diff --git a/SwarselSystems.org b/SwarselSystems.org
index 86d4d15..abf3b0f 100644
--- a/SwarselSystems.org
+++ b/SwarselSystems.org
@@ -4874,7 +4874,7 @@ Here I only enable =networkmanager= and a few default networks. The rest of the
                 wifi-security = {
                   auth-alg = "open";
                   key-mgmt = "wpa-psk";
-                  psk = "WLAN1_PW";
+                  psk = "$WLAN1_PW";
                 };
               };
 
@@ -7696,6 +7696,11 @@ This manages backups for my pictures and obsidian files.
               passwordFile = config.sops.secrets.resticpw.path;
               paths = [
                 "/Vault/data/paperless"
+                "/Vault/data/koillection"
+                "/Vault/data/postgresql"
+                "/Vault/data/firefly-iii"
+                "/Vault/data/radicale"
+                "/Vault/data/matrix-synapse"
                 "/Vault/Eternor/Paperless"
                 "/Vault/Eternor/Bilder"
                 "/Vault/Eternor/Immich"
@@ -9065,6 +9070,7 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
     serviceName = "koillection";
     servicePort = 2282;
     serviceDomain = config.repo.secrets.common.services.domains.${serviceName};
+    serviceDir = "/Vault/data/koillection";
 
     postgresUser = config.systemd.services.postgresql.serviceConfig.User; # postgres
     postgresPort = config.services.postgresql.settings.port; # 5432
@@ -9096,6 +9102,10 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
             "${toString servicePort}:80"
           ];
 
+          volumes = [
+            "${serviceDir}/uploads:/uploads"
+          ];
+
           environment = {
             APP_DEBUG = "0";
             APP_ENV = "prod";
@@ -9174,6 +9184,11 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
             locations = {
               "/" = {
                 proxyPass = "http://${serviceName}";
+                extraConfig = ''
+                  proxy_buffer_size          128k;
+                  proxy_buffers              4 256k;
+                  proxy_busy_buffers_size    256k;
+                '';
               };
             };
           };
diff --git a/modules/nixos/client/network.nix b/modules/nixos/client/network.nix
index 27809ab..8f7ffc3 100644
--- a/modules/nixos/client/network.nix
+++ b/modules/nixos/client/network.nix
@@ -118,7 +118,7 @@ in
                 wifi-security = {
                   auth-alg = "open";
                   key-mgmt = "wpa-psk";
-                  psk = "WLAN1_PW";
+                  psk = "$WLAN1_PW";
                 };
               };
 
diff --git a/modules/nixos/server/koillection.nix b/modules/nixos/server/koillection.nix
index 8db5b0d..3ebb23b 100644
--- a/modules/nixos/server/koillection.nix
+++ b/modules/nixos/server/koillection.nix
@@ -5,6 +5,7 @@ let
   serviceName = "koillection";
   servicePort = 2282;
   serviceDomain = config.repo.secrets.common.services.domains.${serviceName};
+  serviceDir = "/Vault/data/koillection";
 
   postgresUser = config.systemd.services.postgresql.serviceConfig.User; # postgres
   postgresPort = config.services.postgresql.settings.port; # 5432
@@ -36,6 +37,10 @@ in
           "${toString servicePort}:80"
         ];
 
+        volumes = [
+          "${serviceDir}/uploads:/uploads"
+        ];
+
         environment = {
           APP_DEBUG = "0";
           APP_ENV = "prod";
@@ -114,6 +119,11 @@ in
           locations = {
             "/" = {
               proxyPass = "http://${serviceName}";
+              extraConfig = ''
+                proxy_buffer_size          128k;
+                proxy_buffers              4 256k;
+                proxy_busy_buffers_size    256k;
+              '';
             };
           };
         };
diff --git a/modules/nixos/server/restic.nix b/modules/nixos/server/restic.nix
index eb492b1..f668104 100644
--- a/modules/nixos/server/restic.nix
+++ b/modules/nixos/server/restic.nix
@@ -31,6 +31,11 @@ in
             passwordFile = config.sops.secrets.resticpw.path;
             paths = [
               "/Vault/data/paperless"
+              "/Vault/data/koillection"
+              "/Vault/data/postgresql"
+              "/Vault/data/firefly-iii"
+              "/Vault/data/radicale"
+              "/Vault/data/matrix-synapse"
               "/Vault/Eternor/Paperless"
               "/Vault/Eternor/Bilder"
               "/Vault/Eternor/Immich"