diff --git a/fastfetch.png b/fastfetch.png
new file mode 100644
index 0000000..2bc4cf7
Binary files /dev/null and b/fastfetch.png differ
diff --git a/flake.nix b/flake.nix
index db28537..5e92a7b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -24,7 +24,7 @@
       nixpkgs-k8s,
       flake-utils,
       agenix,
-      NixVirt,            
+      NixVirt,
     # k8nix,
     }:
     {
diff --git a/hosts/common.nix b/hosts/common.nix
index 895a2ef..60af7b9 100644
--- a/hosts/common.nix
+++ b/hosts/common.nix
@@ -36,10 +36,19 @@
     useXkbConfig= true;
   };
 
-  environment.systemPackages = with pkgs; [
-    git
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICW1+Ml8R9x1LCJaZ8bIZ1qIV4HCuZ6x7DziFW+0Nn5T xengi@kanae_2022-12-09"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmb+mJfo84IagUaRoDEqY9ROjjQUOQ7tMclpN6NDPrX xengi@kota_2022-01-16"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyklb7dvEHH0VBEMmTUQFKHN6ekBQqkDKj09+EilUIQ xengi@lucy_2018-09-08"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICjv9W8WXq9QGkgmANNPQR24/I1Pm1ghxNIHftEI+jlZ xengi@mayu_2021-06-11"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhyfD+8jMl6FDSADb11sfAsJk0KNoVzjjiDRZjUOtmf xengi@nana_2019-08-16"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPtGqhV7io3mhIoZho4Yf7eCo0sUZvjT2NziM2PkXSo xengi@nyu_2017-10-11"
   ];
 
-  system.stateVersion = "25.11";
-}
+  environment.systemPackages = with pkgs; [
+    git
+    vim
+  ];
 
+  system.stateVersion = "26.05";
+}
diff --git a/hosts/control-plane/default.nix b/hosts/control-plane/default.nix
new file mode 100644
index 0000000..9e09fa3
--- /dev/null
+++ b/hosts/control-plane/default.nix
@@ -0,0 +1,5 @@
+{}:
+
+{
+  imports = [../common.nix];
+}
diff --git a/hosts/kaede/base.nix b/hosts/kaede/base.nix
index b9d1b50..9c7ef9b 100644
--- a/hosts/kaede/base.nix
+++ b/hosts/kaede/base.nix
@@ -2,7 +2,7 @@
 
 {
   boot = {
-    initrd.availableKernelModules = [ "ahci" "xhci_pci" "ehci_pci" "megaraid_sas" "nvme" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
+    initrd.availableKernelModules = [ "ahci" "xhci_pci" "ehci_pci" "megaraid_sas" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
     kernelModules = [ "kvm-intel" ];
     loader = {
       systemd-boot.enable = true;
@@ -12,7 +12,7 @@
     swraid = {
       enable = true;
       mdadmConf = ''
-        ARRAY /dev/md/ROOT metadata=1.2 UUID=acd8260f-e30f-2f3f-74f7-e51ee905a498
+        ARRAY /dev/md/ROOT metadata=1.2 UUID=41506d64-f386-474c-abe1-0142d9c57d84
         MAILADDR root@localhost
       '';
     };
@@ -20,20 +20,20 @@
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-uuid/e44cfa13-868e-4d26-b3de-5a8ae92bb055";
+      device = "/dev/disk/by-uuid/41506d64-f386-474c-abe1-0142d9c57d84";
       fsType = "ext4";
       options = [ "discard" "noatime" ];
     };
     "/boot" = {
-      device = "/dev/disk/by-uuid/AD5C-950B";
+      device = "/dev/disk/by-uuid/49B7-9286";
       fsType = "vfat";
       options = [ "fmask=0022" "dmask=0022" "discard" "noatime" ];
     };
   };
 
   swapDevices = [
-    { device = "/dev/disk/by-uuid/e8825b01-f91e-4c4f-8916-bffeb6fac0cd"; }
     { device = "/dev/disk/by-uuid/5b53c0b9-ab57-4992-8e81-957e19c7b685"; }
+    { device = "/dev/disk/by-uuid/e8825b01-f91e-4c4f-8916-bffeb6fac0cd"; }
   ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
@@ -48,6 +48,7 @@
 
   environment.systemPackages = with pkgs; [
     git
+    vim
   ];
 
   virtualisation = {
@@ -62,6 +63,5 @@
   #rootDevice = "/dev/disk/by-label/nixos";
   #mountHostNixStore = true;
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
 }
-
diff --git a/hosts/kaede/default.nix b/hosts/kaede/default.nix
index 6bbc37d..5187f2d 100644
--- a/hosts/kaede/default.nix
+++ b/hosts/kaede/default.nix
@@ -3,10 +3,10 @@
 {
   imports = [
     ./base.nix
+    ./hardware.nix
     ./networking.nix
     ./users.nix
     ./programs.nix
     ./services.nix
   ];
 }
-
diff --git a/hosts/kaede/hardware.nix b/hosts/kaede/hardware.nix
new file mode 100644
index 0000000..a758415
--- /dev/null
+++ b/hosts/kaede/hardware.nix
@@ -0,0 +1,49 @@
+{ ... }:
+
+{
+  swapDevices = [];
+
+  hardware = {
+    graphics = {
+      enable = true;
+      extraPackages = with pkgs; [
+        intel-media-driver
+        intel-ocl
+        intel-vaapi-driver
+      ];
+    };
+    nvidia = {
+      # Modesetting is required.
+      modesetting.enable = true;
+      # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
+      powerManagement.enable = false;
+      # Fine-grained power management. Turns off GPU when not in use.
+      # Experimental and only works on modern Nvidia GPUs (Turing or newer).
+      powerManagement.finegrained = false;
+      # Use the NVidia open source kernel module (not to be confused with the
+      # independent third-party "nouveau" open source driver).
+      # Support is limited to the Turing and later architectures. Full list of
+      # supported GPUs is at:
+      # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
+      # Only available from driver 515.43.04+
+      # Do not disable this unless your GPU is unsupported or if you have a good reason to.
+      open = true;
+      # Enable the Nvidia settings menu,
+      # accessible via `nvidia-settings`.
+      nvidiaSettings = false;
+      # Update for NVIDA GPU headless mode, i.e. nvidia-persistenced.
+      # It ensures all GPUs stay awake even during headless mode.
+      nvidiaPersistenced = true;
+      # Optionally, you may need to select the appropriate driver version for your specific GPU.
+      package = config.boot.kernelPackages.nvidiaPackages.stable;
+      #package = config.boot.kernelPackages.nvidiaPackages.mkDriver {
+      #  version = "565.57.01";
+      #  sha256_64bit = "sha256-8pMskvrdQ8WyNBvkU/xPc/CtcYXCa7ekP73oGuKfH+M=";
+      #  sha256_aarch64 = "sha256-s8ZAVKvRNXpjxRYqM3E5oss5FdqW+tv1qQC2pDjfG+s=";
+      #  openSha256 = "sha256-/32Zf0dKrofTmPZ3Ratw4vDM7B+OgpC4p7s+RHUjCrg=";
+      #  settingsSha256 = "sha256-kQsvDgnxis9ANFmwIwB7HX5MkIAcpEEAHc8IBOLdXvk=";
+      #  persistencedSha256 = "sha256-E2J2wYYyRu7Kc3MMZz/8ZIemcZg68rkzvqEwFAL3fFs=";
+      #};
+    };
+  };
+}
diff --git a/hosts/kaede/networking.nix b/hosts/kaede/networking.nix
index c88d7bd..3bc6dee 100644
--- a/hosts/kaede/networking.nix
+++ b/hosts/kaede/networking.nix
@@ -2,28 +2,41 @@
 
 {
   networking = {
-    hostName = "kaede";
-    domain = "xengi.de";
-    search = [ "xengi.de" ];
+    hostName = "k8s";
+    domain = "berlin.ccc.de";
+    search = [ "berlin.ccc.de" ];
     useNetworkd = true;
     dhcpcd.enable = false;
     nftables.enable = true;
     useDHCP = false;
     nameservers = [
-      "2606:4700:4700::1111#one.one.one.one"
-      "2620:fe::fe#dns.quad9.net"
-      "1.1.1.1#one.one.one.one"
-      "9.9.9.9#dns.quad9.net"
+      "2001:678:560:42::1"
     ];
+    defaultGateway6 = {
+      address = "fe80::6eb3:11ff:fe11:8f55";
+      interface = "eno4";
+    };
     defaultGateway = {
-      address = "217.115.0.182";
-      interface = "eno3";
+      address = "195.160.172.5";
+      interface = "eno4";
     };
     interfaces.eno3 = {
-      ipv6.addresses = [{ address = "2a00:1328:e100:1::6d"; prefixLength = 127; }];
-      ipv4.addresses = [{ address = "217.115.0.183"; prefixLength = 31; }];
+      ipv6.addresses = [{ address = "2001:678:560:42::88"; prefixLength = 64; }];
+      ipv4.addresses = [{ address = "195.160.172.88"; prefixLength = 24; }];
     };
     firewall.enable = true;
   };
+  services.resolved = {
+    enable = true;
+    settings.Resolve = {
+      DNSOverTLS = "opportunistic";
+      DNSSEC = "allow-downgrade";
+      FallbackDNS = [
+        "2606:4700:4700::1111#one.one.one.one"
+        "1.1.1.1#one.one.one.one"
+      ];
+      LLMNR = true;
+      MulticastDNS = true;
+    };
+  };
 }
-
diff --git a/hosts/kaede/programs.nix b/hosts/kaede/programs.nix
index 184c46d..0c2fc08 100644
--- a/hosts/kaede/programs.nix
+++ b/hosts/kaede/programs.nix
@@ -2,7 +2,6 @@
 
 {
   programs = {
-    fish.enable = true;
     vim = {
       enable = true;
       defaultEditor = true;
@@ -28,4 +27,3 @@
     };
   };
 }
-
diff --git a/hosts/kaede/services.nix b/hosts/kaede/services.nix
index 7722ce9..ce5700e 100644
--- a/hosts/kaede/services.nix
+++ b/hosts/kaede/services.nix
@@ -22,4 +22,3 @@
     };
   };
 }
-
diff --git a/hosts/kaede/users.nix b/hosts/kaede/users.nix
deleted file mode 100644
index 573efaa..0000000
--- a/hosts/kaede/users.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  users.users.xengi = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "libvirtd" ];
-    shell = pkgs.fish;
-    packages = with pkgs; [
-      fastfetch
-      kitty # for terminfo
-    ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICW1+Ml8R9x1LCJaZ8bIZ1qIV4HCuZ6x7DziFW+0Nn5T xengi@kanae_2022-12-09"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmb+mJfo84IagUaRoDEqY9ROjjQUOQ7tMclpN6NDPrX xengi@kota_2022-01-16"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyklb7dvEHH0VBEMmTUQFKHN6ekBQqkDKj09+EilUIQ xengi@lucy_2018-09-08"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICjv9W8WXq9QGkgmANNPQR24/I1Pm1ghxNIHftEI+jlZ xengi@mayu_2021-06-11"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhyfD+8jMl6FDSADb11sfAsJk0KNoVzjjiDRZjUOtmf xengi@nana_2019-08-16"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPtGqhV7io3mhIoZho4Yf7eCo0sUZvjT2NziM2PkXSo xengi@nyu_2017-10-11"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILwYcSxbP6Hon//kZFIZJSHdqvsJ6AyCwH4JP9/t4q46 xengi@yuka_2020-12-16"
-    ];
-  };
-}
-
diff --git a/hosts/worker/default.nix b/hosts/worker/default.nix
new file mode 100644
index 0000000..9e09fa3
--- /dev/null
+++ b/hosts/worker/default.nix
@@ -0,0 +1,5 @@
+{}:
+
+{
+  imports = [../common.nix];
+}
diff --git a/services/etcd.nix b/services/etcd.nix
index 98abdbd..4e19b07 100644
--- a/services/etcd.nix
+++ b/services/etcd.nix
@@ -1,9 +1,29 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
+let
+  ip = (builtins.head config.networking.interfaces.enp1s0.ipv6.addresses).address;
+  controlPlaneIps = ["fd00::1" "fd00::2" "fd00::3"];
+  controlPlaneIpSet = builtins.concatStringsSep ", " controlPlaneIps;
+in
 {
   services.etcd = {
     enable = true;
     package = pkgs.etcd_3_6;
+    trustedCaFile = config.age.secrets.etcd_ca_crt.path;
+    peerTrustedCaFile = config.age.secrets.etcd_peer_ca_crt.path;
+    peerClientCertAuth = true;
+    listenPeerUrls = ["https://[${ip}]:2380"];
+    listenClientUrls = ["https://[${ip}]:2379"];
+    initialCluster = ["${config.services.etcd.name}=https://${ip}:2380"];
+    clientCertAuth = true;
+    #peerKeyFile = config.age.secrets.etcd_peer_key.path;
+    #peerCertFile = config.age.secrets.etcd_peer_crt.path;
+    #keyFile = config.age.secrets.etcd_server_key.path;
+    #certFile = config.age.secrets.etcd_server_key.path;
   };
-}
 
+  networking.firewall.extraInputRules = ''
+    ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2380 accept comment "Allow etcd peers"
+    ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2379 accept comment "Allow etcd clients"
+  '';
+}
diff --git a/vm.nix b/vm.nix
new file mode 100644
index 0000000..c2aec9e
--- /dev/null
+++ b/vm.nix
@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  virtualisation.qemu.guestAgent.enable = true;
+}