diff --git a/config/installer.nix b/config/installer.nix
index 44b7a49d..f6e24e4e 100644
--- a/config/installer.nix
+++ b/config/installer.nix
@@ -13,10 +13,10 @@
   boot.supportedFilesystems = ["zfs"];
   # Oldest system I have is skylake-based
   /*
-   nixpkgs.localSystem = {
-   gcc.arch = "skylake";
-   gcc.tune = "skylake";
-   system = "x86_64-linux";
-   };
-   */
+  nixpkgs.localSystem = {
+  gcc.arch = "skylake";
+  gcc.tune = "skylake";
+  system = "x86_64-linux";
+  };
+  */
 }
diff --git a/config/nixos-8gb-fsn1-1-arm64.nix b/config/nixos-8gb-fsn1-1-arm64.nix
new file mode 100644
index 00000000..c9da90c5
--- /dev/null
+++ b/config/nixos-8gb-fsn1-1-arm64.nix
@@ -0,0 +1,5 @@
+_: {
+  imports = [
+    ./nixos-8gb-fsn1-1.nix
+  ];
+}
diff --git a/flake.nix b/flake.nix
index 0322f57e..fdef83d0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,6 +39,10 @@ rec {
         name = "nixos-8gb-fsn1-1"; # Hetzner Server
         system = "x86_64-linux";
       }
+      {
+        name = "nixos-8gb-fsn1-1-arm64"; # Hetzner Server
+        system = "aarch64-linux";
+      }
       {
         name = "nutty-noon"; # PC
         system = "x86_64-linux";
diff --git a/modules/matrix/mautrix-whatsapp.nix b/modules/matrix/mautrix-whatsapp.nix
index 28c4f7ad..93d7979e 100644
--- a/modules/matrix/mautrix-whatsapp.nix
+++ b/modules/matrix/mautrix-whatsapp.nix
@@ -104,9 +104,9 @@ in {
         ProtectHostname = true;
         ProtectKernelModules = true;
         ProtectClock = true;
-        SystemCallArchitectures="native";
-        SystemCallErrorNumber="EPERM";
-        SystemCallFilter="@system-service";
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = "@system-service";
         WorkingDirectory = dataDir;
         StateDirectory = baseNameOf dataDir;
         UMask = 0117;
@@ -141,9 +141,9 @@ in {
         ProtectHostname = true;
         ProtectKernelModules = true;
         ProtectClock = true;
-        SystemCallArchitectures="native";
-        SystemCallErrorNumber="EPERM";
-        SystemCallFilter="@system-service";
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = "@system-service";
         WorkingDirectory = dataDir;
         StateDirectory = baseNameOf dataDir;
         UMask = 0117;
diff --git a/packages/minecraft/luckperms.nix b/packages/minecraft/luckperms.nix
index 60ffc723..41aa6220 100644
--- a/packages/minecraft/luckperms.nix
+++ b/packages/minecraft/luckperms.nix
@@ -72,43 +72,43 @@
   };
 in
   /*
-    stdenv.mkDerivation {
-   inherit pname version src;
-   
-   name = "${pname}-${version}.jar";
-   
-   nativeBuildInputs = [ git ];
-   
-   postPatch = addResolveStep;
-   
-   buildPhase = ''
-   ${gnused}/bin/sed -i "s#'bukkit-legacy',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'bukkit-legacy:loader',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'bungee',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'bungee:loader',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'nukkit',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'nukkit:loader',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'sponge',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'sponge:loader',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'sponge:sponge-service',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'sponge:sponge-service-api8',##" settings.gradle
-   ${gnused}/bin/sed -i "s#'velocity'##" settings.gradle
-   export GRADLE_USER_HOME=$(${coreutils}/bin/mktemp -d)
-   
-   # add local maven repo
-   ${gnused}/bin/sed -i "s#mavenCentral()#mavenCentral(); maven { url '${deps}/maven' }#" build.gradle
-   ${gnused}/bin/sed -i "s#jcenter()#jcenter(); maven { url '${deps}/maven' }#" settings.gradle
-   ${gnused}/bin/sed -i "s#'fabric',##" settings.gradle
-   
-   ${gradle}/bin/gradle --offline --no-daemon --info -Dorg.gradle.java.home=${openjdk17_headless} build
-   '';
-   
-   installPhase = ''
-   cp bukkit/loader/build/libs/LuckPerms-Bukkit-5.4.0.jar $out
-   '';
-   
-   }
-   */
+   stdenv.mkDerivation {
+  inherit pname version src;
+
+  name = "${pname}-${version}.jar";
+
+  nativeBuildInputs = [ git ];
+
+  postPatch = addResolveStep;
+
+  buildPhase = ''
+  ${gnused}/bin/sed -i "s#'bukkit-legacy',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'bukkit-legacy:loader',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'bungee',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'bungee:loader',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'nukkit',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'nukkit:loader',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'sponge',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'sponge:loader',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'sponge:sponge-service',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'sponge:sponge-service-api8',##" settings.gradle
+  ${gnused}/bin/sed -i "s#'velocity'##" settings.gradle
+  export GRADLE_USER_HOME=$(${coreutils}/bin/mktemp -d)
+
+  # add local maven repo
+  ${gnused}/bin/sed -i "s#mavenCentral()#mavenCentral(); maven { url '${deps}/maven' }#" build.gradle
+  ${gnused}/bin/sed -i "s#jcenter()#jcenter(); maven { url '${deps}/maven' }#" settings.gradle
+  ${gnused}/bin/sed -i "s#'fabric',##" settings.gradle
+
+  ${gradle}/bin/gradle --offline --no-daemon --info -Dorg.gradle.java.home=${openjdk17_headless} build
+  '';
+
+  installPhase = ''
+  cp bukkit/loader/build/libs/LuckPerms-Bukkit-5.4.0.jar $out
+  '';
+
+  }
+  */
   fetchurl {
     url = "https://ci.lucko.me/job/LuckPerms/1429/artifact/bukkit/loader/build/libs/LuckPerms-Bukkit-5.4.21.jar";
     sha256 = "bd9090b3cf1412d77ff58ee0c2c7229184306cc83ff18ff4681ea1b7116b3747";
diff --git a/zones/chir.rs.nix b/zones/chir.rs.nix
index 124655ef..68476692 100644
--- a/zones/chir.rs.nix
+++ b/zones/chir.rs.nix
@@ -45,27 +45,27 @@ with dns.lib.combinators; let
       }
     ];
     /*
-     subdomains = {
-     _tcp.subdomains."*".TLSA = [
-     {
-     certUsage = "dane-ee";
-     selector = "spki";
-     match = "sha256";
-     certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
-     ttl = zoneTTL;
-     }
-     ];
-     _udp.subdomains."*".TLSA = [
-     {
-     certUsage = "dane-ee";
-     selector = "spki";
-     match = "sha256";
-     certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
-     ttl = zoneTTL;
-     }
-     ];
-     };
-     */
+    subdomains = {
+    _tcp.subdomains."*".TLSA = [
+    {
+    certUsage = "dane-ee";
+    selector = "spki";
+    match = "sha256";
+    certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
+    ttl = zoneTTL;
+    }
+    ];
+    _udp.subdomains."*".TLSA = [
+    {
+    certUsage = "dane-ee";
+    selector = "spki";
+    match = "sha256";
+    certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
+    ttl = zoneTTL;
+    }
+    ];
+    };
+    */
     HTTPS = [
       {
         svcPriority = 1;
diff --git a/zones/darkkirb.de.nix b/zones/darkkirb.de.nix
index 79a96db8..f869b971 100644
--- a/zones/darkkirb.de.nix
+++ b/zones/darkkirb.de.nix
@@ -45,27 +45,27 @@ with dns.lib.combinators; let
       }
     ];
     /*
-     subdomains = {
-     _tcp.subdomains."*".TLSA = [
-     {
-     certUsage = "dane-ee";
-     selector = "spki";
-     match = "sha256";
-     certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
-     ttl = zoneTTL;
-     }
-     ];
-     _udp.subdomains."*".TLSA = [
-     {
-     certUsage = "dane-ee";
-     selector = "spki";
-     match = "sha256";
-     certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
-     ttl = zoneTTL;
-     }
-     ];
-     };
-     */
+    subdomains = {
+    _tcp.subdomains."*".TLSA = [
+    {
+    certUsage = "dane-ee";
+    selector = "spki";
+    match = "sha256";
+    certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
+    ttl = zoneTTL;
+    }
+    ];
+    _udp.subdomains."*".TLSA = [
+    {
+    certUsage = "dane-ee";
+    selector = "spki";
+    match = "sha256";
+    certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
+    ttl = zoneTTL;
+    }
+    ];
+    };
+    */
     HTTPS = [
       {
         svcPriority = 1;
diff --git a/zones/int.chir.rs.nix b/zones/int.chir.rs.nix
index b36c1385..58ac6dc9 100644
--- a/zones/int.chir.rs.nix
+++ b/zones/int.chir.rs.nix
@@ -76,27 +76,27 @@ in {
         }
       ];
       /*
-       subdomains = {
-       _tcp.subdomains."*".TLSA = [
-       {
-       certUsage = "dane-ee";
-       selector = "spki";
-       match = "sha256";
-       certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
-       ttl = zoneTTL;
-       }
-       ];
-       _udp.subdomains."*".TLSA = [
-       {
-       certUsage = "dane-ee";
-       selector = "spki";
-       match = "sha256";
-       certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
-       ttl = zoneTTL;
-       }
-       ];
-       };
-       */
+      subdomains = {
+      _tcp.subdomains."*".TLSA = [
+      {
+      certUsage = "dane-ee";
+      selector = "spki";
+      match = "sha256";
+      certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
+      ttl = zoneTTL;
+      }
+      ];
+      _udp.subdomains."*".TLSA = [
+      {
+      certUsage = "dane-ee";
+      selector = "spki";
+      match = "sha256";
+      certificate = "0b85bd8fd152ed8b29a25e7fd69c083138a7bd35d79aea62c111efcf17ede23f";
+      ttl = zoneTTL;
+      }
+      ];
+      };
+      */
       HTTPS = [
         {
           svcPriority = 1;