diff --git a/flake.nix b/flake.nix
index 6ee7a5c..1668ffc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,6 +26,7 @@
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
             home-manager.extraSpecialArgs = { inherit inputs; };
+            home-manager.users.data = ./home/desktop/data.nix;
             home-manager.users.root = ./home/desktop/root.nix;
             home-manager.users.bogale = ./home/desktop/bogale.nix;
           }
diff --git a/home/desktop/data.nix b/home/desktop/data.nix
new file mode 100644
index 0000000..36b4edc
--- /dev/null
+++ b/home/desktop/data.nix
@@ -0,0 +1,8 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ../common.nix ];
+  home = {
+    username = "data";
+    homeDirectory = "/home/data";
+  };
+}
diff --git a/server/configuration.nix b/server/configuration.nix
index 64952e2..053fc97 100644
--- a/server/configuration.nix
+++ b/server/configuration.nix
@@ -15,7 +15,9 @@
     };
     users = {
       nginx.extraGroups = [ "php" "acme" ];
-      root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
+      root.openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow"
+      ];
       php = {
         uid = 1568;
         group = "php";
@@ -31,8 +33,8 @@
   networking = {
     hostName = "nixos-server";
     firewall = {
-      allowedTCPPorts = [ 25 443 465 993 ];
       allowedUDPPorts = [ 443 ];
+      allowedTCPPorts = [ 25 443 465 993 ];
     };
     wg-quick.interfaces.awg0 = {
       configFile = "/secrets/awg/1.conf";
@@ -45,4 +47,15 @@
       wifi-security.psk = "$BOGALE_2_4_PSK";
     };
   };
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "letsencrypt@bogaledev.ru";
+    certs."bogaledev.ru" = {
+      validMinDays = 3;
+      dnsProvider = "cloudflare";
+      extraDomainNames = [ "*.bogaledev.ru" ];
+      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
+      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
+    };
+  };
 }
diff --git a/server/mods/mail.nix b/server/mods/mail.nix
index 6be758b..5784320 100644
--- a/server/mods/mail.nix
+++ b/server/mods/mail.nix
@@ -15,9 +15,10 @@ in {
     rspamd = {
       enable = true;
       postfix.enable = true;
-      locals."redis.conf".text = ''
-        servers = "${config.services.redis.servers.rspamd.unixSocket}";
-      '';
+      locals = {
+        "classifier-bayes.conf".text = "autolearn = true;";
+        "redis.conf".text = ''servers = "${config.services.redis.servers.rspamd.unixSocket}";'';
+      };
     };
     postfix = {
       enable = true;
@@ -26,24 +27,23 @@ in {
       mapFiles.smtp_passwd = "/secrets/smtp_passwd";
       virtual = "/.*@bogaledev.ru/ mail@bogaledev.ru";
       submissionsOptions = {
+        smtpd_sasl_type = "dovecot";
         smtpd_tls_wrappermode = true;
         smtpd_sasl_auth_enable = "yes";
+        smtpd_sasl_path = "${postfixDir}/auth";
         milter_macro_daemon_name = "ORIGINATING";
         smtpd_client_restrictions = "permit_sasl_authenticated,reject";
+        smtpd_tls_chain_files = "${sslCertDir}/key.pem,${sslCertDir}/fullchain.pem";
       };
       settings.main = {
-        smtpd_sasl_type = "dovecot";
         smtp_tls_wrappermode = true;
         smtp_sasl_auth_enable = true;
-        smtpd_sasl_auth_enable = true;
         smtp_tls_security_level = "verify";
         relayhost = [ "smtp.resend.com:2465" ];
-        smtpd_sasl_path = "${postfixDir}/auth";
         virtual_mailbox_domains = "bogaledev.ru";
         smtp_sasl_tls_security_options = "noanonymous";
+        virtual_transport = "lmtp:unix:${postfixDir}/lmtp";
         smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd";
-        virtual_transport = "lmtp:unix:${postfixDir}/dovecot-lmtp";
-        smtpd_tls_chain_files = [ "${sslCertDir}/key.pem" "${sslCertDir}/fullchain.pem" ];
       };
     };
     dovecot2 = {
@@ -66,22 +66,22 @@ in {
           user = "postfix";
           group = "postfix";
         };
-        "service lmtp"."unix_listener ${postfixDir}/dovecot-lmtp" = {
+        "service lmtp"."unix_listener ${postfixDir}/lmtp" = {
           mode = "0600";
           user = "postfix";
           group = "postfix";
         };
         "namespace inbox" = let
           mailbox = name: {
-            auto = "create";
+            auto = "subscribe";
             mailbox_special_use = "\\${name}";
           };
         in {
           inbox = true;
           "mailbox Sent" = mailbox "Sent";
           "mailbox Archive" = mailbox "Archive";
-          "mailbox Flagged" = mailbox "Flagged";
-          "mailbox Junk" = mailbox "Junk" // { mailbox_autoexpunge = "45d"; };
+          "mailbox Important" = mailbox "Flagged";
+          "mailbox Spam" = mailbox "Junk" // { mailbox_autoexpunge = "45d"; };
           "mailbox Trash" = mailbox "Trash" // { mailbox_autoexpunge = "45d"; };
         };
       };
diff --git a/server/mods/sysd.nix b/server/mods/sysd.nix
index fe15eb6..5910243 100644
--- a/server/mods/sysd.nix
+++ b/server/mods/sysd.nix
@@ -1,12 +1,36 @@
 { config, lib, pkgs, ... }:
 {
+  services = {
+    prometheus = {
+      enable = true;
+      exporters.node.enable = true;
+      scrapeConfigs = [ {
+        job_name = "node";
+        static_configs = [ { targets = [
+          "localhost:${toString config.services.prometheus.exporters.node.port}"
+        ]; } ];
+      } ];
+    };
+    grafana = {
+      enable = true;
+      settings = {
+        security.secret_key = "$__file{/secrets/grafana-key}";
+        server = {
+          enable_gzip = true;
+          protocol = "socket";
+          socket_mode = "0666";
+          root_url = "https://bogaledev.ru/grafana";
+        };
+      };
+    };
+  };
   systemd = {
     timers = {
       tgbot-send = {
         wantedBy = [ "timers.target" ];
         timerConfig = {
-          OnCalendar = "*-*-01 16:00:00";
           Persistent = true;
+          OnCalendar = "*-*-01 16:00:00";
         };
       };
       network-watchdog = {
@@ -35,7 +59,7 @@
       network-watchdog = {
         serviceConfig = {
           Type = "oneshot";
-          LogLevelMax = "notice";
+          LogLevelMax = "warning";
         };
         script = ''
           if [ ! -e /run/network.failures ] || [ ! -e /run/network.limit ] || \
@@ -45,12 +69,11 @@
           else
             limit=$(cat /run/network.limit)
             failures=$((1+$(cat /run/network.failures)))
-            [ $failures -gt 1 ] && echo "<5>failures = $failures"
           fi
           if [ $failures -ge $limit ]; then
             echo "<4>restarting NetworkManager"
             systemctl restart NetworkManager.service
-            [ $limit -lt 60 ] && limit=$((4*$limit/3))
+            [ $limit -lt 360 ] && limit=$((2*$limit))
             failures=0
           fi
           echo $limit > /run/network.limit
diff --git a/server/mods/web.nix b/server/mods/web.nix
index e24b478..e3fa526 100644
--- a/server/mods/web.nix
+++ b/server/mods/web.nix
@@ -1,16 +1,5 @@
 { config, lib, pkgs, ... }:
 {
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "letsencrypt@bogaledev.ru";
-    certs."bogaledev.ru" = {
-      validMinDays = 3;
-      dnsProvider = "cloudflare";
-      extraDomainNames = [ "*.bogaledev.ru" ];
-      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
-      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
-    };
-  };
   services = let
     sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
   in {
@@ -34,8 +23,8 @@
       settings = {
         "pm" = "ondemand";
         "pm.max_children" = 4;
-        "listen.owner" = "nginx";
         "listen.group" = "nginx";
+        "listen.owner" = "nginx";
       };
     };
     vaultwarden = {
@@ -107,6 +96,11 @@
         "/".extraConfig = phpPool;
         "/local/".extraConfig = "${phpPool} ${localNetworks}";
         "/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
+        "/grafana/" = {
+          proxyWebsockets = true;
+          extraConfig = localNetworks;
+          proxyPass = "http://unix:/run/grafana/grafana.sock:/";
+        };
         "/local/net/".extraConfig = ''
           allow fc01::/64;
           allow 10.1.0.0/16;