diff --git a/configurations/server.nix b/configurations/server.nix
index d539a88..6caa828 100644
--- a/configurations/server.nix
+++ b/configurations/server.nix
@@ -113,9 +113,10 @@ let
         hostName = "${xlib.device.hostname}";
         networkmanager.enable = true;
         firewall.enable = false;
-        # nameservers = [
-        #   "127.0.0.1"
-        # ];
+        nameservers = [
+          "127.0.0.1"
+          "192.168.1.1"
+        ];
       };
 
       system = {
diff --git a/modules/server/chrony.nix b/modules/server/chrony.nix
new file mode 100644
index 0000000..34c8187
--- /dev/null
+++ b/modules/server/chrony.nix
@@ -0,0 +1,10 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  services.chrony = {
+    enable = true;
+  };
+}
diff --git a/modules/server/default.nix b/modules/server/default.nix
index b71c6e6..e6f45d7 100644
--- a/modules/server/default.nix
+++ b/modules/server/default.nix
@@ -7,6 +7,7 @@
     ../software/beets
     ./bentopdf.nix
     ./calibre-web.nix
+    ./chrony.nix
     ./coredns.nix
     ./gitea.nix
     ./glances.nix
diff --git a/modules/server/gitea.nix b/modules/server/gitea.nix
index 14d7c25..bf7bc6b 100644
--- a/modules/server/gitea.nix
+++ b/modules/server/gitea.nix
@@ -14,7 +14,7 @@
       appName = "ZeroQ Gitea Service";
       settings = {
         server = {
-          DOMAIN = "gitea.local";
+          DOMAIN = "git.home.arpa";
           HTTP_PORT = 3000;
         };
         service.DISABLE_REGISTRATION = true;
diff --git a/modules/server/nginx.nix b/modules/server/nginx.nix
index f895858..f0bc550 100644
--- a/modules/server/nginx.nix
+++ b/modules/server/nginx.nix
@@ -29,6 +29,10 @@ in
               addr = "192.168.1.20";
               port = 10000;
             }
+            {
+              addr = "127.0.0.1";
+              port = 10000;
+            }
           ];
         };
         "office.home.arpa" = {
@@ -51,6 +55,10 @@ in
               addr = "192.168.1.20";
               port = 8446;
             }
+            {
+              addr = "127.0.0.1";
+              port = 10000;
+            }
           ];
           extraConfig = ''
             client_max_body_size 5G;
@@ -61,7 +69,7 @@ in
           enableACME = true;
           locations = {
             "/" = {
-              proxyPass = "http://${server}:8446";
+              proxyPass = "http://127.0.0.1:8446";
               proxyWebsockets = true;
             };
           };
@@ -74,11 +82,11 @@ in
           enableACME = true;
           locations = {
             "/" = {
-              proxyPass = "http://${server}:10000";
+              proxyPass = "http://127.0.0.1:10000";
               proxyWebsockets = true;
             };
             "/whiteboard" = {
-              proxyPass = "http://${server}:3002";
+              proxyPass = "http://127.0.0.1:3002";
               proxyWebsockets = true;
             };
           };
@@ -90,7 +98,7 @@ in
           forceSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://${server}:9000";
+            proxyPass = "http://127.0.0.1:9000";
             proxyWebsockets = true;
           };
           extraConfig = ''
@@ -101,7 +109,18 @@ in
           forceSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://${server}:3000";
+            proxyPass = "http://127.0.0.1:3000";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "git.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:3000";
             proxyWebsockets = true;
           };
           extraConfig = ''
@@ -123,7 +142,7 @@ in
           forceSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://${server}:4001";
+            proxyPass = "http://127.0.0.1:4001";
             proxyWebsockets = true;
           };
         };
@@ -131,7 +150,7 @@ in
           addSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://${server}:6061";
+            proxyPass = "http://127.0.0.1:6061";
             proxyWebsockets = true;
           };
         };
@@ -139,7 +158,7 @@ in
           addSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://${server}:2283";
+            proxyPass = "http://127.0.0.1:2283";
             proxyWebsockets = true;
           };
           extraConfig = ''
@@ -150,7 +169,7 @@ in
           forceSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://${server}:8083";
+            proxyPass = "http://127.0.0.1:8083";
             proxyWebsockets = true;
           };
           extraConfig = ''
@@ -161,7 +180,7 @@ in
           forceSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://${server}:53";
+            proxyPass = "http://127.0.0.1:53";
           };
           extraConfig = ''
             client_max_body_size 5G;
@@ -187,6 +206,10 @@ in
               addr = "192.168.1.20";
               port = 80;
             }
+            {
+              addr = "127.0.0.1";
+              port = 80;
+            }
           ];
         };
       };
diff --git a/modules/server/step-ca.nix b/modules/server/step-ca.nix
index ee61016..3d5db3f 100644
--- a/modules/server/step-ca.nix
+++ b/modules/server/step-ca.nix
@@ -31,6 +31,10 @@ in
         dataSource = "${varDir}/db";
       };
       authority = {
+        claims = {
+          defaultTLSCertDuration = "2160h";
+          maxTLSCertDuration = "2160h";
+        };
         provisioners = [
           {
             type = "ACME";