71 files changed, 125 insertions, 103 deletions
diff --git a/modules/by-name/gi/git-back/module.nix b/modules/by-name/gi/git-back/module.nix
deleted file mode 100644
index 7df1bac..0000000
--- a/modules/by-name/gi/git-back/module.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.vhack.git-back;
-in {
-  options.vhack.git-back = {
-    enable = lib.mkEnableOption "Back integration into git-server";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "The domain where to deploy back";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    vhack.back = {
-      enable = true;
-
-      user = "git";
-      group = "git";
-
-      settings = {
-        scan_path = "${config.services.gitolite.dataDir}/repositories";
-        project_list = "${config.services.gitolite.dataDir}/projects.list";
-        root_url = "https://${cfg.domain}";
-      };
-    };
-
-    vhack.anubis.instances."${cfg.domain}".target = "http://127.0.0.1:8000";
-  };
-}
diff --git a/modules/by-name/an/anubis/module.nix b/modules/vhack/an/anubis/module.nix
index 4e70e4f..4e70e4f 100644
--- a/modules/by-name/an/anubis/module.nix
+++ b/modules/vhack/an/anubis/module.nix
diff --git a/modules/by-name/at/atuin-sync/module.nix b/modules/vhack/at/atuin-sync/module.nix
index e0d75bb..4295697 100644
--- a/modules/by-name/at/atuin-sync/module.nix
+++ b/modules/vhack/at/atuin-sync/module.nix
@@ -1,13 +1,12 @@
 {
   config,
   lib,
-  vhackPackages,
   ...
 }: let
   cfg = config.vhack.atuin-sync;
 in {
   options.vhack.atuin-sync = {
-    enable = lib.mkEnableOption "atuin sync server";
+    enable = lib.mkEnableOption "atuin (turtle) sync server";
 
     fqdn = lib.mkOption {
       description = "The fully qualified domain name of this instance.";
@@ -19,17 +18,13 @@ in {
   config = lib.mkIf cfg.enable {
     vhack.nginx.enable = true;
 
-    vhack.anubis.instances."${cfg.fqdn}".target = "http://127.0.0.1:${toString config.services.atuin.port}";
+    vhack.anubis.instances."${cfg.fqdn}".target = "http://127.0.0.1:${toString config.services.turtle.port}";
 
     services = {
-      atuin = {
+      turtle = {
         enable = true;
-        package = vhackPackages.atuin-server-only;
         host = "127.0.0.1";
 
-        # Nobody knows about the fqdn and even if, they can only upload encrypted blobs.
-        openRegistration = true;
-
         database.createLocally = true;
       };
     };
diff --git a/modules/by-name/ba/backup/module.nix b/modules/vhack/ba/backup/module.nix
index 856a1c3..856a1c3 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/vhack/ba/backup/module.nix
diff --git a/modules/by-name/co/constants/module.nix b/modules/vhack/co/constants/module.nix
index 3de9608..9127488 100644
--- a/modules/by-name/co/constants/module.nix
+++ b/modules/vhack/co/constants/module.nix
@@ -55,6 +55,12 @@
       grocy = 341;
       anubis = 342;
       postfix-tlspol = 343;
+      rocie = 344;
+      fluent-bit = 345;
+      loki = 346;
+      grafana = 347;
+      node-exporter = 348;
+      smartctl-exporter-access = 349;
 
       # As per the NixOS file, the uids should not be greater or equal to 400;
     };
@@ -94,6 +100,12 @@
         systemd-coredump # matches systemd-coredump user
         resolvconf # This group is not matched to an user?
         stalwart-mail-certificates # This group is used to connect nginx and stalwart-mail
+        rocie
+        fluent-bit
+        loki
+        grafana
+        node-exporter
+        smartctl-exporter-access
         ;
 
       # The gid should match the uid. Thus should not be >= 400;
diff --git a/modules/by-name/co/coredump/module.nix b/modules/vhack/co/coredump/module.nix
index ce28ed9..ce28ed9 100644
--- a/modules/by-name/co/coredump/module.nix
+++ b/modules/vhack/co/coredump/module.nix
diff --git a/modules/by-name/dh/dhcpcd/module.nix b/modules/vhack/dh/dhcpcd/module.nix
index 0e35af3..0e35af3 100644
--- a/modules/by-name/dh/dhcpcd/module.nix
+++ b/modules/vhack/dh/dhcpcd/module.nix
diff --git a/modules/by-name/di/disko/module.nix b/modules/vhack/di/disko/module.nix
index b4fc3c8..b4fc3c8 100644
--- a/modules/by-name/di/disko/module.nix
+++ b/modules/vhack/di/disko/module.nix
diff --git a/modules/by-name/dn/dns/dns/default.nix b/modules/vhack/dn/dns/dns/default.nix
index 4ce07d8..4ce07d8 100644
--- a/modules/by-name/dn/dns/dns/default.nix
+++ b/modules/vhack/dn/dns/dns/default.nix
diff --git a/modules/by-name/dn/dns/dns/types/default.nix b/modules/vhack/dn/dns/dns/types/default.nix
index ece315f..ece315f 100644
--- a/modules/by-name/dn/dns/dns/types/default.nix
+++ b/modules/vhack/dn/dns/dns/types/default.nix
diff --git a/modules/by-name/dn/dns/dns/types/record.nix b/modules/vhack/dn/dns/dns/types/record.nix
index e992bf9..e992bf9 100644
--- a/modules/by-name/dn/dns/dns/types/record.nix
+++ b/modules/vhack/dn/dns/dns/types/record.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/A.nix b/modules/vhack/dn/dns/dns/types/records/A.nix
index 296943e..296943e 100644
--- a/modules/by-name/dn/dns/dns/types/records/A.nix
+++ b/modules/vhack/dn/dns/dns/types/records/A.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/AAAA.nix b/modules/vhack/dn/dns/dns/types/records/AAAA.nix
index 4717176..4717176 100644
--- a/modules/by-name/dn/dns/dns/types/records/AAAA.nix
+++ b/modules/vhack/dn/dns/dns/types/records/AAAA.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/CAA.nix b/modules/vhack/dn/dns/dns/types/records/CAA.nix
index 4b40510..4b40510 100644
--- a/modules/by-name/dn/dns/dns/types/records/CAA.nix
+++ b/modules/vhack/dn/dns/dns/types/records/CAA.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/CNAME.nix b/modules/vhack/dn/dns/dns/types/records/CNAME.nix
index 095b078..095b078 100644
--- a/modules/by-name/dn/dns/dns/types/records/CNAME.nix
+++ b/modules/vhack/dn/dns/dns/types/records/CNAME.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/DKIM.nix b/modules/vhack/dn/dns/dns/types/records/DKIM.nix
index 31b2f67..31b2f67 100644
--- a/modules/by-name/dn/dns/dns/types/records/DKIM.nix
+++ b/modules/vhack/dn/dns/dns/types/records/DKIM.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/DMARC.nix b/modules/vhack/dn/dns/dns/types/records/DMARC.nix
index 0f10f2c..0f10f2c 100644
--- a/modules/by-name/dn/dns/dns/types/records/DMARC.nix
+++ b/modules/vhack/dn/dns/dns/types/records/DMARC.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/DNAME.nix b/modules/vhack/dn/dns/dns/types/records/DNAME.nix
index 042ce95..042ce95 100644
--- a/modules/by-name/dn/dns/dns/types/records/DNAME.nix
+++ b/modules/vhack/dn/dns/dns/types/records/DNAME.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/DNSKEY.nix b/modules/vhack/dn/dns/dns/types/records/DNSKEY.nix
index 86ce3a1..86ce3a1 100644
--- a/modules/by-name/dn/dns/dns/types/records/DNSKEY.nix
+++ b/modules/vhack/dn/dns/dns/types/records/DNSKEY.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/DS.nix b/modules/vhack/dn/dns/dns/types/records/DS.nix
index 76fac9a..76fac9a 100644
--- a/modules/by-name/dn/dns/dns/types/records/DS.nix
+++ b/modules/vhack/dn/dns/dns/types/records/DS.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/HTTPS.nix b/modules/vhack/dn/dns/dns/types/records/HTTPS.nix
index 6e2ef3d..6e2ef3d 100644
--- a/modules/by-name/dn/dns/dns/types/records/HTTPS.nix
+++ b/modules/vhack/dn/dns/dns/types/records/HTTPS.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/MTA-STS.nix b/modules/vhack/dn/dns/dns/types/records/MTA-STS.nix
index 030490e..030490e 100644
--- a/modules/by-name/dn/dns/dns/types/records/MTA-STS.nix
+++ b/modules/vhack/dn/dns/dns/types/records/MTA-STS.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/MX.nix b/modules/vhack/dn/dns/dns/types/records/MX.nix
index c25b89c..c25b89c 100644
--- a/modules/by-name/dn/dns/dns/types/records/MX.nix
+++ b/modules/vhack/dn/dns/dns/types/records/MX.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/NS.nix b/modules/vhack/dn/dns/dns/types/records/NS.nix
index ea60a91..ea60a91 100644
--- a/modules/by-name/dn/dns/dns/types/records/NS.nix
+++ b/modules/vhack/dn/dns/dns/types/records/NS.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/OPENPGPKEY.nix b/modules/vhack/dn/dns/dns/types/records/OPENPGPKEY.nix
index 1f39cb9..1f39cb9 100644
--- a/modules/by-name/dn/dns/dns/types/records/OPENPGPKEY.nix
+++ b/modules/vhack/dn/dns/dns/types/records/OPENPGPKEY.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/PTR.nix b/modules/vhack/dn/dns/dns/types/records/PTR.nix
index 075f82e..075f82e 100644
--- a/modules/by-name/dn/dns/dns/types/records/PTR.nix
+++ b/modules/vhack/dn/dns/dns/types/records/PTR.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/SOA.nix b/modules/vhack/dn/dns/dns/types/records/SOA.nix
index db7436e..db7436e 100644
--- a/modules/by-name/dn/dns/dns/types/records/SOA.nix
+++ b/modules/vhack/dn/dns/dns/types/records/SOA.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/SRV.nix b/modules/vhack/dn/dns/dns/types/records/SRV.nix
index 5f558ed..5f558ed 100644
--- a/modules/by-name/dn/dns/dns/types/records/SRV.nix
+++ b/modules/vhack/dn/dns/dns/types/records/SRV.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/SSHFP.nix b/modules/vhack/dn/dns/dns/types/records/SSHFP.nix
index 1409860..1409860 100644
--- a/modules/by-name/dn/dns/dns/types/records/SSHFP.nix
+++ b/modules/vhack/dn/dns/dns/types/records/SSHFP.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/SVCB.nix b/modules/vhack/dn/dns/dns/types/records/SVCB.nix
index 62cbc3d..62cbc3d 100644
--- a/modules/by-name/dn/dns/dns/types/records/SVCB.nix
+++ b/modules/vhack/dn/dns/dns/types/records/SVCB.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/TLSA.nix b/modules/vhack/dn/dns/dns/types/records/TLSA.nix
index d92a29b..d92a29b 100644
--- a/modules/by-name/dn/dns/dns/types/records/TLSA.nix
+++ b/modules/vhack/dn/dns/dns/types/records/TLSA.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/TXT.nix b/modules/vhack/dn/dns/dns/types/records/TXT.nix
index d605ce8..d605ce8 100644
--- a/modules/by-name/dn/dns/dns/types/records/TXT.nix
+++ b/modules/vhack/dn/dns/dns/types/records/TXT.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/default.nix b/modules/vhack/dn/dns/dns/types/records/default.nix
index 76a86cd..76a86cd 100644
--- a/modules/by-name/dn/dns/dns/types/records/default.nix
+++ b/modules/vhack/dn/dns/dns/types/records/default.nix
diff --git a/modules/by-name/dn/dns/dns/types/records/dnssec.nix b/modules/vhack/dn/dns/dns/types/records/dnssec.nix
index 648f676..648f676 100644
--- a/modules/by-name/dn/dns/dns/types/records/dnssec.nix
+++ b/modules/vhack/dn/dns/dns/types/records/dnssec.nix
diff --git a/modules/by-name/dn/dns/dns/types/simple.nix b/modules/vhack/dn/dns/dns/types/simple.nix
index fece2c9..fece2c9 100644
--- a/modules/by-name/dn/dns/dns/types/simple.nix
+++ b/modules/vhack/dn/dns/dns/types/simple.nix
diff --git a/modules/by-name/dn/dns/dns/types/zone.nix b/modules/vhack/dn/dns/dns/types/zone.nix
index 44ccb15..44ccb15 100644
--- a/modules/by-name/dn/dns/dns/types/zone.nix
+++ b/modules/vhack/dn/dns/dns/types/zone.nix
diff --git a/modules/by-name/dn/dns/dns/util/default.nix b/modules/vhack/dn/dns/dns/util/default.nix
index 59e661d..59e661d 100644
--- a/modules/by-name/dn/dns/dns/util/default.nix
+++ b/modules/vhack/dn/dns/dns/util/default.nix
diff --git a/modules/by-name/dn/dns/module.nix b/modules/vhack/dn/dns/module.nix
index 8f4ad37..8f4ad37 100644
--- a/modules/by-name/dn/dns/module.nix
+++ b/modules/vhack/dn/dns/module.nix
diff --git a/modules/by-name/et/etesync/module.nix b/modules/vhack/et/etesync/module.nix
index 4dc8575..4dc8575 100644
--- a/modules/by-name/et/etesync/module.nix
+++ b/modules/vhack/et/etesync/module.nix
diff --git a/modules/by-name/fa/fail2ban/module.nix b/modules/vhack/fa/fail2ban/module.nix
index c619ef9..c619ef9 100644
--- a/modules/by-name/fa/fail2ban/module.nix
+++ b/modules/vhack/fa/fail2ban/module.nix
diff --git a/modules/by-name/ga/gallery/module.nix b/modules/vhack/ga/gallery/module.nix
index a5237e6..a5237e6 100644
--- a/modules/by-name/ga/gallery/module.nix
+++ b/modules/vhack/ga/gallery/module.nix
diff --git a/modules/by-name/gi/git-server/css.nix b/modules/vhack/gi/git-server/css.nix
index 7d0ad06..7d0ad06 100644
--- a/modules/by-name/gi/git-server/css.nix
+++ b/modules/vhack/gi/git-server/css.nix
diff --git a/modules/by-name/gi/git-server/module.nix b/modules/vhack/gi/git-server/module.nix
index db35897..3e2c848 100644
--- a/modules/by-name/gi/git-server/module.nix
+++ b/modules/vhack/gi/git-server/module.nix
@@ -8,8 +8,7 @@
 
   cgitCss = import ./css.nix {
     inherit pkgs;
-    cgitPkg =
-      config.services.cgit."${cfg.domain}".package;
+    cgitPkg = config.services.cgit."${cfg.domain}".package;
   };
 in {
   options.vhack.git-server = {
@@ -84,10 +83,16 @@ in {
 
       cgit."${cfg.domain}" = {
         enable = true;
-        package = pkgs.cgit-pink;
+        package = pkgs.cgit;
         scanPath = "${config.services.gitolite.dataDir}/repositories";
         user = "git";
         group = "git";
+
+        # Don't bypass `cgit` when performing a http only clone.
+        # This is slightly slower, but we don't need to worry about the access
+        # restrictions also being by-passed.
+        gitHttpBackend.enable = false;
+
         settings = {
           branch-sort = "age";
 
diff --git a/modules/by-name/gr/grocy/module.nix b/modules/vhack/gr/grocy/module.nix
index 28107f2..28107f2 100644
--- a/modules/by-name/gr/grocy/module.nix
+++ b/modules/vhack/gr/grocy/module.nix
diff --git a/modules/by-name/im/impermanence/module.nix b/modules/vhack/im/impermanence/module.nix
index 1c916e2..1c916e2 100644
--- a/modules/by-name/im/impermanence/module.nix
+++ b/modules/vhack/im/impermanence/module.nix
diff --git a/modules/by-name/in/invidious-router/module.nix b/modules/vhack/in/invidious-router/module.nix
index f85a06c..750f852 100644
--- a/modules/by-name/in/invidious-router/module.nix
+++ b/modules/vhack/in/invidious-router/module.nix
@@ -1,7 +1,7 @@
 {
   config,
   lib,
-  pkgsUnstable,
+  pkgs,
   ...
 }: let
   cfg = config.vhack.invidious-router;
@@ -21,7 +21,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.invidious-router = {
       enable = true;
-      package = pkgsUnstable.invidious-router;
+      package = pkgs.invidious-router;
       settings = {
         app = {
           listen = "127.0.0.1:8050";
diff --git a/modules/by-name/ma/mail/module.nix b/modules/vhack/ma/mail/module.nix
index 500abd0..cdc730f 100644
--- a/modules/by-name/ma/mail/module.nix
+++ b/modules/vhack/ma/mail/module.nix
@@ -27,12 +27,6 @@ in {
         mode = "0700";
       }
       {
-        directory = "/var/lib/mail/sieve";
-        user = "virtualMail";
-        group = "virtualMail";
-        mode = "0700";
-      }
-      {
         directory = "/var/lib/mail/vmail";
         user = "virtualMail";
         group = "virtualMail";
@@ -63,29 +57,32 @@ in {
         mode = "0700";
       }
     ];
+
     vhack.nginx.enable = true;
     security.acme.certs = {
       "${cfg.fqdn}" = {
         domain = cfg.fqdn;
       };
     };
+
     mailserver = {
       enable = true;
       inherit (cfg) fqdn;
 
-      stateVersion = 3;
-
-      useFsLayout = true;
+      stateVersion = 5;
 
-      extraVirtualAliases = {
+      aliases = {
         "abuse@vhack.eu" = all_admins;
         "postmaster@vhack.eu" = all_admins;
         "admin@vhack.eu" = all_admins;
       };
 
-      mailDirectory = "/var/lib/mail/vmail";
-      dkimKeyDirectory = "/var/lib/mail/dkim";
-      sieveDirectory = "/var/lib/mail/sieve";
+      storage = {
+        directoryLayout = "fs";
+        path = "/var/lib/mail/vmail";
+      };
+
+      dkim.keyDirectory = "/var/lib/mail/dkim";
       backup.snapshotRoot = "/var/lib/mail/backup";
 
       enableImap = false;
@@ -97,9 +94,8 @@ in {
       enableSubmissionSsl = true;
       openFirewall = true;
 
-      keyFile = "/var/lib/acme/${cfg.fqdn}/key.pem";
-      certificateScheme = "acme";
-      certificateFile = "/var/lib/acme/${cfg.fqdn}/fullchain.pem";
+      # Reference the existing ACME configuration created by nginx
+      x509.useACMEHost = cfg.fqdn;
 
       domains = [
         "vhack.eu"
@@ -110,9 +106,11 @@ in {
         "sils.li"
         "nightingale.sils.li"
         "sils.sils.li"
+
+        "jaki.li"
       ];
 
-      loginAccounts = {
+      accounts = {
         "sils@vhack.eu" = {
           hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm";
         };
@@ -120,6 +118,9 @@ in {
           hashedPassword = "$2b$05$XX36sJuHNbTFvi8DFldscOeQBHahluSkiUqD9QGzQaET7NJusSuQW";
         };
 
+        "soispha@b-peetz.de" = {
+          hashedPassword = "$y$j9T$asnEgvMxJrbeabfyp1AOe/$0dJ0/Rta57V8nHCLVGOHrXsXeEhBCaKx/HTuPHXZj04";
+        };
         "benedikt.peetz@b-peetz.de" = {
           hashedPassword = "$2b$05$MfET8utot2OolPZNASqoDe4VXNoG2chnEWhdfQ2E92mit0TvI2gBy";
           aliases = ["@b-peetz.de"];
@@ -142,6 +143,14 @@ in {
             "@sils.li"
           ];
         };
+        "mail@jaki.li" = {
+          hashedPassword = "$y$j9T$jaG/lkAOfYXUNiJt11DoE.$ZKTeev6b5TCBEXZzNLH12hOmy5mL.Fitp0V6saWXR73";
+          aliases = [
+            "postmaster@jaki.li"
+            "abuse@jaki.li"
+            "admin@jaki.li"
+          ];
+        };
 
         # Mail-Account used by hosted software
         "mastodon@vhack.eu" = {
diff --git a/modules/by-name/ma/mastodon/module.nix b/modules/vhack/ma/mastodon/module.nix
index 84f3ec8..84f3ec8 100644
--- a/modules/by-name/ma/mastodon/module.nix
+++ b/modules/vhack/ma/mastodon/module.nix
diff --git a/modules/by-name/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch b/modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
index 35dc809..870492a 100644
--- a/modules/by-name/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
+++ b/modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
@@ -1,6 +1,6 @@
-From ab67426c53d343eee349de501767ecbbf5d211ad Mon Sep 17 00:00:00 2001
+From 265bc7b12ab8229225b13565a361051b9e120792 Mon Sep 17 00:00:00 2001
 From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
-Date: Sat, 21 Dec 2024 20:07:11 +0100
+Date: Tue, 7 Jul 2026 11:34:50 +0200
 Subject: [PATCH] feat(treewide): Increase character limit to 5000 in messages
 
 The default of 500 was just not enough.
@@ -10,31 +10,31 @@ The default of 500 was just not enough.
  2 files changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
-index bda2edba6..76ac65bf3 100644
+index c5cffff10d..2172a0ad8f 100644
 --- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
 +++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
-@@ -28,7 +28,7 @@ const mapStateToProps = state => ({
-   anyMedia: state.getIn(['compose', 'media_attachments']).size > 0,
+@@ -58,7 +58,7 @@ const mapStateToProps = state => ({
+     && !state.getIn(['settings', 'dismissed_banners', PRIVATE_QUOTE_MODAL_ID]),
    isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
    lang: state.getIn(['compose', 'language']),
--  maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500),
-+  maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 5000),
+-  maxChars: state.getIn(['server', 'server', 'item', 'configuration', 'statuses', 'max_characters'], 500),
++  maxChars: state.getIn(['server', 'server', 'item', 'configuration', 'statuses', 'max_characters'], 5000),
  });
- 
- const mapDispatchToProps = (dispatch) => ({
+
+ const mapDispatchToProps = (dispatch, props) => ({
 diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
-index dc841ded3..9cb1ec94b 100644
+index 575aaf1869..ecefca6fe9 100644
 --- a/app/validators/status_length_validator.rb
 +++ b/app/validators/status_length_validator.rb
 @@ -1,7 +1,7 @@
  # frozen_string_literal: true
- 
+
  class StatusLengthValidator < ActiveModel::Validator
 -  MAX_CHARS = 500
 +  MAX_CHARS = 5000
    URL_PLACEHOLDER_CHARS = 23
    URL_PLACEHOLDER = 'x' * 23
- 
--- 
-2.47.0
+
+--
+2.54.0
 
diff --git a/modules/by-name/ma/matrix/module.nix b/modules/vhack/ma/matrix/module.nix
index 39631ef..39631ef 100644
--- a/modules/by-name/ma/matrix/module.nix
+++ b/modules/vhack/ma/matrix/module.nix
diff --git a/modules/by-name/mi/miniflux/module.nix b/modules/vhack/mi/miniflux/module.nix
index 0075bca..0075bca 100644
--- a/modules/by-name/mi/miniflux/module.nix
+++ b/modules/vhack/mi/miniflux/module.nix
diff --git a/modules/by-name/mu/murmur/module.nix b/modules/vhack/mu/murmur/module.nix
index 5cc6f7d..061e236 100644
--- a/modules/by-name/mu/murmur/module.nix
+++ b/modules/vhack/mu/murmur/module.nix
@@ -47,8 +47,11 @@ in {
 
         The entire team of [name of the company] is thrilled to welcome you on board. We hope you’ll do some amazing work here!
       '';
-      sslKey = "${cfg.murmurStore}/key.pem";
-      sslCert = "${cfg.murmurStore}/fullchain.pem";
+
+      tls = {
+        keyPath = "${cfg.murmurStore}/key.pem";
+        certPath = "${cfg.murmurStore}/fullchain.pem";
+      };
 
       registerUrl = cfg.url;
       registerName = cfg.name;
diff --git a/modules/by-name/ne/nextcloud/module.nix b/modules/vhack/ne/nextcloud/module.nix
index 3e1ef3e..ed51936 100644
--- a/modules/by-name/ne/nextcloud/module.nix
+++ b/modules/vhack/ne/nextcloud/module.nix
@@ -43,8 +43,17 @@ in {
     services = {
       nextcloud = {
         enable = true;
+        inherit (cfg) package;
+
         extraApps = {
-          inherit (cfg.package.packages.apps) calendar contacts tasks;
+          inherit
+            (cfg.package.packages.apps)
+            calendar
+            contacts
+            tasks
+            mail
+            onlyoffice
+            ;
         };
         extraAppsEnable = true;
         configureRedis = true;
@@ -59,7 +68,6 @@ in {
         hostName = cfg.hostname;
         https = true;
         maxUploadSize = "5G";
-        package = cfg.package;
         settings = {
           default_phone_region = "DE";
         };
diff --git a/modules/by-name/ng/nginx/module.nix b/modules/vhack/ng/nginx/module.nix
index fa3337d..1317d4d 100644
--- a/modules/by-name/ng/nginx/module.nix
+++ b/modules/vhack/ng/nginx/module.nix
@@ -18,15 +18,6 @@ in {
       a default nginx config.
     '';
 
-    selfsign = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Whether to selfsign the acme certificates. This should only
-        really be useful for tests.
-      '';
-    };
-
     redirects = lib.mkOption {
       type = lib.types.attrsOf lib.types.str;
       default = {};
@@ -39,9 +30,27 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    vhack.persist.directories = [
-      "/var/lib/acme"
-    ];
+    vhack = {
+      persist.directories = [
+        "/var/lib/acme"
+      ];
+
+      monitoring.prometheus = {
+        sources = [
+          {
+            name = "nginx";
+            target = "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}";
+          }
+        ];
+      };
+    };
+
+    services.prometheus.exporters.nginx = {
+      enable = true;
+      port = 9111;
+      listenAddress = "127.0.0.1";
+      scrapeUri = "http://localhost:80/nginx_status";
+    };
 
     users = {
       users.acme = {
@@ -56,10 +65,6 @@ in {
       defaults = {
         email = "admin@vhack.eu";
         webroot = "/var/lib/acme/acme-challenge";
-
-        # Avoid spamming the acme server, if we run in a test, and only really want self-signed
-        # certificates
-        server = lib.mkIf cfg.selfsign "https://127.0.0.1";
       };
     };
 
@@ -68,6 +73,10 @@ in {
     };
     services.nginx = {
       enable = true;
+
+      # Enable the status page for the prometheus exporter.
+      statusPage = lib.mkIf config.services.prometheus.enable true;
+
       virtualHosts = redirects;
     };
   };
diff --git a/modules/by-name/ni/nix-sync/internal_module.nix b/modules/vhack/ni/nix-sync/internal_module.nix
index 4e28586..4e28586 100644
--- a/modules/by-name/ni/nix-sync/internal_module.nix
+++ b/modules/vhack/ni/nix-sync/internal_module.nix
diff --git a/modules/by-name/ni/nix-sync/module.nix b/modules/vhack/ni/nix-sync/module.nix
index 9ddd210..9ddd210 100644
--- a/modules/by-name/ni/nix-sync/module.nix
+++ b/modules/vhack/ni/nix-sync/module.nix
diff --git a/modules/by-name/ni/nixconfig/module.nix b/modules/vhack/ni/nixconfig/module.nix
index a5bf950..a5bf950 100644
--- a/modules/by-name/ni/nixconfig/module.nix
+++ b/modules/vhack/ni/nixconfig/module.nix
diff --git a/modules/by-name/ns/nscd/module.nix b/modules/vhack/ns/nscd/module.nix
index 428ae3b..428ae3b 100644
--- a/modules/by-name/ns/nscd/module.nix
+++ b/modules/vhack/ns/nscd/module.nix
diff --git a/modules/by-name/oo/oomd/module.nix b/modules/vhack/oo/oomd/module.nix
index 3b39236..3b39236 100644
--- a/modules/by-name/oo/oomd/module.nix
+++ b/modules/vhack/oo/oomd/module.nix
diff --git a/modules/by-name/op/openssh/module.nix b/modules/vhack/op/openssh/module.nix
index 83aeadf..83aeadf 100644
--- a/modules/by-name/op/openssh/module.nix
+++ b/modules/vhack/op/openssh/module.nix
diff --git a/modules/by-name/pe/peertube/module.nix b/modules/vhack/pe/peertube/module.nix
index e65e0b5..e65e0b5 100644
--- a/modules/by-name/pe/peertube/module.nix
+++ b/modules/vhack/pe/peertube/module.nix
diff --git a/modules/by-name/po/postgresql/module.nix b/modules/vhack/po/postgresql/module.nix
index 319c3ac..319c3ac 100644
--- a/modules/by-name/po/postgresql/module.nix
+++ b/modules/vhack/po/postgresql/module.nix
diff --git a/modules/by-name/re/redlib/module.nix b/modules/vhack/re/redlib/module.nix
index 4d3c600..4d3c600 100644
--- a/modules/by-name/re/redlib/module.nix
+++ b/modules/vhack/re/redlib/module.nix
diff --git a/modules/by-name/re/resolvconf/module.nix b/modules/vhack/re/resolvconf/module.nix
index ff99696..ff99696 100644
--- a/modules/by-name/re/resolvconf/module.nix
+++ b/modules/vhack/re/resolvconf/module.nix
diff --git a/modules/by-name/ru/rust-motd/module.nix b/modules/vhack/ru/rust-motd/module.nix
index bf23843..bf23843 100644
--- a/modules/by-name/ru/rust-motd/module.nix
+++ b/modules/vhack/ru/rust-motd/module.nix
diff --git a/modules/by-name/sh/sharkey/module.nix b/modules/vhack/sh/sharkey/module.nix
index 18bf394..186fed2 100644
--- a/modules/by-name/sh/sharkey/module.nix
+++ b/modules/vhack/sh/sharkey/module.nix
@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  pkgsUnstable,
   ...
 }: let
   cfg = config.vhack.sharkey;
@@ -19,7 +18,7 @@ in {
 
       package = lib.mkOption {
         type = lib.types.package;
-        default = pkgsUnstable.sharkey;
+        default = pkgs.sharkey;
         defaultText = lib.literalExpression "vhackPackages.sharkey";
         description = "Sharkey package to use.";
       };
diff --git a/modules/by-name/st/stalwart-mail/module.nix b/modules/vhack/st/stalwart-mail/module.nix
index f7e44d8..f7e44d8 100644
--- a/modules/by-name/st/stalwart-mail/module.nix
+++ b/modules/vhack/st/stalwart-mail/module.nix
diff --git a/modules/by-name/st/stalwart-mail/settings.nix b/modules/vhack/st/stalwart-mail/settings.nix
index eb53783..dfaf63d 100644
--- a/modules/by-name/st/stalwart-mail/settings.nix
+++ b/modules/vhack/st/stalwart-mail/settings.nix
@@ -24,7 +24,7 @@
     then "internal"
     else "in-memory";
 in {
-  config.services.stalwart-mail.settings = lib.mkIf cfg.enable {
+  config.services.stalwart.settings = lib.mkIf cfg.enable {
     # https://www.rfc-editor.org/rfc/rfc6376.html#section-3.3
     signature = let
       signatures =
diff --git a/modules/by-name/sy/system-info/module.nix b/modules/vhack/sy/system-info/module.nix
index 8136ae5..e25e88c 100644
--- a/modules/by-name/sy/system-info/module.nix
+++ b/modules/vhack/sy/system-info/module.nix
@@ -36,9 +36,11 @@
 
       "10222" = checkEnabled "taskchampion-sync" "taskchampion-sync";
 
+      "64738" = checkEnabled "murmur" "murmur";
+
       # TODO(@bpeetz): Check which service opens these ports: <2025-01-28>
-      "64738" = "???";
       "4190" = "???";
+      "8112" = "???";
     };
   in ''
     ${mode} ${builtins.toString port}: ${
diff --git a/modules/by-name/ta/taskchampion-sync/module.nix b/modules/vhack/ta/taskchampion-sync/module.nix
index a722883..a7cba30 100644
--- a/modules/by-name/ta/taskchampion-sync/module.nix
+++ b/modules/vhack/ta/taskchampion-sync/module.nix
@@ -18,7 +18,10 @@ in {
 
   config = lib.mkIf cfg.enable {
     users = {
-      users.taskchampion.uid = config.vhack.constants.ids.uids.taskchampion;
+      users.taskchampion = {
+        uid = config.vhack.constants.ids.uids.taskchampion;
+        group = "taskchampion";
+      };
       groups.taskchampion.gid = config.vhack.constants.ids.uids.taskchampion;
     };
 
@@ -34,6 +37,16 @@ in {
       nginx.enable = true;
     };
 
+    systemd.services.taskchampion-sync-server = {
+      serviceConfig = {
+        # The upstream service uses DynamicUsers, which currently poses issues to our
+        # directory persisting strategy.
+        User = "taskchampion";
+        Group = "taskchampion";
+        DynamicUser = lib.mkForce false;
+      };
+    };
+
     services = {
       taskchampion-sync-server = {
         enable = true;
diff --git a/modules/by-name/us/users/module.nix b/modules/vhack/us/users/module.nix
index 6011204..e029130 100644
--- a/modules/by-name/us/users/module.nix
+++ b/modules/vhack/us/users/module.nix
@@ -36,7 +36,7 @@
         uid = 1000;
       }
       {
-        name = "sils";
+        name = "jaki";
         password = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC";
         sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILn7Oumr5IYtTTIKRFvDnofGXXiDLBQE9jVF+7UE+4G5 vhack.eu";
         uid = 1001;