config = {
+    file =
+      ../../secrets/knot_dns_acme_dns_01_key_config.age;
+    owner = "knot";
+  };
+
   # get the package for the debugging tools
   environment.systemPackages = with pkgs; [ knot-dns ];
 
@@ -21,28 +27,57 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    settingsFile = pkgs.writeTextFile {
-      name = "knot.conf";
-      text = ''
-        server:
-            listen: 0.0.0.0@53
-            listen: ::@53
+    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
+    settings = {
+      server.listen = [ "0.0.0.0@53" "::@53" ];
+      acl = [
+        {
+          id = "update_acl";
+          address = "10.0.0.0/16";
+          key = "acme-dns-01";
+          action = "update";
+          update-type = [ "TXT" ];
+        }
+      ];
+      zone = [
+        {
+          domain = "noratrieb.dev";
+          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
 
-        zone:
-          - domain: noratrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-          - domain: nilstrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-        log:
-          - target: syslog
-            any: info
-      '';
+      ] ++ (if name == "dns1" then [
+        {
+          domain = "nilstrieb.dev";
+          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
+        {
+          domain = "noratrieb-acme-delegate.dev";
+          storage = "/var/lib/knot/zones/";
+          file = "noratrieb-acme-delegate.dev.zone";
+          acl = "update_acl";
+        }
+      ] else [ ]);
+      log = [{
+        target = "syslog";
+        any = "info";
+      }];
     };
   };
 
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
+  systemd.services.knot.preStart =
+    lib.mkIf (name == "dns1")
+      (lib.getExe
+        (pkgs.writeShellApplication {
+          name = "knot-prestart.sh";
+          text = ''
+            mkdir -p /var/lib/knot/zones/
+            cp ${
+              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
+            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
+          '';
+        }));
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;
diff --git a/nix/modules/dns/nilstrieb.dev.nix b/nix/modules/dns/nilstrieb.dev.nix
index c013f4f..528fc83 100644
--- a/nix/modules/dns/nilstrieb.dev.nix
+++ b/nix/modules/dns/nilstrieb.dev.nix
@@ -29,14 +29,11 @@ let
       ];
 
       NS = [
-        "ns1.nilstrieb.dev."
-        "ns2.nilstrieb.dev."
+        "ns.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
-        ns1 = dns1;
-        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 
diff --git a/nix/modules/dns/noratrieb-acme-delegate.dev.nix b/nix/modules/dns/noratrieb-acme-delegate.dev.nix
new file mode 100644
index 0000000..cf4308d
--- /dev/null
+++ b/nix/modules/dns/noratrieb-acme-delegate.dev.nix
@@ -0,0 +1,39 @@
+# https://github.com/nix-community/dns.nix
+{ pkgs, lib, networkingConfig, ... }:
+let
+  data = with pkgs.nix-dns.lib.combinators;
+    let
+      hour1 = 3600;
+      hostsToDns = builtins.mapAttrs
+        (name: { publicIPv4, publicIPv6, ... }:
+          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
+          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
+        networkingConfig;
+    in
+    with hostsToDns;
+    {
+      TTL = hour1;
+      SOA = {
+        nameServer = "ns.noratrieb-acme-delegate.dev.";
+        adminEmail = "void@noratrieb.dev";
+        serial = 2024072601;
+      };
+
+      CAA = [
+        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
+        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
+      ];
+
+      NS = [
+        "ns.noratrieb-acme-delegate.dev."
+      ];
+
+      subdomains = {
+        ns = dns1;
+      };
+    };
+in
+pkgs.writeTextFile {
+  name = "noratrieb-acme-delegate.dev.zone";
+  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
+}
diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix
index c753f0f..3edc5a5 100644
--- a/nix/modules/dns/noratrieb.dev.nix
+++ b/nix/modules/dns/noratrieb.dev.nix
@@ -54,6 +54,9 @@ let
         ns1 = dns1;
         ns2 = dns2;
 
+        # --- ACME setup for caddy
+        _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ];
+
         # --- website stuff
         blog = vps1;
         www = vps1;
@@ -94,10 +97,15 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = {
-          immich = minipc;
-          paperless = minipc;
-        };
+        internal.subdomains = builtins.listToAttrs (builtins.map
+          (name: {
+            inherit name;
+            value = minipc // {
+              subdomains = {
+                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
+              };
+            };
+          }) [ "immich" "paperless" "home-assistant" ]);
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];
diff --git a/nix/modules/home-assistant/default.nix b/nix/modules/home-assistant/default.nix
new file mode 100644
index 0000000..15fe44e
--- /dev/null
+++ b/nix/modules/home-assistant/default.nix
@@ -0,0 +1,28 @@
+{ config, ... }: {
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      # Recommended for fast zlib compression
+      # https://www.home-assistant.io/integrations/isal
+      "isal"
+      "fronius"
+      "integration"
+    ];
+    config = {
+      default_config = { };
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = [ "::1" ];
+      };
+    };
+  };
+
+  services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
+    '';
+  };
+}
diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix
index 9d3b52c..97213e6 100644
--- a/nix/modules/immich/default.nix
+++ b/nix/modules/immich/default.nix
@@ -13,7 +13,6 @@
     environment = {
       IMMICH_TELEMETRY_INCLUDE = "all";
     };
-    openFirewall = true;
   };
 
   services.postgresql = {
@@ -30,5 +29,14 @@
     '';
   };
 
+  services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.immich.port}
+    '';
+  };
+
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
 }
diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix
index 5cb60cb..bfb6414 100644
--- a/nix/modules/paperless/default.nix
+++ b/nix/modules/paperless/default.nix
@@ -12,6 +12,7 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       PAPERLESS_TIME_ZONE = "Europe/Zurich";
       PAPERLESS_ADMIN_USER = "nora";
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
+      PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
     };
     exporter = {
       enable = true;
@@ -20,5 +21,12 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 8010 ];
+  services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
+    '';
+  };
 }
diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age
index af72302..c8828d3 100644
Binary files a/nix/secrets/backup_s3_secret.age and b/nix/secrets/backup_s3_secret.age differ
diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age
index fb3f1f4..e0a5138 100644
Binary files a/nix/secrets/caddy_s3_key_secret.age and b/nix/secrets/caddy_s3_key_secret.age differ
diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age
index 83a4bc9..71e7bdd 100644
--- a/nix/secrets/docker_registry_password.age
+++ b/nix/secrets/docker_registry_password.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw
-PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM
---- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic
-�|�H��LX�
Z��'v2"���<�K#9�$T���	�_��
�}^ao�4�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg UVJ4EkIz+aHGJHW/UWVOod/NSUrmLL4pNvK60KPWxzE
+pQ3h/qZ8XfwCqb2QshUxuLs6F+YddX2QSp8MLQnxBR0
+--- gox0jFVFKNb46LsZ/aOEpkxCWnx8sTe7Rvv+tdzkvq8
+��iB�<'+�̽����L�Yd�6c�6B�g�]UG􊃻N��c�]4Y<
\ No newline at end of file
diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age
index 81b84bd..cc6be88 100644
Binary files a/nix/secrets/does_it_build_private_key.age and b/nix/secrets/does_it_build_private_key.age differ
diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age
index ae631cc..0a2c88c 100644
--- a/nix/secrets/forgejo_s3_key_secret.age
+++ b/nix/secrets/forgejo_s3_key_secret.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k
-qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk
---- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY
-��"�.O��
J���7���6���~ԥS��H����-�4�0���[vA�D���=���^T��y"@A��@�,������P��|�q!؊M
\ No newline at end of file
+-> ssh-ed25519 qM6TYg nMMawatvWfcdHyOTJu5UBTCZbB8MDbvdd5XaSCR9ARQ
+iUI0FSTyjhx0xdfUn3ikxR3dcW8GQH1Flu2kwlkP1HA
+--- Fb7A45fAQY9VJN6Er23jTuEMvm5eDHJflTiiNFB4dYs
+�.�)!�$Y�Q�ώ$�9i3�3b_z
+��TR˲q�hs|[����F(�m��I���q1z�^&�&	'��(�g׏6��Fվ�^.�j]��D�i
M5�q�
\ No newline at end of file
diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age
index 7f33bee..9d822f6 100644
--- a/nix/secrets/garage_secrets.age
+++ b/nix/secrets/garage_secrets.age
@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg jJSJ3eWbmwKqaqaH0nCAfJh6zG0wQ8NHYLch6MjVFiM
-nzMK9xuag1meleJVM6aNGK3Uj+LDiklWtAbEsEVaZrE
--> ssh-ed25519 91VHug lgN/V9/OYL6qvoDo54bMwkRjgJx72ER4rwCyBLE7JBI
-KyqOc40/5iNubbk3vuF6e5qypscUNWGXSO+TvnE60Ug
--> ssh-ed25519 XzACZQ MH28c1eBXCHnnmWeEiKbB7qnqIWb11ciYZopRwK1lzw
-kHr78ot/c9JS7L+uWk5XhCwZ8y41cEkCfjiv5ITHXpI
--> ssh-ed25519 51bcvA JbXk+iiHx+TkrosjfP28iGjQQ3lNFlo6L7ebmOmOJzs
-KQH6qVfm+48U6TzaomwPQJP3Xs8JCX1JDuVNu6+djUM
--> ssh-ed25519 vT7ExA W/tG8Jk982TcvMP+ZVY1Jgtk/0ykGlKT471OloV68G8
-9/ieFx+uf+zLUKfWtIYUiEyHHkwYLOhX8FtZP6oup/Y
---- Nr1pkXNHv0+lBg4J3QnK4f5kM3ZOWjwTCwjUYNMRABk
-�UsI�	lNdL����^���q/P�D\���%���s4�GC��Ϻքag����|-�f�+,���|vpj�]��.�L���=����U�����_?�bG&Yw����|f~4qR��*�Lx�$ڋ�Y�P�rE����N,�jW���z��#K��@̧�#7�"&�Ξ=��Gx��N�.�n�O7�c}fczT
\ No newline at end of file
+-> ssh-ed25519 qM6TYg GE45kAK/hBIkfDcJ9T5KSf2ZlRuznfyCXNgyiROKSho
+07IiEZYSR+BoaHsNOMfpTB7KvFI5erLqiLkxHeghNA0
+-> ssh-ed25519 91VHug I5YszjRHyHEIPSO9ATRx/hgSiBnq6CmQeCiEWyThKQY
+6cyqqeR7jyvWCC3yfxqVk9YtjhR8LmUISxoScoAl0Ac
+-> ssh-ed25519 XzACZQ qqZvo9xbK4rQRDzCsyKD0NVYhk3960UW5FRfavIoI24
+AjsMDfEzmGMCGekIAHPXkN2RRZHC4ZjACo3cNGx/iqc
+-> ssh-ed25519 51bcvA mvDGI9jBis304qlduEX3kDb2Y5E2fiNL70i110hdDUo
+OJl67yJ26ZZVLgobEbh63J9kku+whdmgawpPrlyAgFs
+-> ssh-ed25519 vT7ExA NgHlD7tjMUF2kIeMmHyE/qsZI9VzIkg4drUCDj0GABs
+kxwMjB9CBd5IRlh2SBHIQJSjCjARLMwOg40DSdbDO3k
+--- hzXf515cyiJHjcIAg+kmCeZ4Hy2GI/b21F5O+Pq7r5A
+�=�)�BT�֢��(�_�_��
�2�{�E��d��ι��	w�MS�Vs9T�j_+�q��}���f��5�1�޿�^�>Q�F�g�^Qvn�Z�͔d�Θ��l=��YȬ�پ\!�F�4v��t����h���!�A�m�%'��n���<W�wi�ghmڬ�/'��Ⴗ��Y|AC����`zX���׻-�3�
\ No newline at end of file
diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age
index 5dd7134..504b519 100644
--- a/nix/secrets/generic_backup_password.age
+++ b/nix/secrets/generic_backup_password.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU
-e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg
--> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4
-QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ
--> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk
-LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE
--> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo
-yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA
--> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs
-acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8
---- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI
-{�đ��q.忳U�َcO��)��|¥�,+^]���?��PĻ$3m�4�Ǧ|�c��)�.R6@r�]���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg NaiDsYFYQAZuJinDZ60OiPEZMsnmPOggyW/lKwLPWR0
+vLZKSA9iaFIdOjE7K9n7vtlF8UKCS+AKuSS3O8jlfbw
+-> ssh-ed25519 91VHug O5htAKX31xr2plcilbKy/AZ0xtyIDekjtr6GYeIXcns
+aK43EBfhqDCEtkB/1RephM7PK0tB0xHjS+GIDTFw2A8
+-> ssh-ed25519 XzACZQ NRs3M2HrY9vZ94a+MccGZisn/cEyY9lg6l/ZiOaECgY
+aZ84NrESzU+yhsxXk+XiHEFJ+5/8B5wmFZVhPU5K8p4
+-> ssh-ed25519 51bcvA 74NdYVJKbbDBuhxqUUAgx4GpGbKFzL0/+KRXJKoxh0M
+nXjmvzBfiq5Y7EUeUM5aoEColQa80JUCMwaLX36Scss
+-> ssh-ed25519 vT7ExA buG7ZHfGrdKqobgouN2DHkOointeeSo3LbQ5TbXxMT4
+v+CfO/1CDfu2d/Oy7LX1S/tPa25zaY6rWafpQB+yzdo
+--- 1urbgjL5IrFAQbt9FPGt+Hv5hJ99uiFaC3K3G4X5JSQ
+?
+A�>�$-��>6������������蝠���>/RZs�Y�ɮ4�5�ѺR}��a�9S�Xw����R9�
\ No newline at end of file
diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age
index 53e26d0..a8f2696 100644
--- a/nix/secrets/grafana_admin_password.age
+++ b/nix/secrets/grafana_admin_password.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ jIs+NClvISjvJSkJlkkGX5ZJzFge/1Nj2Wi4en/viRw
-H1sfzg7cCWmCVg9GpFF5QNVVJjllxbmt7wBETRfM8hw
---- hOo2vi9EjLwAa8PQzJGdzUZ/VIzfhM7TnPsQ+OYJzcY
-%�f>8������Àuw�[	�l*�V(u�2��)e&����X�)
-Ƽ�Q�"�X|iO���,'��;��Itʽo�Z�՝k���E)��I� �0v/��?
\ No newline at end of file
+-> ssh-ed25519 XzACZQ io2AGztJepz/HVtDyyO5pplYumC+Ym95zUvjvzz3Twc
+mmJtTOkG/7HnUVKmpEMhRER1WhCbPMqsS09d3V76qr8
+--- yquBIN4NRMcxCzpDb2N1MTf3d4S0riWumE+fVIkwx8U
+�ǽŻt^z��Ϊ#t8��	#U�&�B#��pܐ9�No�R���O��٥']��Ϥ�����9��~EeFҺc�I�����d5�,�]�	]�k����r�
\ No newline at end of file
diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age
index fec59be..82504b1 100644
--- a/nix/secrets/hugochat_db_password.age
+++ b/nix/secrets/hugochat_db_password.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg o9FlX/G7SotMq0hWJWsBnutiOuMu9pX6iY7w6xODUQA
-Q/AZ3tKlwi5rEV8mQSQF/7uBxy0RVEzajdKZuVGLzvg
---- FujHNw9RfcGuMYfpj5C9hoWs5iYaj+x7tDqJ74lqVsg
-��vP�a�@���Q�R .�@,�@;��{�xtf�Ms��DF�#�u#,o�!$C5Сk�J����O��b�Ү��<i��wO�e�^b6�	f��`?��s�
��ʕahm���`�_k1��>�0�$
k�⬑7; ��M
��A���Ӂ��5�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg kzaYC7OTJ7pOil0/e+q6+MwCBhyCu+O8pkRt0LtuzVY
+9VM4lmMvJqaHB3WfzbzBfniO8oTHgUz1vZzK2c0TfTw
+--- PPkKzcyL6DezZfRPUvIVjn2gjT5AFtYRbXhabPIIq/E
+��"�u5�s��x�[�n��(���+�yGc㦂����=}��:�#��g@L7�P�"7�"�/����Vĥ�J�=���K���F6����l��6!�"�ᡋ�X�">��?���m)�v>��hC'W���KG*�b��i��=��R?sK�1j��Uw
\ No newline at end of file
diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age
index 08c97e4..3ecb67a 100644
--- a/nix/secrets/immich_secrets.age
+++ b/nix/secrets/immich_secrets.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY
-0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0
---- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg
-*c��lH��x�Ah�5H(d��U�'�nҘ;M.Vx}���"�f� ����9��f�~Jv�9�
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q ttfca/hqpWJm9dRJYWBXj9Of1rdWg2NbgfsAJFMUQTY
+qokH5RFlOmZMETgkqlWhcx41EtXtN2IxKpvP/WGz6mk
+--- vn3HoHqGBa02fSSeO8LGjhGb/7JK/tN/0Zh1Pjz25dY
+]?m����D�C:g��_klU�G���Q����J+��g3�u�9FH"���'g�����d���߃
\ No newline at end of file
diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age
index 3633642..91975e5 100644
Binary files a/nix/secrets/killua_env.age and b/nix/secrets/killua_env.age differ
diff --git a/nix/secrets/knot_dns_acme_dns_01_key_config.age b/nix/secrets/knot_dns_acme_dns_01_key_config.age
new file mode 100644
index 0000000..b47832e
--- /dev/null
+++ b/nix/secrets/knot_dns_acme_dns_01_key_config.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 LZU5Eg REfGT+ZHVlXvO+6s9AgIGQCBS+AQYfAG012IfRipJhQ
+V/O4nPGoAOpB/4DyBWuEV/GxoRJ7hdgVomIQwcxnSdg
+-> ssh-ed25519 5bWSnQ vFGAKwm8eJ/Fqv+LxLo+1mnzg4ht1BLTA7zdJuWdlnI
+Lhh3d9dWKyRcVTKeMOJb/cVzwnnqrBYNE0ijDgAxut0
+--- Du4x4K3KsDMktwzmEMiFRxGXq63eP5x9CBowtGJWM+w
+�1�{$�e��9�b���`��+g��p�����D��x�hK*/�Z�~eAԥ�H�}l���0���Ό��s�Z�t��ڸ��:!���k�j�!I�_�y�I�[e����F��G���Cb��x����
\ No newline at end of file
diff --git a/nix/secrets/knot_dns_acme_dns_01_key_envvar.age b/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
new file mode 100644
index 0000000..9503cd7
--- /dev/null
+++ b/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 vT7ExA UhRU412YTV9dkMkINM4xDQvQqwosWzIRGap+NxS7MFQ
+FUlsU461cxI+2befwB1v3ygyYAeTwfpJft/EX7eCGCo
+-> ssh-ed25519 yMKb8Q 2kpI3iQwInOH+TYnbvuyKyksGD9Q8UthqF1eBG5I+0g
+Si5Q1xNovm8hBmSfHx6l4PsiFU/cPa52rLw8OAGWQl0
+--- PO+gCtXKMloPmRAplw/pOAVPDHqh5PwzrQqrzSPN5Ng
+_W���[��VN�J��1���D-���:�ᔆ|V�z��l���S�v�*{��G�9V"����_��G�r��S\�c�?s���&갶�S��	
\ No newline at end of file
diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age
index 3b49086..cbbf258 100644
Binary files a/nix/secrets/loki_env.age and b/nix/secrets/loki_env.age differ
diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age
index c046394..9937f85 100644
Binary files a/nix/secrets/minio_env_file.age and b/nix/secrets/minio_env_file.age differ
diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age
index 234ac01..6c79515 100644
--- a/nix/secrets/openolat_db_password.age
+++ b/nix/secrets/openolat_db_password.age
@@ -1,7 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg anB4Ljud6na0zsnFkNjgBcicE6kFUg0y2xTlohEUggI
-gUTv83/Mktm8CyXdKEf1eu7NpWJd/hmiGzKs91WyPCc
---- zxoGip/R/tIH30MATCWht9P9oUxU//L/jnf6T/DwKEI
-U�͌5��f��q�{���!���%�Z��E���;��
-xȻ�v�n��k�����t��P\-�1Pۺ�B}gMn{3���o����*]�ڦ�0��z�U5�2�߈���@y�r�U�gA� �-4��)F�
-�>"��U�b�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg 8JOs+ohdkwfpHfDO7hq07sJ8IGny1yupoCy5ucro2n4
+2TWbFpYjg6k6fBgGmAhNQQ1hBd6k04wu9gcKD2iF/ZY
+--- GO7BMFQgRi6aBsnhc64kRcslMo4ziPFbrFVgzubQ5Ww
+K��&�1��=c0�^$�Lr�����§0�G}��S5���/�j�
+�	���6S�1D�%����%Q]�|�!�oq�ϝY��ڧT��l�S��v�E�B�d��ծH�����(� 9�4R�G�MA�<SZ��K,J��{
\ No newline at end of file
diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age
index 1da8fb8..7dfa32a 100644
Binary files a/nix/secrets/paperless_env.age and b/nix/secrets/paperless_env.age differ
diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age
index 637f942..13bf603 100644
Binary files a/nix/secrets/pyroscope_s3_secret.age and b/nix/secrets/pyroscope_s3_secret.age differ
diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age
index 5ffafb6..d027b5a 100644
Binary files a/nix/secrets/registry_htpasswd.age and b/nix/secrets/registry_htpasswd.age differ
diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age
index 72fe931..1ce82a2 100644
Binary files a/nix/secrets/registry_s3_key_secret.age and b/nix/secrets/registry_s3_key_secret.age differ
diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age
index 38f3560..935f42a 100644
Binary files a/nix/secrets/restic_backup.age and b/nix/secrets/restic_backup.age differ
diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age
index 0287a9e..a35f4dc 100644
Binary files a/nix/secrets/s3_mc_admin_client.age and b/nix/secrets/s3_mc_admin_client.age differ
diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index f9fed44..00d810c 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -33,6 +33,8 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
+  "knot_dns_acme_dns_01_key_config.age".publicKeys = [ dns1 dns2 ];
+  "knot_dns_acme_dns_01_key_envvar.age".publicKeys = [ vps5 minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];
diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age
index 631523c..33b042c 100644
Binary files a/nix/secrets/upload_files_s3_secret.age and b/nix/secrets/upload_files_s3_secret.age differ
diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age
index 9adbf22..cc2d8cb 100644
Binary files a/nix/secrets/website_s3_key_write.age and b/nix/secrets/website_s3_key_write.age differ
diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age
index f218338..da9fe8c 100644
--- a/nix/secrets/wg_private_dns1.age
+++ b/nix/secrets/wg_private_dns1.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs
-PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo
---- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY
-kM�Ql?N'!��.LlL��BoD�Y���:���_��V��c����t�ci= �3�rKv��M�f�Du��
\ No newline at end of file
+-> ssh-ed25519 LZU5Eg 8zZFvGVb6VIefxLJERJ16VqhKczWW2tcUEdSU4dIsC4
+5k+Qpn+ZloytTx4DhcgT3Il5lBlXIuNmwMvNKC1hvNY
+--- rEDDdmvnau74yyYkVHKGx8kKi+Is/s/Ygt7PKfs4dv0
+=@�_��y��\����-*垣��F<��KV^u�WCzZ�l���}oo
�6�h"��E��p��k#l���aʰ�&
\ No newline at end of file
diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age
index 536fb4f..5e3c22c 100644
--- a/nix/secrets/wg_private_dns2.age
+++ b/nix/secrets/wg_private_dns2.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 5bWSnQ KNg5E8fLL/rDMbRGQDujv/NaSUVGY/HmxFgIVK7vox4
-bH+Gywr/dDW3UPfQpLpWg9sVZq+LfE2aDs29chCpaDk
---- mYTYZH2KoiKyxtfrxgIomqaaCyfnLVNwXkUzp+cDl7c
-�Q}�B��.�$b��q���{4�;5-;��3�Jyble��̞�d�o��#i�(�{�J譍����y���>˨]�
\ No newline at end of file
+-> ssh-ed25519 5bWSnQ K+8u0rnGv8MsfaRy0eeZTwOsKsRcPixxnp1X7VR9cFk
+U9MsbgO1w5x91uqRxLdD94VmbuAk/nqv8e/b9B8QP8E
+--- LzVg9wCJGFUNvtRLqwzMBTWNcJRJoy6FgRq7g0IQ7M8
+i	���!��8��ƴ+H�����#:?v!�H
�N'Aa%�.�Y-N0S����^�qIs��}l��}���."�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age
index 2fa88e6..a3c964b 100644
--- a/nix/secrets/wg_private_minipc.age
+++ b/nix/secrets/wg_private_minipc.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE
-w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw
---- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ
-m �*Q��v"����+��JQ���Ā�'�P��hD��>G���J�]�
��Ġ����Lݩ����	�N��̤ۀ
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q OK8Z0x1tfsdGQo0Acqxj99IDVwfRRO4nHmtBuwDXpEo
+FNfKD0EJ3FMQ8neRd5tNldCLp9Wk2K4/wlaEjKQPxPQ
+--- y32/fNgc6fz2cAr76vUej99Xu5DMcmO8bDQepK04TRM
+ѣ`'mo�HK{O��-����Ёy�l��,X49��
'+�t��r&OK�^���
ߚ>
+�(��G���>�A��n�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age
index a944270..c88ff5f 100644
Binary files a/nix/secrets/wg_private_vps1.age and b/nix/secrets/wg_private_vps1.age differ
diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age
index 3cf2891..b951cf0 100644
--- a/nix/secrets/wg_private_vps2.age
+++ b/nix/secrets/wg_private_vps2.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE
-NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM
---- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY
-ʋ�.\��Ņ��iқ���~`�Q�,��W;m����pQ�TY
T�z?]��T-s�4)�ZP�,6�H5b�Ԅ7��h
\ No newline at end of file
+-> ssh-ed25519 91VHug v7DD5jgO2eah7KvV9shAkyFRG1zce0kKKD6U/QBIzCk
+hKwCVfnc/5wKEs2ow0etWhet/8+AT318LOnrEgTVEdw
+--- WWKcK5xf8FeUsA7atbz8r/ScBM857aXQA9mN9TdpRB8
+Ђ��/ ?K!A>��9q�mׂ���,�l�����^[pĻ�!r�mME��zʀ�O�`����q>q�^cR�K�3�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age
index 5cb419d..63c109d 100644
Binary files a/nix/secrets/wg_private_vps3.age and b/nix/secrets/wg_private_vps3.age differ
diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age
index 7915ceb..44987eb 100644
Binary files a/nix/secrets/wg_private_vps4.age and b/nix/secrets/wg_private_vps4.age differ
diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age
index d870bc4..2f52122 100644
--- a/nix/secrets/wg_private_vps5.age
+++ b/nix/secrets/wg_private_vps5.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA 5Yp0GcAOQbgRlxiIBgDt2O5NK0zoEN3PdUQOFsKtSXc
-653+sJWsCeQpu6agZn85RU6GOrpMJY+TbzqRLbYvnaw
---- SYT84Omvncdv4tQYH7Put8sXqqA3LBR4/DuVyVCVbNg
-���v_Ab���L"f��R6�W���6�hep����K��e�g�,E���;`��"�G
xu��V���B^�+k��6���
\ No newline at end of file
+-> ssh-ed25519 vT7ExA 1SyRWnZNW7piWgD9AhV3evIk5qmlPZw3vtaYysYPKUo
+vC2skZEXjrM2HgU6nhrzqZhwVtIZWrZyaVZwUp5PE5c
+--- 46tHy1OYd8fqnjpLu+MVYrJyPaP6UdgubrsvhI7KO4A
+��J��HJ�S�v�}��+	���j��/��
���MJ��P�+~8A�웧�f�^ۄ�lj�K�AbH��5�U"@
\ No newline at end of file
diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age
index c9bb838..401e63c 100644
--- a/nix/secrets/widetom_bot_token.age
+++ b/nix/secrets/widetom_bot_token.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg qE/RX7sfudkaWg+9A1jRP84PnGCC8f7y2Ai308kN+zg
-LnySP1Ywe33ECGtFx3Un0+QcxH/IscCHao49nbuEvm8
---- DYF2tyroJ1KnECqhUvzLyox9wULA/eEH5SdENW2fPVc
-)n�CzL��b�!�P[��>jl(9���P@�{�����;a#�B���q#0��+]��-���M�\5��{��)�laW�k��RCE�tc�3���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg p+Rts+QHTmO+vPpCHEp2LTAdPF8UMq0BqoN3rAPzCgM
+g5RaqS2rCOdp8/vllNb3Revq+bfDdHQkwYKsnNRN97c
+--- Ws0i3nFuR6DNeO1RpdUvc3Irt4I3HuzBtPgxXsBaOvU
+P���n_8�P��lJ����P(�l���*=V+QX�=�R�Ob��f'l&�u�U�=�F���.���`s���
·�_�&��}�ά-<�0�_-�
\ No newline at end of file
diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age
index af313d3..34b8537 100644
Binary files a/nix/secrets/widetom_config_toml.age and b/nix/secrets/widetom_config_toml.age differ
diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_config b/secrets-git-crypt/knot_dns_acme_dns_01_key_config
new file mode 100644
index 0000000..e180250
Binary files /dev/null and b/secrets-git-crypt/knot_dns_acme_dns_01_key_config differ
diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar b/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar
new file mode 100644
index 0000000..c679314
Binary files /dev/null and b/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar differ