19 files changed, 309 insertions, 177 deletions
diff --git a/accounts/gkleen@sif/default.nix b/accounts/gkleen@sif/default.nix
index 2e7a25c9..87cd9e2f 100644
--- a/accounts/gkleen@sif/default.nix
+++ b/accounts/gkleen@sif/default.nix
@@ -143,7 +143,7 @@ in {
              # ProxyCommand ${pkgs.socat}/bin/socat - SOCKS4A:127.0.0.1:%h:%p,socksport=8118
              ProxyJump ssh.math.lmu.de
-            Match host *.cipmath.loc !host cip04.cipmath.loc !exec "nc -z -w 1 %h %p &>/dev/null"
+            Match host *.cipmath.loc !host cip04.cipmath.loc,mgmt-cls01.cipmath.loc !exec "nc -z -w 1 %h %p &>/dev/null"
              ProxyJump cip04
            Match host *.ifi.lmu.de,*.math.lmu.de
@@ -225,6 +225,7 @@ in {
          scrot = "$HOME/screenshots";
          flk = "$HOME/config/nixos-flakes";
          rz = "$HOME/projects/rz";
+          pro = "$HOME/projects/pro";
        };
        obs-studio = {
diff --git a/accounts/gkleen@sif/ssh-hosts.nix b/accounts/gkleen@sif/ssh-hosts.nix
index 8a34376a..ac930614 100644
--- a/accounts/gkleen@sif/ssh-hosts.nix
+++ b/accounts/gkleen@sif/ssh-hosts.nix
@@ -445,6 +445,11 @@
    { hostname = "cip04.cipmath.loc";
      proxyJump = "mathw0h";
    };
+  "mgmt-cls01" =
+    { user = "root";
+      hostname = "mgmt-cls01.cipmath.loc";
+      proxyJump = "ssh.math.lmu.de";
+    };
  "mgmt01" =
    { hostname = "mgmt01.mathinst.loc";
      proxyJump = "mathw0h";
diff --git a/flake.lock b/flake.lock
index 0c0a7ad1..09989a6a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -815,6 +815,9 @@
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-eostre": "nixpkgs-eostre",
+        "nixpkgs-installer": [
+          "nixpkgs-stable"
+        ],
        "nixpkgs-pgbackrest": "nixpkgs-pgbackrest",
        "nixpkgs-stable": "nixpkgs-stable_2",
        "nvfetcher": "nvfetcher",
diff --git a/flake.nix b/flake.nix
index 6f24a90c..dca04010 100644
--- a/flake.nix
+++ b/flake.nix
@@ -35,6 +35,7 @@
      repo = "nixpkgs";
      ref = "23.11";
    };
+    nixpkgs-installer.follows = "nixpkgs-stable";
    home-manager = {
      type = "github";
      # owner = "nix-community";
diff --git a/hosts/surtr/dns/zones/email.bouncy.soa b/hosts/surtr/dns/zones/email.bouncy.soa
index 40e4b78b..2b319a93 100644
--- a/hosts/surtr/dns/zones/email.bouncy.soa
+++ b/hosts/surtr/dns/zones/email.bouncy.soa
@@ -1,7 +1,7 @@
 $ORIGIN bouncy.email.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023020101 ; serial
+  2024070901 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -41,10 +41,10 @@ mailin			IN	MX	0 mailin.bouncy.email.
 mailin                  IN      TXT     "v=spf1 redirect=bouncy.email"
 _acme-challenge.mailin  IN      NS      ns.yggdrasil.li.
-_25._tcp.mailin         IN      TLSA    2 1 1 276fe8a8c4ec7611565bf9fce6dcace9be320c1b5bea27596b2204071ed04f10
+; _25._tcp.mailin       IN      TLSA    2 1 1 276fe8a8c4ec7611565bf9fce6dcace9be320c1b5bea27596b2204071ed04f10
-_25._tcp.mailin         IN      TLSA    2 1 1 bd936e72b212ef6f773102c6b77d38f94297322efc25396bc3279422e0c89270
+; _25._tcp.mailin       IN      TLSA    2 1 1 bd936e72b212ef6f773102c6b77d38f94297322efc25396bc3279422e0c89270
-_25._tcp.mailin         IN      TLSA    2 1 1 8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d
+; _25._tcp.mailin       IN      TLSA    2 1 1 8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d
-_25._tcp.mailin         IN      TLSA    2 1 1 e5545e211347241891c554a03934cde9b749664a59d26d615fe58f77990f2d03
+; _25._tcp.mailin       IN      TLSA    2 1 1 e5545e211347241891c554a03934cde9b749664a59d26d615fe58f77990f2d03
 mailsub                 IN      A       202.61.241.61
 mailsub                 IN      AAAA    2a03:4000:52:ada::
diff --git a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
index f481090c..00182523 100644
--- a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
+++ b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
@@ -27,20 +27,27 @@ class PolicyHandler(StreamRequestHandler):
        logger.info('Connection parameters: %s', self.args)
        allowed = False
-        with self.server.db_pool.connection() as conn:
+        user = None
-            local, domain = self.args['sender'].split(sep='@', maxsplit=1)
+        if self.args['sasl_username']:
-            extension = None
+            user = self.args['sasl_username']
-            if '+' in local:
+        if self.args['ccert_subject']:
-                local, extension = local.split(sep='+', maxsplit=1)
+            user = self.args['ccert_subject']
-            logger.debug('Parsed address: %s', {'local': local, 'extension': extension, 'domain': domain})
+        if user:
+            with self.server.db_pool.connection() as conn:
-            with conn.cursor() as cur:
+                local, domain = self.args['sender'].split(sep='@', maxsplit=1)
-                cur.row_factory = namedtuple_row
+                extension = None
-                cur.execute('SELECT "mailbox"."mailbox" as "user", "local", "extension", "domain" FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s', params = {'user': self.args['ccert_subject'], 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True)
+                if '+' in local:
-                for record in cur:
+                    local, extension = local.split(sep='+', maxsplit=1)
-                    logger.debug('Received result: %s', record)
-                    allowed = True
+                logger.debug('Parsed address: %s', {'local': local, 'extension': extension, 'domain': domain})
+                with conn.cursor() as cur:
+                    cur.row_factory = namedtuple_row
+                    cur.execute('SELECT "mailbox"."mailbox" as "user", "local", "extension", "domain" FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s', params = {'user': user, 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True)
+                    for record in cur:
+                        logger.debug('Received result: %s', record)
+                        allowed = True
        action = '550 5.7.0 Sender address not authorized for current user'
        if allowed:
diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index bb0f6e20..c10f611f 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -32,9 +32,63 @@ let
      });
    };
+  nftables-nologin-script = pkgs.writeScript "nftables-mail-nologin" ''
+    #!${pkgs.zsh}/bin/zsh
+    set -e
+    export PATH="${lib.makeBinPath (with pkgs; [inetutils nftables])}:$PATH"
+    typeset -a as_sets mnt_bys route route6
+    as_sets=(${lib.escapeShellArgs config.services.email.nologin.ASSets})
+    mnt_bys=(${lib.escapeShellArgs config.services.email.nologin.MNTBys})
+    for as_set in $as_sets; do
+        while IFS=$'\n' read line; do
+            if [[ "''${line}" =~ "^route:\s+(.+)$" ]]; then
+                route+=($match[1])
+            elif [[ "''${line}" =~ "^route6:\s+(.+)$" ]]; then
+                route6+=($match[1])
+            fi
+        done < <(whois -h whois.radb.net "!i''${as_set},1" | egrep -o 'AS[0-9]+' | xargs -- whois -h whois.radb.net -- -i origin)
+    done
+    for mnt_by in $mnt_bys; do
+        while IFS=$'\n' read line; do
+            if [[ "''${line}" =~ "^route:\s+(.+)$" ]]; then
+                route+=($match[1])
+            elif [[ "''${line}" =~ "^route6:\s+(.+)$" ]]; then
+                route6+=($match[1])
+            fi
+        done < <(whois -h whois.radb.net "!o''${mnt_by}")
+    done
+    printf -v elements4 '%s,' "''${route[@]}"
+    elements4=''${elements4%,}
+    printf -v elements6 '%s,' "''${route6[@]}"
+    elements6=''${elements6%,}
+    nft -f - <<EOF
+    flush set inet filter mail_nologin4
+    flush set inet filter mail_nologin6
+    add element inet filter mail_nologin4 {''${elements4}}
+    add element inet filter mail_nologin6 {''${elements6}}
+    EOF
+  '';
  spmDomains = ["bouncy.email"];
  emailDomains = spmDomains ++ ["kleen.consulting"];
 in {
+  options = {
+    services.email.nologin = {
+      ASSets = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+      MNTBys = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+    };
+  };
  config = {
    nixpkgs.overlays = [
      (final: prev: {
@@ -167,6 +221,7 @@ in {
        maximal_backoff_time = "10m";
        maximal_queue_lifetime = "100m";
        bounce_queue_lifetime = "20m";
+        delay_warning_time = "10m";
        smtpd_discard_ehlo_keyword_address_maps = "cidr:${pkgs.writeText "esmtp_access" ''
          # Allow DSN requests from local subnet only
@@ -204,17 +259,15 @@ in {
        postscreen_greet_action = "enforce";
      };
      masterConfig = {
-        smtps = {
+        "465" = {
          type = "inet";
          private = false;
-          command = "smtpd";
+          command = "smtpd -v";
          args = [
            "-o" "smtpd_tls_security_level=encrypt"
            "-o" "{smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1, !TLSv1.2}"
            "-o" "{smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1, !TLSv1.2}"
            "-o" "smtpd_tls_mandatory_ciphers=high"
-            "-o" "smtpd_tls_dh1024_param_file=${toString config.security.dhparams.params."postfix-smtps-1024".path}"
-            "-o" "smtpd_tls_dh512_param_file=${toString config.security.dhparams.params."postfix-smtps-512".path}"
            "-o" "{tls_eecdh_auto_curves = X25519 X448}"
            "-o" "smtpd_tls_wrappermode=yes"
@@ -223,22 +276,52 @@ in {
            "-o" "smtpd_tls_received_header=no"
            "-o" "cleanup_service_name=subcleanup"
            "-o" "smtpd_client_restrictions=permit_tls_all_clientcerts,reject"
-            "-o" "{smtpd_data_restrictions = check_policy_service unix:/run/postfwd3/postfwd3.sock}"
-            "-o" "smtpd_relay_restrictions=permit_tls_all_clientcerts,reject"
            "-o" "{smtpd_sender_restrictions = reject_unknown_sender_domain,reject_unverified_sender,check_policy_service unix:/run/postfix-ccert-sender-policy.sock}"
+            "-o" ''{smtpd_recipient_restrictions=reject_unauth_pipelining,reject_non_fqdn_recipient,reject_unknown_recipient_domain,check_recipient_access pgsql:${pkgs.writeText "check_recipient_access.cf" ''
+            hosts = postgresql:///email
+            dbname = email
+            query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s' OR (lookup = regexp_replace('%s', '\+[^@]*@', '@') AND NOT EXISTS (SELECT 1 FROM virtual_mailbox_access WHERE lookup = '%s'))
+          ''},permit_tls_all_clientcerts,reject}''
+            "-o" "smtpd_relay_restrictions=permit_tls_all_clientcerts,reject"
+            "-o" "{smtpd_data_restrictions = check_policy_service unix:/run/postfwd3/postfwd3.sock}"
            "-o" "unverified_sender_reject_code=550"
            "-o" "unverified_sender_reject_reason={Sender address rejected: undeliverable address}"
+            "-o" "milter_macro_daemon_name=surtr.yggdrasil.li"
+            "-o" ''smtpd_milters=${config.services.opendkim.socket}''
+          ];
+        };
+        "466" = {
+          type = "inet";
+          private = false;
+          command = "smtpd -v";
+          args = [
+            "-o" "smtpd_tls_security_level=encrypt"
+            "-o" "smtpd_tls_wrappermode=yes"
+            "-o" "smtpd_tls_ask_ccert=no"
+            "-o" "smtpd_tls_req_ccert=no"
+            "-o" "smtpd_sasl_type=dovecot"
+            "-o" "smtpd_sasl_path=/run/dovecot-sasl"
+            "-o" "smtpd_sasl_auth_enable=yes"
+            "-o" "smtpd_tls_received_header=no"
+            "-o" "cleanup_service_name=subcleanup"
+            "-o" "smtpd_client_restrictions=permit_sasl_authenticated,reject"
+            "-o" "{smtpd_sender_restrictions = reject_unknown_sender_domain,reject_unverified_sender,check_policy_service unix:/run/postfix-ccert-sender-policy.sock}"
            "-o" ''{smtpd_recipient_restrictions=reject_unauth_pipelining,reject_non_fqdn_recipient,reject_unknown_recipient_domain,check_recipient_access pgsql:${pkgs.writeText "check_recipient_access.cf" ''
            hosts = postgresql:///email
            dbname = email
            query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s' OR (lookup = regexp_replace('%s', '\+[^@]*@', '@') AND NOT EXISTS (SELECT 1 FROM virtual_mailbox_access WHERE lookup = '%s'))
-          ''},permit_tls_all_clientcerts,reject}''
+          ''},permit_sasl_authenticated,reject}''
+            "-o" "smtpd_relay_restrictions=permit_sasl_authenticated,reject"
+            "-o" "{smtpd_data_restrictions = check_policy_service unix:/run/postfwd3/postfwd3.sock}"
+            "-o" "unverified_sender_reject_code=550"
+            "-o" "unverified_sender_reject_reason={Sender address rejected: undeliverable address}"
            "-o" "milter_macro_daemon_name=surtr.yggdrasil.li"
            "-o" ''smtpd_milters=${config.services.opendkim.socket}''
          ];
        };
        subcleanup = {
-          command = "cleanup";
+          command = "cleanup -v";
          private = false;
          maxproc = 0;
          args = [
@@ -256,13 +339,13 @@ in {
        smtp_pass = {
          name = "smtpd";
          type = "pass";
-          command = "smtpd";
+          command = "smtpd -v";
        };
        postscreen = {
          name = "smtp";
          type = "inet";
          private = false;
-          command = "postscreen";
+          command = "postscreen -v";
          maxproc = 1;
        };
        smtp = {};
@@ -417,7 +500,7 @@ in {
        dovecotSqlConf = pkgs.writeText "dovecot-sql.conf" ''
          driver = pgsql
          connect = dbname=email
-          password_query = SELECT NULL as password, 'Y' as nopassword, "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
+          password_query = SELECT (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN NULL ELSE "password" END) as password, (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN true WHEN password IS NULL THEN true ELSE NULL END) as nopassword, "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
          user_query = SELECT "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
          iterate_query = SELECT "user" FROM imap_user
        '';
@@ -449,7 +532,7 @@ in {
        auth_ssl_username_from_cert = yes
        ssl_cert_username_field = commonName
-        auth_mechanisms = external
+        auth_mechanisms = plain login external
        auth_verbose = yes
        verbose_ssl = yes
@@ -505,6 +588,15 @@ in {
            group = postfix
          }
        }
+        service auth {
+          vsz_limit = 2G
+          unix_listener /run/dovecot-sasl {
+            mode = 0600
+            user = postfix
+            group = postfix
+          }
+        }
        namespace inbox {
          separator = /
@@ -869,9 +961,13 @@ in {
    services.postfwd = {
      enable = true;
+      cache = false;
      rules = ''
-        id=RCPT01; protocol_state=DATA; protocol_state=END-OF-MESSAGE; action=rcpt(ccert_subject/100/3600/set(HIT_RATELIMIT=1,HIT_RATECOUNT=$$ratecount,HIT_RATELIMIT_LIMIT=100,HIT_RATELIMIT_INTERVAL=3600))
+        id=RCPT_SASL01; protocol_state=DATA; protocol_state=END-OF-MESSAGE; sasl_username!=; action=rcpt(sasl_username/100/3600/set(HIT_RATELIMIT=1,HIT_RATECOUNT=$$ratecount,HIT_RATELIMIT_LIMIT=100,HIT_RATELIMIT_INTERVAL=3600))
-        id=RCPT02; protocol_state=DATA; protocol_state=END-OF-MESSAGE; action=rcpt(ccert_subject/1000/86400/set(HIT_RATELIMIT=1,HIT_RATECOUNT=$$ratecount,HIT_RATELIMIT_LIMIT=1000,HIT_RATELIMIT_INTERVAL=86400))
+        id=RCPT_SASL02; protocol_state=DATA; protocol_state=END-OF-MESSAGE; sasl_username!=; action=rcpt(sasl_username/1000/86400/set(HIT_RATELIMIT=1,HIT_RATECOUNT=$$ratecount,HIT_RATELIMIT_LIMIT=1000,HIT_RATELIMIT_INTERVAL=86400))
+        id=RCPT_CCERT01; protocol_state=DATA; protocol_state=END-OF-MESSAGE; ccert_subject!=; action=rcpt(ccert_subject/100/3600/set(HIT_RATELIMIT=1,HIT_RATECOUNT=$$ratecount,HIT_RATELIMIT_LIMIT=100,HIT_RATELIMIT_INTERVAL=3600))
+        id=RCPT_CCERT02; protocol_state=DATA; protocol_state=END-OF-MESSAGE; ccert_subject!=; action=rcpt(ccert_subject/1000/86400/set(HIT_RATELIMIT=1,HIT_RATECOUNT=$$ratecount,HIT_RATELIMIT_LIMIT=1000,HIT_RATELIMIT_INTERVAL=86400))
        id=JUMP_REJECT_RL; HIT_RATELIMIT=="1"; action=jump(REJECT_RL)
@@ -880,5 +976,25 @@ in {
        id=REJECT_RL; action=450 4.7.1 Exceeding maximum of $$HIT_RATELIMIT_LIMIT recipients per $$HIT_RATELIMIT_INTERVAL seconds [$$HIT_RATECOUNT]
      '';
    };
+    services.email.nologin.MNTBys = ["MICROSOFT-MAINT"];
+    systemd.services.nftables.serviceConfig = {
+      ExecStart = lib.mkAfter [ nftables-nologin-script ];
+      ExecReload = lib.mkAfter [ nftables-nologin-script ];
+    };
+    systemd.services."nftables-mail-nologin" = {
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = nftables-nologin-script;
+      };
+    };
+    systemd.timers."nftables-mail-nologin" = {
+      wantedBy = [ "nftables.service" ];
+      timerConfig = {
+        OnActiveSec = "20h";
+        RandomizedDelaySec = "8h";
+      };
+    };
  };
 }
diff --git a/hosts/surtr/postgresql/default.nix b/hosts/surtr/postgresql/default.nix
index f0e42ee8..583e4443 100644
--- a/hosts/surtr/postgresql/default.nix
+++ b/hosts/surtr/postgresql/default.nix
@@ -262,6 +262,20 @@ in {
          GRANT DELETE ON "mailbox_mapping" TO "spm";
          COMMIT;
+          BEGIN;
+          SELECT _v.register_patch('011-password', ARRAY['000-base'], null);
+          ALTER TABLE mailbox ADD COLUMN password text CONSTRAINT password_non_empty CHECK (password IS DISTINCT FROM ''');
+          COMMIT;
+          BEGIN;
+          SELECT _v.register_patch('012-imap-password', ARRAY['000-base', '002-citext'], null);
+          DROP VIEW imap_user;
+          CREATE VIEW imap_user ("user", "password", quota_rule) AS SELECT mailbox.mailbox AS "user", "password", quota_rule FROM mailbox_quota_rule INNER JOIN mailbox ON mailbox_quota_rule.mailbox = mailbox.mailbox;
+          COMMIT;
        ''}
        psql etebase postgres -eXf ${pkgs.writeText "etebase.sql" ''
diff --git a/hosts/surtr/ruleset.nft b/hosts/surtr/ruleset.nft
index ee72614f..5c2bba7c 100644
--- a/hosts/surtr/ruleset.nft
+++ b/hosts/surtr/ruleset.nft
@@ -86,6 +86,7 @@ table inet filter {
  counter established-rx {}
+  counter reject-mail-nologin {}
  counter reject-ratelimit-rx {}
  counter reject-rx {}
  counter reject-tcp-rx {}
@@ -114,6 +115,17 @@ table inet filter {
  counter tx {}
+  set mail_nologin4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+  }
+  set mail_nologin6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+  }
  chain forward {
    type filter hook forward priority filter
    policy drop
@@ -145,6 +157,14 @@ table inet filter {
    counter name drop-fw
  }
+  chain reject_input {
+    limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop
+    log level debug prefix "reject input: " counter name reject-rx
+    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
+    ct state new counter name reject-icmp-rx reject
+    counter name drop-rx
+  }
  chain input {
    type filter hook input priority filter
    policy drop
@@ -177,8 +197,11 @@ table inet filter {
    udp dport {3478, 5349} counter name stun-rx accept
    udp dport 49000-50000 counter name turn-rx accept
+    tcp dport {465,466,993,4190} ip saddr @mail_nologin4 log prefix "mail nologin: " counter name reject-mail-nologin jump reject_input
+    tcp dport {465,466,993,4190} ip6 saddr @mail_nologin6 log prefix "mail nologin: " counter name reject-mail-nologin jump reject_input
    tcp dport 25 counter name smtp-rx accept
-    tcp dport 465 counter name submissions-rx accept
+    tcp dport {465, 466} counter name submissions-rx accept
    tcp dport 993 counter name imaps-rx accept
    tcp dport 4190 counter name managesieve-rx accept
    iifname yggdrasil tcp dport 8432 counter name pgbackrest-rx accept
@@ -186,13 +209,7 @@ table inet filter {
    ct state {established, related} counter name established-rx accept
-    limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop
+    jump reject_input
-    log level debug prefix "reject input: " counter name reject-rx
-    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
-    ct state new counter name reject-icmp-rx reject
-    counter name drop-rx
  }
  chain output {
@@ -224,7 +241,7 @@ table inet filter {
    udp sport 49000-50000 counter name turn-tx accept
    tcp sport 25 counter name smtp-tx accept
-    tcp sport 465 counter name submissions-tx accept
+    tcp sport {465, 466} counter name submissions-tx accept
    tcp sport 993 counter name imaps-tx accept
    tcp sport 4190 counter name managesieve-tx accept
    tcp sport 8432 counter name pgbackrest-tx accept
@@ -232,4 +249,4 @@ table inet filter {
    counter name tx
  }
-}
-\ No newline at end of file
+}
diff --git a/hosts/surtr/vpn/default.nix b/hosts/surtr/vpn/default.nix
index 1d31a6f2..3f7483bd 100644
--- a/hosts/surtr/vpn/default.nix
+++ b/hosts/surtr/vpn/default.nix
@@ -66,6 +66,15 @@ in {
        systemd.network = {
          netdevs = {
+            upstream = {
+              netdevConfig = {
+                Name = "upstream";
+                Kind = "ipvlan";
+              };
+              ipvlanConfig = {
+                Mode = "L2";
+              };
+            };
            vpn = {
              netdevConfig = {
                Name = "vpn";
diff --git a/hosts/surtr/zfs.nix b/hosts/surtr/zfs.nix
index 583ab8e1..17c5cd32 100644
--- a/hosts/surtr/zfs.nix
+++ b/hosts/surtr/zfs.nix
@@ -17,7 +17,7 @@
          fsType = "zfs";
          neededForBoot = true;
        };
-      
      "/var/lib/nixos" =
        { device = "surtr/local/var-lib-nixos";
          fsType = "zfs";
@@ -62,10 +62,13 @@
    };
    services.zfssnap.enable = true;
-    services.zfs.trim.enable = false;
+    services.zfs.trim = {
+      enable = true;
+      interval = "Sun 16:00:00 Europe/Berlin";
+    };
    services.zfs.autoScrub = {
      enable = true;
-      interval = "Sun *-*-1..7 04:00:00";
+      interval = "Sun *-*-1..7 04:00:00 Europe/Berlin";
    };
    services.zfs.zed.settings = {
      ZED_SYSLOG_SUBCLASS_EXCLUDE = "history_event";
diff --git a/hosts/vidhar/dns/zones/yggdrasil.soa b/hosts/vidhar/dns/zones/yggdrasil.soa
index f679b741..dede06ac 100644
--- a/hosts/vidhar/dns/zones/yggdrasil.soa
+++ b/hosts/vidhar/dns/zones/yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.
 $TTL 300
 @ IN SOA vidhar.yggdrasil. hostmaster.yggdrasil.li (
-  2023030501 ; serial
+  2024070901 ; serial
  300        ; refresh
  300        ; retry
  300        ; expire
@@ -27,4 +27,5 @@ vidhar.lan	IN	A	10.141.0.1
 vidhar.mgmt     IN      A       10.141.1.1
 switch01.mgmt   IN      A       10.141.1.2
 dsl01.mgmt      IN      A       10.141.1.3
+gpon01.mgmt     IN      A       10.10.1.1
 ap01.mgmt       IN      A       10.141.1.4
diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index 4a792851..0643f0bb 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -3,7 +3,7 @@
 with lib;
 {
-  imports = [ ./dsl.nix ./bifrost ./dhcp ];
+  imports = [ ./gpon.nix ./bifrost ./dhcp ];
  config = {
    networking = {
diff --git a/hosts/vidhar/network/dsl.nix b/hosts/vidhar/network/gpon.nix
index 1e8e9c73..1628159c 100644
--- a/hosts/vidhar/network/dsl.nix
+++ b/hosts/vidhar/network/gpon.nix
@@ -8,7 +8,7 @@ in {
  options = {
    networking.pppInterface = mkOption {
      type = types.str;
-      default = "dsl";
+      default = "gpon";
    };
  };
@@ -34,7 +34,7 @@ in {
        plugin pppoe.so
        name telekom
        user 002576900250551137425220#0001@t-online.de
-        telekom
+        nic-telekom
        debug
        +ipv6
      '';
@@ -45,6 +45,12 @@ in {
      serviceConfig = {
        PIDFile = "/run/pppd/${pppInterface}.pid";
      };
+      restartTriggers = with config; [
+        environment.etc."ppp/ip-pre-up".source
+        environment.etc."ppp/ip-up".source
+        environment.etc."ppp/ip-down".source
+        # sops.secrets."pap-secrets".sopsFile
+      ];
    };
    sops.secrets."pap-secrets" = {
      format = "binary";
@@ -70,8 +76,8 @@ in {
            tc qdisc add dev "${pppInterface}" handle ffff: ingress
            tc filter add dev "${pppInterface}" parent ffff: basic action ctinfo dscp 0x0000003f 0x00000040 action mirred egress redirect dev "ifb4${pppInterface}"
-            tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 64Mb pppoe-ptm diffserv4 bandwidth 93mbit
+            tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional diffserv4 bandwidth 285mbit
-            tc qdisc replace dev "${pppInterface}" root cake memlimit 64Mb pppoe-ptm nat diffserv4 wash bandwidth 35mbit
+            tc qdisc replace dev "${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional nat diffserv4 wash bandwidth 143mbit
          '';
        };
      in "${app}/bin/${app.meta.mainProgram}";
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 6eb97f85..9f519302 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -4,15 +4,15 @@ table arp filter {
  limit lim_arp_local {
    rate over 50 mbytes/second burst 50 mbytes
  }
-  limit lim_arp_dsl {
+  limit lim_arp_gpon {
-    rate over 1400 kbytes/second burst 1400 kbytes
+    rate over 7500 kbytes/second burst 7500 kbytes
  }
  counter arp-rx {}
  counter arp-tx {}
-  counter arp-ratelimit-dsl-rx {}
+  counter arp-ratelimit-gpon-rx {}
-  counter arp-ratelimit-dsl-tx {}
+  counter arp-ratelimit-gpon-tx {}
  counter arp-ratelimit-local-rx {}
  counter arp-ratelimit-local-tx {}
@@ -21,8 +21,8 @@ table arp filter {
    type filter hook input priority filter
    policy accept
-    iifname != dsl limit name lim_arp_local counter name arp-ratelimit-local-rx drop
+    iifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-rx drop
-    iifname dsl limit name lim_arp_dsl counter name arp-ratelimit-dsl-rx drop
+    iifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-rx drop
    counter name arp-rx
  }
@@ -31,8 +31,8 @@ table arp filter {
    type filter hook output priority filter
    policy accept
-    oifname != dsl limit name lim_arp_local counter name arp-ratelimit-local-tx drop
+    oifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-tx drop
-    oifname dsl limit name lim_arp_dsl counter name arp-ratelimit-dsl-tx drop
+    oifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-tx drop
    counter name arp-tx
  }
@@ -46,11 +46,11 @@ table inet filter {
  limit lim_icmp_local {
    rate over 50 mbytes/second burst 50 mbytes
  }
-  limit lim_icmp_dsl {
+  limit lim_icmp_gpon {
-    rate over 1400 kbytes/second burst 1400 kbytes
+    rate over 7500 kbytes/second burst 7500 kbytes
  }
-  counter icmp-ratelimit-dsl-fw {}
+  counter icmp-ratelimit-gpon-fw {}
  counter icmp-ratelimit-local-fw {}
  counter icmp-fw {}
@@ -58,7 +58,7 @@ table inet filter {
  counter invalid-fw {}
  counter fw-lo {}
  counter fw-lan {}
-  counter fw-dsl {}
+  counter fw-gpon {}
  counter fw-cups {}
@@ -73,7 +73,7 @@ table inet filter {
  counter invalid-local4-rx {}
  counter invalid-local6-rx {}
-  counter icmp-ratelimit-dsl-rx {}
+  counter icmp-ratelimit-gpon-rx {}
  counter icmp-ratelimit-local-rx {}
  counter icmp-rx {}
@@ -101,7 +101,7 @@ table inet filter {
  counter tx-lo {}
-  counter icmp-ratelimit-dsl-tx {}
+  counter icmp-ratelimit-gpon-tx {}
  counter icmp-ratelimit-local-tx {}
  counter icmp-tx {}
@@ -123,10 +123,10 @@ table inet filter {
  chain forward_icmp_accept {
-    oifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
+    oifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
-    iifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
+    iifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
-    oifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    oifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
-    iifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    iifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
    counter name icmp-fw accept
  }
  chain forward {
@@ -139,10 +139,10 @@ table inet filter {
    iifname lo counter name fw-lo accept
-    oifname { lan, dsl, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
+    oifname { lan, gpon, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
-    iifname lan oifname { dsl, bifrost } counter name fw-lan accept
+    iifname lan oifname { gpon, bifrost } counter name fw-lan accept
-    iifname dsl oifname lan ct state { established, related } counter name fw-dsl accept
+    iifname gpon oifname lan ct state { established, related } counter name fw-gpon accept
    limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
@@ -163,22 +163,22 @@ table inet filter {
    iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
    iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
-    iifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-rx drop
+    iifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-rx drop
-    iifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
+    iifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
    meta l4proto $icmp_protos counter name icmp-rx accept
-    iifname { lan, mgmt, dsl, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
+    iifname { lan, mgmt, gpon, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
-    iifname { lan, mgmt, dsl, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
+    iifname { lan, mgmt, gpon, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
    iifname { lan, mgmt, wifibh, yggdrasil } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
    iifname { lan, yggdrasil } tcp dport 2049 counter name nfs-rx accept
-    iifname { lan, mgmt, dsl } meta protocol ip udp dport 51820 counter name wg-rx accept
+    iifname { lan, mgmt, gpon } meta protocol ip udp dport 51820 counter name wg-rx accept
-    iifname { lan, mgmt, dsl } meta protocol ip6 udp dport 51821 counter name wg-rx accept
+    iifname { lan, mgmt, gpon } meta protocol ip6 udp dport 51821 counter name wg-rx accept
    iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept
-    iifname dsl meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
+    iifname gpon meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
    iifname mgmt udp dport 123 counter name ntp-rx accept
@@ -209,8 +209,8 @@ table inet filter {
    oifname lo counter name tx-lo accept
-    oifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-tx drop
+    oifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-tx drop
-    oifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
+    oifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
    meta l4proto $icmp_protos counter name icmp-tx accept
@@ -246,7 +246,7 @@ table inet filter {
 }
 table inet nat {
-  counter dsl-nat {}
+  counter gpon-nat {}
  # counter container-nat {}
  chain postrouting {
@@ -254,20 +254,20 @@ table inet nat {
    policy accept
-    meta nfproto ipv4 oifname dsl counter name dsl-nat masquerade
+    meta nfproto ipv4 oifname gpon counter name gpon-nat masquerade
-    # iifname ve-* oifname dsl counter name container-nat masquerade
+    # iifname ve-* oifname gpon counter name container-nat masquerade
  }
 }
 table inet mss_clamp {
-  counter dsl-mss-clamp {}
+  counter gpon-mss-clamp {}
  chain postrouting {
    type filter hook postrouting priority mangle
    policy accept
-    oifname dsl tcp flags & (syn|rst) == syn counter name dsl-mss-clamp tcp option maxseg size set rt mtu
+    oifname gpon tcp flags & (syn|rst) == syn counter name gpon-mss-clamp tcp option maxseg size set rt mtu
  }
 }
@@ -402,7 +402,7 @@ table inet dscpclassify {
    chain postrouting {
        type filter hook postrouting priority filter + 1; policy accept
-        oifname != dsl return
+        oifname != gpon return
        ip dscp cs0 goto ct_set_cs0
        ip dscp lephb goto ct_set_lephb
diff --git a/hosts/vidhar/prometheus/default.nix b/hosts/vidhar/prometheus/default.nix
index 1e649824..3e938933 100644
--- a/hosts/vidhar/prometheus/default.nix
+++ b/hosts/vidhar/prometheus/default.nix
@@ -63,7 +63,7 @@ in {
        systemd = {
          enable = true;
          extraFlags = [
-            "--systemd.collector.unit-include=(dhcpcd-dsl|pppd-telekom|corerad|ndppd)\.service"
+            "--systemd.collector.unit-include=(dhcpcd-.*|pppd-telekom|corerad|ndppd)\.service"
            "--systemd.collector.enable-restart-count"
            "--systemd.collector.enable-ip-accounting"
          ];
@@ -144,17 +144,6 @@ in {
          ];
          scrape_interval = "15s";
        }
-        { job_name = "zte";
-          static_configs = [
-            { targets = ["localhost:9900"]; }
-          ];
-          relabel_configs = [
-            { replacement = "dsl01";
-              target_label = "instance";
-            }
-          ];
-          scrape_interval = "15s";
-        }
        { job_name = "unbound";
          static_configs = [
            { targets = ["localhost:${toString config.services.prometheus.exporters.unbound.port}"]; }
@@ -274,6 +263,9 @@ in {
                { record = "systemd_unit_runtime_seconds:resets_per_week";
                  expr = "resets(systemd_unit_runtime_seconds[1w])";
                }
+                { record = "systemd_unit_runtime_seconds:avg_resets_per_day";
+                  expr = "avg_over_time(systemd_unit_runtime_seconds:resets_per_day[1w])";
+                }
              ];
            }
            { name = "apcupsd-transfers";
@@ -290,6 +282,9 @@ in {
                { record = "apcupsd_last_transfer_on_battery_counter_seconds:resets_per_week";
                  expr = "resets(apcupsd_last_transfer_on_battery_counter_seconds[1w])";
                }
+                { record = "apcupsd_last_transfer_on_battery_counter_seconds:avg_resets_per_day";
+                  expr = "avg_over_time(apcupsd_last_transfer_on_battery_counter_seconds:resets_per_day[1w])";
+                }
              ];
            }
          ];
@@ -315,47 +310,6 @@ in {
      };
    };
-    systemd.services."prometheus-zte-exporter@dsl01.mgmt.yggdrasil" = {
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      serviceConfig = {
-        Restart = "always";
-        PrivateTmp = true;
-        WorkingDirectory = "/tmp";
-        DynamicUser = true;
-        CapabilityBoundingSet = [""];
-        DeviceAllow = [""];
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectSystem = "strict";
-        RemoveIPC = true;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        UMask = "0077";
-        Type = "simple";
-        ExecStart = "${pkgs.zte-prometheus-exporter}/bin/zte-prometheus-exporter";
-        Environment = "ZTE_BASEURL=http://%I ZTE_HOSTNAME=localhost ZTE_PORT=9900";
-        EnvironmentFile = config.sops.secrets."zte_dsl01.mgmt.yggdrasil".path;
-      };
-    };
-    sops.secrets."zte_dsl01.mgmt.yggdrasil" = {
-      format = "binary";
-      sopsFile = ./zte_dsl01.mgmt.yggdrasil;
-    };
    systemd.services."prometheus-nftables-exporter" = {
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
diff --git a/hosts/vidhar/prometheus/zte_dsl01.mgmt.yggdrasil b/hosts/vidhar/prometheus/zte_dsl01.mgmt.yggdrasil
deleted file mode 100644
index 1c9c1fe0..00000000
--- a/hosts/vidhar/prometheus/zte_dsl01.mgmt.yggdrasil
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-        "data": "ENC[AES256_GCM,data:nAsn7dhfDr0+V1cJjpqWn/kJQt2zGjlfQKi3n5speroJkL3IvMG/9fsTaXJQZSi2gPlrN8GbxKQ=,iv:9g0V3xRBC+sa/JPP2bUZMfg//VuKT5qI7ua9iU4QRCg=,tag:fzwih9OHUBLmx8dxL4BjGg==,type:str]",
-        "sops": {
-                "kms": null,
-                "gcp_kms": null,
-                "azure_kv": null,
-                "hc_vault": null,
-                "age": [
-                        {
-                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
-                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaEE3bUFBY0xKSDUrVnc2\nbFpjSkNOSm56amJTNjdXcTljdDNRREhITm1NCjZrOUEwNFpxN2FmTVV5T2xCbENk\nMEFmVzlPZ29CTlJ4dVNCRUsyRFFseXcKLS0tIEhscVZ4VUVsaG9OUnBIRFE4WXA2\ncGFnbWpNMlNIQzFLc1Ryc1Z3NUl1bVUKi9zYBlF2vslGKu4GP368ApbvuxjZnQpF\nuOujXSNoEps21wY6xUENm+CbYbgaJjSgmb5c1IjAmnubVI4JVY9OyQ==\n-----END AGE ENCRYPTED FILE-----\n"
-                        }
-                ],
-                "lastmodified": "2021-12-31T15:00:33Z",
-                "mac": "ENC[AES256_GCM,data:sw2NVXHLibbuOChgScLhSTjGZBjSoHpzIuRqfCW0eL3DwhL5CekG6T/oYu06KjNmxVjxwb3OmqECSU0TUvPn9ySOWwMSoBfyJpDoTHnZ+YOjOH351IOAMBNcBDJse7aLGRWW5YXKLDfmp8Dhg2hlMhCmkVwAquQjPhfmAdJfj64=,iv:wgM/BlRU2XJSGj7KvAo1WRamecffUDnFvv2+4twtsQY=,tag:0mXblJtTGMTvxndedws94A==,type:str]",
-                "pgp": [
-                        {
-                                "created_at": "2023-01-30T10:58:49Z",
-                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAcwl1Blp3J5wgpRJKbYI1G1yEZrRYeYuoDtYUh3ToMAQw\nd92/bIJJR5Ml91eDym9uBN0fFRRy72r6FOx4qZT7S4DhmuA84qCbASjF8bKSclc0\n0l4BBXvDS5Dz1Q7iYc+LxZjHASV1v73A+MaeCFvG/pjmHzF0z0EzBiAJD4ZWGcP0\nX2dDbjl+n9VFrvmeLRxQNh4XZW43iTXdRjwHDgm16zhd9X6VOVhr5UkC4Nyjq2Ar\n=4ZEa\n-----END PGP MESSAGE-----\n",
-                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
-                        }
-                ],
-                "unencrypted_suffix": "_unencrypted",
-                "version": "3.7.1"
-        }
-}
-\ No newline at end of file
diff --git a/modules/postfwd.nix b/modules/postfwd.nix
index 3edff44d..93729978 100644
--- a/modules/postfwd.nix
+++ b/modules/postfwd.nix
@@ -9,6 +9,10 @@ in {
    services.postfwd = with types; {
      enable = mkEnableOption "postfwd3 - postfix firewall daemon";
+      cache = mkEnableOption "postfwd3 cache" // {
+        default = true;
+      };
      rules = mkOption {
        type = lines;
        default = "";
@@ -26,7 +30,7 @@ in {
      serviceConfig = {
        Type = "forking";
-        ExecStart = "${pkgs.postfwd}/bin/postfwd3 ${escapeShellArgs [
+        ExecStart = "${pkgs.postfwd}/bin/postfwd3 ${escapeShellArgs ([
          "-vv"
          "--daemon" "--user" "postfwd" "--group" "postfwd"
          "--pidfile" "/run/postfwd3/postfwd3.pid"
@@ -35,11 +39,14 @@ in {
          "--save_rates" "/var/lib/postfwd/rates"
          "--save_groups" "/var/lib/postfwd/groups"
          "--summary" "3600"
+          "--file" (pkgs.writeText "postfwd3-rules" cfg.rules)
+        ] ++ lib.optionals cfg.cache [
          "--cache" "600"
          "--cache_proto" "unix"
          "--cache_port" "/run/postfwd3/cache.sock"
-          "--file" (pkgs.writeText "postfwd3-rules" cfg.rules)
+        ] ++ lib.optionals (!cfg.cache) [
-        ]}";
+          "--cache" "0"
+        ])}";
        PIDFile = "/run/postfwd3/postfwd3.pid";
        Restart = "always";
@@ -79,5 +86,19 @@ in {
        IPAddressDeny = "any";
      };
    };
+    environment.systemPackages = [
+      (pkgs.postfwd.overrideAttrs (oldAttrs: {
+        nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [ pkgs.makeWrapper pkgs.coreutils ];
+        postInstall = ''
+          ${oldAttrs.postInstall or ""}
+          wrapProgram $out/bin/postfwd3 \
+            --add-flags "--proto unix --port /run/postfwd3/postfwd3.sock"
+          ln -s postfwd3 $out/bin/postfwd
+        '';
+      }))
+    ];
  };
 }
diff --git a/overlays/worktime/worktime/__main__.py b/overlays/worktime/worktime/__main__.py
index 0df226fa..21316182 100755
--- a/overlays/worktime/worktime/__main__.py
+++ b/overlays/worktime/worktime/__main__.py
@@ -2,9 +2,9 @@ import requests
 from requests.exceptions import HTTPError
 from requests.auth import HTTPBasicAuth
 from datetime import *
-from xdg import (BaseDirectory)
+from xdg import BaseDirectory
 import toml
-from uritools import uricompose
+from uritools import (uricompose)
 from dateutil.easter import *
 from dateutil.tz import *
@@ -80,7 +80,7 @@ class TogglAPI(object):
        max_time=10,
    )
    def _raw_query(self, url, method):
-        headers = {'content-type': 'application/json'}
+        headers = {'content-type': 'application/json', 'accept': 'application/json'}
        response = None
        if method == 'GET':
@@ -127,9 +127,9 @@ class TogglAPI(object):
                    pass
            entries = list()
-            params = { 'since': (req_start - timedelta(days=1)).astimezone(timezone.utc).isoformat(),
+            params = { 'since': (req_start - timedelta(days=1)).date().isoformat(),
-                       'until': (req_end + timedelta(days=1)).astimezone(timezone.utc).isoformat(),
+                       'until': (req_end + timedelta(days=1)).date().isoformat(),
-                       'rounding': rounding,
+                       'rounding': 'yes' if rounding else 'no',
                       'billable': 'yes'
                      }
            if client_ids is not None: