diff --git a/config.nix b/config.nix
index 3978417c411e65f0c880733198f34ef5b547fc11..05104fdac163f686a3c899a9a4af626b5bccd45b 100644
--- a/config.nix
+++ b/config.nix
@@ -3,5 +3,6 @@   pkgs ? import <nixpkgs> { },
 }:
 {
   username = "jolheiser";
+  sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+uhnfFLhlyfGGsksSxh5IIY6gnIMryeQ2EiM979kZa";
   domain = "jolheiser.com";
 }
diff --git a/dragonwell/default.nix b/dragonwell/default.nix
index 8480926ea43d7a4c0098c7433cbbf11e2010369e..738e174071e819dbcb9ab4563e9e4a907c3cc7ff 100644
--- a/dragonwell/default.nix
+++ b/dragonwell/default.nix
@@ -1,7 +1,4 @@
 { jolheiser, ... }:
-let
-  key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+uhnfFLhlyfGGsksSxh5IIY6gnIMryeQ2EiM979kZa";
-in
 {
   imports =
     (map (name: ./services + "/${name}") (builtins.attrNames (builtins.readDir ./services)))
@@ -39,9 +36,9 @@         "docker"
         "storage"
       ];
       isNormalUser = true;
-      openssh.authorizedKeys.keys = [ key ];
+      openssh.authorizedKeys.keys = [ jolheiser.sshKey ];
     };
-    "root".openssh.authorizedKeys.keys = [ key ];
+    "root".openssh.authorizedKeys.keys = [ jolheiser.sshKey ];
   };
 
   nix = {
diff --git a/gunpowder/default.nix b/gunpowder/default.nix
index 00dd9604e462031a376fdea59aeff4336fa25b3c..ef70ac02f632e38dbdd9ec733db6097aaf9648c6 100644
--- a/gunpowder/default.nix
+++ b/gunpowder/default.nix
@@ -1,11 +1,13 @@
-{ jolheiser, pkgs, ... }:
+{ pkgs, ... }:
 let
+  username = "jolheiser";
   key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJh5aUDN/KN28+4tbayXRQliLyKFZaCZtUMEBNaJfHYj";
 in
 {
-  imports =
-    (map (name: ./services + "/${name}") (builtins.attrNames (builtins.readDir ./services)))
-    ++ [ ./hardware.nix ];
+  imports = [
+    ./beszel.nix
+    ./hardware.nix
+  ];
 
   boot = {
     kernelPackages = pkgs.linuxPackages_latest;
@@ -52,11 +54,63 @@       enable = true;
       package = pkgs.mullvad-vpn;
     };
     resolved.enable = true;
+
+    # media
+    jellyfin = {
+      enable = true;
+      openFirewall = true;
+    };
+    tailproxy.jellyfin = {
+      enable = true;
+      hostname = "jellyfin";
+      port = 8096;
+      authKey = "tskey-auth-khZwt3ASDX11CNTRL-jYDAVuX7VVLCebLUGdvnVLLoUkeEevXEV"; # One-time key
+    };
+    sonarr = {
+      enable = true;
+      openFirewall = true;
+    };
+    tailproxy.sonarr = {
+      enable = true;
+      hostname = "sonarr";
+      port = 8989;
+      authKey = "tskey-auth-k1mZ4587A511CNTRL-uxq54KBAvb6YuhvZbxscb6rf7x8UwNiP"; # One-time key
+    };
+    radarr = {
+      enable = true;
+      openFirewall = true;
+    };
+    tailproxy.radarr = {
+      enable = true;
+      hostname = "radarr";
+      port = 7878;
+      authKey = "tskey-auth-kjuWphWmFp11CNTRL-dcpVCTbdPTAAiqQHaKVhTA27uNQeHxmq5"; # One-time key
+    };
+    bazarr = {
+      enable = true;
+      openFirewall = true;
+    };
+    tailproxy.bazarr = {
+      enable = true;
+      hostname = "bazarr";
+      port = 6767;
+      authKey = "tskey-auth-kydeAt7KDA21CNTRL-bLfZMG4ip4i4a91DX1b85ipjnZi9KgoN9"; # One-time key
+    };
+    prowlarr = {
+      enable = true;
+      openFirewall = true;
+    };
+    tailproxy.prowlarr = {
+      enable = true;
+      hostname = "prowlarr";
+      port = 9696;
+      authKey = "tskey-auth-koCbGEVEvh11CNTRL-7pxqVBdP4v5xNvsPP5mMv5oW8PrgVQmb"; # One-time key
+    };
   };
 
   users = {
     users = {
-      "${jolheiser.username}" = {
+      "${username}" = {
         extraGroups = [
           "wheel"
           "docker"
@@ -70,6 +124,9 @@     };
     groups.media.members = [
       "jolheiser"
       "olheiser"
+      "jellyfin"
+      "radarr"
+      "sonarr"
     ];
   };
 
diff --git a/gunpowder/services/bazarr.nix b/gunpowder/services/bazarr.nix
deleted file mode 100644
index 9a1ea19bd78afc4f5576f652b8939a5f9cc360fe..0000000000000000000000000000000000000000
--- a/gunpowder/services/bazarr.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  services = {
-    bazarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    tailproxy.bazarr = {
-      enable = true;
-      hostname = "bazarr";
-      port = 6767;
-      authKey = "tskey-auth-kydeAt7KDA21CNTRL-bLfZMG4ip4i4a91DX1b85ipjnZi9KgoN9"; # One-time key
-    };
-  };
-}
diff --git a/gunpowder/services/beszel.nix b/gunpowder/beszel.nix
rename from gunpowder/services/beszel.nix
rename to gunpowder/beszel.nix
index ff157f647a0f75d2d98c9307aa2e5cfba2cab0e5..d6e2596e5936819d7be2ab24125c526b879098f0 100644
--- a/gunpowder/services/beszel.nix
+++ b/gunpowder/beszel.nix
@@ -1,9 +1,6 @@
-{ lib, config, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  age.secrets.beszel-gunpowder.file = ../../secrets/beszel-gunpowder.age;
+{ config, ... }:
+{
+  age.secrets.beszel-gunpowder.file = ../secrets/beszel-gunpowder.age;
   services.beszel.agent = {
     enable = true;
     environment = {
diff --git a/gunpowder/services/jellyfin.nix b/gunpowder/services/jellyfin.nix
deleted file mode 100644
index 2f8374d7eefd66c06e0c231a4aec3caee7007bde..0000000000000000000000000000000000000000
--- a/gunpowder/services/jellyfin.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  services = {
-    jellyfin = {
-      enable = true;
-      openFirewall = true;
-    };
-    tailproxy.jellyfin = {
-      enable = true;
-      hostname = "jellyfin";
-      port = 8096;
-      authKey = "tskey-auth-khZwt3ASDX11CNTRL-jYDAVuX7VVLCebLUGdvnVLLoUkeEevXEV"; # One-time key
-    };
-  };
-  users.groups.media.members = [ "jellyfin" ];
-}
diff --git a/gunpowder/services/prowlarr.nix b/gunpowder/services/prowlarr.nix
deleted file mode 100644
index d3dc752b8e133ca10dcd9e01dd9ae0ca99179811..0000000000000000000000000000000000000000
--- a/gunpowder/services/prowlarr.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  services = {
-    prowlarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    tailproxy.prowlarr = {
-      enable = true;
-      hostname = "prowlarr";
-      port = 9696;
-      authKey = "tskey-auth-koCbGEVEvh11CNTRL-7pxqVBdP4v5xNvsPP5mMv5oW8PrgVQmb"; # One-time key
-    };
-  };
-}
diff --git a/gunpowder/services/radarr.nix b/gunpowder/services/radarr.nix
deleted file mode 100644
index 14afd26fb07ff5782d5fc1569f403ab03cd997c3..0000000000000000000000000000000000000000
--- a/gunpowder/services/radarr.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  services = {
-    radarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    tailproxy.radarr = {
-      enable = true;
-      hostname = "radarr";
-      port = 7878;
-      authKey = "tskey-auth-kjuWphWmFp11CNTRL-dcpVCTbdPTAAiqQHaKVhTA27uNQeHxmq5"; # One-time key
-    };
-  };
-  users.groups.media.members = [ "radarr" ];
-}
diff --git a/gunpowder/services/sonarr.nix b/gunpowder/services/sonarr.nix
deleted file mode 100644
index 7ff6f9354eec58dac82b181cb6458a26736e993d..0000000000000000000000000000000000000000
--- a/gunpowder/services/sonarr.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  services = {
-    sonarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    tailproxy.sonarr = {
-      enable = true;
-      hostname = "sonarr";
-      port = 8989;
-      authKey = "tskey-auth-k1mZ4587A511CNTRL-uxq54KBAvb6YuhvZbxscb6rf7x8UwNiP"; # One-time key
-    };
-  };
-  users.groups.media.members = [ "sonarr" ];
-}
diff --git a/jasmine/beszel.nix b/jasmine/beszel.nix
new file mode 100644
index 0000000000000000000000000000000000000000..eb7e365c97c24da7d856564f87b6673160addfa8
--- /dev/null
+++ b/jasmine/beszel.nix
@@ -0,0 +1,9 @@
+{ config, ... }:
+{
+  age.secrets.beszel-jasmine.file = ../secrets/beszel-jasmine.age;
+  services.beszel.agent = {
+    enable = true;
+    environment.LOG_LEVEL = "info";
+    environmentFile = config.age.secrets.beszel-jasmine.path;
+  };
+}
diff --git a/jasmine/default.nix b/jasmine/default.nix
index 0a2111e64105bbf1de243efb93c1a60baad14eb3..8c66d174aa477608eeeacf8c2b19d085f1c4edb1 100644
--- a/jasmine/default.nix
+++ b/jasmine/default.nix
@@ -1,11 +1,16 @@
-{ jolheiser, pkgs, ... }:
+{ pkgs, ... }:
 let
+  username = "jolheiser";
   key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7cgpIUaEY3q12xBct9a0gIl7rdckBBPsWQea7Wtj7P";
 in
 {
-  imports =
-    (map (name: ./services + "/${name}") (builtins.attrNames (builtins.readDir ./services)))
-    ++ [ ./hardware.nix ];
+  imports = [
+    ./beszel.nix
+    ./cifs.nix
+    ./homeassistant.nix
+    ./slideshow.nix
+    ./hardware.nix
+  ];
 
   boot.loader.grub = {
     enable = true;
@@ -43,7 +48,7 @@     displayManager = {
       lightdm.enable = true;
       autoLogin = {
         enable = true;
-        user = jolheiser.username;
+        user = username;
       };
       defaultSession = "none+i3";
     };
@@ -57,7 +62,7 @@     fail2ban.enable = true;
   };
 
   users.users = {
-    "${jolheiser.username}" = {
+    "${username}" = {
       isNormalUser = true;
       extraGroups = [
         "networkmanager"
@@ -81,7 +86,7 @@     settings = {
       trusted-users = [
         "@sudo"
         "@wheel"
-        "${jolheiser.username}"
+        "jolheiser"
       ];
       experimental-features = [
         "flakes"
diff --git a/jasmine/homeassistant.nix b/jasmine/homeassistant.nix
new file mode 100644
index 0000000000000000000000000000000000000000..9e7eb2df922b4ab263484c458c4d97430cd80e13
--- /dev/null
+++ b/jasmine/homeassistant.nix
@@ -0,0 +1,18 @@
+{
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers.homeassistant = {
+      volumes = [ "home-assistant:/config" ];
+      environment.TZ = "America/Chicago";
+      image = "ghcr.io/home-assistant/home-assistant:stable"; # Warning: if the tag does not change, the image will not be updated
+      extraOptions = [
+        "--network=host"
+        # "--device=/dev/ttyACM0:/dev/ttyACM0" # Example, change this to match your own hardware
+      ];
+    };
+  };
+  networking.firewall.allowedTCPPorts = [
+    4001
+    8123
+  ];
+}
diff --git a/jasmine/services/beszel.nix b/jasmine/services/beszel.nix
deleted file mode 100644
index 080293f0a46c4bb78affce11ef129b2d86ad7e5f..0000000000000000000000000000000000000000
--- a/jasmine/services/beszel.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ config, lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  age.secrets.beszel-jasmine.file = ../../secrets/beszel-jasmine.age;
-  services.beszel.agent = {
-    enable = true;
-    environment.LOG_LEVEL = "info";
-    environmentFile = config.age.secrets.beszel-jasmine.path;
-  };
-}
diff --git a/jasmine/services/cifs.nix b/jasmine/cifs.nix
rename from jasmine/services/cifs.nix
rename to jasmine/cifs.nix
index bd664b66c97a6cd6c620b7a78c212f01864069c0..67cd47fb413ebb7ec6b66a4e44d8ffa8a6f3fece 100644
--- a/jasmine/services/cifs.nix
+++ b/jasmine/cifs.nix
@@ -1,14 +1,6 @@
+{ pkgs, config, ... }:
 {
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  age.secrets.cifs.file = ../../secrets/cifs.age;
+  age.secrets.cifs.file = ../secrets/cifs.age;
   environment.systemPackages = [ pkgs.cifs-utils ];
   fileSystems."/mnt/slideshow" = {
     device = "//192.168.40.244/slideshow";
diff --git a/jasmine/services/homeassistant.nix b/jasmine/services/homeassistant.nix
deleted file mode 100644
index 0970eedeec0a01fdd586eb9e1b53c78d7ba16d0b..0000000000000000000000000000000000000000
--- a/jasmine/services/homeassistant.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers.homeassistant = {
-      volumes = [ "home-assistant:/config" ];
-      environment.TZ = "America/Chicago";
-      image = "ghcr.io/home-assistant/home-assistant:stable";
-      extraOptions = [
-        "--network=host"
-      ];
-    };
-  };
-  networking.firewall.allowedTCPPorts = [
-    4001
-    8123
-  ];
-}
diff --git a/jasmine/services/slideshow.nix b/jasmine/slideshow.nix
rename from jasmine/services/slideshow.nix
rename to jasmine/slideshow.nix
index 1b64a6cd315cda310d24d47360347445ae4319e4..e9ff241c2676cfbf93563eb49f0273da66df8822 100644
--- a/jasmine/services/slideshow.nix
+++ b/jasmine/slideshow.nix
@@ -1,6 +1,5 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 let
-  enable = true;
   root = "/mnt/slideshow";
   slideshow = pkgs.writeShellApplication {
     name = "slideshow";
@@ -27,7 +26,7 @@       done
     '';
   };
 in
-lib.mkIf enable {
+{
   systemd.user.services = {
     slideshow = {
       description = "Autostart slideshow";
diff --git a/shincha/default.nix b/shincha/default.nix
index 3248ae73e3b3043683c5c83c70facec3f8c541af..ab95b4ed457cef2e64caed915d5c036f8f56ed92 100644
--- a/shincha/default.nix
+++ b/shincha/default.nix
@@ -1,11 +1,17 @@
-{ jolheiser, ... }:
 let
+  username = "jolheiser";
   key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBxdG9mduIWiQ+egYKMvUKKCyShdeM8O6QsLs6g5aGt";
 in
 {
-  imports =
-    (map (name: ./services + "/${name}") (builtins.attrNames (builtins.readDir ./services)))
-    ++ [ ./hardware.nix ];
+  imports = [
+    ./beszel.nix
+    ./cfg.nix
+    ./golink.nix
+    ./mazanoke.nix
+    ./oidc.nix
+    ./tclip.nix
+    ./hardware.nix
+  ];
 
   boot.loader.grub = {
     enable = true;
@@ -53,7 +59,7 @@     openssh.enable = true;
   };
 
   users.users = {
-    "${jolheiser.username}" = {
+    "${username}" = {
       isNormalUser = true;
       extraGroups = [
         "networkmanager"
@@ -77,7 +83,7 @@     settings = {
       trusted-users = [
         "@sudo"
         "@wheel"
-        "${jolheiser.username}"
+        "jolheiser"
       ];
       experimental-features = [
         "flakes"
diff --git a/shincha/services/beszel.nix b/shincha/beszel.nix
rename from shincha/services/beszel.nix
rename to shincha/beszel.nix
index 2dabfc532355111581407a80a8daabbdff161fa2..994c9bae452b48dcfa244f820c2f996e8b9d2029 100644
--- a/shincha/services/beszel.nix
+++ b/shincha/beszel.nix
@@ -1,10 +1,6 @@
-{ lib, config, ... }:
-let
-  enable = true;
-  host = "monit";
-in
-lib.mkIf enable {
-  age.secrets.beszel-shincha.file = ../../secrets/beszel-shincha.age;
+{ config, ... }:
+{
+  age.secrets.beszel-shincha.file = ../secrets/beszel-shincha.age;
   services = {
     beszel = {
       agent = {
@@ -15,14 +11,14 @@       };
       hub = {
         enable = true;
         environment = {
-          APP_URL = "https://${host}";
+          APP_URL = "https://monit";
           DISABLE_PASSWORD_AUTH = "true";
         };
       };
     };
     tailproxy.beszel = {
       enable = true;
-      hostname = host;
+      hostname = "monit";
       authKey = "tskey-auth-krRJB4JVL321CNTRL-Vfaa8HZwsVXzTU4MUAnBWXsZMCcFbrLVe"; # One-time key
       port = 8090;
     };
diff --git a/shincha/services/cfg.nix b/shincha/cfg.nix
rename from shincha/services/cfg.nix
rename to shincha/cfg.nix
index 0f6ff9b2ae41291f32a686942b7d4c2467ce58fc..3f2ef70e0d880571df46bcbaeb7a1ee608a936b0 100644
--- a/shincha/services/cfg.nix
+++ b/shincha/cfg.nix
@@ -1,8 +1,4 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
+{
   services.cfg-playground = {
     enable = true;
     verbose = true;
diff --git a/shincha/services/golink.nix b/shincha/golink.nix
rename from shincha/services/golink.nix
rename to shincha/golink.nix
index df19e38068712ec12690f1f0555dfcc375ca1860..887a64d14787a93a00bdd342e2c74355a045ae4b 100644
--- a/shincha/services/golink.nix
+++ b/shincha/golink.nix
@@ -1,8 +1,5 @@
-{ pkgs, lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
+{ pkgs, ... }:
+{
   services.golink = {
     enable = true;
     tailscaleAuthKeyFile = pkgs.writeText "tskey" "tskey-auth-k7Tfyvczdn11CNTRL-tE6VsLtnqEaTzfugS2XYEaEEaVQPxUsbf"; # One-time key
diff --git a/shincha/services/mazanoke.nix b/shincha/mazanoke.nix
rename from shincha/services/mazanoke.nix
rename to shincha/mazanoke.nix
index 7c89e1e3e984d0208d48941605bc6b4555d91b56..db0415476f795cba4c8c4a20e7bcba8344248e8b 100644
--- a/shincha/services/mazanoke.nix
+++ b/shincha/mazanoke.nix
@@ -1,8 +1,4 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
+{
   services = {
     mazanoke.enable = true;
     tailproxy.mazanoke = {
diff --git a/shincha/services/oidc.nix b/shincha/oidc.nix
rename from shincha/services/oidc.nix
rename to shincha/oidc.nix
index 0f8712e74e2bf5b630e96e9132cbe939fb609bd1..5e32e51e8a5fa9232b4f5d65de28d87763778245 100644
--- a/shincha/services/oidc.nix
+++ b/shincha/oidc.nix
@@ -1,17 +1,12 @@
-{ lib, ... }:
-let
-  enable = true;
-  host = "oidc";
-in
-lib.mkIf enable {
+{
   services = {
     oidc-playground = {
       enable = true;
-      origin = "https://${host}";
+      origin = "https://oidc";
     };
     tailproxy.oidc-playground = {
       enable = true;
-      hostname = host;
+      hostname = "oidc";
       authKey = "tskey-auth-kkFJ2NFkCX11CNTRL-Doq9XTGfm9Vxn8nb6QQU9VjmAh6ZFgih"; # One-time key
       port = 6432;
     };
diff --git a/shincha/services/tclip.nix b/shincha/tclip.nix
rename from shincha/services/tclip.nix
rename to shincha/tclip.nix
index 8f159fafe73404b2417fc15a7f47dce0e0aba734..3c202edf97dceba83f4e0085bc3ac8dadeb65ece 100644
--- a/shincha/services/tclip.nix
+++ b/shincha/tclip.nix
@@ -1,8 +1,4 @@
-{ lib, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
+{
   services.tclip = {
     enable = true;
     hostname = "paste";