diff --git a/flake.nix b/flake.nix
index 9a7646f..608d4df 100644
--- a/flake.nix
+++ b/flake.nix
@@ -38,20 +38,20 @@
     in {
     overlays = import ./overlays.nix {inherit inputs;};
 
-    nixosConfigurations.server = nixpkgs.lib.nixosSystem {
+    nixosConfigurations.server = nixpkgs-unstable.lib.nixosSystem {
       inherit system;
       modules = [
         ./users/anon
         ./modules/collections/server.nix
         ./systems/server/configuration.nix
         ({ config, outputs, ... }: { nixpkgs.overlays = with outputs.overlays; [additions modifications unstable-packages]; })
-        home-manager.nixosModules.home-manager
+        home-manager-unstable.nixosModules.home-manager
         agenix.nixosModules.default
       ];
       specialArgs = {
         ## Custom variables (e.g. ip, interface, etc)
         vars = import ./systems/userdata-default.nix // import ./systems/server/userdata.nix;
-        pkgsVersion = nixpkgs;
+        pkgsVersion = nixpkgs-unstable;
         inherit inputs outputs;
       };
     };
diff --git a/modules/services/github-runner.nix b/modules/services/github-runner.nix
index fba7c45..c1e72a6 100644
--- a/modules/services/github-runner.nix
+++ b/modules/services/github-runner.nix
@@ -26,7 +26,7 @@
         "d /data 0770 github-actions-runner nginx -"
         "d /data/website 0770 github-actions-runner nginx -"
     ];
-    services.github-runner = {
+    services.github-runners.oberprofis = {
         enable = true;
         name = "nixos-server";
         tokenFile = config.age.secrets.github-runner-token.path;
diff --git a/modules/services/kavita.nix b/modules/services/kavita.nix
index f004414..7b87118 100644
--- a/modules/services/kavita.nix
+++ b/modules/services/kavita.nix
@@ -1,7 +1,5 @@
 { config, pkgs, lib, inputs, ... }:
 let
-  fqdn = "kavita.home.arpa";
-  useHttps = config.services.step-ca.enable;
   baseDir = "/mnt/1tbssd/kavita";
   mangal = "${pkgs.mangal}/bin/mangal";
 in
@@ -19,26 +17,16 @@ in
   services.kavita = {
     enable = true;
     user = "kavita";
-    port = 5000;
+    settings.Port = 5000;
     dataDir = baseDir;
     tokenKeyFile = config.age.secrets.kavita.path;
     package = pkgs.my-kavita;
+    settings.BaseUrl = "/kavita";
   };
 
   #todo: base url needs new kavita version
   systemd.services.kavita = {
-      after = [ "nginx.service" "step-ca.service" ];
-      preStart = ''
-        umask u=rwx,g=rx,o=
-        cat > "/mnt/1tbssd/kavita/config/appsettings.json" <<EOF
-        {
-          "TokenKey": "$(cat ${config.age.secrets.kavita.path})",
-          "Port": 5000,
-          "BaseUrl" : "/books",
-          "IpAddresses": "${lib.concatStringsSep "," ["0.0.0.0" "::"]}"
-        }
-        EOF
-      '';
+      after = [ "nginx.service" ];
   };
 
   systemd.services.download-manga = {
@@ -62,14 +50,9 @@ in
     };
   };
 
-  security.acme.certs."${fqdn}".server = "https://127.0.0.1:8443/acme/acme/directory";
-  services.nginx.virtualHosts."${fqdn}" = {
-    forceSSL = useHttps;
-    enableACME = useHttps;
-    quic = useHttps;
-    http3 = useHttps;
-    locations."/".proxyPass = "http://127.0.0.1:5000";
-    locations."/".extraConfig = ''
+  services.nginx.virtualHosts."kopatz.ddns.net".locations."/kavita" = {
+    proxyPass = "http://127.0.0.1:5000";
+    extraConfig = ''
       add_header Access-Control-Allow-Origin *;
       add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
       add_header Access-Control-Allow-Headers "Authorization, Origin, X-Requested-With, Content-Type, Accept";
diff --git a/modules/services/nextcloud.nix b/modules/services/nextcloud.nix
index d573f80..7fddd1f 100644
--- a/modules/services/nextcloud.nix
+++ b/modules/services/nextcloud.nix
@@ -39,21 +39,16 @@ in
     };
     services.nextcloud = {
         enable = true;
-        package = pkgs.nextcloud27;
+        package = pkgs.nextcloud28;
         https = true;
         hostName = "nextcloud.home.arpa";
         config.adminpassFile = config.age.secrets.nextcloud-admin.path;
         config.dbtype = "pgsql";
         database.createLocally = true;
-        config.extraTrustedDomains = [ wireguardIp "nextcloud.home.arpa" ];
+        settings.trusted_domains = [ wireguardIp "nextcloud.home.arpa" ];
         home = "/mnt/250ssd/nextcloud";
         extraApps = with config.services.nextcloud.package.packages.apps; {
             inherit onlyoffice calendar mail;
-            spreed = pkgs.fetchNextcloudApp rec {
-                url = "https://github.com/nextcloud-releases/spreed/releases/download/v17.1.1/spreed-v17.1.1.tar.gz";
-                sha256 = "sha256-LaUG0maatc2YtWQjff7J54vadQ2RE4X6FcW8vFefBh8=";
-                license = "agpl3";
-            };
         };
 
         phpOptions = {
@@ -61,7 +56,7 @@ in
           post_max_size = lib.mkForce "20G";
         };
         extraAppsEnable = true;
-        extraOptions.enabledPreviewProviders = [
+        settings.enabledPreviewProviders = [
             "OC\\Preview\\BMP"
             "OC\\Preview\\GIF"
             "OC\\Preview\\JPEG"
diff --git a/secrets/github-runner-token.age b/secrets/github-runner-token.age
index 69edd0d..981a396 100644
Binary files a/secrets/github-runner-token.age and b/secrets/github-runner-token.age differ