diff --git a/flake.nix b/flake.nix
index 5a8f3203..8335caf3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,5 +1,16 @@
 {
   description = "yukkop's nix utilities";
+
+  nixConfig = {
+    extra-substituters = [
+      "https://cache.nixos.org"
+      "https://cache.hectic-lab.com/hectic"
+    ];
+    extra-trusted-public-keys = [
+      "hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA="
+    ];
+  };
+
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixpkgs-fixed.url = "github:NixOS/nixpkgs/nixos-25.11";
diff --git a/nixos/system/hectic-lab/attic.nix b/nixos/system/hectic-lab/attic.nix
index 46d984bf..d1275db3 100644
--- a/nixos/system/hectic-lab/attic.nix
+++ b/nixos/system/hectic-lab/attic.nix
@@ -18,7 +18,10 @@
 
   services.nginx.virtualHosts."cache.${domain}" = {
     enableACME = true;
-    forceSSL = true;
+    forceSSL   = true;
+    extraConfig = ''
+      client_max_body_size 0;
+    '';
     locations."/" = {
       proxyPass = "http://127.0.0.1:8080";
     };
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index 65b2ad6c..744b16b3 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -37,10 +37,6 @@ let
       hashedPasswordFile = config.sops.secrets."mailserver/${name}/hashedPassword".path;
     };
   };
-  sslOpts = {
-    sslCertificate    = config.sops.secrets."ssl/porkbun/${domain}/domain.cert.pem".path;
-    sslCertificateKey = config.sops.secrets."ssl/porkbun/${domain}/private.key.pem".path;
-  };
 in {
   imports = [
     self.nixosModules.hectic
@@ -118,18 +114,6 @@ in {
         key = "init-postgresql";
       };
       "atticd/environment" = {};
-      "ssl/porkbun/${domain}/domain.cert.pem" = {
-        group = "nginx";
-        mode  = "0440";
-      };
-      "ssl/porkbun/${domain}/private.key.pem" = {
-        group = "nginx";
-        mode  = "0440";
-      };
-      "ssl/porkbun/${domain}/public.key.pem" = {
-        group = "nginx";
-        mode  = "0440";
-      };
       "wg-bfs/private-key" = {};
     };
   };