diff --git a/Justfile b/Justfile
index e3a0be5..951ba68 100755
--- a/Justfile
+++ b/Justfile
@@ -196,22 +196,21 @@ hm-iterate-qtile:
 
 # !!! DANGERIOUS !!! This wipes the disk which is configured for the given device.
 disk-prepare dir:
-	just -v _device diskPrepare {{dir}} --argstr rebuildarg "dummy"
+	just -v _device diskPrepare {{dir}}
 
 disk-relabel dir previous:
-	just -v _device diskRelabel {{dir}} --argstr rebuildarg "dummy" --argstr previousDiskId {{previous}}
+	just -v _device diskRelabel {{dir}} --argstr previousDiskId {{previous}}
 
 # Mount the target disk specified by device configuration directory. The 'dir' argument points to a device configuration, e.g. 'nix/os/devices/steveej-live-mmc-SL32G_0x259093f6'
 disk-mount dir:
-	just -v _device diskMount {{dir}} --argstr rebuildarg "dummy"
-
+	just -v _device diskMount {{dir}}
 # Unmount target disk, specified by device configuration directory
 disk-umount dir:
-	just -v _device diskUmount {{dir}} --argstr rebuildarg "dummy"
+	just -v _device diskUmount {{dir}}
 
 # Perform an offline installation on the mounted target disk, specified by device configuration directory
 disk-install dir: _render_templates
-	just -v _device diskInstall {{dir}} --argstr rebuildarg "dummy"
+	just -v _device diskInstall {{dir}}
 
 verify-n-unlock sshserver attempts="10":
 	#!/usr/bin/env bash
diff --git a/nix/os/containers/backup.nix b/nix/os/containers/backup.nix
index 6ade22f..3ac35d9 100644
--- a/nix/os/containers/backup.nix
+++ b/nix/os/containers/backup.nix
@@ -1,70 +1,13 @@
 { config
 , hostAddress
 , localAddress
+, subvolumes
+, targetPathSuffix ? ""
 }:
 
 let
-  unstablepkgs = import <channels-nixos-unstable> { config = config.nixpkgs.config; };
-
   passwords = import ../../variables/passwords.crypt.nix;
-  bucket = "bkp";
-  subvolumeParentDir = "/var/lib";
-
-  subvolumeDir = "/var/lib/container-volumes";
-  subvolumeSnapshot = "/var/lib/container-volumes.snapshot";
-
-  bkpSource = subvolumeSnapshot;
-  bkpDestination = "/container/backup";
-  cacheDir = "/var/lib/rclone-cachedir";
-
-  wasabiRc = pkgs: pkgs.writeText "rc" ''
-    [wasabi-${bucket}]
-    type = s3
-    provider = Wasabi
-    env_auth = false
-
-    #bkp user
-    access_key_id = ${passwords.storage.wasabi.bkp.key}
-    secret_access_key = ${passwords.storage.wasabi.bkp.secret}
-
-    region = us-east-1
-    endpoint = s3.wasabisys.com
-    location_constraint =
-    acl =
-    server_side_encryption =
-    storage_class =
-  '';
-
-
-  bkp-mount-rclone-manual = pkgs: {
-      enable = true;
-      description = "bkp-mount-rclone-manual service";
-      path = with pkgs; [ unstablepkgs.rclone utillinux ];
-      serviceConfig = {
-        Type = "notify";
-      };
-      script = ''
-        export PATH="$PATH:/run/wrappers/bin"
-        exec rclone --config ${wasabiRc pkgs} mount wasabi-${bucket}:${bucket} ${bkpDestination} \
-                    --stats=50m --stats-log-level=NOTICE \
-                    --cache-dir=${cacheDir} \
-                    --vfs-cache-mode=full
-
-      '';
-      preStart  = ''
-          mkdir -p ${bkpDestination}
-          mkdir -p ${cacheDir}
-      '';
-      postStop = ''
-          sync
-          umount ${bkpDestination} \
-            || umount -l ${bkpDestination} \
-            || :
-
-          rmdir ${bkpDestination}
-      '';
-    };
-
+  subvolumeParentDir = "/var/lib/container-volumes";
 
 in {
   config = { pkgs, ... }: {
@@ -74,18 +17,14 @@ in {
 
     environment.systemPackages = with pkgs; [
       btrfs-progs
-      rdup rdedup
-      iptraf-ng nethogs
-      rclone
+      btrbk
     ];
 
     networking.firewall.enable = true;
 
-    systemd.services."bkp-mount-rclone-manual" = bkp-mount-rclone-manual pkgs;
-
-    systemd.services."bkp-sync-rclone" = {
+    systemd.services."bkp-sync" = {
       enable = true;
-      description = "bkp-sync-rclone service";
+      description = "bkp-sync service";
 
       serviceConfig = {
         Type = "oneshot";
@@ -99,14 +38,10 @@ in {
         "bkp-run.service"
       ];
 
-      path = with pkgs; [ unstablepkgs.rclone utillinux ];
+      path = with pkgs; [ utillinux ];
       script = ''
         set -x
-        echo Starting rclone sync...
-        rclone --config ${wasabiRc pkgs} sync \
-          ${bkpDestination}/rdedup/ wasabi-${bucket}:${bucket}/rdedup/  \
-            --stats=50m --stats-log-level=WARNING
-        echo Finished rclone sync...
+        true
       '';
     };
 
@@ -119,41 +54,35 @@ in {
       };
 
       partOf = [
-        "bkp-sync-rclone.service"
+        "bkp-sync.service"
       ];
 
-      path = with pkgs; [ btrfs-progs rdup rdedup coreutils ];
-      preStart = ''
-        echo Creating new btrfs snapshot of ${subvolumeDir} at ${subvolumeSnapshot}
-        btrfs subvolume snapshot -r ${subvolumeDir} ${subvolumeSnapshot}
-      '';
-      script = ''
+      path = with pkgs; [ btrfs-progs btrbk coreutils ];
+
+      script = let 
+        bktrbkConf = pkgs.writeText "cfg" ''
+          timestamp_format long
+          ssh_identity ${passwords.storage.homeChBackup.keyPath}
+          ssh_user ${passwords.storage.homeChBackup.user}
+          ssh_compression no
+          backend_remote btrfs-progs-sudo
+          compat_remote busybox
+          btrfs_commit_delete each
+          snapshot_create onchange
+          snapshot_preserve_min latest
+          snapshot_preserve 7d 4w
+          target_preserve_min no
+          target_preserve 7d 4w 12m *y
+
+          volume ${subvolumeParentDir}
+            target ${passwords.storage.homeChBackup.target}/container-volumes/${targetPathSuffix}
+          ${builtins.foldl' (sum: elem: sum + "  subvolume " + elem + "\n") "" subvolumes}
+        '';
+      in ''
         #! ${pkgs.bash}/bin/bash
         set -Eeuxo pipefail
 
-        export RUST_BACKTRACE=1
-        export TIMESTAMP=$(date +"%Y%m%d.%H%M%S")
-
-        echo Starting rdup/rdedup backup...
-        for d in `ls -1 ${bkpSource}`; do
-          echo Determining backup source size ${bkpSource}/$d...
-          du -hs ${bkpSource}/$d
-          rdup -x /dev/null ${bkpSource}/$d | rdedup -v -ttt --dir=${bkpDestination}/rdedup store $d-''${TIMESTAMP}
-        done
-        sync
-        echo Finished rdup/rdedup backup...
-
-        echo Removing all previous backups...
-        rdedup --dir=${bkpDestination}/rdedup list | grep -v ''${TIMESTAMP} | xargs echo rdedup --dir=${bkpDestination}/rdedup remove
-
-        echo Running rdedup garbage-collector...
-        time rdedup -v -ttt --dir=${bkpDestination}/rdedup gc
-
-        echo Determining backup destination size ${bkpDestination}/rdedup...
-        du -hs ${bkpDestination}/rdedup
-      '';
-      postStop = ''
-        btrfs subvolume delete ${subvolumeSnapshot}
+        btrbk -c ${bktrbkConf} --progress ''${@:-run}
       '';
     };
 
@@ -164,9 +93,9 @@ in {
       timerConfig = {
         # Obtained using `systemd-analyze calendar "Wed 23:00"`
         # OnCalendar = "Wed *-*-* 23:00:00";
-        OnStartupSec="2d";
-        Unit = "bkp-sync-rclone.service";
-        OnUnitInactiveSec="2d";
+        OnStartupSec="1m";
+        Unit = "bkp-sync.service";
+        OnUnitInactiveSec="2h";
         Persistent="true";
       };
     };
@@ -176,10 +105,15 @@ in {
 
   bindMounts = {
     "${subvolumeParentDir}" = {
-      hostPath = "/var/lib/";
+      hostPath = subvolumeParentDir;
       isReadOnly = false;
     };
 
+    "/etc/secrets/" = {
+      hostPath = "/var/lib/container-volumes/backup/etc-secrets";
+      isReadOnly = true;
+    };
+
     "/dev/fuse" = {
       hostPath = "/dev/fuse";
       isReadOnly = false;
diff --git a/nix/os/containers/syncthing.nix b/nix/os/containers/syncthing.nix
index 9ab498a..c9d8eaf 100644
--- a/nix/os/containers/syncthing.nix
+++ b/nix/os/containers/syncthing.nix
@@ -1,6 +1,7 @@
 { hostAddress
 , localAddress
 , syncthingPort ? 22000
+, syncthingLocalAnnouncePort ? 21027
 }:
 
 {
@@ -39,6 +40,11 @@
       hostPort = syncthingPort;
       protocol = "tcp";
     }
+    {
+      containerPort = 21027;
+      hostPort = syncthingLocalAnnouncePort;
+      protocol = "tcp";
+    }
   ];
 
   inherit hostAddress localAddress;
diff --git a/nix/os/containers/webserver.nix b/nix/os/containers/webserver.nix
index 089f266..20a7e3a 100644
--- a/nix/os/containers/webserver.nix
+++ b/nix/os/containers/webserver.nix
@@ -14,14 +14,23 @@
         domain = "www.stefanjunker.de";
     };
 
+    security.acme = {
+      acceptTerms = true;
+      certs."www.stefanjunker.de".email = "mail@stefanjunker.de";
+    };
+
     services.nginx.enable = true;
-    services.nginx.virtualHosts."stefanjunker.de" = {
+    services.nginx.virtualHosts."www.stefanjunker.de" = {
       default = true;
       onlySSL = true;
       root = "/var/www/stefanjunker.de/htdocs";
 
-      sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
-      sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";
+      enableACME = true;
+      serverAliases = [
+        "stefanjunker.de"
+      ];
+      # sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
+      # sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";
 
       locations."/fi" = {
         index = "index.php";
diff --git a/nix/os/devices/default.nix b/nix/os/devices/default.nix
index 932f730..3ac1419 100644
--- a/nix/os/devices/default.nix
+++ b/nix/os/devices/default.nix
@@ -1,16 +1,23 @@
-{ pkgs ? import <channels-nixos-stable> {}
+{ dir
+, pkgs ? import <channels-nixos-stable> {}
 , ownLib ? import ../lib/default.nix { }
-, dir
-, rebuildarg
-, moreargs ? ""
-, diskId ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.encryptedDisk.diskId
 , gitRoot ? "$(git rev-parse --show-toplevel)"
-, previousDiskId ? ""
-}:
+
+# FIXME: why do these need explicit mentioning?
+# , moreargs ? ""
+# , rebuildarg ? ""
+, ...
+} @ args :
 
 let
   rebuildargsSudo = [ "switch" "boot" ];
-  rebuild = pkgs.writeScript "script" ''
+  rebuild = {
+    gitRoot
+    , rebuildarg ? "dry-activate"
+    , moreargs ? ""
+
+    , ...
+  }: pkgs.writeScript "script" ''
     #!/usr/bin/env bash
     set -xe
 
@@ -20,11 +27,11 @@ let
     [[ -e "''${NIXOS_CONFIG}" ]]
 
     ${if (builtins.elem rebuildarg rebuildargsSudo)
-          && builtins.match ".*--target-host.*" moreargs == null
-    then
-      "sudo -E \\"
-    else
-      ""
+          && (builtins.match ".*--target-host.*" moreargs) == null
+      then
+        "sudo -E \\"
+      else
+        ""
     }
     nixos-rebuild --show-trace -I nixos-config=''${NIXOS_CONFIG} ${rebuildarg} ${moreargs}
     if test -L result; then
@@ -35,6 +42,12 @@ let
 
 in {
   recipes = {
-    inherit rebuild;
-  } // (import ./disk.nix { inherit pkgs ownLib dir rebuildarg moreargs diskId gitRoot previousDiskId; });
+    rebuild = rebuild {
+      inherit gitRoot;
+    }
+      # // pkgs.lib.attrsets.optionalAttrs (moreargs != "") { inherit moreargs; }
+      # // pkgs.lib.attrsets.optionalAttrs (rebuildarg != "") { inherit rebuildarg; }
+      ;
+  } // (import ./disk.nix (args // { inherit pkgs ownLib gitRoot; }))
+  ;
 }
diff --git a/nix/os/devices/disk.nix b/nix/os/devices/disk.nix
index 58fb360..4181f1a 100644
--- a/nix/os/devices/disk.nix
+++ b/nix/os/devices/disk.nix
@@ -1,11 +1,12 @@
 { pkgs
 , ownLib
 , dir
-, rebuildarg
-, moreargs
-, diskId
 , gitRoot
+, diskId ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.opinionatedDisk.diskId
+, encrypted ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.opinionatedDisk.encrypted
 , previousDiskId ? ""
+
+, ...
 }:
 
 let
@@ -16,7 +17,9 @@ in rec {
     #!/usr/bin/env bash
     set -xe
     echo Mounting ${diskId}
-    sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ''}
     sleep 1
     sudo vgchange -ay ${ownLib.disk.volumeGroup diskId}
     sudo mkdir -p /mnt
@@ -32,7 +35,9 @@ in rec {
     sudo umount -Rl ${mntRootVol}
     sudo rmdir ${mntRootVol}
     sudo vgchange -an ${ownLib.disk.volumeGroup diskId}
-    sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ''}
     sync
   '';
 
@@ -56,7 +61,7 @@ in rec {
     #!/usr/bin/env bash
     set -xe
 
-    read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)?" choice
+    read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)? " choice
     case "$choice" in
       YES ) echo "Continuing in 3 seconds..."; sleep 3;;
       n|N ) echo "Exiting..."; exit 0;;
@@ -100,12 +105,14 @@ in rec {
 
     sleep 1
 
-    # Encrypt
-    sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
-    sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      # Encrypt
+      sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
+      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+    ''}
 
     # LVM
-    sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.luksPhysicalVolume diskId}
+    sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.lvmPv diskId encrypted}
     sudo lvcreate ${ownLib.disk.volumeGroup diskId} -L 2G -n swap
     sudo lvcreate ${ownLib.disk.volumeGroup diskId} -l 100%FREE -n root
 
@@ -160,7 +167,9 @@ in rec {
 
 
     if test "${previousDiskId}"; then
-      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+      ${pkgs.lib.strings.optionalString encrypted ''
+        sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
+      ''}
       sync
       sleep 1
       if sudo vgs ${previousDiskId}; then
@@ -168,6 +177,8 @@ in rec {
         sudo vgscan
       fi
     fi
-    sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ${pkgs.lib.strings.optionalString encrypted ''
+      sudo cryptsetup close ${ownLib.disk.luksName diskId}
+    ''}
   '';
 }
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix
new file mode 100644
index 0000000..cd4c05f
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix
@@ -0,0 +1,8 @@
+{ lib
+, ...
+}:
+
+{
+  boot.loader.grub.efiSupport = true;
+  boot.extraModulePackages = [ ];
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix
new file mode 100644
index 0000000..b681c06
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix
@@ -0,0 +1,15 @@
+{ ... }:
+
+{
+  disabledModules = [
+  ];
+  imports = [
+    ../../profiles/common/configuration.nix
+    ../../modules/opinionatedDisk.nix
+
+    ./system.nix
+    ./hw.nix
+    ./pkg.nix
+    ./boot.nix
+  ];
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix
new file mode 100644
index 0000000..4714d6e
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix
@@ -0,0 +1,31 @@
+{ ... }:
+
+let
+  stage1Modules =  [
+    "aesni_intel"
+    "kvm-intel"
+    "aes_x86_64"
+
+    "virtio_balloon"
+    "virtio_scsi"
+    "virtio_net"
+    "virtio_pci"
+    "virtio_ring"
+    "virtio"
+    "scsi_mod"
+  ];
+
+in
+{
+  # TASK: new device
+  hardware.opinionatedDisk = {
+    enable = true;
+    encrypted = false;
+    diskId = "ata-Crucial_CT750MX300SSD1_16161311C7A6";
+  };
+
+  boot.initrd.availableKernelModules = stage1Modules;
+  boot.initrd.kernelModules = stage1Modules;
+  boot.extraModprobeConfig = ''
+  '';
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix
new file mode 100644
index 0000000..68784f6
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix
@@ -0,0 +1,53 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  nixpkgs.config.packageOverrides = pkgs: with pkgs; {
+    nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
+  };
+  home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix { inherit pkgs; };
+
+  nix.buildMachines = [
+    { hostName = "localhost";
+      system = "x86_64-linux";
+      supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
+      maxJobs = 4;
+    }
+  ];
+
+  # services.hydra = {
+  #   enable = false;
+  #   hydraURL = "http://localhost:3000"; # externally visible URL
+  #   notificationSender = "hydra@${config.networking.hostName}.stefanjunker.de"; # e-mail of hydra service
+  #   # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
+  #   buildMachinesFiles = [];
+  #   # you will probably also want, otherwise *everything* will be built from scratch
+  #   useSubstitutes = true;
+  # };
+
+  # services.gitlab-runner = {
+  #   enable = false;
+
+  #   extraPackages = with pkgs; [
+  #     bash
+  #     gitlab-runner
+  #     nix
+  #     gitFull
+  #     git-crypt
+  #   ];
+
+  #   concurrent = 2;
+  #   checkInterval = 0;
+  #   services = {
+  #     nixRunner = {
+  #       executor = "shell";
+  #       runUntagged = true;
+  #       registrationConfigFile = "/etc/secrets/gitlab-runner/nix-runner.registration";
+  #       tagList = [ "nix" ];
+  #     };
+  #   };
+  # };
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix
new file mode 100644
index 0000000..a74e612
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix
@@ -0,0 +1,93 @@
+{ pkgs
+, lib
+, config
+, ... }:
+
+let
+  keys = import ../../../variables/keys.nix;
+
+in {
+  # TASK: new device
+  networking.hostName = "srv0"; # Define your hostname.
+  # networking.domain =  "home-ch.stefanjunker.de";
+
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [
+    # iperf3
+    5201
+  ];
+  networking.firewall.logRefusedConnections = false;
+
+  networking.usePredictableInterfaceNames = false;
+  networking.dhcpcd = {
+    enable = true;
+    persistent = true;
+  };
+
+  networking.interfaces.eth0 = {
+    useDHCP = true;
+    # ipv6.addresses = [
+    #   { address = "2a02:c207:3003:2387::1"; prefixLength = 64; }
+    # ];
+  };
+
+  # networking.defaultGateway6 = {
+  #   address = "fe80::1";
+  #   interface = "eth0";
+  # };
+
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "ve-+" ];
+    externalInterface = "eth0";
+  };
+
+  # Kubernetes
+  # services.kubernetes.roles = ["master" "node"];
+
+  # virtualization
+  virtualisation = {
+    docker.enable = true;
+  };
+
+  nix.gc = {
+    automatic = true;
+  };
+
+  networking.useHostResolvConf = true;
+
+  containers = {
+    webserver = import ../../containers/webserver.nix {
+      hostAddress = "192.168.100.12";
+      localAddress = "192.168.100.13";
+
+      httpsPort = 443;
+    };
+
+    syncthing = import ../../containers/syncthing.nix {
+      hostAddress = "192.168.100.14";
+      localAddress = "192.168.100.15";
+
+      syncthingPort = 22000;
+    };
+
+    backup = import ../../containers/backup.nix {
+      inherit config;
+      hostAddress = "192.168.100.16";
+      localAddress = "192.168.100.17";
+      subvolumes = [
+        "webserver"
+        "backup"
+        "syncthing"
+      ];
+    };
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "20.03"; # Did you read the comment?
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix
new file mode 100644
index 0000000..519781a
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix
@@ -0,0 +1,37 @@
+let
+  nixpkgs = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.09";
+    rev = "51aaa3fa1b69559456f9bd4968bd5b179a784f67";
+  };
+in
+
+{
+  inherit nixpkgs;
+  "channels-nixos-stable" = nixpkgs;
+  "channels-nixos-20.03" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.03";
+    rev = "ff6fda61600cc60404bab5cb6b18b8636785b7bc";
+  };
+  "channels-nixos-19.09" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-19.09";
+    rev = "75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1";
+  };
+  "channels-nixos-unstable" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-unstable";
+    rev = "24c9b05ac53e422f1af81a156f1fd58499eb27fb";
+  };
+  "nixpkgs-master" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "master";
+    rev = "9b3e35d991ea6a43f256069dcb2e006006730d05";
+  };
+  "home-manager-module" = {
+    url = "https://github.com/nix-community/home-manager";
+    ref = "release-20.09";
+    rev = "7339784e07217ed0232e08d1ea33b610c94657d8";
+  };
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix
new file mode 100644
index 0000000..a19cc09
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix
@@ -0,0 +1,37 @@
+let
+  nixpkgs = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.09";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+in
+
+{
+  inherit nixpkgs;
+  "channels-nixos-stable" = nixpkgs;
+  "channels-nixos-20.03" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.03";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.03 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "channels-nixos-19.09" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-19.09";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-19.09 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "channels-nixos-unstable" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-unstable";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "nixpkgs-master" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "master";
+    rev = "<% git ls-remote https://github.com/NixOS/nixpkgs.git master | head -n1 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "home-manager-module" = {
+    url = "https://github.com/nix-community/home-manager";
+    ref = "release-20.09";
+    rev = "<% git ls-remote https://github.com/nix-community/home-manager.git release-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+}
diff --git a/nix/os/devices/steveej-rmvbl-sdep0/hw.nix b/nix/os/devices/steveej-rmvbl-sdep0/hw.nix
index 34dd81c..d105279 100644
--- a/nix/os/devices/steveej-rmvbl-sdep0/hw.nix
+++ b/nix/os/devices/steveej-rmvbl-sdep0/hw.nix
@@ -2,8 +2,6 @@
 
 {
   # TASK: new device
-  hardware.encryptedDisk = {
-    enable = true;
-    diskId = "usb-SanDisk_Extreme_Pro_12345978EC62-0:0";
-  };
+  hardware.opinionatedDisk.diskId = "usb-SanDisk_Extreme_Pro_12345978EC62-0:0";
+  hardware.opinionatedDisk.encrypted = true;
 }
diff --git a/nix/os/devices/steveej-t14/configuration.nix b/nix/os/devices/steveej-t14/configuration.nix
index 3828dd1..b78c268 100644
--- a/nix/os/devices/steveej-t14/configuration.nix
+++ b/nix/os/devices/steveej-t14/configuration.nix
@@ -4,7 +4,7 @@
   imports = [
     ../../profiles/common/configuration.nix
     ../../profiles/graphical/configuration.nix
-    ../../modules/encryptedDisk.nix
+    ../../modules/opinionatedDisk.nix
 
     ./system.nix
     ./hw.nix
diff --git a/nix/os/devices/steveej-t14/hw.nix b/nix/os/devices/steveej-t14/hw.nix
index dd4c4a3..4438fda 100644
--- a/nix/os/devices/steveej-t14/hw.nix
+++ b/nix/os/devices/steveej-t14/hw.nix
@@ -18,8 +18,9 @@ let
 in
 {
   # TASK: new device
-  hardware.encryptedDisk = {
+  hardware.opinionatedDisk = {
     enable = true;
+    encrypted = true;
     diskId = "nvme-SKHynix_HFS001TD9TNI-L2B0B_CJ0AN89731030AV3Q";
   };
 
diff --git a/nix/os/devices/steveej-t14/versions.nix b/nix/os/devices/steveej-t14/versions.nix
index ddd3610..31ea2af 100644
--- a/nix/os/devices/steveej-t14/versions.nix
+++ b/nix/os/devices/steveej-t14/versions.nix
@@ -2,7 +2,7 @@ let
   nixpkgs = {
     url = "https://github.com/NixOS/nixpkgs/";
     ref = "nixos-20.09";
-    rev = "4a75ca4a4e7d14e7b0b0230b3ea57b5bd7c16218";
+    rev = "c6b23ba64aea4b0e2163ff84990084a6bec455c5";
   };
 in
 
@@ -15,12 +15,12 @@ in
   "channels-nixos-unstable" = {
     url = "https://github.com/NixOS/nixpkgs/";
     ref = "nixos-unstable";
-    rev = "1a57d96edd156958b12782e8c8b6a374142a7248";
+    rev = "56bb1b0f7a33e5d487dc2bf2e846794f4dcb4d01";
   };
   "nixpkgs-master" = {
     url = "https://github.com/NixOS/nixpkgs/";
     ref = "master";
-    rev = "44c443a7a602e7752641aac21e4ad17061761290";
+    rev = "174267e601bc2d525a685084d9712841b3ef93da";
   };
   "home-manager-module" = {
     url = "https://github.com/nix-community/home-manager";
diff --git a/nix/os/devices/vmd32387.contaboserver.net/configuration.nix b/nix/os/devices/vmd32387.contaboserver.net/configuration.nix
index ffce549..b681c06 100644
--- a/nix/os/devices/vmd32387.contaboserver.net/configuration.nix
+++ b/nix/os/devices/vmd32387.contaboserver.net/configuration.nix
@@ -5,7 +5,7 @@
   ];
   imports = [
     ../../profiles/common/configuration.nix
-    ../../modules/encryptedDisk.nix
+    ../../modules/opinionatedDisk.nix
 
     ./system.nix
     ./hw.nix
diff --git a/nix/os/devices/vmd32387.contaboserver.net/hw.nix b/nix/os/devices/vmd32387.contaboserver.net/hw.nix
index 7a04340..75d5aae 100644
--- a/nix/os/devices/vmd32387.contaboserver.net/hw.nix
+++ b/nix/os/devices/vmd32387.contaboserver.net/hw.nix
@@ -18,8 +18,9 @@ let
 in
 {
   # TASK: new device
-  hardware.encryptedDisk = {
+  hardware.opinionatedDisk = {
     enable = true;
+    encrypted = true;
     diskId = "scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
   };
 
diff --git a/nix/os/devices/vmd32387.contaboserver.net/system.nix b/nix/os/devices/vmd32387.contaboserver.net/system.nix
index 2944e09..c25022a 100644
--- a/nix/os/devices/vmd32387.contaboserver.net/system.nix
+++ b/nix/os/devices/vmd32387.contaboserver.net/system.nix
@@ -114,24 +114,14 @@ in {
       sievePort = 4190;
     };
 
-    webserver = import ../../containers/webserver.nix {
-      hostAddress = "192.168.100.12";
-      localAddress = "192.168.100.13";
-
-      httpsPort = 443;
-    };
-
-    syncthing = import ../../containers/syncthing.nix {
-      hostAddress = "192.168.100.14";
-      localAddress = "192.168.100.15";
-
-      syncthingPort = 22000;
-    };
-
     backup = import ../../containers/backup.nix {
       inherit config;
       hostAddress = "192.168.100.16";
       localAddress = "192.168.100.17";
+      subvolumes = [
+        "mailserver"
+        "backup"
+      ];
     };
   };
 
diff --git a/nix/os/devices/vmd32387.contaboserver.net/versions.tmpl.nix b/nix/os/devices/vmd32387.contaboserver.net/versions.tmpl.nix
index a19cc09..399cefe 100644
--- a/nix/os/devices/vmd32387.contaboserver.net/versions.tmpl.nix
+++ b/nix/os/devices/vmd32387.contaboserver.net/versions.tmpl.nix
@@ -8,6 +8,9 @@ in
 
 {
   inherit nixpkgs;
+  nixos = nixpkgs // {
+    suffix = "/nixos";
+  };
   "channels-nixos-stable" = nixpkgs;
   "channels-nixos-20.03" = {
     url = "https://github.com/NixOS/nixpkgs/";
diff --git a/nix/os/lib/default.nix b/nix/os/lib/default.nix
index 566ccb9..503d30e 100644
--- a/nix/os/lib/default.nix
+++ b/nix/os/lib/default.nix
@@ -48,5 +48,10 @@
     bootLuksDevice = diskId: "/dev/disk/by-partlabel/" + (shortenGptPartlabel ("3-"+diskId));
     luksName = diskId: (volumeGroup diskId)+"pv";
     luksPhysicalVolume = diskId: "/dev/mapper/" + (luksName diskId);
+    lvmPv = diskId: encrypted:
+      if encrypted == true
+      then luksPhysicalVolume diskId
+      else bootLuksDevice diskId
+      ;
   };
 }
diff --git a/nix/os/modules/encryptedDisk.nix b/nix/os/modules/opinionatedDisk.nix
similarity index 76%
rename from nix/os/modules/encryptedDisk.nix
rename to nix/os/modules/opinionatedDisk.nix
index b70c7be..c9864ed 100644
--- a/nix/os/modules/encryptedDisk.nix
+++ b/nix/os/modules/opinionatedDisk.nix
@@ -4,14 +4,18 @@
 with lib;                     
 
 let
-  cfg = config.hardware.encryptedDisk;
+  cfg = config.hardware.opinionatedDisk;
   ownLib = import ../lib/default.nix { };
 in {
-  options.hardware.encryptedDisk = {
-    enable = mkEnableOption "Enable encrypted filesystem layout";
+  options.hardware.opinionatedDisk = {
+    enable = mkEnableOption "Enable opinionated filesystem layout";
     diskId = mkOption {
       type = types.str;
     };
+    encrypted = mkOption {
+      default = true;
+      type = types.bool;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -36,10 +40,10 @@ in {
 
     boot.loader.grub = {
       device = (ownLib.disk.bootGrubDevice cfg.diskId);
-      enableCryptodisk = true;
+      enableCryptodisk = cfg.encrypted;
     };
 
-    boot.initrd.luks.devices = builtins.listToAttrs [
+    boot.initrd.luks.devices = lib.optionalAttrs cfg.encrypted (builtins.listToAttrs [
       {
         name =
           let
@@ -53,6 +57,6 @@ in {
           allowDiscards = true;
         };
       }
-    ];
+    ]);
   };
 }
diff --git a/nix/os/profiles/removable-medium/configuration.nix b/nix/os/profiles/removable-medium/configuration.nix
index 883c2a4..77d7eb5 100644
--- a/nix/os/profiles/removable-medium/configuration.nix
+++ b/nix/os/profiles/removable-medium/configuration.nix
@@ -2,7 +2,7 @@
 
 {
   imports = [ 
-    ../../modules/encryptedDisk.nix
+    ../../modules/opinionatedDisk.nix
 
     ./pkg.nix
     ./hw.nix
diff --git a/nix/os/profiles/removable-medium/hw.nix b/nix/os/profiles/removable-medium/hw.nix
index 99f014f..6121e79 100644
--- a/nix/os/profiles/removable-medium/hw.nix
+++ b/nix/os/profiles/removable-medium/hw.nix
@@ -1,6 +1,6 @@
 { ... }:
 
 {
-  hardware.encryptedDisk.enable = true;
+  hardware.opinionatedDisk.enable = true;
   hardware.enableAllFirmware = true;
 }
diff --git a/nix/overlays/overrides.nix b/nix/overlays/overrides.nix
index 92516fc..a8e0e87 100644
--- a/nix/overlays/overrides.nix
+++ b/nix/overlays/overrides.nix
@@ -44,4 +44,24 @@ in {
       keyring
     ]);
   });
+
+  btrbk = super.btrbk.overrideAttrs(attrs: rec {
+    version = "0.30.0";
+    src =  builtins.fetchurl {
+      url = "https://digint.ch/download/btrbk/releases/${attrs.pname}-${version}.tar.xz";
+      sha256 = "1wlp0z0ijv3cr155kp9c5l16dz4jf8h897ddnawaj9rj1zgfk9z8";
+    };
+
+    # version = "2020-12-30";
+    # src = builtins.fetchurl {
+    #   url = "https://github.com/digint/btrbk/archive/dd5991099ad778a3e0c5d11c770ad169c3095068.tar.gz";
+    #   sha256 = "0iyjgr1nv1n7mpsrgkrmb85sz3ycimmfvvhj08cvkjgl0r1762sb";
+    # };
+
+    preFixup = ''
+      wrapProgram $out/bin/btrbk \
+        --set PERL5LIB $PERL5LIB \
+        --prefix PATH ':' "${self.stdenv.lib.makeBinPath (with self; [ btrfs-progs bash mbuffer openssh ])}"
+    '';
+  });
 }
diff --git a/nix/pkgs/default.nix b/nix/pkgs/default.nix
index a4c21e9..f743346 100644
--- a/nix/pkgs/default.nix
+++ b/nix/pkgs/default.nix
@@ -44,7 +44,7 @@ in rec {
     nixpkgsWithPhp5 = pkgs.fetchFromGitHub {
       owner = "nixos";
       repo = "nixpkgs-channels";
-      rev = "pkgs";
+      rev = "846d8f8305192dcc3a63139102698b4ac6b9ef9f";
       sha256 = "1qifgc1q2i4g0ivpfjnxp4jl2cc82gfjws08dsllgw7q7kw4b4rb";
     };
     php5 = (pkgs.callPackage "${nixpkgsWithPhp5}/pkgs/development/interpreters/php/default.nix" {
diff --git a/nix/variables/passwords.crypt.nix b/nix/variables/passwords.crypt.nix
index 92f89d2..98713c6 100644
Binary files a/nix/variables/passwords.crypt.nix and b/nix/variables/passwords.crypt.nix differ
diff --git a/services/home-ch/router-wan.lan/Justfile b/services/home-ch/router-wan.lan/Justfile
index 8792f32..3715bfa 100644
--- a/services/home-ch/router-wan.lan/Justfile
+++ b/services/home-ch/router-wan.lan/Justfile
@@ -3,7 +3,10 @@ _run_ssh_cmd cmd:
 
 post-setup:
 	just -v _run_ssh_cmd "opkg update"
-	just -v _run_ssh_cmd "opkg install luci-ssl"
+	just -v _run_ssh_cmd "opkg install luci-ssl luci-app-ddns"
 	just -v _run_ssh_cmd "opkg install luci-app-samba samba36-server"
-	just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils"
+	just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils kmod-usb-storage-uas kmod-fs-btrfs btrfs-progs"
+	# multiuser SFTP
+	just -v _run_ssh_cmd "opkg install openssh-server openssh-sftp-server"
+	just -v _run_ssh_cmd "opkg install sudo coreutils-readlink"
 	just -v _run_ssh_cmd "/etc/init.d/uhttpd restart"