diff --git a/audiobooks.nix b/audiobooks.nix
index 02cb859..7c6574d 100644
--- a/audiobooks.nix
+++ b/audiobooks.nix
@@ -1,8 +1,7 @@
-{ config, ... }:
+{ ... }:
 
 let
   domain = "books.sondell.org";
-	# derp = "hi";
 in
 {
   # 
@@ -13,14 +12,10 @@ in
 
 
   services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
+    default = true;
     locations."/" = {
       proxyPass = "http://localhost:8000/";
       proxyWebsockets = true;
-      # extraConfig = ''
-      #   access_log /var/log/nginx/access.log main if=$forgejo_access_log;
-      # '';
     };
   };
 }
diff --git a/configuration.nix b/configuration.nix
index 5b86ee0..2e30133 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -110,11 +110,15 @@
   environment.systemPackages = with pkgs; [
   #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
   #  wget
+    htop
+    cloudflared
     filebrowser
+    dufs
     git
     helix
     nil
     starship
+    tailscale
   ];
 
   programs.fish= {
diff --git a/coturn.nix b/coturn.nix
index 6354b40..ec5e853 100644
--- a/coturn.nix
+++ b/coturn.nix
@@ -63,10 +63,10 @@
     group = "turnserver";
   };
   # configure synapse to point users to coturn
-  services.matrix-synapse = with config.services.coturn; {
-    turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
-    turn_shared_secret = static-auth-secret;
-    turn_user_lifetime = "1h";
-  };
+  # services.matrix-synapse = with config.services.coturn; {
+  #   turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
+  #   turn_shared_secret = static-auth-secret;
+  #   turn_user_lifetime = "1h";
+  # };
 }
 
diff --git a/filebrowser.nix b/filebrowser.nix
index 5cf3325..5d346c6 100644
--- a/filebrowser.nix
+++ b/filebrowser.nix
@@ -18,16 +18,25 @@ in
     };
   };
 
+  systemd.services.tailBrowser = with pkgs; {
+    enable = true;
+    description = "serve via tailscale filebrowser";
+    wantedBy = [ "multi-user.target" ];
+    unitConfig = {
+      After="filebrowser.target";
+    };
+    serviceConfig = {
+      ExecStart = "${tailscale}/bin/tailscale serve --http 80 localhost:8080";
+      # User= "jellyfin";
+      Type= "simple";
+    };
+  };
+
 
   services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
     locations."/" = {
       proxyPass = "http://localhost:8080/";
       proxyWebsockets = true;
-      # extraConfig = ''
-      #   access_log /var/log/nginx/access.log main if=$forgejo_access_log;
-      # '';
     };
   };
 }
diff --git a/flake.nix b/flake.nix
index b4b2d7c..12caad0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,14 +8,15 @@
       specialArgs = attrs;
       modules = [ 
         ./configuration.nix 
+        ./audiobooks.nix 
+        ./tunnel.nix
         ./forgejo.nix 
         ./nextcloud.nix 
-        ./audiobooks.nix 
         ./jellyfin.nix 
         ./filebrowser.nix
-        ./matrix.nix
         ./tail.nix
-        ./coturn.nix
+        ./matrix.nix
+        # ./coturn.nix  # disabled becouse tls not solved
       ];
 
     };
diff --git a/forgejo.nix b/forgejo.nix
index 123bbc7..bc93c06 100644
--- a/forgejo.nix
+++ b/forgejo.nix
@@ -19,7 +19,6 @@ in
   };
 
   services.nginx = {
-    enable = true;
     appendHttpConfig = ''
       map $uri $forgejo_access_log {
         default 1;
@@ -29,13 +28,8 @@ in
   };
 
   services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
     locations."/" = {
       proxyPass = "http://localhost:3000/";
-      # extraConfig = ''
-      #   access_log /var/log/nginx/access.log main if=$forgejo_access_log;
-      # '';
     };
   };
 }
diff --git a/jellyfin.nix b/jellyfin.nix
index 0675dcb..a214af7 100644
--- a/jellyfin.nix
+++ b/jellyfin.nix
@@ -12,14 +12,9 @@ in
 
 
   services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
     locations."/" = {
       proxyPass = "http://localhost:8096/";
       proxyWebsockets = true;
-      # extraConfig = ''
-      #   access_log /var/log/nginx/access.log main if=$forgejo_access_log;
-      # '';
     };
   };
 }
diff --git a/matrix.nix b/matrix.nix
index cc2d4c5..2b19a33 100644
--- a/matrix.nix
+++ b/matrix.nix
@@ -52,8 +52,8 @@ services.postgresql = {
 
   services.nginx.virtualHosts = {
     ${fqdn} = {
-      enableACME = true;
-      forceSSL = true;
+      # enableACME = true;
+      # forceSSL = true;
       locations."/".extraConfig = ''
         return 404;
       '';
@@ -65,8 +65,8 @@ services.postgresql = {
     };
 
     ${domain} = {
-      enableACME = true;
-      forceSSL = true;
+      # enableACME = true;
+      # forceSSL = true;
       locations."/" = {
         proxyPass = "http://localhost:8008";
       };
diff --git a/nextcloud.nix b/nextcloud.nix
index 02d9610..e3b8382 100644
--- a/nextcloud.nix
+++ b/nextcloud.nix
@@ -17,8 +17,8 @@ in
   services = {
     nginx.virtualHosts = {
       ${domain} = {
-        forceSSL = true;
-        enableACME = true;
+        # forceSSL = true;
+        # enableACME = true;
         # Use DNS Challenege.
         # acmeRoot = null;
       };
diff --git a/tunnel.nix b/tunnel.nix
new file mode 100644
index 0000000..739c85e
--- /dev/null
+++ b/tunnel.nix
@@ -0,0 +1,20 @@
+{...}:
+{
+  services.nginx = {
+    enable = true;
+    clientMaxBodySize = "10g";
+    defaultHTTPListenPort = 1234;
+  };
+  services.cloudflared = {
+    enable = true;
+    tunnels = {
+      "tulpan" = {
+        credentialsFile = "/etc/nixos/.secrets/tulpan-tunnel.json";
+        default = "http_status:404";
+        ingress = {
+          "*.sondell.org" = "http://localhost:1234";
+        };
+      };
+    };
+  }; 
+}