diff --git a/flake.lock b/flake.lock
index ad8c1bc..81e3e05 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,59 +2,34 @@
   "nodes": {
     "agenix": {
       "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1770165109,
-        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "lastModified": 1790734419,
+        "narHash": "sha256-n7wew722m1OTBT9DOIMxNX/NF4zfsSUABAO5eW3wikE=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "3daa710894355fa2fad8243380af373a2b4046ef",
         "type": "github"
       },
       "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
+        "owner": "ryantm",
+        "repo": "agenix",
         "type": "github"
       }
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1791914995,
+        "narHash": "sha256-Zf/xfQEAasnwnmEfHqW/4hjDE/s44yn2hD4RuVIZRjA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "b7a79d3fea1e214f6d668d521cecec0c01e26544",
         "type": "github"
       },
       "original": {
@@ -63,34 +38,13 @@
         "type": "github"
       }
     },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790328731,
-        "narHash": "sha256-Rvx1gJOPmsXVvislwhD16OSbqYjYD/jnLEdY4w77few=",
+        "lastModified": 1791935857,
+        "narHash": "sha256-Zrhxwe8+HMRiDpjsOIoOIUvK6b8HCp3FL5R50N901hU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "392b320636af0527be6f300a8f57e5ab5f43ba38",
+        "rev": "952dd4355e1932709b993aa31de5e5b7bbe114f7",
         "type": "github"
       },
       "original": {
@@ -121,21 +75,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index b5c6c98..5435e1e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,7 +21,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets = {
                 matrix_registration_shared_secret = {
@@ -57,7 +56,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets.hedgedoc_db_password = {
                 file = ./secrets/hedgedoc_db_password.age;
@@ -73,7 +71,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets = {
                 www-staging-htpasswd = {
@@ -97,7 +94,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets = {
                 grafana_secret_key = {
@@ -139,7 +135,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets = {
                 postgres-matrix-synapse = {
@@ -181,7 +176,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets = {
                 #radicale-htpasswd = {
@@ -199,7 +193,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets = {
                 postgres-forgejo = {
@@ -247,7 +240,6 @@
           system = "x86_64-linux";
           modules = [
             agenix.nixosModules.default
-            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
             {
               age.secrets = {
                 forgejo-runner-token = {
diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix
index 6c97af6..d3b2713 100644
--- a/hosts/forgejo-runner/forgejo-runner.nix
+++ b/hosts/forgejo-runner/forgejo-runner.nix
@@ -45,7 +45,7 @@
         };
         container = {
           enable_ipv6 = true;
-          network = "forgejo";
+          network = "default";
           privileged = true;
           force_pull = true;
           docker_host = "unix:///run/podman/podman.sock";
diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix
index f8afa8e..c5efd3e 100644
--- a/hosts/www/nginx.nix
+++ b/hosts/www/nginx.nix
@@ -2,6 +2,12 @@
 
 let
   # TODO: mkVHost
+  aliasDir = url: path: {
+    "${url}" = {
+      return = "301 ${url}/";
+    };
+    "${url}/".alias = "${path}/";
+  };
 in
 {
   imports = [
@@ -42,13 +48,6 @@ in
           index = "index.html";
           tryFiles = "$uri $uri/ $uri.html =404";
         };
-        "/twentyyears/".alias = "/srv/http/twentyyears/";
-        "/thirtytwoyears/".alias = "/srv/http/thirtytwoyears/";
-        # RFC8805
-        "/noc/".alias = "/srv/http/noc/";
-        "/static/".alias = "/srv/http/static/";
-        # RFC8805 new location
-        "/.well-known/loc/".alias = "/srv/http/noc/";
         "= /.well-known/security.txt" = {
           alias = "/srv/http/security.txt";
           extraConfig = ''
@@ -90,7 +89,15 @@ in
             default_type text/calendar;
           '';
         };
-      };
+      }
+      // aliasDir "/twentyyears" "/srv/http/twentyyears"
+      // aliasDir "/thirtytwoyears" "/srv/http/thirtytwoyears"
+      // aliasDir "/kik" "/srv/http/kik"
+      # RFC8805
+      // aliasDir "/noc" "/srv/http/noc"
+      // aliasDir "/static" "/srv/http/static"
+      # RFC8805 new location
+      // aliasDir "/.well-known/loc" "/srv/http/noc";
     };
     "staging.${config.networking.domain}" = {
       quic = true;
diff --git a/secrets/secrets.nix b/secrets/agenix-rules.nix
similarity index 100%
rename from secrets/secrets.nix
rename to secrets/agenix-rules.nix