diff --git a/base.nix b/base.nix
index fba6df9..6216d8f 100644
--- a/base.nix
+++ b/base.nix
@@ -15,6 +15,12 @@
     )
   ];
 
+  # TODO: how can i do this in home-manager?
+  nixpkgs.config.permittedInsecurePackages = [
+    "pulsar-1.106.0"
+    "zotero-6.0.26"
+  ];
+
   environment.systemPackages = with pkgs; [
     ddrescue
     gptfdisk
diff --git a/flake.nix b/flake.nix
index 913a7f8..f07ba83 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,7 +42,6 @@
     nixpkgs-19.flake = false; # Earlier versions are not flake-pure
     /**/
 
-    # TODO: somehow make these private repos optional (a lazy fetch would be nice)
     pbsds-papers.url = "git+ssh://git@github.com/pbsds/papers.git";
   };
 
diff --git a/hosts/bolle/default.nix b/hosts/bolle/default.nix
index 09dab63..6fe06b9 100644
--- a/hosts/bolle/default.nix
+++ b/hosts/bolle/default.nix
@@ -19,7 +19,7 @@
     ../../profiles/shell/nix-utils.nix
     #../../profiles/shell/binfmt-emu.nix # qemu won't compile...
 
-    ../../profiles/domeneshop-dyndns # TODO: secrets
+    ../../profiles/domeneshop-dyndns
     #../../profiles/code-remote
     #../../profiles/remote-builders
     #../../profiles/autossh-reverse-tunnels
diff --git a/hosts/brumlebasse/default.nix b/hosts/brumlebasse/default.nix
index 4f74a9d..20b14e6 100644
--- a/hosts/brumlebasse/default.nix
+++ b/hosts/brumlebasse/default.nix
@@ -22,7 +22,7 @@
     ../../profiles/shell/nix-utils.nix
     #../../profiles/shell/binfmt-emu.nix # qemu won't compile...
 
-    #../../profiles/domeneshop-dyndns # TODO: secrets
+    #../../profiles/domeneshop-dyndns
   ];
   #services.domeneshop-updater.targets = [ config.networking.fqdn ];
 
diff --git a/hosts/garp/default.nix b/hosts/garp/default.nix
index 669ea0c..1908168 100644
--- a/hosts/garp/default.nix
+++ b/hosts/garp/default.nix
@@ -26,8 +26,8 @@
     ../../profiles/upgrade-diff.nix
     ../../profiles/sshd.nix
     ../../profiles/no-suspend.nix
-    ../../profiles/podman.nix
-    ../../profiles/docker.nix
+    #../../profiles/podman.nix
+    #../../profiles/docker.nix
 
     ../../users/pbsds
 
@@ -37,12 +37,12 @@
     #../../profiles/shell/binfmt-emu.nix # qemu won't compile...
 
     ../../profiles/desktop/base.nix
-    ../../profiles/desktop/gnome # configures gdm
-    #../../profiles/desktop/sound/alsa.nix
-    #../../profiles/desktop/sound/pulseaudio.nix
-    ../../profiles/desktop/sound/pipewire.nix
+    #../../profiles/desktop/gnome # configures gdm
+    ##../../profiles/desktop/sound/alsa.nix
+    ##../../profiles/desktop/sound/pulseaudio.nix
+    #../../profiles/desktop/sound/pipewire.nix
 
-    ../../profiles/domeneshop-dyndns # TODO: secrets
+    ../../profiles/domeneshop-dyndns
   ];
   services.domeneshop-updater.targets = [ config.networking.fqdn ];
 
diff --git a/profiles/remote-builders/default.nix b/profiles/remote-builders/default.nix
index 344e741..561ab48 100644
--- a/profiles/remote-builders/default.nix
+++ b/profiles/remote-builders/default.nix
@@ -21,8 +21,10 @@ let
       #mandatoryFeatures  = [ ];
       publicKey  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeOB/57N1fQPVorIUlkkJZaQduBo+4+km2Qbj4ebd/k";
       proxy.user = "pederbs";
-      proxy.host = "isvegg.pvv.ntnu.no";
-      proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU=";
+      #proxy.host = "isvegg.pvv.ntnu.no";
+      #proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="; # isvegg
+      proxy.host = "hildring.pvv.ntnu.no";
+      proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="; # hildring
     }
     /**/
     {
@@ -36,8 +38,10 @@ let
       #mandatoryFeatures  = [ ];
       publicKey  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOkcZ3cUAKk8uUvZPsX7PDBInkb3Eps3Xh+xVrhPY+sx";
       proxy.user = "pederbs";
-      proxy.host = "isvegg.pvv.ntnu.no";
-      proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU=";
+      #proxy.host = "isvegg.pvv.ntnu.no";
+      #proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="; # isvegg
+      proxy.host = "hildring.pvv.ntnu.no";
+      proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="; # hildring
     }
     /** /
     {
@@ -64,8 +68,10 @@ let
       #mandatoryFeatures  = [ ];
       publicKey          = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDuWdqEQ5mmVjuKi6f/Q2PFxuqB3URpgTHid06Vw7we";
       proxy.user         = "pederbs";
-      proxy.host         = "isvegg.pvv.ntnu.no";
-      proxy.publicKey    = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU=";
+      #proxy.host = "isvegg.pvv.ntnu.no";
+      #proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="; # isvegg
+      proxy.host = "hildring.pvv.ntnu.no";
+      proxy.publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="; # hildring
     }
     /** /
     {