diff --git a/configuration.nix b/configuration.nix
index 53b6f08..6469729 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -225,8 +225,8 @@
     ddclient
     telegram-desktop
     btop
-    ungoogled-chromium
-    opencode
+    # ungoogled-chromium
+    # opencode
     doas
     lan-mouse
     stylua
@@ -277,6 +277,7 @@
     keepassxc
     sops
     age
+    unzip
   ];
 
   # Some programs need SUID wrappers, can be configured further or are
@@ -294,10 +295,10 @@
   services.caddy = {
     enable = true;
     environmentFile = config.sops.templates."caddy.env".path;
-    globalConfig = ''
-      acme_ca https://acme.zerossl.com/v2/DV90
-      email {$ACME_EMAIL};
-    '';
+    # globalConfig = ''
+    #   acme_ca https://acme.zerossl.com/v2/DV90
+    #   email {$ACME_EMAIL};
+    # '';
 
     #tls ${config.sops.secrets.zerossl_cert.path} ${config.sops.secrets.zerossl_private_key.path}
     virtualHosts."centraldogma.site:".extraConfig = ''
@@ -316,12 +317,18 @@
       reverse_proxy /radarr/* 127.0.0.1:7878
 
     '';
-
-    virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = ''
-      root * /srv/root/
-      file_server
-      encode zstd gzip
+    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
+      redir /jellyfin /jellyfin/
+      reverse_proxy /jellyfin/* 127.0.0.1:8096
     '';
+    virtualHosts."git.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:3000
+    '';
+    # virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = ''
+    #   root * /srv/root/
+    #   file_server
+    #   encode zstd gzip
+    # '';
   };
   services.flaresolverr = {
     enable = true;
diff --git a/flake.lock b/flake.lock
index 6a02f65..e155dc2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -86,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789352311,
-        "narHash": "sha256-E9hlcRNSRQ1vb+UicOusX/ucroGlBAz/pYhCBorLOn4=",
+        "lastModified": 1789386765,
+        "narHash": "sha256-4hyLFBhzQC7+qPMELWc7J/sbdA6ckXZxXU9CYRsGhsc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cfcda3f99334c8459fa4cd46cce87502e0b48f0a",
+        "rev": "87c391f49a34660de6010f35bb50fb1bf811be9f",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1789149629,
-        "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=",
+        "lastModified": 1789286504,
+        "narHash": "sha256-eiEK7cKZORNEvX0GeF3RtNEF/JXhgf2RqSp3230q13E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b",
+        "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 7b32dd1..7b3daec 100644
--- a/flake.nix
+++ b/flake.nix
@@ -50,6 +50,10 @@
             inherit inputs;
           };
 
+          home-manager.sharedModules = [
+            inputs.sops-nix.homeManagerModules.sops
+          ];
+
           home-manager.users.mask = ./home.nix;
         }
 
diff --git a/home.nix b/home.nix
index 3afd8e4..119fcb0 100644
--- a/home.nix
+++ b/home.nix
@@ -83,6 +83,8 @@
     SOPS_EDITOR = "nvim";
     EDITOR = "nvim";
     VISUAL = "nvim";
+    TEST = "test";
+    TEST_A = "testa";
   };
 
   # Let Home Manager install and manage itself.
@@ -126,4 +128,13 @@
   };
 
   programs.home-manager.enable = true;
+
+  sops = {
+    age.keyFile = "/home/mask/.config/sops/age/keys.txt";
+    defaultSopsFile = ./secrets/secrets.yaml;
+    secrets = {
+      "github/token" = {};
+      "gitlab/token" = {};
+    };
+  };
 }
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 13b692a..84b4704 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -22,6 +22,7 @@ postgres:
     pgmasterpass: ENC[AES256_GCM,data:KYlzLRIV9jkbtbb8O8EiTXXYP+cPwYkV+WEse1T+grd5kPpl/xxAqAOIc44UcfQ8+FJMFpBe,iv:kWHbvoeLznuESsvKx5ADrPGGxVYVRMlRL3XUjr92+fU=,tag:dK2gii+lxVM7+Y++1eR5ZA==,type:str]
 pgmasterpass: ENC[AES256_GCM,data:s3KOZiag7h3iFYxBxXnhyYQ6ZG9jdav4uM9bQHgXdpYZW4yircOgoI1YiuciDoF1RhdOjbNh,iv:KzblpETo/wQtYUJUALAyvPRDlbuxXPiGOBhgJpVJd/8=,tag:Z5f7UhWNtn060UUm+/owqg==,type:str]
 gitea:
+    database: ENC[AES256_GCM,data:AiYQyrsmFVlWSYO+YFFgrCSTGTn3nl2tH+YcXlQKsLGJeNtTt1WV0/VvNuo=,iv:XZhZi183po9Mp8hAvSpti5qWec5+Rwu+UFPEUplZv0I=,tag:IFT/oP9Unwk+RE9sBLjJGg==,type:str]
     password: ENC[AES256_GCM,data:6GKcqsdLXaHVJODuuz2sZSZDn/0U1vT9NTfeuNlhwGO6MrQ9QYaOlpU3AI8=,iv:TL1EQnLXgXeenp0CqNAOajq4g66Spl1JLgPP3i4OpQc=,tag:9jPCAGR6zxKl0tzMeXWsGA==,type:str]
 caddy:
     acme_email: ENC[AES256_GCM,data:TpXEvreBkq2gqpq3OTokke/Zues=,iv:iO8jIMEzBpk5DOksQqnT87Nq8vFTG28qELvfIscOqWc=,tag:poK3Kl1bkePLetSF5DPb9A==,type:str]
@@ -49,7 +50,7 @@ sops:
             OXJfnqQIRsiwQJFNLDjB4hNZ5r9iupVj66BAbadO3pwlHWOFt6+PaQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1xgfxwt7488dkpksgjawc53ewsc4p94jy6kdvnpd5r0jv5a5yr9tqzxy8x2
-    lastmodified: "2026-09-14T02:31:14Z"
-    mac: ENC[AES256_GCM,data:P+9OCeLiwRCEfDcxVfK8ryFgfLy8oxR3KG02rhFmuQ2QqGKxuVQv5lHSB7QX8pzwM6+t7iAz666dk5+6Ztj48v+WruXwkV+gC1sM+NhfFmP5El0ItCozyvzu8/+pgcMFtsBoJ9DSgK8vQzAvPbKm1MjFSbLvqCuq753HsjYKiz0=,iv:oMKTX/1zXx3JgjLJEVYA7ROQYg3ueFvzj+bMdKPFq8Y=,tag:/y9zg6YtNjgqmYnydDE5gQ==,type:str]
+    lastmodified: "2026-09-14T10:21:43Z"
+    mac: ENC[AES256_GCM,data:rCIlQV0lfuJl+E0t4Y5IvOFxToL4+47IfMzIm7V7eq3aoj13nv8g+2k2yZncV22shjJppasvyis7u6KtFsvDNkmc+VdduiuB3vBKNkBOr3IRwtOhvzqIHyvTeN9xsy/cGmrASr661jnM8aruMOMoevsyF1LMO/f15QzS/grUOlc=,iv:dZnCqRSXMeDvv/f4vekEqu9hPvl62Vzid0HZfXTRs2k=,tag:ie90n1/kQGNZB98/5cNaRQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3