diff --git a/hosts/machine/kanade/modules/nix.nix b/hosts/machine/kanade/modules/nix.nix
index 0313eb4..97c19d5 100644
--- a/hosts/machine/kanade/modules/nix.nix
+++ b/hosts/machine/kanade/modules/nix.nix
@@ -14,11 +14,9 @@
       "imnyang"
     ];
     substituters = [
-      # "https://cache.mizuki.guru"
       "https://nix.mizuki.my/public"
     ];
     trusted-public-keys = [
-      # "cache.mizuki.guru-1:EbUC9b0ryD7BJKqfT8fl4GoS2ojLV+hI9fW1al5Whp0="
       "public:SnHrtrxbCPcZujbJdgsKFeObTfRKQl5KhrI+LljtZUE="
     ];
   };
diff --git a/hosts/server/hikari/hako/services/caddy.nix b/hosts/server/hikari/hako/services/caddy.nix
index bcca6da..e09e4a0 100644
--- a/hosts/server/hikari/hako/services/caddy.nix
+++ b/hosts/server/hikari/hako/services/caddy.nix
@@ -300,8 +300,6 @@ in
           }
         '';
 
-        "cache.mizuki.guru".extraConfig = reverseProxy "127.0.0.1:8080";
-
         "phrygiacomo.mizuki.guru".extraConfig = withErrors ''
           basic_auth {
             imnyang $2a$10$zA83XKt84pcXiwfkuvNmKOpQ5Cw0IP6m/.1AX0ahkVQaPOzrmFlxm
diff --git a/hosts/server/kazusa/configuration.nix b/hosts/server/kazusa/configuration.nix
index 855cc5c..6e9845a 100644
--- a/hosts/server/kazusa/configuration.nix
+++ b/hosts/server/kazusa/configuration.nix
@@ -98,5 +98,13 @@
 
   services.qemuGuest.enable = true;
 
+  services.cloud-init = {
+    enable = true;
+
+    settings = {
+      preserve_hostname = true;
+    };
+  };
+
   system.stateVersion = "26.05";
 }
diff --git a/hosts/server/kazusa/services/caddy.nix b/hosts/server/kazusa/services/caddy.nix
index 74c7bb3..613d4b4 100644
--- a/hosts/server/kazusa/services/caddy.nix
+++ b/hosts/server/kazusa/services/caddy.nix
@@ -42,7 +42,7 @@
         "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
         "github.com/neodyme-labs/user_agent_parse@v0.0.1"
       ];
-      hash = "sha256-YqOyHxPIKreCSkXfJUWTEFi+xOlIIiDqy3bYt7/A6Rg=";
+      hash = "sha256-z9/LF2gws+H0pKL6F62QfklD0W8DKWCccnXLOOs3+jY=";
     };
   };
 }
diff --git a/hosts/server/kazusa/services/mailserver.nix b/hosts/server/kazusa/services/mailserver.nix
index d7fbe81..ccdcf9e 100644
--- a/hosts/server/kazusa/services/mailserver.nix
+++ b/hosts/server/kazusa/services/mailserver.nix
@@ -9,12 +9,13 @@ let
   mailSecret = key: {
     sopsFile = ../secrets/mailserver.yaml;
     inherit key;
-    owner = "nginx";
-    group = "nginx";
+    # The OAuth client credentials are read by Roundcube's PHP-FPM pool,
+    # which runs as the dedicated `roundcube` user (not nginx).
+    owner = "roundcube";
+    group = "roundcube";
     mode = "0440";
     restartUnits = [
       "phpfpm-roundcube.service"
-      "dovecot.service"
     ];
   };
 
diff --git a/hosts/server/natsu/default.nix b/hosts/server/natsu/default.nix
index aeee863..1ff6eff 100644
--- a/hosts/server/natsu/default.nix
+++ b/hosts/server/natsu/default.nix
@@ -11,6 +11,7 @@ nixpkgs.lib.nixosSystem {
     sops-nix.nixosModules.sops
     # ./services/attic.nix
     ./services/caddy.nix
+    ./services/cfwithoutincident.nix
     ./services/forgejo-runner.nix
     ./services/limbo.nix
     ./services/stream.nix
diff --git a/hosts/server/natsu/services/caddy.nix b/hosts/server/natsu/services/caddy.nix
index eee1072..9182353 100644
--- a/hosts/server/natsu/services/caddy.nix
+++ b/hosts/server/natsu/services/caddy.nix
@@ -143,10 +143,6 @@ in
       }
     '';
 
-    virtualHosts."cache.mizuki.guru".extraConfig = ''
-      reverse_proxy 127.0.0.1:5000
-    '';
-
     virtualHosts."paste.mizuki.guru".extraConfig = ''
       reverse_proxy 10.11.8.102:11108
     '';
@@ -182,6 +178,10 @@ in
       reverse_proxy 127.0.0.1:4321
     '';
 
+    virtualHosts."cfwithoutincident.imnya.ng".extraConfig = ''
+      reverse_proxy 127.0.0.1:31774
+    '';
+
     virtualHosts."stream.mizuki.guru".extraConfig = ''
       handle /live/* {
         reverse_proxy 127.0.0.1:10023
diff --git a/hosts/server/natsu/services/cfwithoutincident.nix b/hosts/server/natsu/services/cfwithoutincident.nix
new file mode 100644
index 0000000..fc98f6b
--- /dev/null
+++ b/hosts/server/natsu/services/cfwithoutincident.nix
@@ -0,0 +1,25 @@
+{ pkgs, ... }:
+
+{
+  systemd.services.cfwithoutincident = {
+    description = "Cloudflare Status D-Day dashboard";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "imnyang";
+      Group = "users";
+      WorkingDirectory = "/home/imnyang/git/imnyang/cfwithoutincident";
+      Environment = [
+        "PORT=31774"
+      ];
+      ExecStart = "${pkgs.bun}/bin/bun run src/index.ts";
+      Restart = "always";
+      RestartSec = 5;
+    };
+
+    path = [ pkgs.bun ];
+  };
+}
diff --git a/modules/mizukios/base/nix.nix b/modules/mizukios/base/nix.nix
index dc7e2d4..cb348a4 100644
--- a/modules/mizukios/base/nix.nix
+++ b/modules/mizukios/base/nix.nix
@@ -21,14 +21,10 @@
 
   nix.settings = {
     substituters = [
-      # "https://cache.mizuki.guru/public"
-      # "https://cache.mizuki.guru/imnyang"
       "https://nix.mizuki.my/public"
       "https://vicinae.cachix.org"
     ];
     trusted-public-keys = [
-      # "public:IgipakDD/clr0XbuaIejPYMT5UkTVGKVTxtWXcsbiAg="
-      # "imnyang:x8Oex2DLzZUBxS/3VvkVptT3DiugjsCbQ23VjsxMT5c="
       "public:SnHrtrxbCPcZujbJdgsKFeObTfRKQl5KhrI+LljtZUE="
       "vicinae.cachix.org-1:1kDrfienkGHPYbkpNj1mWTr7Fm1+zcenzgTizIcI3oc="
     ];