diff --git a/hosts/sisko/default.nix b/hosts/sisko/default.nix
index 456bfca..3d5293b 100644
--- a/hosts/sisko/default.nix
+++ b/hosts/sisko/default.nix
@@ -11,13 +11,10 @@
       "wireguard-server"
       "mediatomb"
       "transmission"
-      # "hercules-ci"
       "home-assistant"
       "adguard-home"
       "cloudflare-dyndns"
       "sisko-proxy"
-      "invidious"
-      "searx"
       "sisko-share"
       "forgejo"
       "prometheus"
@@ -32,7 +29,6 @@
       "syncthing"
       "atticd"
       "jellyfin"
-      "firefly"
       "matrix"
       "radarr"
       "zerotier"
diff --git a/modules/adguard-home/default.nix b/modules/adguard-home/default.nix
index a1ec2aa..4020c07 100644
--- a/modules/adguard-home/default.nix
+++ b/modules/adguard-home/default.nix
@@ -1,3 +1,4 @@
+{ config, ... }:
 {
   services.adguardhome = {
     enable = true;
@@ -15,4 +16,13 @@
   environment.persistence."/persist".directories = [
     "/var/lib/AdGuardHome"
   ];
+
+  services.nginx.virtualHosts."adguard.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.adguardhome.port}";
+    };
+    serverAliases = [ "adguard.sisko.zt.aciceri.dev" ];
+  };
 }
diff --git a/modules/cloudflare-dyndns/default.nix b/modules/cloudflare-dyndns/default.nix
index 071a22b..5538150 100644
--- a/modules/cloudflare-dyndns/default.nix
+++ b/modules/cloudflare-dyndns/default.nix
@@ -8,15 +8,8 @@
       "aciceri.dev"
       "git.aciceri.dev"
       "home.aciceri.dev"
-      "torrent.aciceri.dev"
-      "search.aciceri.dev"
-      "invidious.aciceri.dev"
-      "vpn.aciceri.dev"
       "photos.aciceri.dev"
-      "status.aciceri.dev"
       "jelly.aciceri.dev"
-      "firefly.aciceri.dev"
-      "import.firefly.aciceri.dev"
       "matrix.aciceri.dev"
     ];
     apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
diff --git a/modules/grafana/default.nix b/modules/grafana/default.nix
index a95e543..5466fd2 100644
--- a/modules/grafana/default.nix
+++ b/modules/grafana/default.nix
@@ -7,7 +7,7 @@ in
     enable = true;
     settings = {
       server = {
-        domain = "status.aciceri.dev";
+        domain = "status.sisko.aciceri.dev";
         http_addr = "127.0.0.1";
         http_port = 2342;
         root_url = "https://${config.services.grafana.settings.server.domain}:443/";
@@ -30,10 +30,11 @@ in
   ];
 
   services.nginx.virtualHosts = {
-    "status.aciceri.dev" = {
-      enableACME = true;
+    "status.sisko.wg.aciceri.dev" = {
+      useACMEHost = "aciceri.dev";
       forceSSL = true;
       locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.settings.server.http_port}";
+      serverAliases = [ "status.sisko.zt.aciceri.dev" ];
     };
   };
 }
diff --git a/modules/jellyfin/default.nix b/modules/jellyfin/default.nix
index 51e066a..c9cdeaa 100644
--- a/modules/jellyfin/default.nix
+++ b/modules/jellyfin/default.nix
@@ -15,7 +15,7 @@
     "jelly.aciceri.dev" = {
       enableACME = true;
       forceSSL = true;
-      locations."/".proxyPass = "http://127.0.0.1:8096";
+      locations."/".proxyPass = "http://127.0.0.1:8096"; # FIXME hardcoded port
     };
   };
 }
diff --git a/modules/matrix/default.nix b/modules/matrix/default.nix
index c7d115b..c7c5917 100644
--- a/modules/matrix/default.nix
+++ b/modules/matrix/default.nix
@@ -7,7 +7,6 @@
 let
   clientConfig = {
     "m.homeserver".base_url = "https://matrix.aciceri.dev";
-    # "org.matrix.msc3575.proxy".url = "https://syncv3.matrix.aciceri.dev";
   };
   serverConfig."m.server" = "matrix.aciceri.dev:443";
   mkWellKnown = data: ''
@@ -21,7 +20,7 @@ in
 
   services.nginx.virtualHosts = {
     "aciceri.dev" = {
-      enableACME = true;
+      useACMEHost = "aciceri.dev";
       forceSSL = true;
       locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
       locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
@@ -36,17 +35,6 @@ in
     };
   };
 
-  services.postgresql = {
-    enable = true;
-    # initialScript = pkgs.writeText "synapse-init.sql" ''
-    #   CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-    #   CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-    # TEMPLATE template0
-    # LC_COLLATE = "C"
-    # LC_CTYPE = "C";
-    # '';
-  };
-
   systemd.tmpfiles.rules = [
     "d ${config.services.matrix-synapse.dataDir} 770 matrix-synapse matrix-synapse"
   ];
@@ -79,28 +67,4 @@ in
     };
     extraConfigFiles = [ config.age.secrets.matrix-registration-shared-secret.path ];
   };
-
-  # backup.paths = [
-  #   config.services.matrix-synapse.dataDir
-  #   "/var/backup/postgresql/matrix-synapse.sql.gz"
-  # ];
-
-  # services.postgresqlBackup = {
-  #   enable = true;
-  # databases = [ "matrix-synapse" ];
-  # };
-
-  # services.matrix-sliding-sync = {
-  #   enable = true;
-  #   environmentFile = config.age.secrets.matrix-sliding-sync-secret.path;
-  #   settings = {
-  #     SYNCV3_SERVER = "http://localhost:8008";
-  #   };
-  # };
-
-  # services.nginx.virtualHosts."syncv3.matrix.aciceri.dev" = {
-  #   enableACME = true;
-  #   forceSSL = true;
-  #   locations."/".proxyPass = config.services.matrix-sliding-sync.settings.SYNCV3_SERVER;
-  # };
 }
diff --git a/modules/nginx-base/default.nix b/modules/nginx-base/default.nix
index fa8dd61..f201630 100644
--- a/modules/nginx-base/default.nix
+++ b/modules/nginx-base/default.nix
@@ -1,7 +1,23 @@
+{ config, ... }:
 {
   security.acme = {
     acceptTerms = true;
     defaults.email = "andrea.ciceri@autistici.org";
+    certs = {
+      "aciceri.dev" = {
+        reloadServices = [ "nginx.service" ];
+        domain = "aciceri.dev";
+        extraDomainNames = [
+          "*.sisko.zt.aciceri.dev"
+          "*.sisko.wg.aciceri.dev"
+        ];
+        dnsProvider = "cloudflare";
+        # dnsResolver = "1.1.1.1:53";
+        dnsPropagationCheck = true;
+        group = config.services.nginx.group;
+        environmentFile = config.age.secrets.cloudflare-dyndns-api-token.path;
+      };
+    };
   };
 
   networking.firewall.allowedTCPPorts = [
@@ -11,6 +27,7 @@
 
   services.nginx = {
     enable = true;
+    statusPage = true;
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
     recommendedProxySettings = true;
diff --git a/modules/paperless/default.nix b/modules/paperless/default.nix
index e1e01fb..eea062d 100644
--- a/modules/paperless/default.nix
+++ b/modules/paperless/default.nix
@@ -25,14 +25,15 @@
 
   imports = [ ../nginx-base ];
 
-  services.nginx.virtualHosts."paper.aciceri.dev" = {
+  services.nginx.virtualHosts."paper.sisko.wg.aciceri.dev" = {
     forceSSL = true;
-    enableACME = true;
+    useACMEHost = "aciceri.dev";
     locations."/" = {
       proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
     };
     extraConfig = ''
       client_max_body_size 50000M;
     '';
+    serverAliases = [ "paper.sisko.zt.aciceri.dev" ];
   };
 }
diff --git a/modules/radarr/default.nix b/modules/radarr/default.nix
index 321b7a5..77ee804 100644
--- a/modules/radarr/default.nix
+++ b/modules/radarr/default.nix
@@ -2,4 +2,13 @@
   services.radarr = {
     enable = true;
   };
+
+  services.nginx.virtualHosts."radarr.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations."/" = {
+      proxyPass = "http://localhost:7878"; # FIXME hardcoded port
+    };
+    serverAliases = [ "radarr.sisko.zt.aciceri.dev" ];
+  };
 }
diff --git a/modules/sisko-proxy/default.nix b/modules/sisko-proxy/default.nix
index 353af1b..f35fcd1 100644
--- a/modules/sisko-proxy/default.nix
+++ b/modules/sisko-proxy/default.nix
@@ -15,26 +15,17 @@
         proxy_set_header    Connection  $connection_upgrade;
       '';
     };
-    "torrent.aciceri.dev" = {
+    "home.sisko.aciceri.dev" = {
       forceSSL = true;
-      enableACME = true;
+      useACMEHost = "aciceri.dev";
       locations."/" = {
-        proxyPass = "http://localhost:${builtins.toString config.services.transmission.settings.rpc-port}";
-      };
-    };
-    "search.aciceri.dev" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:8888";
-      };
-    };
-    "invidious.aciceri.dev" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:${builtins.toString config.services.invidious.port}";
+        proxyPass = "http://localhost:${builtins.toString config.services.home-assistant.config.http.server_port}";
+        proxyWebsockets = true;
       };
+      extraConfig = ''
+        proxy_set_header    Upgrade     $http_upgrade;
+        proxy_set_header    Connection  $connection_upgrade;
+      '';
     };
     "photos.aciceri.dev" = {
       extraConfig = ''
diff --git a/modules/transmission/default.nix b/modules/transmission/default.nix
index 0a7b3fd..eda7055 100644
--- a/modules/transmission/default.nix
+++ b/modules/transmission/default.nix
@@ -48,4 +48,13 @@
   environment.persistence."/persist".directories = [
     config.services.transmission.home
   ];
+
+  services.nginx.virtualHosts."torrent.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.transmission.settings.rpc-port}";
+    };
+    serverAliases = [ "torrent.sisko.zt.aciceri.dev" ];
+  };
 }