diff --git a/docker_compose/mediahost/gitea/docker-compose.yaml b/docker_compose/mediahost/gitea/docker-compose.yaml
index aa75d76..497021a 100644
--- a/docker_compose/mediahost/gitea/docker-compose.yaml
+++ b/docker_compose/mediahost/gitea/docker-compose.yaml
@@ -16,4 +16,10 @@ services:
       - /data/gitea:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
-
+    networks:
+      - default
+      - shared-proxy-services
+networks:
+  default:
+  shared-proxy-services:
+    external: true
diff --git a/docker_compose/mediahost/homeassistant/docker-compose.yaml b/docker_compose/mediahost/homeassistant/docker-compose.yaml
index 585bef7..c106a76 100644
--- a/docker_compose/mediahost/homeassistant/docker-compose.yaml
+++ b/docker_compose/mediahost/homeassistant/docker-compose.yaml
@@ -9,6 +9,11 @@ services:
       TZ: Europe/Vienna
     volumes:
       - /srv/homeassistant:/config
+    devices:
+      - /dev/bus/usb:/dev/bus/usb
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
 
   mosquitto:
     container_name: mosquitto
diff --git a/docker_compose/mediahost/immich/docker-compose.yaml b/docker_compose/mediahost/immich/docker-compose.yaml
new file mode 100644
index 0000000..cbf38a0
--- /dev/null
+++ b/docker_compose/mediahost/immich/docker-compose.yaml
@@ -0,0 +1,81 @@
+#
+# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
+#
+# Make sure to use the docker-compose.yml of the current release:
+#
+# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+#
+# The compose file on main may not be compatible with the latest release.
+
+name: immich
+
+services:
+  immich-server:
+    container_name: immich_server
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    # extends:
+    #   file: hwaccel.transcoding.yml
+    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
+    volumes:
+      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
+      - ${UPLOAD_LOCATION}:/data
+      - /data/immich/pictures:/libary
+      - /etc/localtime:/etc/localtime:ro
+    env_file:
+      - .env
+    ports:
+      - '2283:2283'
+    depends_on:
+      - database
+    restart: always
+    healthcheck:
+      disable: false
+    networks:
+      - immich
+      - shared-redis-services
+
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
+    # Example tag: ${IMMICH_VERSION:-release}-cuda
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
+    #   file: hwaccel.ml.yml
+    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    volumes:
+      - model-cache:/cache
+    env_file:
+      - .env
+    restart: always
+    healthcheck:
+      disable: false
+    networks:
+      - immich
+
+  database:
+    container_name: immich_postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
+      # DB_STORAGE_TYPE: 'HDD'
+    volumes:
+      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+    shm_size: 128mb
+    restart: always
+    healthcheck:
+      disable: false
+    networks:
+      - immich
+
+volumes:
+  model-cache:
+networks:
+  immich:
+  shared-redis-services:
+    external: true
+                           
diff --git a/docker_compose/mediahost/jellyfin/docker-compose.yaml b/docker_compose/mediahost/jellyfin/docker-compose.yaml
index 3a106be..7bea011 100644
--- a/docker_compose/mediahost/jellyfin/docker-compose.yaml
+++ b/docker_compose/mediahost/jellyfin/docker-compose.yaml
@@ -15,7 +15,6 @@ services:
     networks:
       - default
       - shared-proxy-services
-
   seerr:
     image: ghcr.io/seerr-team/seerr:latest
     container_name: seerr
@@ -29,6 +28,7 @@ services:
     networks:
       - default
       - shared-proxy-services
+
 networks:
   default:
     external: true
diff --git a/docker_compose/mediahost/mediaarr/docker-compose.yaml b/docker_compose/mediahost/mediaarr/docker-compose.yaml
index 763b62e..3e6b79a 100644
--- a/docker_compose/mediahost/mediaarr/docker-compose.yaml
+++ b/docker_compose/mediahost/mediaarr/docker-compose.yaml
@@ -1,22 +1,5 @@
 
 services:
-  sonarr-en:
-    image: lscr.io/linuxserver/sonarr:latest
-    container_name: sonarr-en
-    restart: unless-stopped
-    ports:
-      - "8989:8989"
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Europe/Berlin
-    volumes:
-      - ./sonarr_EN:/config
-      - /data/jellyfin/media/series-english:/JellyfinSeriesEnglish
-      - /data/jellyfin/media/anime-english:/JellyfinAnimeEnglish
-      - /data/jellyfin/media/documentaries-english:/JellyfinDocus
-      - /data/jellyfin/buffer:/buffer
-      - /torrent/qbittorrent/downloads:/downloads
   sonarr-de:
     image: lscr.io/linuxserver/sonarr:latest
     container_name: sonarr-de
@@ -31,10 +14,13 @@ services:
       - ./sonarr_DE:/config
       - /data/jellyfin/media/series-german:/JellyfinSeriesGerman
       - /data/jellyfin/media/anime-german:/JellyfinAnimeGerman
+      - /data/jellyfin/media/series-english:/JellyfinSeriesEnglish
+      - /data/jellyfin/media/anime-english:/JellyfinAnimeEnglish
+      - /data/jellyfin/media/documentaries-english:/JellyfinDocus
       - /data/jellyfin/media/series-kids:/JellyfinKinder
       - /data/jellyfin/buffer:/buffer
       - /torrent/qbittorrent/downloads:/downloads
-      - /torrent/rundfunkarr:/downloads-rundfunkarr
+      - /torrent/rundfunkarr-de:/downloads-rundfunkarr
   radarr-en:
     image: lscr.io/linuxserver/radarr:latest
     container_name: radarr-en
@@ -67,7 +53,7 @@ services:
       - /data/jellyfin/media/movies-kids:/JellyfinKinder
       - /data/jellyfin/buffer:/buffer
       - /torrent/qbittorrent/downloads:/downloads
-      - /torrent/rundfunkarr:/downloads-rundfunkarr
+      - /torrent/rundfunkarr-de:/downloads-rundfunkarr
   prowlarr:
     image: lscr.io/linuxserver/prowlarr:latest
     container_name: prowlarr
@@ -177,7 +163,7 @@ services:
       - TZ=Europe/Berlin
     volumes:
       - ./lidarr:/config
-      - /data/navidrome/music:/music
+      - /data/navidrome/music/music:/music
       - /torrent/qbittorrent/downloads:/downloads
  
     ports:
@@ -261,14 +247,43 @@ services:
       - /data/jellyfin/media/comedy-english:/data/comedy-english:ro
       - /data/jellyfin/media/movies-german:/data/movies-german:ro
       - /data/jellyfin/media/movies-kids:/data/movies-kids:ro
-#      - /data/audiobookshelf/podcasts:/podcasts
-#      - /data/audiobookshelf/audiobooks-englisch:/audiobooks
       - /data/navidrome/music:/data/music:ro
       - /data/audiobookshelf/data/audiobooks-englisch:/data/audiobooks-english:ro
       - /data/audiobookshelf/data/audiobooks-deutsch:/data/audiobooks-german:ro
       - /data/audiobookshelf/data/audiobooks-kinder:/data/audiobooks-kinder:ro
       # Download location
       - /torrent/qbittorrent/downloads:/downloads
+  jackett:
+    image: lscr.io/linuxserver/jackett:latest
+    container_name: jackett
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Vienna
+    volumes:
+      - ./jackett/config:/config
+      - ./jackett/downloads:/downloads
+    ports:
+      - "9117:9117"
+    restart: unless-stopped
+  gluetun-proxy:
+    image: qmcgaw/gluetun:latest
+    container_name: gluetun-proxy
+    cap_add:
+      - NET_ADMIN
+    ports:
+      - "8889:8888"   # HTTP proxy
+      - "8388:8388"   # SOCKS5 proxy
+    volumes:
+      - ./gluetun-proxy:/gluetun/wireguard
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - VPN_SERVICE_PROVIDER=custom
+      - VPN_TYPE=wireguard
+      - SOCKS5_ENABLED=on 
+      - HTTPPROXY=on
+      - SOCKSPROXY=on
+    restart: unless-stopped
 
 networks:
   default:
diff --git a/docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf b/docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf
new file mode 100644
index 0000000..4cef4f3
--- /dev/null
+++ b/docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf
@@ -0,0 +1,11 @@
+#
+# Use this configuration with WireGuard client
+#
+[Interface]
+Address = 10.14.0.2/16
+PrivateKey = mKeDQdxtM1iFJS7WLlb2jPGabZIt3NkoA/nGCcNOU1I=
+DNS = 162.252.172.57, 149.154.159.92
+[Peer]
+PublicKey = dPZe8Jq3Hu0k07MDk+Y4+AS2XHSLYalyg91TSFXRYEA=
+AllowedIPs = 0.0.0.0/0
+Endpoint = 87.249.133.4:51820
diff --git a/docker_compose/mediahost/monitoring/blackbox.yml b/docker_compose/mediahost/monitoring/blackbox.yml
new file mode 100644
index 0000000..1b74093
--- /dev/null
+++ b/docker_compose/mediahost/monitoring/blackbox.yml
@@ -0,0 +1,8 @@
+modules:
+  http_2xx:
+    prober: http
+    timeout: 5s
+    http:
+      valid_status_codes: []
+      method: GET
+      preferred_ip_protocol: ip4
diff --git a/docker_compose/mediahost/monitoring/docker-compose.yaml b/docker_compose/mediahost/monitoring/docker-compose.yaml
index a2bc6ee..71d284f 100644
--- a/docker_compose/mediahost/monitoring/docker-compose.yaml
+++ b/docker_compose/mediahost/monitoring/docker-compose.yaml
@@ -8,6 +8,9 @@ services:
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
       - prometheus-data:/prometheus
+    networks:
+      - default 
+      - shared-proxy-services
 
   grafana:
     image: grafana/grafana:latest
@@ -47,9 +50,9 @@ services:
     volumes:
       - '/:/host:ro,rslave'
       - ./node_exporter/textfile_collector:/textfile:ro
-    ports:
-      - '9100:9100'
-
+#    ports:
+#      - '9100:9100'
+    network_mode: host
   cadvisor:
     image: gcr.io/cadvisor/cadvisor:latest
     container_name: cadvisor
@@ -58,9 +61,24 @@ services:
       - "8080:8080"
     volumes:
       - /:/rootfs:ro
-      - /data:/data:ro
-      - /docker:/docker:ro
-  
+#      - /data:/data:ro
+#      - /docker:/docker:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker:/var/lib/docker:ro  
+    command:
+      - "--disable_metrics=percpu,tcp,udp,process,sched"
+      - "--housekeeping_interval=30s"
+      - "--housekeeping_interval=1m"
+      - "--docker_only=true"
+  blackbox-exporter:
+    image: prom/blackbox-exporter:latest
+    container_name: blackbox-exporter
+    restart: unless-stopped
+    ports:
+      - "9115:9115"
+    volumes:
+      - ./blackbox.yml:/etc/blackbox_exporter/config.yml:ro
 volumes:
   prometheus-data:
   grafana-data:
diff --git a/docker_compose/mediahost/monitoring/prometheus.yml b/docker_compose/mediahost/monitoring/prometheus.yml
index 2e72443..bc4cf00 100644
--- a/docker_compose/mediahost/monitoring/prometheus.yml
+++ b/docker_compose/mediahost/monitoring/prometheus.yml
@@ -1,6 +1,6 @@
 global:
-  scrape_interval: 15s
-  evaluation_interval: 15s
+  scrape_interval: 30s
+  evaluation_interval: 30s
 
 scrape_configs:
 
@@ -8,6 +8,35 @@ scrape_configs:
     static_configs:
       - targets:
           - "prometheus:9090"
+  - job_name: "nginx"
+    static_configs:
+      - targets:
+          - nginx-exporter:9113
+  - job_name: blackbox_https
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
+ 
+    static_configs:
+      - targets:
+          - https://cloud.someoneslinux.selfhost.eu
+          - https://media.someoneslinux.selfhost.eu
+          - https://audiobooks.someoneslinux.selfhost.eu
+#          - https://login.someoneslinux.selfhost.eu
+          - https://auto.someoneslinux.selfhost.eu
+          - https://music.someoneslinux.selfhost.eu
+          - https://passwd.someoneslinux.selfhost.eu
+          - https://requests.someoneslinux.selfhost.eu
+          - https://torrent.someoneslinux.selfhost.eu
+          - https://status.someoneslinux.selfhost.eu 
+ 
+    relabel_configs:
+      - source_labels: [__address__]
+        target_label: __param_target
+      - source_labels: [__param_target]
+        target_label: instance
+      - target_label: __address__
+        replacement: blackbox-exporter:9115
 
   - job_name: "node-exporter"
     static_configs:
@@ -16,20 +45,33 @@ scrape_configs:
         labels:
           host: serverhost 
       - targets:
-          - "node-exporter:9100"
+          - "192.168.0.4:9100"
         labels:
           host: "mediahost"
-
+      - targets:
+          - "192.168.0.39:9100"
+        labels:
+          host: "quiethost"
   - job_name: "cadvisor"
     static_configs:
       - targets:
           - "cadvisor:8080"
+        labels:
+          host: mediahost 
+      - targets:
+          - "192.168.0.2:8081"
+        labels:
+          host: serverhost 
   - job_name: "smartctl"
     static_configs:
       - targets:
           - "192.168.0.2:9633"
         labels:
           host: serverhost 
+      - targets:
+          - "192.168.0.39:9633"
+        labels:
+          host: "quiethost"
       - targets:
           - "192.168.0.4:9633"
         labels:
diff --git a/docker_compose/mediahost/navidrome/docker-compose.yaml b/docker_compose/mediahost/navidrome/docker-compose.yaml
index 88e7fe3..c321aa0 100755
--- a/docker_compose/mediahost/navidrome/docker-compose.yaml
+++ b/docker_compose/mediahost/navidrome/docker-compose.yaml
@@ -23,6 +23,7 @@ services:
       - /data/navidrome/music/kamerun:/kamerun:ro
       - /data/navidrome/music/weihnachten:/weihnachten:ro
       - /data/navidrome/music/playlists:/playlists:ro
+      - /data/navidrome/music/playlists-export:/playlists-export
     networks:
       - shared-proxy-services
       - default
diff --git a/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf b/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf
index 534ba70..efcd236 100644
--- a/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf
+++ b/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf
@@ -17,7 +17,8 @@ server {
         passwd.someoneslinux.selfhost.eu
         requests.someoneslinux.selfhost.eu
         torrent.someoneslinux.selfhost.eu
-        status.someoneslinux.selfhost.eu;    
+        status.someoneslinux.selfhost.eu    
+        code.someoneslinux.selfhost.eu;    
     #ssl_conf_command Groups X25519:secp256r1:secp384r1;
 #    ssl_conf_command Groups X25519:prime256v1:secp384r1;
     location /.well-known/acme-challenge/ {
@@ -27,12 +28,28 @@ server {
 
     location / {
         return 301 https://$host$request_uri;
+
+    }
+
+    listen 8080;
+    location /nginx_status {
+        stub_status;
+        allow 172.16.0.0/12;
+        deny all;
     }
 }
 
 # Common SSL settings
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers on;
+server {
+    listen 443 ssl default_server;
+    server_name _;
+
+    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
+    return 404;
+}
 
 ###################
 # NEXTCLOUD
@@ -51,6 +68,8 @@ server {
 
     location / {
         proxy_pass http://nextcloud:80;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto https;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -76,6 +95,8 @@ server {
 
     location / {
         proxy_pass http://jellyfin:8096;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -103,6 +124,8 @@ server {
 
     location / {
         proxy_pass http://audiobookshelf:80;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -112,40 +135,14 @@ server {
     }
 }
 
-###################
-# AUTHENTIK
-###################
-server {
-    listen 443 ssl;http2 on;
-    server_name login.someoneslinux.selfhost.eu;
-
-    add_header Content-Security-Policy "frame-ancestors 'self';" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
-    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
-    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
-
-    location / {
-        proxy_pass http://authentik-server-1:9000;
-        proxy_http_version 1.1;
-        
-        proxy_set_header X-Forwarded-Proto https;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-}
-
 ####################
-## HOME ASSISTANT
+## AUTHENTIK
 ####################
 #server {
 #    listen 443 ssl;http2 on;
-#    server_name auto.someoneslinux.selfhost.eu;
+#    server_name login.someoneslinux.selfhost.eu;
 #
-#    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
+#    add_header Content-Security-Policy "frame-ancestors 'self';" always;
 #    add_header X-Frame-Options "SAMEORIGIN" always;
 #    add_header X-Content-Type-Options "nosniff" always;
 #    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -155,17 +152,45 @@ server {
 #    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
 #
 #    location / {
-#        proxy_pass http://192.168.0.4:8123;
+#        proxy_pass http://authentik-server-1:9000;
 #        proxy_http_version 1.1;
-#
-#        proxy_set_header Host $host;
-#        proxy_set_header Upgrade $http_upgrade;
-#        proxy_set_header Connection $connection_upgrade;
-#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#        
 #        proxy_set_header X-Forwarded-Proto https;
+#        proxy_set_header X-Forwarded-Host $host;
+#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 #    }
 #}
 
+###################
+# HOME ASSISTANT
+###################
+server {
+    listen 443 ssl;http2 on;
+    server_name auto.someoneslinux.selfhost.eu;
+
+#    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
+
+    location / {
+        proxy_pass http://192.168.0.4:8123;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}
+
 ###################
 # NAVIDROME
 ###################
@@ -184,6 +209,8 @@ server {
     location / {
         proxy_pass http://navidrome:4533;
 
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto https;
         proxy_set_header X-Real-IP $remote_addr;
@@ -208,6 +235,8 @@ server {
 
     location / {
         proxy_pass http://vaultwarden:80;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
 
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto https;
@@ -216,6 +245,8 @@ server {
 
     location /notifications/hub {
         proxy_pass http://vaultwarden:3012;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Upgrade $http_upgrade;
@@ -240,6 +271,8 @@ server {
 
     location / {
         proxy_pass http://seerr:5055;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -268,6 +301,8 @@ server {
 
     location / {
         proxy_pass http://192.168.0.2:8080;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
  
         proxy_set_header Host $host;
@@ -275,6 +310,7 @@ server {
         proxy_set_header Connection $connection_upgrade;
         proxy_set_header X-Forwarded-Proto https;
     }
+
 }
 
 ###################
@@ -294,6 +330,8 @@ server {
 
     location / {
         proxy_pass http://grafana:3000;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -302,3 +340,33 @@ server {
         proxy_set_header X-Forwarded-Proto https;
     }
 }
+
+###################
+# GITEA
+###################
+server {
+    listen 443 ssl;http2 on;
+    server_name code.someoneslinux.selfhost.eu;
+
+    add_header Content-Security-Policy "frame-ancestors 'self';" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
+
+    location / {
+        proxy_pass http://gitea:3000;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}
diff --git a/docker_compose/mediahost/nginx/docker-compose.yaml b/docker_compose/mediahost/nginx/docker-compose.yaml
index 693f30d..e58f6fc 100644
--- a/docker_compose/mediahost/nginx/docker-compose.yaml
+++ b/docker_compose/mediahost/nginx/docker-compose.yaml
@@ -3,11 +3,9 @@ services:
     image: nginx:stable
     container_name: nginx
     restart: unless-stopped
-
     ports:
       - "80:80"
       - "443:443"
-
     volumes:
       - ./conf.d:/etc/nginx/conf.d
       - ./certs:/etc/nginx/certs
@@ -15,8 +13,23 @@ services:
       # Access and error logs
       - ./logs:/var/log/nginx
     networks:
+      - default
       - shared-proxy-services
 
+  nginx-exporter:
+    image: nginx/nginx-prometheus-exporter:latest
+    container_name: nginx-exporter
+    restart: unless-stopped
+    command:
+      - --nginx.scrape-uri=http://nginx:8080/nginx_status
+    ports:
+      - "9113:9113"
+    depends_on:
+      - nginx
+    networks:
+      - default
+      - shared-proxy-services
+  
   crowdsec:
     image: crowdsecurity/crowdsec:latest
     container_name: crowdsec
@@ -29,7 +42,8 @@ services:
       - crowdsec-db:/var/lib/crowdsec/data
       - ./logs:/var/log/nginx:ro
       - /etc/localtime:/etc/localtime:ro
-
+    networks:
+      - default
 
   certbot:
     image: certbot/certbot:latest
@@ -41,7 +55,9 @@ services:
       - shared-proxy-services
 
 networks:
+  default:
   shared-proxy-services:
     external: true
+
 volumes:
   crowdsec-db:
diff --git a/docker_compose/mediahost/redis/docker-compose.yaml b/docker_compose/mediahost/redis/docker-compose.yaml
index e388045..9c4c9c4 100644
--- a/docker_compose/mediahost/redis/docker-compose.yaml
+++ b/docker_compose/mediahost/redis/docker-compose.yaml
@@ -3,7 +3,7 @@ services:
     image: redis:7
     container_name: redis
     restart: unless-stopped
-    command: redis-server --appendonly yes --requirepass PerCent7heStorySp0tInOrd3r
+    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
 
     healthcheck:
       test: