diff --git a/config/users.nix b/config/users.nix
index 427ea78..8ffd1cd 100644
--- a/config/users.nix
+++ b/config/users.nix
@@ -43,6 +43,5 @@
       unifi = uidGid 968;
       plugdev.gid = 967;
       tss = uidGid 966;
-      firezone-client = uidGid 965;
     };
 }
diff --git a/hosts/kroma/default.nix b/hosts/kroma/default.nix
index 5b89c21..9e3a12d 100644
--- a/hosts/kroma/default.nix
+++ b/hosts/kroma/default.nix
@@ -1,5 +1,4 @@
 {
-  globals,
   inputs,
   lib,
   minimal,
@@ -89,28 +88,6 @@
   #  };
   #};
 
-  # FIXME: the ui is not directly accessible via environment.systemPackages
-  # FIXME: to control it as a user (and to allow SSO) we need to be in the netbird-home group
-  services.netbird.ui.enable = true;
-  services.netbird.clients.home = {
-    port = 51820;
-    name = "netbird-home";
-    interface = "wt-home";
-    autoStart = false;
-    openFirewall = true;
-    config.ServerSSHAllowed = false;
-    environment = rec {
-      NB_MANAGEMENT_URL = "https://${globals.services.netbird.domain}";
-      NB_ADMIN_URL = NB_MANAGEMENT_URL;
-    };
-  };
-  environment.persistence."/persist".directories = [
-    {
-      directory = "/var/lib/netbird-home";
-      mode = "0700";
-    }
-  ];
-
   programs.nix-ld.enable = true;
   topology.self.icon = "devices.desktop";
 
@@ -122,9 +99,4 @@
     dockerCompat = true;
     defaultNetwork.settings.dns_enabled = true;
   };
-
-  services.firezone.server.domain.enable = true;
-  services.firezone.server.domain.enableLocalDB = true;
-  services.firezone.server.web.enable = true;
-  services.firezone.server.api.enable = true;
 }
diff --git a/modules/default.nix b/modules/default.nix
index 0db5116..260bdb2 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -8,9 +8,6 @@
     ./backups.nix
     ./deterministic-ids.nix
     ./distributed-config.nix
-    ./firezone-relay.nix
-    ./firezone-gateways.nix
-    ./firezone-server.nix
     ./globals.nix
     ./meta.nix
     ./netbird-client.nix
diff --git a/modules/firezone-gateways.nix b/modules/firezone-gateways.nix
deleted file mode 100644
index c09cca8..0000000
--- a/modules/firezone-gateways.nix
+++ /dev/null
@@ -1,170 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  inherit (lib)
-    boolToString
-    concatMapAttrs
-    flip
-    getExe
-    mkEnableOption
-    mkOption
-    mkPackageOption
-    types
-    ;
-in
-{
-  options = {
-    services.firezone.gateways = mkOption {
-      description = ''
-        A set of gateway clients to deploy on this machine. Each gateway can
-        connect to exactly one firezone server.
-      '';
-      default = { };
-      type = types.attrsOf (
-        types.submodule (gatewaysSubmod: {
-          options = {
-            package = mkPackageOption pkgs "firezone-gateway" { };
-
-            name = mkOption {
-              type = types.str;
-              default = gatewaysSubmod.config._module.args.name;
-              description = "The name of this gateway as shown in firezone";
-            };
-
-            user = mkOption {
-              type = types.strMatching "^[a-zA-Z0-9_-]{1,32}$";
-              default = "firezone-gw-${gatewaysSubmod.config._module.args.name}";
-              description = "The DynamicUser name under which the gateway will run. Cannot exceed 32 characters.";
-            };
-
-            interface = mkOption {
-              type = types.strMatching "^[a-zA-Z0-9_-]{1,15}$";
-              default = "tun-${gatewaysSubmod.config._module.args.name}";
-              description = "The name of the TUN interface which will be created by this gateway";
-            };
-
-            apiUrl = mkOption {
-              type = types.str;
-              example = "wss://firezone.example.com/api";
-              description = ''
-                The URL of your firezone server's API. This should be the same
-                as your server's setting for {option}`services.firezone.server.settings.api.externalUrl`,
-                but with `wss://` instead of `https://`.
-              '';
-            };
-
-            tokenFile = mkOption {
-              type = types.path;
-              example = "/run/secrets/firezone-gateway-token";
-              description = ''
-                A file containing the firezone gateway token. Do not use a nix-store path here
-                as it will make the token publicly readable!
-
-                This file will be passed via systemd credentials, it should only be accessible
-                by the root user.
-              '';
-            };
-
-            logLevel = mkOption {
-              type = types.str;
-              default = "info";
-              description = ''
-                The log level for the firezone application. See
-                [RUST_LOG](https://docs.rs/env_logger/latest/env_logger/#enabling-logging)
-                for the format.
-              '';
-            };
-
-            enableTelemetry = mkEnableOption "telemetry";
-          };
-        })
-      );
-    };
-  };
-
-  config = {
-    systemd.services = flip concatMapAttrs config.services.firezone.gateways (
-      gatewayName: gatewayCfg: {
-        "firezone-gateway-${gatewayName}" = {
-          description = "Gateway service for the Firezone zero-trust access platform";
-          after = [ "network.target" ];
-          wantedBy = [ "multi-user.target" ];
-
-          path = [ pkgs.util-linux ];
-          script = ''
-            # If FIREZONE_ID is not given by the user, use a persisted (or newly generated) uuid.
-            if [[ -z "''${FIREZONE_ID:-}" ]]; then
-              if [[ ! -e gateway_id ]]; then
-                uuidgen -r > gateway_id
-              fi
-              export FIREZONE_ID=$(< gateway_id)
-            fi
-
-            export FIREZONE_TOKEN=$(< "$CREDENTIALS_DIRECTORY/firezone-token")
-            exec ${getExe gatewayCfg.package}
-          '';
-
-          environment = {
-            FIREZONE_API_URL = gatewayCfg.apiUrl;
-            FIREZONE_NAME = gatewayCfg.name;
-            FIREZONE_NO_TELEMETRY = boolToString gatewayCfg.enableTelemetry;
-            FIREZONE_TUN_INTERFACE = gatewayCfg.interface;
-            RUST_LOG = gatewayCfg.logLevel;
-          };
-
-          serviceConfig = {
-            LockPersonality = true;
-            MemoryDenyWriteExecute = true;
-            NoNewPrivileges = true;
-            PrivateMounts = true;
-            PrivateTmp = true;
-            PrivateUsers = false;
-            ProcSubset = "pid";
-            ProtectClock = true;
-            ProtectControlGroups = true;
-            ProtectHome = true;
-            ProtectHostname = true;
-            ProtectKernelLogs = true;
-            ProtectKernelModules = true;
-            ProtectKernelTunables = true;
-            ProtectProc = "invisible";
-            ProtectSystem = "strict";
-            RestrictAddressFamilies = [
-              "AF_INET"
-              "AF_INET6"
-              "AF_NETLINK"
-              "AF_UNIX"
-            ];
-            RestrictNamespaces = true;
-            RestrictRealtime = true;
-            RestrictSUIDSGID = true;
-            SystemCallArchitectures = "native";
-            SystemCallFilter = "@system-service";
-            UMask = "077";
-
-            Type = "exec";
-            DynamicUser = true;
-            User = gatewayCfg.user;
-            LoadCredential = [ "firezone-token:${gatewayCfg.tokenFile}" ];
-
-            DeviceAllow = "/dev/net/tun";
-            AmbientCapabilities = [ "CAP_NET_ADMIN" ];
-            CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
-
-            StateDirectory = "firezone-gateways/${gatewayName}";
-            WorkingDirectory = "/var/lib/firezone-gateways/${gatewayName}";
-          };
-        };
-      }
-    );
-  };
-
-  meta.maintainers = with lib.maintainers; [
-    oddlama
-    patrickdag
-  ];
-}
diff --git a/modules/firezone-relay.nix b/modules/firezone-relay.nix
deleted file mode 100644
index 702a4ab..0000000
--- a/modules/firezone-relay.nix
+++ /dev/null
@@ -1,177 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  inherit (lib)
-    boolToString
-    getExe
-    mkEnableOption
-    mkIf
-    mkOption
-    mkPackageOption
-    types
-    ;
-
-  cfg = config.services.firezone.relay;
-in
-{
-  options = {
-    services.firezone.relay = {
-      enable = mkEnableOption "the firezone relay server";
-      package = mkPackageOption pkgs "firezone-relay" { };
-
-      publicIpv4 = mkOption {
-        type = types.str;
-        description = "The public ipv4 address of this relay";
-      };
-
-      publicIpv6 = mkOption {
-        type = types.str;
-        description = "The public ipv6 address of this relay";
-      };
-
-      openFirewall = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Opens up the main STUN port and the TURN allocation range.";
-      };
-
-      port = mkOption {
-        type = types.port;
-        default = 3478;
-        description = "The port to listen on for STUN messages";
-      };
-
-      lowestPort = mkOption {
-        type = types.port;
-        default = 49152;
-        description = "The lowest port to use in TURN allocation";
-      };
-
-      highestPort = mkOption {
-        type = types.port;
-        default = 65535;
-        description = "The highest port to use in TURN allocation";
-      };
-
-      apiUrl = mkOption {
-        type = types.str;
-        example = "wss://firezone.example.com/api";
-        description = ''
-          The URL of your firezone server's API. This should be the same
-          as your server's setting for {option}`services.firezone.server.settings.api.externalUrl`,
-          but with `wss://` instead of `https://`.
-        '';
-      };
-
-      tokenFile = mkOption {
-        type = types.path;
-        example = "/run/secrets/firezone-relay-token";
-        description = ''
-          A file containing the firezone relay token. Do not use a nix-store path here
-          as it will make the token publicly readable!
-
-          This file will be passed via systemd credentials, it should only be accessible
-          by the root user.
-        '';
-      };
-
-      logLevel = mkOption {
-        type = types.str;
-        default = "firezone_relay=info,firezone_tunnel=info,connlib_shared=info,tunnel_state=info,phoenix_channel=info,snownet=info,str0m=info,warn";
-        description = ''
-          The log level for the firezone application. See
-          [RUST_LOG](https://docs.rs/env_logger/latest/env_logger/#enabling-logging)
-          for the format.
-        '';
-      };
-
-      enableTelemetry = mkEnableOption "telemetry";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services."firezone-relay" = {
-      description = "relay service for the Firezone zero-trust access platform";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      path = [ pkgs.util-linux ];
-      script = ''
-        # If FIREZONE_ID is not given by the user, use a persisted (or newly generated) uuid.
-        if [[ -z "''${FIREZONE_ID:-}" ]]; then
-          if [[ ! -e relay_id ]]; then
-            uuidgen -r > relay_id
-          fi
-          export FIREZONE_ID=$(< relay_id)
-        fi
-
-        export FIREZONE_TOKEN=$(< "$CREDENTIALS_DIRECTORY/firezone-token")
-        exec ${getExe cfg.package}
-      '';
-
-      environment = {
-        FIREZONE_API_URL = cfg.apiUrl;
-        FIREZONE_NAME = cfg.name;
-        FIREZONE_TELEMETRY = boolToString cfg.enableTelemetry;
-
-        PUBLIC_IPV4_ADDRESS = cfg.publicIpv4;
-        PUBLIC_IPV6_ADDRESS = cfg.publicIpv6;
-
-        LISTEN_PORT = toString cfg.port;
-        LOWEST_PORT = toString cfg.lowestPort;
-        HIGHEST_PORT = toString cfg.highestPort;
-
-        RUST_LOG = cfg.logLevel;
-        LOG_FORMAT = "human";
-      };
-
-      serviceConfig = {
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = false;
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_NETLINK"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = "@system-service";
-        UMask = "077";
-
-        Type = "exec";
-        DynamicUser = true;
-        User = "firezone-relay";
-        LoadCredential = [ "firezone-token:${cfg.tokenFile}" ];
-
-        StateDirectory = "firezone-relay";
-        WorkingDirectory = "/var/lib/firezone-relay";
-      };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [
-    oddlama
-    patrickdag
-  ];
-}
diff --git a/modules/firezone-server.nix b/modules/firezone-server.nix
deleted file mode 100644
index 62ae9d8..0000000
--- a/modules/firezone-server.nix
+++ /dev/null
@@ -1,948 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  inherit (lib)
-    attrNames
-    boolToString
-    concatLines
-    concatLists
-    concatMapAttrs
-    concatStringsSep
-    filterAttrs
-    filterAttrsRecursive
-    flip
-    forEach
-    getExe
-    isBool
-    mapAttrs
-    mapAttrsToList
-    mkDefault
-    mkEnableOption
-    mkIf
-    mkMerge
-    mkOption
-    mkPackageOption
-    optionalAttrs
-    recursiveUpdate
-    subtractLists
-    toUpper
-    types
-    ;
-
-  cfg = config.services.firezone.server;
-  jsonFormat = pkgs.formats.json { };
-  availableAuthAdapters = [
-    "email"
-    "openid_connect"
-    "userpass"
-    "token"
-    "google_workspace"
-    "microsoft_entra"
-    "okta"
-    "jumpcloud"
-  ];
-
-  # All non-secret environment variables or the given component
-  collectEnvironment =
-    component:
-    mapAttrs (_: v: if isBool v then boolToString v else toString v) (
-      cfg.settings // cfg.${component}.settings
-    );
-
-  # All mandatory secrets which were not explicitly provided by the user will
-  # have to be generated, if they do not yet exist.
-  generateSecrets =
-    let
-      requiredSecrets = filterAttrs (_: v: v == null) cfg.settingsSecret;
-    in
-    ''
-      mkdir -p secrets
-      chmod 700 secrets
-    ''
-    + concatLines (
-      forEach (attrNames requiredSecrets) (secret: ''
-        if [[ ! -e secrets/${secret} ]]; then
-          echo "Generating ${secret}"
-          # Some secrets like TOKENS_KEY_BASE require a value >=64 bytes.
-          head -c 64 /dev/urandom | base64 -w 0 > secrets/${secret}
-          chmod 600 secrets/${secret}
-        fi
-      '')
-    );
-
-  # All secrets given in `cfg.settingsSecret` must be loaded from a file and
-  # exported into the environment. Also exclude any variables that were
-  # overwritten by the local component settings.
-  loadSecretEnvironment =
-    component:
-    let
-      relevantSecrets = subtractLists (attrNames cfg.${component}.settings) (
-        attrNames cfg.settingsSecret
-      );
-    in
-    concatLines (
-      forEach relevantSecrets (
-        secret:
-        ''export ${secret}=$(< ${
-          if cfg.settingsSecret.${secret} == null then
-            "secrets/${secret}"
-          else
-            "\"$CREDENTIALS_DIRECTORY/${secret}\""
-        })''
-      )
-    );
-
-  provisionStateJson =
-    let
-      # Convert clientSecretFile options into the real counterpart
-      augmentedAccounts = flip mapAttrs cfg.provision.accounts (
-        accountName: account:
-        account
-        // {
-          auth = flip mapAttrs account.auth (
-            authName: auth:
-            recursiveUpdate auth (
-              optionalAttrs (auth.adapter_config.clientSecretFile != null) {
-                adapter_config.client_secret = "{env:AUTH_CLIENT_SECRET_${toUpper accountName}_${toUpper authName}}";
-              }
-            )
-          );
-        }
-      );
-    in
-    jsonFormat.generate "provision-state.json" {
-      # Do not include any clientSecretFile attributes in the resulting json
-      accounts = filterAttrsRecursive (k: _: k != "clientSecretFile") augmentedAccounts;
-    };
-
-  commonServiceConfig = {
-    AmbientCapablities = [ ];
-    CapabilityBoundingSet = [ ];
-    LockPersonality = true;
-    MemoryDenyWriteExecute = true;
-    NoNewPrivileges = true;
-    PrivateMounts = true;
-    PrivateTmp = true;
-    PrivateUsers = false;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_NETLINK"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    SystemCallFilter = "@system-service";
-    UMask = "077";
-
-    DynamicUser = true;
-    User = "firezone";
-
-    Slice = "system-firezone.slice";
-    StateDirectory = "firezone";
-    WorkingDirectory = "/var/lib/firezone";
-
-    LoadCredential = mapAttrsToList (secretName: secretFile: "${secretName}:${secretFile}") (
-      filterAttrs (_: v: v != null) cfg.settingsSecret
-    );
-    Type = "exec";
-    Restart = "on-failure";
-    RestartSec = 10;
-  };
-
-  componentOptions = component: {
-    enable = mkEnableOption "the Firezone ${component} server";
-    package = mkPackageOption pkgs "firezone-server-${component}" { };
-
-    settings = mkOption {
-      description = ''
-        Environment variables for this component of the Firezone server. For a
-        list of available variables, please refer to the [upstream definitions](https://github.com/firezone/firezone/blob/main/elixir/apps/domain/lib/domain/config/definitions.ex).
-        Some variables like `OUTBOUND_EMAIL_ADAPTER_OPTS` require json values
-        for which you can use `VAR = builtins.toJSON { /* ... */ }`.
-
-        This component will automatically inherit all variables defined via
-        {option}`services.firezone.server.settings` and
-        {option}`services.firezone.server.settingsSecret`, but which can be
-        overwritten by this option.
-      '';
-      default = { };
-      type = types.submodule {
-        freeformType = types.attrsOf (
-          types.oneOf [
-            types.bool
-            types.float
-            types.int
-            types.str
-            types.path
-            types.package
-          ]
-        );
-      };
-    };
-  };
-in
-{
-  options.services.firezone.server = {
-    enable = mkEnableOption "all Firezone components";
-    enableLocalDB = mkEnableOption "a local postgresql database for Firezone";
-    nginx.enable = mkEnableOption "nginx virtualhost definition";
-
-    openClusterFirewall = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Opens up the erlang distribution port of all enabled components to
-        allow reaching the server cluster from the internet. You only need to
-        set this if you are actually distributing your cluster across multiple
-        machines.
-      '';
-    };
-
-    clusterHosts = mkOption {
-      type = types.listOf types.str;
-      default = [
-        "api@localhost.localdomain"
-        "web@localhost.localdomain"
-        "domain@localhost.localdomain"
-      ];
-      description = ''
-        A list of components and their hosts that are part of this cluster. For
-        a single-machine setup, the default value will be sufficient. This
-        value will automatically set `ERLANG_CLUSTER_ADAPTER_CONFIG`.
-
-        The format is `<COMPONENT_NAME>@<HOSTNAME>`.
-      '';
-    };
-
-    settingsSecret = mkOption {
-      default = { };
-      description = ''
-        This is a convenience option which allows you to set secret values for
-        environment variables by specifying a file which will contain the value
-        at runtime. Before starting the server, the content of each file will
-        be loaded into the respective environment variable.
-
-        Otherwise, this option is equivalent to
-        {option}`services.firezone.server.settings`. Refer to the settings
-        option for more information regarding the actual variables and how
-        filtering rules are applied for each component.
-      '';
-      type = types.submodule {
-        freeformType = types.attrsOf types.path;
-        options = {
-          RELEASE_COOKIE = mkOption {
-            type = types.nullOr types.path;
-            default = null;
-            description = ''
-              A file containing a unique secret identifier for the Erlang
-              cluster. All Firezone components in your cluster must use the
-              same value.
-
-              If this is `null`, a shared value will automatically be generated
-              on startup and used for all components on this machine. You do
-              not need to set this except when you spread your cluster over
-              multiple hosts.
-            '';
-          };
-
-          TOKENS_KEY_BASE = mkOption {
-            type = types.nullOr types.path;
-            default = null;
-            description = ''
-              A file containing a unique base64 encoded secret for the
-              `TOKENS_KEY_BASE`. All Firezone components in your cluster must
-              use the same value.
-
-              If this is `null`, a shared value will automatically be generated
-              on startup and used for all components on this machine. You do
-              not need to set this except when you spread your cluster over
-              multiple hosts.
-            '';
-          };
-
-          SECRET_KEY_BASE = mkOption {
-            type = types.nullOr types.path;
-            default = null;
-            description = ''
-              A file containing a unique base64 encoded secret for the
-              `SECRET_KEY_BASE`. All Firezone components in your cluster must
-              use the same value.
-
-              If this is `null`, a shared value will automatically be generated
-              on startup and used for all components on this machine. You do
-              not need to set this except when you spread your cluster over
-              multiple hosts.
-            '';
-          };
-
-          TOKENS_SALT = mkOption {
-            type = types.nullOr types.path;
-            default = null;
-            description = ''
-              A file containing a unique base64 encoded secret for the
-              `TOKENS_SALT`. All Firezone components in your cluster must
-              use the same value.
-
-              If this is `null`, a shared value will automatically be generated
-              on startup and used for all components on this machine. You do
-              not need to set this except when you spread your cluster over
-              multiple hosts.
-            '';
-          };
-
-          LIVE_VIEW_SIGNING_SALT = mkOption {
-            type = types.nullOr types.path;
-            default = null;
-            description = ''
-              A file containing a unique base64 encoded secret for the
-              `LIVE_VIEW_SIGNING_SALT`. All Firezone components in your cluster must
-              use the same value.
-
-              If this is `null`, a shared value will automatically be generated
-              on startup and used for all components on this machine. You do
-              not need to set this except when you spread your cluster over
-              multiple hosts.
-            '';
-          };
-
-          COOKIE_SIGNING_SALT = mkOption {
-            type = types.nullOr types.path;
-            default = null;
-            description = ''
-              A file containing a unique base64 encoded secret for the
-              `COOKIE_SIGNING_SALT`. All Firezone components in your cluster must
-              use the same value.
-
-              If this is `null`, a shared value will automatically be generated
-              on startup and used for all components on this machine. You do
-              not need to set this except when you spread your cluster over
-              multiple hosts.
-            '';
-          };
-
-          COOKIE_ENCRYPTION_SALT = mkOption {
-            type = types.nullOr types.path;
-            default = null;
-            description = ''
-              A file containing a unique base64 encoded secret for the
-              `COOKIE_ENCRYPTION_SALT`. All Firezone components in your cluster must
-              use the same value.
-
-              If this is `null`, a shared value will automatically be generated
-              on startup and used for all components on this machine. You do
-              not need to set this except when you spread your cluster over
-              multiple hosts.
-            '';
-          };
-        };
-      };
-    };
-
-    settings = mkOption {
-      description = ''
-        Environment variables for the Firezone server. For a list of available
-        variables, please refer to the [upstream definitions](https://github.com/firezone/firezone/blob/main/elixir/apps/domain/lib/domain/config/definitions.ex).
-        Some variables like `OUTBOUND_EMAIL_ADAPTER_OPTS` require json values
-        for which you can use `VAR = builtins.toJSON { /* ... */ }`.
-
-        Each component has an additional `settings` option which allows you to
-        override specific variables passed to that component.
-      '';
-      default = { };
-      type = types.submodule {
-        freeformType = types.attrsOf (
-          types.oneOf [
-            types.bool
-            types.float
-            types.int
-            types.str
-            types.path
-            types.package
-          ]
-        );
-      };
-    };
-
-    smtp = {
-      configureManually = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Outbound email configuration is mandatory for Firezone and supports
-          many different delivery adapters. Yet, most users will only need an
-          SMTP relay to send emails, so this configuration enforced by default.
-
-          If you want to utilize an alternative way to send emails (e.g. via a
-          supportd API-based service), enable this option and define
-          `OUTBOUND_EMAIL_FROM`, `OUTBOUND_EMAIL_ADAPTER` and
-          `OUTBOUND_EMAIL_ADAPTER_OPTS` manually via
-          {option}`services.firezone.server.settings` and/or
-          {option}`services.firezone.server.settingsSecret`.
-
-          The Firezone documentation holds [a list of supported Swoosh adapters](https://github.com/firezone/firezone/blob/main/website/src/app/docs/reference/env-vars/readme.mdx#outbound-emails).
-        '';
-      };
-
-      from = mkOption {
-        type = types.str;
-        example = "firezone@example.com";
-        description = "Outbound SMTP FROM address";
-      };
-
-      host = mkOption {
-        type = types.str;
-        example = "mail.example.com";
-        description = "Outbound SMTP host";
-      };
-
-      port = mkOption {
-        type = types.port;
-        example = 465;
-        description = "Outbound SMTP port";
-      };
-
-      implicitTls = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to use implicit TLS instead of STARTTLS (usually port 465)";
-      };
-
-      username = mkOption {
-        type = types.str;
-        example = "firezone@example.com";
-        description = "Username to authenticate against the SMTP relay";
-      };
-
-      passwordFile = mkOption {
-        type = types.path;
-        example = "/run/secrets/smtp-password";
-        description = "File containing the password for the given username. Beware that a file in the nix store will be world readable.";
-      };
-    };
-
-    domain = componentOptions "domain";
-
-    web = componentOptions "web" // {
-      externalUrl = mkOption {
-        type = types.strMatching "^https://.+/$";
-        example = "https://firezone.example.com/";
-        description = ''
-          The external URL under which you will serve the web interface. You
-          need to setup a reverse proxy for TLS termination, either with
-          {option}`services.firezone.server.nginx.enable` or manually.
-        '';
-      };
-
-      address = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "The address to listen on";
-      };
-
-      port = mkOption {
-        type = types.port;
-        default = 8080;
-        description = "The port under which the web interface will be served locally";
-      };
-
-      trustedProxies = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = "A list of trusted proxies";
-      };
-    };
-
-    api = componentOptions "api" // {
-      externalUrl = mkOption {
-        type = types.strMatching "^https://.+/$";
-        example = "https://firezone.example.com/api/";
-        description = ''
-          The external URL under which you will serve the api. You need to
-          setup a reverse proxy for TLS termination, either with
-          {option}`services.firezone.server.nginx.enable` or manually.
-        '';
-      };
-
-      address = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "The address to listen on";
-      };
-
-      port = mkOption {
-        type = types.port;
-        default = 8081;
-        description = "The port under which the api will be served locally";
-      };
-
-      trustedProxies = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = "A list of trusted proxies";
-      };
-    };
-
-    provision = {
-      enable = mkEnableOption "provisioning of the Firezone domain server";
-      accounts = mkOption {
-        type = types.attrsOf (
-          types.submodule {
-            freeformType = jsonFormat.type;
-            options = {
-              name = mkOption {
-                type = types.str;
-                description = "The account name";
-                example = "My Organization";
-              };
-
-              features =
-                let
-                  mkFeatureOption =
-                    name: default:
-                    mkOption {
-                      type = types.bool;
-                      inherit default;
-                      description = "Whether to enable the `${name}` feature for this account.";
-                    };
-                in
-                {
-                  flow_activities = mkFeatureOption "flow_activities" true;
-                  policy_conditions = mkFeatureOption "policy_conditions" true;
-                  multi_site_resources = mkFeatureOption "multi_site_resources" true;
-                  traffic_filters = mkFeatureOption "traffic_filters" true;
-                  self_hosted_relays = mkFeatureOption "self_hosted_relays" true;
-                  idp_sync = mkFeatureOption "idp_sync" true;
-                  rest_api = mkFeatureOption "rest_api" true;
-                  internet_resource = mkFeatureOption "internet_resource" true;
-                };
-
-              actors = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    freeformType = jsonFormat.type;
-                    options = {
-                      type = mkOption {
-                        type = types.enum [
-                          "account_admin_user"
-                          "account_user"
-                          "service_account"
-                          "api_client"
-                        ];
-                        description = "The account type";
-                      };
-
-                      email = mkOption {
-                        type = types.str;
-                        description = "The email address used to authenticate as this account";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  admin = {
-                    type = "account_admin_user";
-                    email = "admin@myorg.example.com";
-                  };
-                };
-                description = "All actors (users) to provision.";
-              };
-
-              auth = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    freeformType = jsonFormat.type;
-                    options = {
-                      adapter = mkOption {
-                        type = types.enum availableAuthAdapters;
-                        description = "The auth adapter type";
-                      };
-
-                      adapter_config.clientSecretFile = mkOption {
-                        type = types.nullOr types.path;
-                        default = null;
-                        description = ''
-                          A file containing a the client secret for an openid_connect adapter.
-                          You only need to set this if this is an openid_connect provider.
-                        '';
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  myoidcprovider = {
-                    adapter = "openid_connect";
-                    adapter_config = {
-                      client_id = "clientid";
-                      clientSecretFile = "/run/secrets/oidc-client-secret";
-                      response_type = "code";
-                      scope = "openid email name";
-                      discorvery_document_uri = "https://auth.example.com/.well-known/openid-configuration";
-                    };
-                  };
-                };
-                description = "All authentication providers to provision.";
-              };
-            };
-          }
-        );
-        default = { };
-        example = {
-          main = {
-            name = "My Account / Organization";
-            metadata.stripe.billing_email = "org@myorg.example.com";
-            features.rest_api = false;
-          };
-        };
-        description = ''
-          All accounts to provision. The key specified here will become the
-          account slug. By using `"{file:/path/to/file}"` as a string value
-          anywhere in these settings, the provisioning script will replace that
-          value with the content of the given file at runtime.
-
-          Please refer to the [Firezone source code](https://github.com/firezone/firezone/blob/main/elixir/apps/domain/lib/domain/accounts/account.ex)
-          for all available properties.
-        '';
-      };
-    };
-  };
-
-  config = mkMerge [
-    {
-      assertions =
-        [
-          {
-            assertion = cfg.provision.enable -> cfg.domain.enable;
-            message = "Provisioning must be done on a machine running the firezone domain server";
-          }
-        ]
-        ++ concatLists (
-          flip mapAttrsToList cfg.provision.accounts (
-            accountName: accountCfg:
-            [
-              {
-                assertion = (builtins.match "^[[:lower:]_-]+$" accountName) != null;
-                message = "An account name must contain only lowercase characters and underscores, as it will be used as the URL slug for this account.";
-              }
-            ]
-            ++ flip mapAttrsToList accountCfg.auth (
-              authName: _: {
-                assertion = (builtins.match "^[[:alnum:]_-]+$" authName) != null;
-                message = "An authentication provider name must contain only letters, numbers, underscores or dashes.";
-              }
-            )
-          )
-        );
-    }
-    # Enable all components if the main server is enabled
-    (mkIf cfg.enable {
-      services.firezone.server.domain.enable = true;
-      services.firezone.server.web.enable = true;
-      services.firezone.server.api.enable = true;
-    })
-    # Create (and configure) a local database if desired
-    (mkIf cfg.enableLocalDB {
-      services.postgresql = {
-        enable = true;
-        ensureUsers = [
-          {
-            name = "firezone";
-            ensureDBOwnership = true;
-          }
-        ];
-        ensureDatabases = [ "firezone" ];
-      };
-
-      services.firezone.server.settings = {
-        DATABASE_SOCKET_DIR = "/run/postgresql";
-        DATABASE_PORT = "5432";
-        DATABASE_NAME = "firezone";
-        DATABASE_USER = "firezone";
-      };
-    })
-    # Create a local nginx reverse proxy
-    (mkIf cfg.nginx.enable {
-      services.nginx = mkMerge [
-        {
-          enable = true;
-        }
-        (
-          let
-            urlComponents = builtins.elemAt (builtins.split "https://([^/]*)(/?.*)" cfg.web.externalUrl) 1;
-            domain = builtins.elemAt urlComponents 0;
-            location = builtins.elemAt urlComponents 1;
-          in
-          {
-            virtualHosts.${domain} = {
-              forceSSL = mkDefault true;
-              locations.${location} = {
-                # The trailing slash is important to strip the location prefix from the request
-                proxyPass = "http://${cfg.web.address}:${toString cfg.web.port}/";
-                proxyWebsockets = true;
-              };
-            };
-          }
-        )
-        (
-          let
-            urlComponents = builtins.elemAt (builtins.split "https://([^/]*)(/?.*)" cfg.api.externalUrl) 1;
-            domain = builtins.elemAt urlComponents 0;
-            location = builtins.elemAt urlComponents 1;
-          in
-          {
-            virtualHosts.${domain} = {
-              forceSSL = mkDefault true;
-              locations.${location} = {
-                # The trailing slash is important to strip the location prefix from the request
-                proxyPass = "http://${cfg.api.address}:${toString cfg.api.port}/";
-                proxyWebsockets = true;
-              };
-            };
-          }
-        )
-      ];
-    })
-    # Specify sensible defaults
-    {
-      services.firezone.server = {
-        settings = {
-          LOG_LEVEL = mkDefault "info";
-          RELEASE_HOSTNAME = mkDefault "localhost.localdomain";
-
-          ERLANG_CLUSTER_ADAPTER = mkDefault "Elixir.Cluster.Strategy.Epmd";
-          ERLANG_CLUSTER_ADAPTER_CONFIG = mkDefault (
-            builtins.toJSON {
-              hosts = cfg.clusterHosts;
-            }
-          );
-
-          TZDATA_DIR = mkDefault "/var/lib/firezone/tzdata";
-          TELEMETRY_ENABLED = mkDefault false;
-
-          # By default this will open nproc * 2 connections for each component,
-          # which can exceeds the (default) maximum of 100 connections for
-          # postgresql on a 12 core +SMT machine. 16 connections will be
-          # sufficient for small to medium deployments
-          DATABASE_POOL_SIZE = "16";
-
-          AUTH_PROVIDER_ADAPTERS = mkDefault (concatStringsSep "," availableAuthAdapters);
-
-          FEATURE_FLOW_ACTIVITIES_ENABLED = mkDefault true;
-          FEATURE_POLICY_CONDITIONS_ENABLED = mkDefault true;
-          FEATURE_MULTI_SITE_RESOURCES_ENABLED = mkDefault true;
-          FEATURE_SELF_HOSTED_RELAYS_ENABLED = mkDefault true;
-          FEATURE_IDP_SYNC_ENABLED = mkDefault true;
-          FEATURE_REST_API_ENABLED = mkDefault true;
-          FEATURE_INTERNET_RESOURCE_ENABLED = mkDefault true;
-          FEATURE_TRAFFIC_FILTERS_ENABLED = mkDefault true;
-          FEATURE_SIGN_UP_ENABLED = mkDefault true;
-        };
-
-        domain.settings = {
-          ERLANG_DISTRIBUTION_PORT = mkDefault 9000;
-          HEALTHZ_PORT = mkDefault 4000;
-          BACKGROUND_JOBS_ENABLED = mkDefault true;
-        };
-
-        web.settings = {
-          ERLANG_DISTRIBUTION_PORT = mkDefault 9001;
-          HEALTHZ_PORT = mkDefault 4001;
-          BACKGROUND_JOBS_ENABLED = mkDefault false;
-
-          PHOENIX_LISTEN_ADDRESS = mkDefault cfg.web.address;
-          PHOENIX_EXTERNAL_TRUSTED_PROXIES = mkDefault (builtins.toJSON cfg.web.trustedProxies);
-          PHOENIX_HTTP_WEB_PORT = mkDefault cfg.web.port;
-          PHOENIX_HTTP_API_PORT = mkDefault cfg.api.port;
-          PHOENIX_SECURE_COOKIES = mkDefault true; # enforce HTTPS on cookies
-          WEB_EXTERNAL_URL = mkDefault cfg.web.externalUrl;
-          API_EXTERNAL_URL = mkDefault cfg.api.externalUrl;
-        };
-
-        api.settings = {
-          ERLANG_DISTRIBUTION_PORT = mkDefault 9002;
-          HEALTHZ_PORT = mkDefault 4002;
-          BACKGROUND_JOBS_ENABLED = mkDefault false;
-
-          PHOENIX_LISTEN_ADDRESS = mkDefault cfg.api.address;
-          PHOENIX_EXTERNAL_TRUSTED_PROXIES = mkDefault (builtins.toJSON cfg.api.trustedProxies);
-          PHOENIX_HTTP_WEB_PORT = mkDefault cfg.web.port;
-          PHOENIX_HTTP_API_PORT = mkDefault cfg.api.port;
-          PHOENIX_SECURE_COOKIES = mkDefault true; # enforce HTTPS on cookies
-          WEB_EXTERNAL_URL = mkDefault cfg.web.externalUrl;
-          API_EXTERNAL_URL = mkDefault cfg.api.externalUrl;
-        };
-      };
-    }
-    (mkIf (!cfg.smtp.configureManually) {
-      services.firezone.server.settings = {
-        OUTBOUND_EMAIL_ADAPTER = "Elixir.Swoosh.Adapters.Mua";
-        OUTBOUND_EMAIL_ADAPTER_OPTS = builtins.toJSON { };
-        OUTBOUND_EMAIL_FROM = cfg.smtp.from;
-        OUTBOUND_EMAIL_SMTP_HOST = cfg.smtp.host;
-        OUTBOUND_EMAIL_SMTP_PORT = toString cfg.smtp.port;
-        OUTBOUND_EMAIL_SMTP_PROTOCOL = if cfg.smtp.implicitTls then "ssl" else "tcp";
-        OUTBOUND_EMAIL_SMTP_USERNAME = cfg.smtp.username;
-      };
-      services.firezone.server.settingsSecret = {
-        OUTBOUND_EMAIL_SMTP_PASSWORD = cfg.smtp.passwordFile;
-      };
-    })
-    (mkIf cfg.provision.enable {
-      # Load client secrets from authentication providers
-      services.firezone.server.settingsSecret = flip concatMapAttrs cfg.provision.accounts (
-        accountName: accountCfg:
-        flip concatMapAttrs accountCfg.auth (
-          authName: authCfg:
-          optionalAttrs (authCfg.adapter_config.clientSecretFile != null) {
-            "AUTH_CLIENT_SECRET_${toUpper accountName}_${toUpper authName}" =
-              authCfg.adapter_config.clientSecretFile;
-          }
-        )
-      );
-    })
-    (mkIf (cfg.openClusterFirewall && cfg.domain.enable) {
-      networking.firewall.allowedTCPPorts = [
-        cfg.domain.settings.ERLANG_DISTRIBUTION_PORT
-      ];
-    })
-    (mkIf (cfg.openClusterFirewall && cfg.web.enable) {
-      networking.firewall.allowedTCPPorts = [
-        cfg.web.settings.ERLANG_DISTRIBUTION_PORT
-      ];
-    })
-    (mkIf (cfg.openClusterFirewall && cfg.api.enable) {
-      networking.firewall.allowedTCPPorts = [
-        cfg.api.settings.ERLANG_DISTRIBUTION_PORT
-      ];
-    })
-    (mkIf (cfg.domain.enable || cfg.web.enable || cfg.api.enable) {
-      systemd.slices.system-firezone = {
-        description = "Firezone Slice";
-      };
-
-      systemd.targets.firezone = {
-        description = "Common target for all Firezone services.";
-        wantedBy = [ "multi-user.target" ];
-      };
-
-      systemd.services.firezone-initialize = {
-        description = "Backend initialization service for the Firezone zero-trust access platform";
-
-        after = mkIf cfg.enableLocalDB [ "postgresql.service" ];
-        requires = mkIf cfg.enableLocalDB [ "postgresql.service" ];
-        wantedBy = [ "firezone.target" ];
-        partOf = [ "firezone.target" ];
-
-        script = ''
-          mkdir -p "$TZDATA_DIR"
-
-          # Generate and load secrets
-          ${generateSecrets}
-          ${loadSecretEnvironment "domain"}
-
-          echo "Running migrations"
-          ${getExe cfg.domain.package} eval Domain.Release.migrate
-        '';
-
-        # We use the domain environment to be able to run migrations
-        environment = collectEnvironment "domain";
-        serviceConfig = commonServiceConfig // {
-          Type = "oneshot";
-          RemainAfterExit = true;
-        };
-      };
-
-      systemd.services.firezone-server-domain = mkIf cfg.domain.enable {
-        description = "Backend domain server for the Firezone zero-trust access platform";
-        after = [ "firezone-initialize.service" ];
-        bindsTo = [ "firezone-initialize.service" ];
-        wantedBy = [ "firezone.target" ];
-        partOf = [ "firezone.target" ];
-
-        script = ''
-          ${loadSecretEnvironment "domain"}
-          exec ${getExe cfg.domain.package} start;
-        '';
-
-        path = [ pkgs.curl ];
-        postStart = mkIf cfg.provision.enable ''
-          ${loadSecretEnvironment "domain"}
-
-          # Wait for the firezone server to come online
-          count=0
-          while [[ "$(curl -s "http://localhost:${toString cfg.domain.settings.HEALTHZ_PORT}" 2>/dev/null || echo)" != '{"status":"ok"}' ]]
-          do
-            sleep 1
-            if [[ "$count" -eq 30 ]]; then
-              echo "Tried for at least 30 seconds, giving up..."
-              exit 1
-            fi
-            count=$((count++))
-          done
-
-          sleep 1 # Wait for server to fully come up. Not ideal to use sleep, but at least it works.
-          ln -sTf ${provisionStateJson} provision-state.json
-          ${getExe cfg.domain.package} rpc 'Code.eval_file("${./provision.exs}")'
-        '';
-
-        environment = collectEnvironment "domain";
-        serviceConfig = commonServiceConfig;
-      };
-
-      systemd.services.firezone-server-web = mkIf cfg.web.enable {
-        description = "Backend web server for the Firezone zero-trust access platform";
-        after = [ "firezone-initialize.service" ];
-        bindsTo = [ "firezone-initialize.service" ];
-        wantedBy = [ "firezone.target" ];
-        partOf = [ "firezone.target" ];
-
-        script = ''
-          ${loadSecretEnvironment "web"}
-          exec ${getExe cfg.web.package} start;
-        '';
-
-        environment = collectEnvironment "web";
-        serviceConfig = commonServiceConfig;
-      };
-
-      systemd.services.firezone-server-api = mkIf cfg.api.enable {
-        description = "Backend api server for the Firezone zero-trust access platform";
-        after = [ "firezone-initialize.service" ];
-        bindsTo = [ "firezone-initialize.service" ];
-        wantedBy = [ "firezone.target" ];
-        partOf = [ "firezone.target" ];
-
-        script = ''
-          ${loadSecretEnvironment "api"}
-          exec ${getExe cfg.api.package} start;
-        '';
-
-        environment = collectEnvironment "api";
-        serviceConfig = commonServiceConfig;
-      };
-    })
-  ];
-
-  meta.maintainers = with lib.maintainers; [
-    oddlama
-    patrickdag
-  ];
-}
diff --git a/modules/provision.exs b/modules/provision.exs
deleted file mode 100644
index 98e9c93..0000000
--- a/modules/provision.exs
+++ /dev/null
@@ -1,155 +0,0 @@
-defmodule Provision do
-  alias Domain.{Repo, Accounts, Auth, Actors}
-  require Logger
-
-  defp resolve_references(value) when is_map(value) do
-    Enum.into(value, %{}, fn {k, v} -> {k, resolve_references(v)} end)
-  end
-
-  defp resolve_references(value) when is_list(value) do
-    Enum.map(value, &resolve_references/1)
-  end
-
-  defp resolve_references(value) when is_binary(value) do
-    Regex.replace(~r/\{env:([^}]+)\}/, value, fn _, var ->
-      System.get_env(var) || raise "Environment variable #{var} not set"
-    end)
-  end
-
-  defp resolve_references(value), do: value
-
-  defp atomize_keys(map) when is_map(map) do
-    Enum.into(map, %{}, fn {k, v} ->
-      {
-        if(is_binary(k), do: String.to_atom(k), else: k),
-        if(is_map(v), do: atomize_keys(v), else: v)
-      }
-    end)
-  end
-
-  def provision() do
-    IO.inspect("Starting provisioning", label: "INFO")
-    json_file = "provision-state.json"
-    {:ok, raw_json} = File.read(json_file)
-    {:ok, %{"accounts" => accounts}} = Jason.decode(raw_json)
-    accounts = resolve_references(accounts)
-
-    multi = Enum.reduce(accounts, Ecto.Multi.new(), fn {slug, account_data}, multi ->
-      account_attrs = atomize_keys(%{
-        name: account_data["name"],
-        slug: slug,
-        features: Map.get(account_data, "features", %{}),
-        metadata: Map.get(account_data, "metadata", %{}),
-        limits: Map.get(account_data, "limits", %{}),
-      })
-
-      multi = multi
-        |> Ecto.Multi.run({:account, slug}, fn repo, _changes ->
-          case Accounts.fetch_account_by_id_or_slug(slug) do
-            {:ok, acc} ->
-              IO.inspect("Updating existing account #{slug}", label: "INFO")
-              updated_acc = acc |> Ecto.Changeset.change(account_attrs) |> repo.update!()
-              {:ok, {:existing, updated_acc}}
-            _ ->
-              IO.inspect("Creating new account #{slug}", label: "INFO")
-              {:ok, account} = Accounts.create_account(account_attrs)
-              {:ok, {:new, account}}
-          end
-        end)
-        |> Ecto.Multi.run({:everyone_group, slug}, fn _repo, changes ->
-          case Map.get(changes, {:account, slug}) do
-            {:new, account} ->
-              IO.inspect("Creating Everyone group for new account", label: "INFO")
-              Actors.create_managed_group(account, %{name: "Everyone", membership_rules: [%{operator: true}]})
-            {:existing, _account} ->
-              {:ok, :skipped}
-          end
-        end)
-        |> Ecto.Multi.run({:provider, slug}, fn _repo, changes ->
-          case Map.get(changes, {:account, slug}) do
-            {:new, account} ->
-              IO.inspect("Creating default email provider for new account", label: "INFO")
-              Auth.create_provider(account, %{name: "Email", adapter: :email, adapter_config: %{}})
-            {:existing, account} ->
-              Auth.Provider.Query.not_disabled()
-              |> Auth.Provider.Query.by_adapter(:email)
-              |> Auth.Provider.Query.by_account_id(account.id)
-              |> Repo.fetch(Auth.Provider.Query, [])
-          end
-        end)
-
-      multi = Enum.reduce(account_data["actors"] || %{}, multi, fn {name, actor_data}, multi ->
-        actor_attrs = atomize_keys(%{
-          name: name,
-          type: String.to_atom(actor_data["type"]),
-        })
-
-        Ecto.Multi.run(multi, {:actor, slug, name}, fn repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          case Repo.get_by(Actors.Actor, account_id: account.id, name: name) do
-            nil ->
-              IO.inspect("Creating new actor #{name}", label: "INFO")
-              {:ok, actor} = Actors.create_actor(account, actor_attrs)
-              {:ok, {:new, actor}}
-            act ->
-              IO.inspect("Updating existing actor #{name}", label: "INFO")
-              updated_act = act |> Ecto.Changeset.change(actor_attrs) |> repo.update!()
-              {:ok, {:existing, updated_act}}
-          end
-        end)
-        |> Ecto.Multi.run({:actor_identity, slug, name}, fn repo, changes ->
-          email_provider = changes[{:provider, slug}]
-          case Map.get(changes, {:actor, slug, name}) do
-            {:new, actor} ->
-              IO.inspect("Creating actor email identity", label: "INFO")
-              Auth.create_identity(actor, email_provider, %{
-                provider_identifier: actor_data["email"],
-                provider_identifier_confirmation: actor_data["email"]
-              })
-            {:existing, actor} ->
-              IO.inspect("Updating actor email identity", label: "INFO")
-              {:ok, identity} = Auth.Identity.Query.not_deleted()
-              |> Auth.Identity.Query.by_actor_id(actor.id)
-              |> Auth.Identity.Query.by_provider_id(email_provider.id)
-              |> Repo.fetch(Auth.Identity.Query, [])
-
-              {:ok, identity |> Ecto.Changeset.change(%{
-                provider_identifier: actor_data["email"],
-              }) |> repo.update!()}
-          end
-        end)
-      end)
-
-      multi = Enum.reduce(account_data["auth"] || %{}, multi, fn {name, provider_data}, multi ->
-        provider_attrs = %{
-          name: name,
-          adapter: String.to_atom(provider_data["adapter"]),
-          adapter_config: provider_data["adapter_config"],
-        }
-
-        Ecto.Multi.run(multi, {:provider, slug, name}, fn repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          case Repo.get_by(Auth.Provider, account_id: account.id, name: name) do
-            nil ->
-              IO.inspect("Creating new provider #{name}", label: "INFO")
-              Auth.create_provider(account, provider_attrs)
-            existing ->
-              IO.inspect("Updating existing provider #{name}", label: "INFO")
-              {:ok, existing |> Ecto.Changeset.change(provider_attrs) |> repo.update!()}
-          end
-        end)
-      end)
-
-      multi
-    end)
-
-    case Repo.transaction(multi) do
-      {:ok, _result} ->
-        Logger.info("Provisioning completed successfully.")
-      {:error, step, reason, _changes} ->
-        Logger.error("Provisioning failed at step #{inspect(step)}: #{inspect(reason)}")
-    end
-  end
-end
-
-Provision.provision()
diff --git a/pkgs/default.nix b/pkgs/default.nix
index db1e13b..763ae4b 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -19,13 +19,6 @@ _inputs: [
     #    (_pythonFinal: pythonPrev: {
     #    })
     #  ];
-    firezone-server-domain = prev.callPackage ./firezone-server-domain/package.nix { };
-    firezone-server-web = prev.callPackage ./firezone-server-web/package.nix { };
-    firezone-server-api = prev.callPackage ./firezone-server-api/package.nix { };
-    firezone-gateway = prev.callPackage ./firezone-gateway/package.nix { };
-    firezone-relay = prev.callPackage ./firezone-relay/package.nix { };
-    firezone-gui-client = prev.callPackage ./firezone-gui-client/package.nix { };
-    firezone-headless-client = prev.callPackage ./firezone-headless-client/package.nix { };
 
     mdns-repeater = prev.callPackage ./mdns-repeater.nix { };
 
diff --git a/pkgs/firezone-gateway/package.nix b/pkgs/firezone-gateway/package.nix
deleted file mode 100644
index bac49eb..0000000
--- a/pkgs/firezone-gateway/package.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "firezone-gateway";
-  version = "1.4.2";
-  src = fetchFromGitHub {
-    owner = "oddlama";
-    repo = "firezone";
-    rev = "feat/configurable-gateway-interface";
-    hash = "sha256-dsGQubRs/ZHdAd6MHpa+3K4vGm4OnCdf1yMlGG1AIJk=";
-  };
-
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-odrexu5mBGmvHNF4cUu9PDIEdxZC451lWV7dsLYT/Sg=";
-  sourceRoot = "${src.name}/rust";
-  buildAndTestSubdir = "gateway";
-
-  # Required to remove profiling arguments which conflict with this builder
-  postPatch = ''
-    rm .cargo/config.toml
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "WireGuard tunnel server for the Firezone zero-trust access platform";
-    homepage = "https://github.com/firezone/firezone";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      oddlama
-      patrickdag
-    ];
-    mainProgram = "firezone-gateway";
-  };
-}
diff --git a/pkgs/firezone-gui-client/0000-add-hyper-tls-dependency.patch b/pkgs/firezone-gui-client/0000-add-hyper-tls-dependency.patch
deleted file mode 100644
index 1d4349c..0000000
--- a/pkgs/firezone-gui-client/0000-add-hyper-tls-dependency.patch
+++ /dev/null
@@ -1,281 +0,0 @@
-diff --git a/rust/Cargo.lock b/rust/Cargo.lock
-index 9645ee069..558339b1f 100644
---- a/rust/Cargo.lock
-+++ b/rust/Cargo.lock
-@@ -951,7 +951,7 @@ dependencies = [
-  "cocoa-foundation 0.1.2",
-  "core-foundation 0.9.4",
-  "core-graphics 0.23.2",
-- "foreign-types",
-+ "foreign-types 0.5.0",
-  "libc",
-  "objc",
- ]
-@@ -967,7 +967,7 @@ dependencies = [
-  "cocoa-foundation 0.2.0",
-  "core-foundation 0.10.0",
-  "core-graphics 0.24.0",
-- "foreign-types",
-+ "foreign-types 0.5.0",
-  "libc",
-  "objc",
- ]
-@@ -1173,7 +1173,7 @@ dependencies = [
-  "bitflags 1.3.2",
-  "core-foundation 0.9.4",
-  "core-graphics-types 0.1.3",
-- "foreign-types",
-+ "foreign-types 0.5.0",
-  "libc",
- ]
- 
-@@ -1186,7 +1186,7 @@ dependencies = [
-  "bitflags 2.6.0",
-  "core-foundation 0.10.0",
-  "core-graphics-types 0.2.0",
-- "foreign-types",
-+ "foreign-types 0.5.0",
-  "libc",
- ]
- 
-@@ -1999,6 +1999,7 @@ dependencies = [
-  "firezone-logging",
-  "firezone-telemetry",
-  "futures",
-+ "hyper-tls",
-  "native-dialog",
-  "nix 0.29.0",
-  "rand 0.8.5",
-@@ -2281,6 +2282,15 @@ version = "0.1.3"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "f81ec6369c545a7d40e4589b5597581fa1c441fe1cce96dd1de43159910a36a2"
- 
-+[[package]]
-+name = "foreign-types"
-+version = "0.3.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-+dependencies = [
-+ "foreign-types-shared 0.1.1",
-+]
-+
- [[package]]
- name = "foreign-types"
- version = "0.5.0"
-@@ -2288,7 +2298,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
- dependencies = [
-  "foreign-types-macros",
-- "foreign-types-shared",
-+ "foreign-types-shared 0.3.1",
- ]
- 
- [[package]]
-@@ -2302,6 +2312,12 @@ dependencies = [
-  "syn 2.0.87",
- ]
- 
-+[[package]]
-+name = "foreign-types-shared"
-+version = "0.1.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-+
- [[package]]
- name = "foreign-types-shared"
- version = "0.3.1"
-@@ -3035,6 +3051,22 @@ dependencies = [
-  "tower-service",
- ]
- 
-+[[package]]
-+name = "hyper-tls"
-+version = "0.6.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
-+dependencies = [
-+ "bytes",
-+ "http-body-util",
-+ "hyper",
-+ "hyper-util",
-+ "native-tls",
-+ "tokio",
-+ "tokio-native-tls",
-+ "tower-service",
-+]
-+
- [[package]]
- name = "hyper-util"
- version = "0.1.9"
-@@ -3723,6 +3755,23 @@ dependencies = [
-  "winapi",
- ]
- 
-+[[package]]
-+name = "native-tls"
-+version = "0.2.12"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466"
-+dependencies = [
-+ "libc",
-+ "log",
-+ "openssl",
-+ "openssl-probe",
-+ "openssl-sys",
-+ "schannel",
-+ "security-framework",
-+ "security-framework-sys",
-+ "tempfile",
-+]
-+
- [[package]]
- name = "ndk"
- version = "0.9.0"
-@@ -4286,6 +4335,50 @@ dependencies = [
-  "pathdiff",
- ]
- 
-+[[package]]
-+name = "openssl"
-+version = "0.10.68"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "6174bc48f102d208783c2c84bf931bb75927a617866870de8a4ea85597f871f5"
-+dependencies = [
-+ "bitflags 2.6.0",
-+ "cfg-if",
-+ "foreign-types 0.3.2",
-+ "libc",
-+ "once_cell",
-+ "openssl-macros",
-+ "openssl-sys",
-+]
-+
-+[[package]]
-+name = "openssl-macros"
-+version = "0.1.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
-+dependencies = [
-+ "proc-macro2",
-+ "quote",
-+ "syn 2.0.87",
-+]
-+
-+[[package]]
-+name = "openssl-probe"
-+version = "0.1.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
-+
-+[[package]]
-+name = "openssl-sys"
-+version = "0.9.104"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
-+dependencies = [
-+ "cc",
-+ "libc",
-+ "pkg-config",
-+ "vcpkg",
-+]
-+
- [[package]]
- name = "opentelemetry"
- version = "0.26.0"
-@@ -5385,6 +5478,15 @@ dependencies = [
-  "winapi-util",
- ]
- 
-+[[package]]
-+name = "schannel"
-+version = "0.1.27"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d"
-+dependencies = [
-+ "windows-sys 0.59.0",
-+]
-+
- [[package]]
- name = "schemars"
- version = "0.8.21"
-@@ -5474,6 +5576,29 @@ dependencies = [
-  "zbus",
- ]
- 
-+[[package]]
-+name = "security-framework"
-+version = "2.11.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
-+dependencies = [
-+ "bitflags 2.6.0",
-+ "core-foundation 0.9.4",
-+ "core-foundation-sys",
-+ "libc",
-+ "security-framework-sys",
-+]
-+
-+[[package]]
-+name = "security-framework-sys"
-+version = "2.14.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "49db231d56a190491cb4aeda9527f1ad45345af50b0851622a7adb8c03b01c32"
-+dependencies = [
-+ "core-foundation-sys",
-+ "libc",
-+]
-+
- [[package]]
- name = "selectors"
- version = "0.22.0"
-@@ -5947,7 +6072,7 @@ dependencies = [
-  "bytemuck",
-  "cfg_aliases",
-  "core-graphics 0.24.0",
-- "foreign-types",
-+ "foreign-types 0.5.0",
-  "js-sys",
-  "log",
-  "objc2",
-@@ -6786,6 +6911,16 @@ dependencies = [
-  "syn 2.0.87",
- ]
- 
-+[[package]]
-+name = "tokio-native-tls"
-+version = "0.3.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
-+dependencies = [
-+ "native-tls",
-+ "tokio",
-+]
-+
- [[package]]
- name = "tokio-rustls"
- version = "0.26.0"
-@@ -7395,6 +7530,12 @@ version = "0.1.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
- 
-+[[package]]
-+name = "vcpkg"
-+version = "0.2.15"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-+
- [[package]]
- name = "version-compare"
- version = "0.2.0"
-diff --git a/rust/gui-client/src-tauri/Cargo.toml b/rust/gui-client/src-tauri/Cargo.toml
-index 32ca56197..f0475e6bf 100644
---- a/rust/gui-client/src-tauri/Cargo.toml
-+++ b/rust/gui-client/src-tauri/Cargo.toml
-@@ -25,6 +25,7 @@ firezone-headless-client = { workspace = true }
- firezone-logging = { workspace = true }
- firezone-telemetry = { workspace = true }
- futures = { workspace = true }
-+hyper-tls = "0.6.0"
- native-dialog = { workspace = true }
- rand = { workspace = true }
- rustls = { workspace = true }
diff --git a/pkgs/firezone-gui-client/package.nix b/pkgs/firezone-gui-client/package.nix
deleted file mode 100644
index 975bbcd..0000000
--- a/pkgs/firezone-gui-client/package.nix
+++ /dev/null
@@ -1,153 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  nix-update-script,
-  pkg-config,
-  dbus,
-  openssl,
-  zenity,
-  cargo-tauri,
-  gdk-pixbuf,
-  glib,
-  gobject-introspection,
-  gtk3,
-  kdialog,
-  libsoup_3,
-  libayatana-appindicator,
-  webkitgtk_4_1,
-  wrapGAppsHook3,
-  stdenvNoCC,
-  git,
-  pnpm_9,
-  nodejs,
-}:
-let
-  version = "1.4.0";
-  src = fetchFromGitHub {
-    owner = "firezone";
-    repo = "firezone";
-    tag = "gui-client-${version}";
-    hash = "sha256-gwlkHTFVd1gHwOOIar+5+LEP2ovoyEIMmLfPxYb/OCs=";
-    # FIXME: remove once https://github.com/firezone/firezone/pull/7808 is released
-    # FIXME: somehow still required...
-    postFetch = ''
-      ${lib.getExe git} -C $out apply ${./0000-add-hyper-tls-dependency.patch}
-    '';
-  };
-
-  frontend = stdenvNoCC.mkDerivation rec {
-    pname = "firezone-gui-client-frontend";
-    inherit version src;
-
-    pnpmDeps = pnpm_9.fetchDeps {
-      inherit pname version;
-      src = "${src}/rust/gui-client";
-      hash = "sha256-Gc+X4mbpHa8b/Ol6Fee7VFpTPG25LksoAEjFww1WH5I=";
-    };
-    pnpmRoot = "rust/gui-client";
-
-    nativeBuildInputs = [
-      pnpm_9.configHook
-      nodejs
-    ];
-
-    buildPhase = ''
-      runHook preBuild
-
-      cd $pnpmRoot
-      cp node_modules/flowbite/dist/flowbite.min.js src/
-      pnpm tailwindcss -i src/input.css -o src/output.css
-      node --max_old_space_size=1024000 ./node_modules/vite/bin/vite.js build
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      cp -r dist $out
-
-      runHook postInstall
-    '';
-  };
-in
-rustPlatform.buildRustPackage rec {
-  pname = "firezone-gui-client";
-  inherit version src;
-
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-eqkYwP14kca7Q/P9wc+CvTBmKETTmbd06EBNx3MKLro=";
-  sourceRoot = "${src.name}/rust";
-  buildAndTestSubdir = "gui-client";
-
-  nativeBuildInputs = [
-    cargo-tauri.hook
-
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    openssl
-    dbus
-    gdk-pixbuf
-    glib
-    gobject-introspection
-    gtk3
-    libsoup_3
-
-    libayatana-appindicator
-    webkitgtk_4_1
-  ];
-
-  # Required to remove profiling arguments which conflict with this builder
-  postPatch = ''
-    rm .cargo/config.toml
-    ln -s ${frontend} gui-client/dist
-  '';
-
-  # Required to run tests
-  preCheck = ''
-    export XDG_RUNTIME_DIR=$(mktemp -d)
-  '';
-
-  checkFlags = [
-    # Requires network access
-    "--skip=notifiers"
-  ];
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      # Otherwise blank screen, see https://github.com/tauri-apps/tauri/issues/9304
-      --set WEBKIT_DISABLE_DMABUF_RENDERER 1
-      --prefix PATH ":" ${
-        lib.makeBinPath [
-          zenity
-          kdialog
-        ]
-      }
-      --prefix LD_LIBRARY_PATH ":" ${
-        lib.makeLibraryPath [
-          libayatana-appindicator
-        ]
-      }
-    )
-  '';
-
-  passthru = {
-    inherit frontend;
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "GUI client for the Firezone zero-trust access platform";
-    homepage = "https://github.com/firezone/firezone";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      oddlama
-      patrickdag
-    ];
-    mainProgram = "firezone-gui-client";
-  };
-}
diff --git a/pkgs/firezone-headless-client/package.nix b/pkgs/firezone-headless-client/package.nix
deleted file mode 100644
index 0ab970a..0000000
--- a/pkgs/firezone-headless-client/package.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "firezone-headless-client";
-  version = "1.4.0";
-  src = fetchFromGitHub {
-    owner = "oddlama";
-    repo = "firezone";
-    rev = "feat/configurable-gateway-interface";
-    hash = "sha256-dsGQubRs/ZHdAd6MHpa+3K4vGm4OnCdf1yMlGG1AIJk=";
-  };
-
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-odrexu5mBGmvHNF4cUu9PDIEdxZC451lWV7dsLYT/Sg=";
-  sourceRoot = "${src.name}/rust";
-  buildAndTestSubdir = "headless-client";
-
-  # Required to remove profiling arguments which conflict with this builder
-  postPatch = ''
-    rm .cargo/config.toml
-  '';
-
-  # Required to run tests
-  preCheck = ''
-    export XDG_RUNTIME_DIR=$(mktemp -d)
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "CLI client for the Firezone zero-trust access platform";
-    homepage = "https://github.com/firezone/firezone";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      oddlama
-      patrickdag
-    ];
-    mainProgram = "firezone-headless-client";
-  };
-}
diff --git a/pkgs/firezone-relay/package.nix b/pkgs/firezone-relay/package.nix
deleted file mode 100644
index ee341ad..0000000
--- a/pkgs/firezone-relay/package.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "firezone-relay";
-  version = "unstable-2025-01-19";
-  src = fetchFromGitHub {
-    owner = "firezone";
-    repo = "firezone";
-    rev = "8c9427b7b133e5050be34c2ac0e831c12c08f02c";
-    hash = "sha256-yccplADHRJQQiKrmHcJ5rvouswHrbx4K6ysnIAoZJR0=";
-  };
-
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-WpJL5ALFMvyYv3QI5gMazAj6BVr4oyGq+zOo40rxqOE=";
-  sourceRoot = "${src.name}/rust";
-  buildAndTestSubdir = "relay";
-
-  # Required to remove profiling arguments which conflict with this builder
-  postPatch = ''
-    rm .cargo/config.toml
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "STUN/TURN server for the Firezone zero-trust access platform";
-    homepage = "https://github.com/firezone/firezone";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      oddlama
-      patrickdag
-    ];
-    mainProgram = "firezone-relay";
-  };
-}
diff --git a/pkgs/firezone-server-api/package.nix b/pkgs/firezone-server-api/package.nix
deleted file mode 100644
index 16a5e7e..0000000
--- a/pkgs/firezone-server-api/package.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-import ../firezone-server-domain/generic.nix {
-  mixReleaseName = "api";
-}
diff --git a/pkgs/firezone-server-domain/0000-add-healthz-port.patch b/pkgs/firezone-server-domain/0000-add-healthz-port.patch
deleted file mode 100644
index dc95561..0000000
--- a/pkgs/firezone-server-domain/0000-add-healthz-port.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-diff --git a/apps/domain/lib/domain/config/definitions.ex b/apps/domain/lib/domain/config/definitions.ex
-index 8cd2e8d0f..de55c8e8f 100644
---- a/apps/domain/lib/domain/config/definitions.ex
-+++ b/apps/domain/lib/domain/config/definitions.ex
-@@ -120,6 +120,7 @@ defmodule Domain.Config.Definitions do
-        ]},
-       {"Instrumentation",
-        [
-+         :healthz_port,
-          :instrumentation_client_logs_enabled,
-          :instrumentation_client_logs_bucket,
-          :telemetry_metrics_reporter,
-@@ -474,6 +475,19 @@ defmodule Domain.Config.Definitions do
-   ## Telemetry
-   ##############################################
- 
-+  @doc """
-+  The port for the internal healthz endpoint.
-+  """
-+  defconfig(:healthz_port, :integer,
-+    default: 4000,
-+    changeset: fn changeset, key ->
-+      Ecto.Changeset.validate_number(changeset, key,
-+        greater_than: 0,
-+        less_than_or_equal_to: 65_535
-+      )
-+    end
-+  )
-+
-   @doc """
-   Enable or disable the Firezone telemetry collection.
- 
-diff --git a/apps/domain/lib/domain/telemetry.ex b/apps/domain/lib/domain/telemetry.ex
-index af430358d..d154282b4 100644
---- a/apps/domain/lib/domain/telemetry.ex
-+++ b/apps/domain/lib/domain/telemetry.ex
-@@ -13,7 +13,7 @@ defmodule Domain.Telemetry do
- 
-     children = [
-       # We start a /healthz endpoint that is used for liveness probes
--      {Bandit, plug: Telemetry.HealthzPlug, scheme: :http, port: 4000},
-+      {Bandit, plug: Telemetry.HealthzPlug, scheme: :http, port: Keyword.get(config, :healthz_port)},
- 
-       # Telemetry poller will execute the given period measurements
-       # every 10_000ms. Learn more here: https://hexdocs.pm/telemetry_metrics
-diff --git a/config/runtime.exs b/config/runtime.exs
-index 7817942fa..c6dfe9c31 100644
---- a/config/runtime.exs
-+++ b/config/runtime.exs
-@@ -211,7 +211,9 @@ if config_env() == :prod do
-       otlp_endpoint: System.get_env("OTLP_ENDPOINT")
-   end
- 
--  config :domain, Domain.Telemetry, metrics_reporter: compile_config!(:telemetry_metrics_reporter)
-+  config :domain, Domain.Telemetry,
-+    healthz_port: compile_config!(:healthz_port),
-+    metrics_reporter: compile_config!(:telemetry_metrics_reporter)
- 
-   if telemetry_metrics_reporter = compile_config!(:telemetry_metrics_reporter) do
-     config :domain, telemetry_metrics_reporter, compile_config!(:telemetry_metrics_reporter_opts)
diff --git a/pkgs/firezone-server-domain/0001-postgres-socket.patch b/pkgs/firezone-server-domain/0001-postgres-socket.patch
deleted file mode 100644
index 9e8f0f4..0000000
--- a/pkgs/firezone-server-domain/0001-postgres-socket.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-diff --git a/apps/domain/lib/domain/config.ex b/apps/domain/lib/domain/config.ex
-index 11fdcc3a1..9254f210d 100644
---- a/apps/domain/lib/domain/config.ex
-+++ b/apps/domain/lib/domain/config.ex
-@@ -42,6 +42,24 @@ defmodule Domain.Config do
-     end
-   end
- 
-+  @doc """
-+  Similar to `compile_config/2` but returns nil if the configuration is invalid.
-+
-+  This function does not resolve values from the database because it's intended use is during
-+  compilation and before application boot (in `config/runtime.exs`).
-+
-+  If you need to resolve values from the database, use `fetch_config/1` or `fetch_config!/1`.
-+  """
-+  def compile_config(module \\ Definitions, key, env_config \\ System.get_env()) do
-+    case Fetcher.fetch_source_and_config(module, key, %{}, env_config) do
-+      {:ok, _source, value} ->
-+        value
-+
-+      {:error, reason} ->
-+        nil
-+    end
-+  end
-+
-   def config_changeset(changeset, schema_key, config_key \\ nil) do
-     config_key = config_key || schema_key
- 
-diff --git a/apps/domain/lib/domain/config/definitions.ex b/apps/domain/lib/domain/config/definitions.ex
-index 8cd2e8d0f..f27d67c69 100644
---- a/apps/domain/lib/domain/config/definitions.ex
-+++ b/apps/domain/lib/domain/config/definitions.ex
-@@ -61,6 +61,7 @@ defmodule Domain.Config.Definitions do
-       {"Database",
-        [
-          :database_host,
-+         :database_socket_dir,
-          :database_port,
-          :database_name,
-          :database_user,
-@@ -255,6 +256,11 @@ defmodule Domain.Config.Definitions do
-   """
-   defconfig(:database_host, :string, default: "postgres")
- 
-+  @doc """
-+  PostgreSQL socket directory (takes precedence over hostname).
-+  """
-+  defconfig(:database_socket_dir, :string, default: nil)
-+
-   @doc """
-   PostgreSQL port.
-   """
-diff --git a/config/runtime.exs b/config/runtime.exs
-index 7817942fa..14cbe182f 100644
---- a/config/runtime.exs
-+++ b/config/runtime.exs
-@@ -1,22 +1,31 @@
- import Config
- 
- if config_env() == :prod do
--  import Domain.Config, only: [compile_config!: 1]
-+  import Domain.Config, only: [compile_config!: 1, compile_config: 1]
- 
-   ###############################
-   ##### Domain ##################
-   ###############################
- 
--  config :domain, Domain.Repo,
--    database: compile_config!(:database_name),
--    username: compile_config!(:database_user),
--    hostname: compile_config!(:database_host),
--    port: compile_config!(:database_port),
--    password: compile_config!(:database_password),
--    pool_size: compile_config!(:database_pool_size),
--    ssl: compile_config!(:database_ssl_enabled),
--    ssl_opts: compile_config!(:database_ssl_opts),
--    parameters: compile_config!(:database_parameters)
-+  config :domain,
-+         Domain.Repo,
-+         [
-+           {:database, compile_config!(:database_name)},
-+           {:username, compile_config!(:database_user)},
-+           {:port, compile_config!(:database_port)},
-+           {:pool_size, compile_config!(:database_pool_size)},
-+           {:ssl, compile_config!(:database_ssl_enabled)},
-+           {:ssl_opts, compile_config!(:database_ssl_opts)},
-+           {:parameters, compile_config!(:database_parameters)}
-+         ] ++
-+           if(compile_config(:database_password),
-+             do: [{:password, compile_config!(:database_password)}],
-+             else: []
-+           ) ++
-+           if(compile_config(:database_socket_dir),
-+             do: [{:socket_dir, compile_config!(:database_socket_dir)}],
-+             else: [{:hostname, compile_config!(:database_host)}]
-+           )
- 
-   config :domain, Domain.Tokens,
-     key_base: compile_config!(:tokens_key_base),
diff --git a/pkgs/firezone-server-domain/0002-add-mua.patch b/pkgs/firezone-server-domain/0002-add-mua.patch
deleted file mode 100644
index 458caf9..0000000
--- a/pkgs/firezone-server-domain/0002-add-mua.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-diff --git a/apps/domain/lib/domain/config/definitions.ex b/apps/domain/lib/domain/config/definitions.ex
-index 8cd2e8d0f..2e6ca054b 100644
---- a/apps/domain/lib/domain/config/definitions.ex
-+++ b/apps/domain/lib/domain/config/definitions.ex
-@@ -584,6 +584,7 @@ defmodule Domain.Config.Definitions do
-           Swoosh.Adapters.Mailgun,
-           Swoosh.Adapters.Mailjet,
-           Swoosh.Adapters.Mandrill,
-+          Swoosh.Adapters.Mua,
-           Swoosh.Adapters.Postmark,
-           Swoosh.Adapters.ProtonBridge,
-           Swoosh.Adapters.SMTP,
-diff --git a/apps/web/lib/web/live/sign_up.ex b/apps/web/lib/web/live/sign_up.ex
-index dfbc94d9b..638e3b373 100644
---- a/apps/web/lib/web/live/sign_up.ex
-+++ b/apps/web/lib/web/live/sign_up.ex
-@@ -1,5 +1,6 @@
- defmodule Web.SignUp do
-   use Web, {:live_view, layout: {Web.Layouts, :public}}
-+  require Logger
-   alias Domain.{Auth, Accounts, Actors, Config}
-   alias Web.Registration
- 
-@@ -358,7 +359,9 @@ defmodule Web.SignUp do
- 
-           {:noreply, assign(socket, form: to_form(changeset))}
- 
--        {:error, :send_email, _reason, _effects_so_far} ->
-+        {:error, :send_email, reason, _effects_so_far} ->
-+          Logger.warning("Failed to send sign_up email", reason: inspect(reason))
-+
-           changeset =
-             Ecto.Changeset.add_error(
-               changeset,
-diff --git a/config/runtime.exs b/config/runtime.exs
-index 7817942fa..8704ccde5 100644
---- a/config/runtime.exs
-+++ b/config/runtime.exs
-@@ -228,7 +228,21 @@ if config_env() == :prod do
-          [
-            adapter: compile_config!(:outbound_email_adapter),
-            from_email: compile_config!(:outbound_email_from)
--         ] ++ compile_config!(:outbound_email_adapter_opts)
-+         ] ++
-+           (if System.get_env("OUTBOUND_EMAIL_ADAPTER") == "Elixir.Swoosh.Adapters.Mua" do
-+              [
-+                protocol: String.to_atom(System.get_env("OUTBOUND_EMAIL_SMTP_PROTOCOL")),
-+                relay: System.get_env("OUTBOUND_EMAIL_SMTP_HOST"),
-+                port: String.to_integer(System.get_env("OUTBOUND_EMAIL_SMTP_PORT")),
-+                auth: [
-+                  username: System.get_env("OUTBOUND_EMAIL_SMTP_USERNAME"),
-+                  password: System.get_env("OUTBOUND_EMAIL_SMTP_PASSWORD")
-+                ]
-+              ]
-+            else
-+              []
-+            end) ++
-+           compile_config!(:outbound_email_adapter_opts)
- 
-   config :workos, WorkOS.Client,
-     api_key: compile_config!(:workos_api_key),
-diff --git a/mix.exs b/mix.exs
-index 12782d631..dee1245d2 100644
---- a/mix.exs
-+++ b/mix.exs
-@@ -47,7 +47,9 @@ defmodule Firezone.MixProject do
-       # Formatter doesn't track dependencies of children applications
-       {:phoenix, "~> 1.7.0"},
-       {:phoenix_live_view, "~> 1.0.0-rc.0"},
--      {:floki, "~> 0.37.0"}
-+      {:floki, "~> 0.37.0"},
-+      {:mua, "~> 0.2.0"},
-+      {:mail, "~> 0.3.0"}
-     ]
-   end
- 
-diff --git a/mix.lock b/mix.lock
-index 757829003..47775677d 100644
---- a/mix.lock
-+++ b/mix.lock
-@@ -50,11 +50,13 @@
-   "junit_formatter": {:hex, :junit_formatter, "3.4.0", "d0e8db6c34dab6d3c4154c3b46b21540db1109ae709d6cf99ba7e7a2ce4b1ac2", [:mix], [], "hexpm", "bb36e2ae83f1ced6ab931c4ce51dd3dbef1ef61bb4932412e173b0cfa259dacd"},
-   "libcluster": {:hex, :libcluster, "3.3.3", "a4f17721a19004cfc4467268e17cff8b1f951befe428975dd4f6f7b84d927fe0", [:mix], [{:jason, "~> 1.1", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "7c0a2275a0bb83c07acd17dab3c3bfb4897b145106750eeccc62d302e3bdfee5"},
-   "logger_json": {:hex, :logger_json, "6.2.0", "13e2e9f5f7b195865c5c3ef3d296c3ad50e7ecb038d899433702a79e979b91d7", [:mix], [{:ecto, "~> 3.11", [hex: :ecto, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:plug, "~> 1.15", [hex: :plug, repo: "hexpm", optional: true]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: true]}], "hexpm", "98366d02bedbb56e41b25a6d248d566d4f4bc224bae2b1e982df00ed04ba9219"},
-+  "mail": {:hex, :mail, "0.3.1", "cb0a14e4ed8904e4e5a08214e686ccf6f9099346885db17d8c309381f865cc5c", [:mix], [], "hexpm", "1db701e89865c1d5fa296b2b57b1cd587587cca8d8a1a22892b35ef5a8e352a6"},
-   "metrics": {:hex, :metrics, "1.0.1", "25f094dea2cda98213cecc3aeff09e940299d950904393b2a29d191c346a8486", [:rebar3], [], "hexpm", "69b09adddc4f74a40716ae54d140f93beb0fb8978d8636eaded0c31b6f099f16"},
-   "mime": {:hex, :mime, "2.0.6", "8f18486773d9b15f95f4f4f1e39b710045fa1de891fada4516559967276e4dc2", [:mix], [], "hexpm", "c9945363a6b26d747389aac3643f8e0e09d30499a138ad64fe8fd1d13d9b153e"},
-   "mimerl": {:hex, :mimerl, "1.3.0", "d0cd9fc04b9061f82490f6581e0128379830e78535e017f7780f37fea7545726", [:rebar3], [], "hexpm", "a1e15a50d1887217de95f0b9b0793e32853f7c258a5cd227650889b38839fe9d"},
-   "mint": {:hex, :mint, "1.6.2", "af6d97a4051eee4f05b5500671d47c3a67dac7386045d87a904126fd4bbcea2e", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "5ee441dffc1892f1ae59127f74afe8fd82fda6587794278d924e4d90ea3d63f9"},
-   "mix_audit": {:hex, :mix_audit, "2.1.4", "0a23d5b07350cdd69001c13882a4f5fb9f90fbd4cbf2ebc190a2ee0d187ea3e9", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "fd807653cc8c1cada2911129c7eb9e985e3cc76ebf26f4dd628bb25bbcaa7099"},
-+  "mua": {:hex, :mua, "0.2.4", "a9172ab0a1ac8732cf2699d739ceac3febcb9b4ffc540260ad2e32c0b6632af9", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}], "hexpm", "e7e4dacd5ad65f13e3542772e74a159c00bd2d5579e729e9bb72d2c73a266fb7"},
-   "multipart": {:hex, :multipart, "0.4.0", "634880a2148d4555d050963373d0e3bbb44a55b2badd87fa8623166172e9cda0", [:mix], [{:mime, "~> 1.2 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}], "hexpm", "3c5604bc2fb17b3137e5d2abdf5dacc2647e60c5cc6634b102cf1aef75a06f0a"},
-   "nimble_csv": {:hex, :nimble_csv, "1.2.0", "4e26385d260c61eba9d4412c71cea34421f296d5353f914afe3f2e71cce97722", [:mix], [], "hexpm", "d0628117fcc2148178b034044c55359b26966c6eaa8e2ce15777be3bbc91b12a"},
-   "nimble_options": {:hex, :nimble_options, "1.1.1", "e3a492d54d85fc3fd7c5baf411d9d2852922f66e69476317787a7b2bb000a61b", [:mix], [], "hexpm", "821b2470ca9442c4b6984882fe9bb0389371b8ddec4d45a9504f00a66f650b44"},
diff --git a/pkgs/firezone-server-domain/generic.nix b/pkgs/firezone-server-domain/generic.nix
deleted file mode 100644
index 7987334..0000000
--- a/pkgs/firezone-server-domain/generic.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  mixReleaseName, # "domain" "web" or "api"
-}:
-{
-  lib,
-  nixosTests,
-  fetchFromGitHub,
-  beamPackages,
-  pnpm_9,
-  nodejs,
-  tailwindcss,
-  esbuild,
-}:
-
-beamPackages.mixRelease rec {
-  pname = "firezone-server-${mixReleaseName}";
-  version = "unstable-2025-01-19";
-
-  src = "${
-    fetchFromGitHub {
-      owner = "firezone";
-      repo = "firezone";
-      rev = "8c9427b7b133e5050be34c2ac0e831c12c08f02c";
-      hash = "sha256-yccplADHRJQQiKrmHcJ5rvouswHrbx4K6ysnIAoZJR0=";
-    }
-  }/elixir";
-  patches = [
-    ./0000-add-healthz-port.patch
-    ./0001-postgres-socket.patch
-    ./0002-add-mua.patch
-  ];
-
-  pnpmDeps = pnpm_9.fetchDeps {
-    inherit pname version;
-    src = "${src}/apps/web/assets";
-    hash = "sha256-6rhhGv3jQY5MkOMNe1GEtNyrzJYXCSzvo8RLlKelP10=";
-  };
-  pnpmRoot = "apps/web/assets";
-
-  preBuild = ''
-    cat >> config/config.exs <<EOF
-    config :tailwind, path: "${lib.getExe tailwindcss}"
-    config :esbuild, path: "${lib.getExe esbuild}"
-    EOF
-
-    cat >> config/runtime.exs <<EOF
-    config :tzdata, :data_dir, System.get_env("TZDATA_DIR")
-    EOF
-  '';
-
-  postBuild = ''
-    pushd apps/web
-    # for external task you need a workaround for the no deps check flag
-    # https://github.com/phoenixframework/phoenix/issues/2690
-    mix do deps.loadpaths --no-deps-check, assets.deploy
-    mix do deps.loadpaths --no-deps-check, phx.digest priv/static
-    popd
-  '';
-
-  nativeBuildInputs = [
-    pnpm_9
-    pnpm_9.configHook
-    nodejs
-  ];
-
-  inherit mixReleaseName;
-
-  # https://github.com/elixir-cldr/cldr_numbers/pull/52
-  mixNixDeps = import ./mix.nix {
-    inherit lib beamPackages;
-    overrides =
-      final: prev:
-      (lib.mapAttrs (
-        _: value:
-        value.override {
-          appConfigPath = src + "/config";
-        }
-      ) prev)
-      // {
-        ex_cldr_numbers = beamPackages.buildMix rec {
-          name = "ex_cldr_numbers";
-          version = "2.33.4";
-
-          src = beamPackages.fetchHex {
-            pkg = "ex_cldr_numbers";
-            version = "${version}";
-            sha256 = "sha256-0Vt+IX6eYMMo5zBF5R3GfXrF0plyR7gz76ssabLtBvU=";
-          };
-
-          beamDeps = [
-            final.decimal
-            final.digital_token
-            final.ex_cldr
-            final.ex_cldr_currencies
-            final.jason
-          ];
-        };
-
-        # mix2nix does not support git dependencies yet,
-        # so we need to add them manually
-        openid_connect = beamPackages.buildMix {
-          name = "openid_connect";
-          version = "2024-06-15-unstable";
-
-          src = fetchFromGitHub {
-            owner = "firezone";
-            repo = "openid_connect";
-            rev = "e4d9dca8ae43c765c00a7d3dfa12d6f24f5b3418";
-            hash = "sha256-LMmG+WWs83Hw/jcrersUMpk2tdXxkOU0CTe7qVbk6GQ=";
-          };
-          beamDeps = [
-            final.jason
-            final.finch
-            final.jose
-          ];
-        };
-      };
-  };
-
-  passthru.tests = {
-    inherit (nixosTests) firezone;
-  };
-
-  meta = {
-    description = "Backend server for the Firezone zero-trust access platform";
-    homepage = "https://github.com/firezone/firezone";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      oddlama
-      patrickdag
-    ];
-    mainProgram = mixReleaseName;
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/firezone-server-domain/mix.nix b/pkgs/firezone-server-domain/mix.nix
deleted file mode 100644
index 46f741a..0000000
--- a/pkgs/firezone-server-domain/mix.nix
+++ /dev/null
@@ -1,1765 +0,0 @@
-{
-  lib,
-  beamPackages,
-  overrides ? (_x: _y: { }),
-}:
-
-let
-  buildRebar3 = lib.makeOverridable beamPackages.buildRebar3;
-  buildMix = lib.makeOverridable beamPackages.buildMix;
-  buildErlangMk = lib.makeOverridable beamPackages.buildErlangMk;
-
-  self = packages // (overrides self packages);
-
-  packages =
-    with beamPackages;
-    with self;
-    {
-      acceptor_pool = buildRebar3 rec {
-        name = "acceptor_pool";
-        version = "1.0.0";
-
-        src = fetchHex {
-          pkg = "acceptor_pool";
-          version = "${version}";
-          sha256 = "0cbcd83fdc8b9ad2eee2067ef8b91a14858a5883cb7cd800e6fcd5803e158788";
-        };
-
-        beamDeps = [ ];
-      };
-
-      argon2_elixir = buildMix rec {
-        name = "argon2_elixir";
-        version = "4.0.0";
-
-        src = fetchHex {
-          pkg = "argon2_elixir";
-          version = "${version}";
-          sha256 = "f9da27cf060c9ea61b1bd47837a28d7e48a8f6fa13a745e252556c14f9132c7f";
-        };
-
-        beamDeps = [
-          comeonin
-          elixir_make
-        ];
-      };
-
-      bandit = buildMix rec {
-        name = "bandit";
-        version = "1.5.7";
-
-        src = fetchHex {
-          pkg = "bandit";
-          version = "${version}";
-          sha256 = "f2dd92ae87d2cbea2fa9aa1652db157b6cba6c405cb44d4f6dd87abba41371cd";
-        };
-
-        beamDeps = [
-          hpax
-          plug
-          telemetry
-          thousand_island
-          websock
-        ];
-      };
-
-      bunt = buildMix rec {
-        name = "bunt";
-        version = "1.0.0";
-
-        src = fetchHex {
-          pkg = "bunt";
-          version = "${version}";
-          sha256 = "dc5f86aa08a5f6fa6b8096f0735c4e76d54ae5c9fa2c143e5a1fc7c1cd9bb6b5";
-        };
-
-        beamDeps = [ ];
-      };
-
-      bureaucrat = buildMix rec {
-        name = "bureaucrat";
-        version = "0.2.10";
-
-        src = fetchHex {
-          pkg = "bureaucrat";
-          version = "${version}";
-          sha256 = "bc7e5162b911c29c8ebefee87a2c16fbf13821a58f448a8fd024eb6c17fae15c";
-        };
-
-        beamDeps = [
-          inflex
-          phoenix
-          plug
-        ];
-      };
-
-      bypass = buildMix rec {
-        name = "bypass";
-        version = "2.1.0";
-
-        src = fetchHex {
-          pkg = "bypass";
-          version = "${version}";
-          sha256 = "d9b5df8fa5b7a6efa08384e9bbecfe4ce61c77d28a4282f79e02f1ef78d96b80";
-        };
-
-        beamDeps = [
-          plug
-          plug_cowboy
-          ranch
-        ];
-      };
-
-      castore = buildMix rec {
-        name = "castore";
-        version = "1.0.8";
-
-        src = fetchHex {
-          pkg = "castore";
-          version = "${version}";
-          sha256 = "0b2b66d2ee742cb1d9cb8c8be3b43c3a70ee8651f37b75a8b982e036752983f1";
-        };
-
-        beamDeps = [ ];
-      };
-
-      certifi = buildRebar3 rec {
-        name = "certifi";
-        version = "2.12.0";
-
-        src = fetchHex {
-          pkg = "certifi";
-          version = "${version}";
-          sha256 = "ee68d85df22e554040cdb4be100f33873ac6051387baf6a8f6ce82272340ff1c";
-        };
-
-        beamDeps = [ ];
-      };
-
-      chatterbox = buildRebar3 rec {
-        name = "chatterbox";
-        version = "0.15.1";
-
-        src = fetchHex {
-          pkg = "ts_chatterbox";
-          version = "${version}";
-          sha256 = "4f75b91451338bc0da5f52f3480fa6ef6e3a2aeecfc33686d6b3d0a0948f31aa";
-        };
-
-        beamDeps = [ hpack ];
-      };
-
-      cldr_utils = buildMix rec {
-        name = "cldr_utils";
-        version = "2.28.2";
-
-        src = fetchHex {
-          pkg = "cldr_utils";
-          version = "${version}";
-          sha256 = "c506eb1a170ba7cdca59b304ba02a56795ed119856662f6b1a420af80ec42551";
-        };
-
-        beamDeps = [
-          castore
-          certifi
-          decimal
-        ];
-      };
-
-      combine = buildMix rec {
-        name = "combine";
-        version = "0.10.0";
-
-        src = fetchHex {
-          pkg = "combine";
-          version = "${version}";
-          sha256 = "1b1dbc1790073076580d0d1d64e42eae2366583e7aecd455d1215b0d16f2451b";
-        };
-
-        beamDeps = [ ];
-      };
-
-      comeonin = buildMix rec {
-        name = "comeonin";
-        version = "5.4.0";
-
-        src = fetchHex {
-          pkg = "comeonin";
-          version = "${version}";
-          sha256 = "796393a9e50d01999d56b7b8420ab0481a7538d0caf80919da493b4a6e51faf1";
-        };
-
-        beamDeps = [ ];
-      };
-
-      cowboy = buildErlangMk rec {
-        name = "cowboy";
-        version = "2.12.0";
-
-        src = fetchHex {
-          pkg = "cowboy";
-          version = "${version}";
-          sha256 = "8a7abe6d183372ceb21caa2709bec928ab2b72e18a3911aa1771639bef82651e";
-        };
-
-        beamDeps = [
-          cowlib
-          ranch
-        ];
-      };
-
-      cowboy_telemetry = buildRebar3 rec {
-        name = "cowboy_telemetry";
-        version = "0.4.0";
-
-        src = fetchHex {
-          pkg = "cowboy_telemetry";
-          version = "${version}";
-          sha256 = "7d98bac1ee4565d31b62d59f8823dfd8356a169e7fcbb83831b8a5397404c9de";
-        };
-
-        beamDeps = [
-          cowboy
-          telemetry
-        ];
-      };
-
-      cowlib = buildRebar3 rec {
-        name = "cowlib";
-        version = "2.13.0";
-
-        src = fetchHex {
-          pkg = "cowlib";
-          version = "${version}";
-          sha256 = "e1e1284dc3fc030a64b1ad0d8382ae7e99da46c3246b815318a4b848873800a4";
-        };
-
-        beamDeps = [ ];
-      };
-
-      credo = buildMix rec {
-        name = "credo";
-        version = "1.7.7";
-
-        src = fetchHex {
-          pkg = "credo";
-          version = "${version}";
-          sha256 = "8bc87496c9aaacdc3f90f01b7b0582467b69b4bd2441fe8aae3109d843cc2f2e";
-        };
-
-        beamDeps = [
-          bunt
-          file_system
-          jason
-        ];
-      };
-
-      ctx = buildRebar3 rec {
-        name = "ctx";
-        version = "0.6.0";
-
-        src = fetchHex {
-          pkg = "ctx";
-          version = "${version}";
-          sha256 = "a14ed2d1b67723dbebbe423b28d7615eb0bdcba6ff28f2d1f1b0a7e1d4aa5fc2";
-        };
-
-        beamDeps = [ ];
-      };
-
-      db_connection = buildMix rec {
-        name = "db_connection";
-        version = "2.7.0";
-
-        src = fetchHex {
-          pkg = "db_connection";
-          version = "${version}";
-          sha256 = "dcf08f31b2701f857dfc787fbad78223d61a32204f217f15e881dd93e4bdd3ff";
-        };
-
-        beamDeps = [ telemetry ];
-      };
-
-      decimal = buildMix rec {
-        name = "decimal";
-        version = "2.3.0";
-
-        src = fetchHex {
-          pkg = "decimal";
-          version = "${version}";
-          sha256 = "a4d66355cb29cb47c3cf30e71329e58361cfcb37c34235ef3bf1d7bf3773aeac";
-        };
-
-        beamDeps = [ ];
-      };
-
-      dialyxir = buildMix rec {
-        name = "dialyxir";
-        version = "1.4.5";
-
-        src = fetchHex {
-          pkg = "dialyxir";
-          version = "${version}";
-          sha256 = "b0fb08bb8107c750db5c0b324fa2df5ceaa0f9307690ee3c1f6ba5b9eb5d35c3";
-        };
-
-        beamDeps = [ erlex ];
-      };
-
-      digital_token = buildMix rec {
-        name = "digital_token";
-        version = "1.0.0";
-
-        src = fetchHex {
-          pkg = "digital_token";
-          version = "${version}";
-          sha256 = "8ed6f5a8c2fa7b07147b9963db506a1b4c7475d9afca6492136535b064c9e9e6";
-        };
-
-        beamDeps = [
-          cldr_utils
-          jason
-        ];
-      };
-
-      ecto = buildMix rec {
-        name = "ecto";
-        version = "3.12.5";
-
-        src = fetchHex {
-          pkg = "ecto";
-          version = "${version}";
-          sha256 = "6eb18e80bef8bb57e17f5a7f068a1719fbda384d40fc37acb8eb8aeca493b6ea";
-        };
-
-        beamDeps = [
-          decimal
-          jason
-          telemetry
-        ];
-      };
-
-      ecto_sql = buildMix rec {
-        name = "ecto_sql";
-        version = "3.12.0";
-
-        src = fetchHex {
-          pkg = "ecto_sql";
-          version = "${version}";
-          sha256 = "dc9e4d206f274f3947e96142a8fdc5f69a2a6a9abb4649ef5c882323b6d512f0";
-        };
-
-        beamDeps = [
-          db_connection
-          ecto
-          postgrex
-          telemetry
-        ];
-      };
-
-      elixir_make = buildMix rec {
-        name = "elixir_make";
-        version = "0.8.4";
-
-        src = fetchHex {
-          pkg = "elixir_make";
-          version = "${version}";
-          sha256 = "6e7f1d619b5f61dfabd0a20aa268e575572b542ac31723293a4c1a567d5ef040";
-        };
-
-        beamDeps = [
-          castore
-          certifi
-        ];
-      };
-
-      erlex = buildMix rec {
-        name = "erlex";
-        version = "0.2.7";
-
-        src = fetchHex {
-          pkg = "erlex";
-          version = "${version}";
-          sha256 = "3ed95f79d1a844c3f6bf0cea61e0d5612a42ce56da9c03f01df538685365efb0";
-        };
-
-        beamDeps = [ ];
-      };
-
-      esbuild = buildMix rec {
-        name = "esbuild";
-        version = "0.8.1";
-
-        src = fetchHex {
-          pkg = "esbuild";
-          version = "${version}";
-          sha256 = "25fc876a67c13cb0a776e7b5d7974851556baeda2085296c14ab48555ea7560f";
-        };
-
-        beamDeps = [
-          castore
-          jason
-        ];
-      };
-
-      ex_cldr = buildMix rec {
-        name = "ex_cldr";
-        version = "2.40.1";
-
-        src = fetchHex {
-          pkg = "ex_cldr";
-          version = "${version}";
-          sha256 = "509810702e8e81991851d9426ffe6b34b48b7b9baa12922e7b3fb8f6368606f3";
-        };
-
-        beamDeps = [
-          cldr_utils
-          decimal
-          gettext
-          jason
-        ];
-      };
-
-      ex_cldr_calendars = buildMix rec {
-        name = "ex_cldr_calendars";
-        version = "1.26.2";
-
-        src = fetchHex {
-          pkg = "ex_cldr_calendars";
-          version = "${version}";
-          sha256 = "b689847f3fbbd145954a9205e19b1e4850a79c2a27cdae1c7912b9b262a8ef35";
-        };
-
-        beamDeps = [
-          ex_cldr_numbers
-          jason
-        ];
-      };
-
-      ex_cldr_currencies = buildMix rec {
-        name = "ex_cldr_currencies";
-        version = "2.16.3";
-
-        src = fetchHex {
-          pkg = "ex_cldr_currencies";
-          version = "${version}";
-          sha256 = "4d1b5f8449fdf0ece6a2e5c7401ad8fcfde77ee6ea480bddc16e266dfa2b570c";
-        };
-
-        beamDeps = [
-          ex_cldr
-          jason
-        ];
-      };
-
-      ex_cldr_dates_times = buildMix rec {
-        name = "ex_cldr_dates_times";
-        version = "2.20.3";
-
-        src = fetchHex {
-          pkg = "ex_cldr_dates_times";
-          version = "${version}";
-          sha256 = "52fe1493f44d2420d4af80dbafb65c89bfd17f0758a98c4ad61182518bb6e5a1";
-        };
-
-        beamDeps = [
-          ex_cldr
-          ex_cldr_calendars
-          jason
-        ];
-      };
-
-      ex_cldr_numbers = buildMix rec {
-        name = "ex_cldr_numbers";
-        version = "2.33.3";
-
-        src = fetchHex {
-          pkg = "ex_cldr_numbers";
-          version = "${version}";
-          sha256 = "4a0d90d06710c1499528d5f536c539379a73a68d4679c55375198a798d138442";
-        };
-
-        beamDeps = [
-          decimal
-          digital_token
-          ex_cldr
-          ex_cldr_currencies
-          jason
-        ];
-      };
-
-      expo = buildMix rec {
-        name = "expo";
-        version = "1.1.0";
-
-        src = fetchHex {
-          pkg = "expo";
-          version = "${version}";
-          sha256 = "fbadf93f4700fb44c331362177bdca9eeb8097e8b0ef525c9cc501cb9917c960";
-        };
-
-        beamDeps = [ ];
-      };
-
-      file_size = buildMix rec {
-        name = "file_size";
-        version = "3.0.1";
-
-        src = fetchHex {
-          pkg = "file_size";
-          version = "${version}";
-          sha256 = "64dd665bc37920480c249785788265f5d42e98830d757c6a477b3246703b8e20";
-        };
-
-        beamDeps = [
-          decimal
-          number
-        ];
-      };
-
-      file_system = buildMix rec {
-        name = "file_system";
-        version = "1.0.1";
-
-        src = fetchHex {
-          pkg = "file_system";
-          version = "${version}";
-          sha256 = "4414d1f38863ddf9120720cd976fce5bdde8e91d8283353f0e31850fa89feb9e";
-        };
-
-        beamDeps = [ ];
-      };
-
-      finch = buildMix rec {
-        name = "finch";
-        version = "0.19.0";
-
-        src = fetchHex {
-          pkg = "finch";
-          version = "${version}";
-          sha256 = "fc5324ce209125d1e2fa0fcd2634601c52a787aff1cd33ee833664a5af4ea2b6";
-        };
-
-        beamDeps = [
-          mime
-          mint
-          nimble_options
-          nimble_pool
-          telemetry
-        ];
-      };
-
-      floki = buildMix rec {
-        name = "floki";
-        version = "0.37.0";
-
-        src = fetchHex {
-          pkg = "floki";
-          version = "${version}";
-          sha256 = "516a0c15a69f78c47dc8e0b9b3724b29608aa6619379f91b1ffa47109b5d0dd3";
-        };
-
-        beamDeps = [ ];
-      };
-
-      gen_smtp = buildRebar3 rec {
-        name = "gen_smtp";
-        version = "1.2.0";
-
-        src = fetchHex {
-          pkg = "gen_smtp";
-          version = "${version}";
-          sha256 = "5ee0375680bca8f20c4d85f58c2894441443a743355430ff33a783fe03296779";
-        };
-
-        beamDeps = [ ranch ];
-      };
-
-      gettext = buildMix rec {
-        name = "gettext";
-        version = "0.26.1";
-
-        src = fetchHex {
-          pkg = "gettext";
-          version = "${version}";
-          sha256 = "01ce56f188b9dc28780a52783d6529ad2bc7124f9744e571e1ee4ea88bf08734";
-        };
-
-        beamDeps = [ expo ];
-      };
-
-      gproc = buildRebar3 rec {
-        name = "gproc";
-        version = "0.9.1";
-
-        src = fetchHex {
-          pkg = "gproc";
-          version = "${version}";
-          sha256 = "905088e32e72127ed9466f0bac0d8e65704ca5e73ee5a62cb073c3117916d507";
-        };
-
-        beamDeps = [ ];
-      };
-
-      grpcbox = buildRebar3 rec {
-        name = "grpcbox";
-        version = "0.17.1";
-
-        src = fetchHex {
-          pkg = "grpcbox";
-          version = "${version}";
-          sha256 = "4a3b5d7111daabc569dc9cbd9b202a3237d81c80bf97212fbc676832cb0ceb17";
-        };
-
-        beamDeps = [
-          acceptor_pool
-          chatterbox
-          ctx
-          gproc
-        ];
-      };
-
-      hackney = buildRebar3 rec {
-        name = "hackney";
-        version = "1.20.1";
-
-        src = fetchHex {
-          pkg = "hackney";
-          version = "${version}";
-          sha256 = "fe9094e5f1a2a2c0a7d10918fee36bfec0ec2a979994cff8cfe8058cd9af38e3";
-        };
-
-        beamDeps = [
-          certifi
-          idna
-          metrics
-          mimerl
-          parse_trans
-          ssl_verify_fun
-          unicode_util_compat
-        ];
-      };
-
-      hpack = buildRebar3 rec {
-        name = "hpack";
-        version = "0.3.0";
-
-        src = fetchHex {
-          pkg = "hpack_erl";
-          version = "${version}";
-          sha256 = "d6137d7079169d8c485c6962dfe261af5b9ef60fbc557344511c1e65e3d95fb0";
-        };
-
-        beamDeps = [ ];
-      };
-
-      hpax = buildMix rec {
-        name = "hpax";
-        version = "1.0.0";
-
-        src = fetchHex {
-          pkg = "hpax";
-          version = "${version}";
-          sha256 = "7f1314731d711e2ca5fdc7fd361296593fc2542570b3105595bb0bc6d0fad601";
-        };
-
-        beamDeps = [ ];
-      };
-
-      httpoison = buildMix rec {
-        name = "httpoison";
-        version = "2.2.1";
-
-        src = fetchHex {
-          pkg = "httpoison";
-          version = "${version}";
-          sha256 = "51364e6d2f429d80e14fe4b5f8e39719cacd03eb3f9a9286e61e216feac2d2df";
-        };
-
-        beamDeps = [ hackney ];
-      };
-
-      idna = buildRebar3 rec {
-        name = "idna";
-        version = "6.1.1";
-
-        src = fetchHex {
-          pkg = "idna";
-          version = "${version}";
-          sha256 = "92376eb7894412ed19ac475e4a86f7b413c1b9fbb5bd16dccd57934157944cea";
-        };
-
-        beamDeps = [ unicode_util_compat ];
-      };
-
-      inflex = buildMix rec {
-        name = "inflex";
-        version = "2.1.0";
-
-        src = fetchHex {
-          pkg = "inflex";
-          version = "${version}";
-          sha256 = "14c17d05db4ee9b6d319b0bff1bdf22aa389a25398d1952c7a0b5f3d93162dd8";
-        };
-
-        beamDeps = [ ];
-      };
-
-      jason = buildMix rec {
-        name = "jason";
-        version = "1.4.4";
-
-        src = fetchHex {
-          pkg = "jason";
-          version = "${version}";
-          sha256 = "c5eb0cab91f094599f94d55bc63409236a8ec69a21a67814529e8d5f6cc90b3b";
-        };
-
-        beamDeps = [ decimal ];
-      };
-
-      jose = buildMix rec {
-        name = "jose";
-        version = "1.11.10";
-
-        src = fetchHex {
-          pkg = "jose";
-          version = "${version}";
-          sha256 = "0d6cd36ff8ba174db29148fc112b5842186b68a90ce9fc2b3ec3afe76593e614";
-        };
-
-        beamDeps = [ ];
-      };
-
-      junit_formatter = buildMix rec {
-        name = "junit_formatter";
-        version = "3.4.0";
-
-        src = fetchHex {
-          pkg = "junit_formatter";
-          version = "${version}";
-          sha256 = "bb36e2ae83f1ced6ab931c4ce51dd3dbef1ef61bb4932412e173b0cfa259dacd";
-        };
-
-        beamDeps = [ ];
-      };
-
-      libcluster = buildMix rec {
-        name = "libcluster";
-        version = "3.3.3";
-
-        src = fetchHex {
-          pkg = "libcluster";
-          version = "${version}";
-          sha256 = "7c0a2275a0bb83c07acd17dab3c3bfb4897b145106750eeccc62d302e3bdfee5";
-        };
-
-        beamDeps = [ jason ];
-      };
-
-      logger_json = buildMix rec {
-        name = "logger_json";
-        version = "6.2.0";
-
-        src = fetchHex {
-          pkg = "logger_json";
-          version = "${version}";
-          sha256 = "98366d02bedbb56e41b25a6d248d566d4f4bc224bae2b1e982df00ed04ba9219";
-        };
-
-        beamDeps = [
-          ecto
-          jason
-          plug
-          telemetry
-        ];
-      };
-
-      mail = buildMix rec {
-        name = "mail";
-        version = "0.3.1";
-
-        src = fetchHex {
-          pkg = "mail";
-          version = "${version}";
-          sha256 = "1db701e89865c1d5fa296b2b57b1cd587587cca8d8a1a22892b35ef5a8e352a6";
-        };
-
-        beamDeps = [ ];
-      };
-
-      metrics = buildRebar3 rec {
-        name = "metrics";
-        version = "1.0.1";
-
-        src = fetchHex {
-          pkg = "metrics";
-          version = "${version}";
-          sha256 = "69b09adddc4f74a40716ae54d140f93beb0fb8978d8636eaded0c31b6f099f16";
-        };
-
-        beamDeps = [ ];
-      };
-
-      mime = buildMix rec {
-        name = "mime";
-        version = "2.0.6";
-
-        src = fetchHex {
-          pkg = "mime";
-          version = "${version}";
-          sha256 = "c9945363a6b26d747389aac3643f8e0e09d30499a138ad64fe8fd1d13d9b153e";
-        };
-
-        beamDeps = [ ];
-      };
-
-      mimerl = buildRebar3 rec {
-        name = "mimerl";
-        version = "1.3.0";
-
-        src = fetchHex {
-          pkg = "mimerl";
-          version = "${version}";
-          sha256 = "a1e15a50d1887217de95f0b9b0793e32853f7c258a5cd227650889b38839fe9d";
-        };
-
-        beamDeps = [ ];
-      };
-
-      mint = buildMix rec {
-        name = "mint";
-        version = "1.6.2";
-
-        src = fetchHex {
-          pkg = "mint";
-          version = "${version}";
-          sha256 = "5ee441dffc1892f1ae59127f74afe8fd82fda6587794278d924e4d90ea3d63f9";
-        };
-
-        beamDeps = [
-          castore
-          hpax
-        ];
-      };
-
-      mix_audit = buildMix rec {
-        name = "mix_audit";
-        version = "2.1.4";
-
-        src = fetchHex {
-          pkg = "mix_audit";
-          version = "${version}";
-          sha256 = "fd807653cc8c1cada2911129c7eb9e985e3cc76ebf26f4dd628bb25bbcaa7099";
-        };
-
-        beamDeps = [
-          jason
-          yaml_elixir
-        ];
-      };
-
-      mua = buildMix rec {
-        name = "mua";
-        version = "0.2.4";
-
-        src = fetchHex {
-          pkg = "mua";
-          version = "${version}";
-          sha256 = "e7e4dacd5ad65f13e3542772e74a159c00bd2d5579e729e9bb72d2c73a266fb7";
-        };
-
-        beamDeps = [ castore ];
-      };
-
-      multipart = buildMix rec {
-        name = "multipart";
-        version = "0.4.0";
-
-        src = fetchHex {
-          pkg = "multipart";
-          version = "${version}";
-          sha256 = "3c5604bc2fb17b3137e5d2abdf5dacc2647e60c5cc6634b102cf1aef75a06f0a";
-        };
-
-        beamDeps = [ mime ];
-      };
-
-      nimble_csv = buildMix rec {
-        name = "nimble_csv";
-        version = "1.2.0";
-
-        src = fetchHex {
-          pkg = "nimble_csv";
-          version = "${version}";
-          sha256 = "d0628117fcc2148178b034044c55359b26966c6eaa8e2ce15777be3bbc91b12a";
-        };
-
-        beamDeps = [ ];
-      };
-
-      nimble_options = buildMix rec {
-        name = "nimble_options";
-        version = "1.1.1";
-
-        src = fetchHex {
-          pkg = "nimble_options";
-          version = "${version}";
-          sha256 = "821b2470ca9442c4b6984882fe9bb0389371b8ddec4d45a9504f00a66f650b44";
-        };
-
-        beamDeps = [ ];
-      };
-
-      nimble_pool = buildMix rec {
-        name = "nimble_pool";
-        version = "1.1.0";
-
-        src = fetchHex {
-          pkg = "nimble_pool";
-          version = "${version}";
-          sha256 = "af2e4e6b34197db81f7aad230c1118eac993acc0dae6bc83bac0126d4ae0813a";
-        };
-
-        beamDeps = [ ];
-      };
-
-      number = buildMix rec {
-        name = "number";
-        version = "1.0.5";
-
-        src = fetchHex {
-          pkg = "number";
-          version = "${version}";
-          sha256 = "c0733a0a90773a66582b9e92a3f01290987f395c972cb7d685f51dd927cd5169";
-        };
-
-        beamDeps = [ decimal ];
-      };
-
-      observer_cli = buildMix rec {
-        name = "observer_cli";
-        version = "1.7.5";
-
-        src = fetchHex {
-          pkg = "observer_cli";
-          version = "${version}";
-          sha256 = "872cf8e833a3a71ebd05420692678ec8aaede8fd96c805a4687398f6b23a3014";
-        };
-
-        beamDeps = [ recon ];
-      };
-
-      open_api_spex = buildMix rec {
-        name = "open_api_spex";
-        version = "3.21.2";
-
-        src = fetchHex {
-          pkg = "open_api_spex";
-          version = "${version}";
-          sha256 = "f42ae6ed668b895ebba3e02773cfb4b41050df26f803f2ef634c72a7687dc387";
-        };
-
-        beamDeps = [
-          decimal
-          jason
-          plug
-          ymlr
-        ];
-      };
-
-      opentelemetry = buildRebar3 rec {
-        name = "opentelemetry";
-        version = "1.5.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry";
-          version = "${version}";
-          sha256 = "cdf4f51d17b592fc592b9a75f86a6f808c23044ba7cf7b9534debbcc5c23b0ee";
-        };
-
-        beamDeps = [ opentelemetry_api ];
-      };
-
-      opentelemetry_api = buildMix rec {
-        name = "opentelemetry_api";
-        version = "1.4.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_api";
-          version = "${version}";
-          sha256 = "3dfbbfaa2c2ed3121c5c483162836c4f9027def469c41578af5ef32589fcfc58";
-        };
-
-        beamDeps = [ ];
-      };
-
-      opentelemetry_cowboy = buildRebar3 rec {
-        name = "opentelemetry_cowboy";
-        version = "1.0.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_cowboy";
-          version = "${version}";
-          sha256 = "7575716eaccacd0eddc3e7e61403aecb5d0a6397183987d6049094aeb0b87a7c";
-        };
-
-        beamDeps = [
-          cowboy_telemetry
-          opentelemetry_api
-          opentelemetry_semantic_conventions
-          opentelemetry_telemetry
-          otel_http
-          telemetry
-        ];
-      };
-
-      opentelemetry_ecto = buildMix rec {
-        name = "opentelemetry_ecto";
-        version = "1.2.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_ecto";
-          version = "${version}";
-          sha256 = "70dfa2e79932e86f209df00e36c980b17a32f82d175f0068bf7ef9a96cf080cf";
-        };
-
-        beamDeps = [
-          opentelemetry_api
-          opentelemetry_process_propagator
-          telemetry
-        ];
-      };
-
-      opentelemetry_exporter = buildRebar3 rec {
-        name = "opentelemetry_exporter";
-        version = "1.8.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_exporter";
-          version = "${version}";
-          sha256 = "a1f9f271f8d3b02b81462a6bfef7075fd8457fdb06adff5d2537df5e2264d9af";
-        };
-
-        beamDeps = [
-          grpcbox
-          opentelemetry
-          opentelemetry_api
-          tls_certificate_check
-        ];
-      };
-
-      opentelemetry_finch = buildMix rec {
-        name = "opentelemetry_finch";
-        version = "0.2.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_finch";
-          version = "${version}";
-          sha256 = "7364f70822ec282853cade12953f40d7b94e03967608a52fd406e3b080f18d5e";
-        };
-
-        beamDeps = [
-          opentelemetry_api
-          telemetry
-        ];
-      };
-
-      opentelemetry_liveview = buildMix rec {
-        name = "opentelemetry_liveview";
-        version = "1.0.0-rc.4";
-
-        src = fetchHex {
-          pkg = "opentelemetry_liveview";
-          version = "${version}";
-          sha256 = "e06ab69da7ee46158342cac42f1c22886bdeab53e8d8c4e237c3b3c2cf7b815d";
-        };
-
-        beamDeps = [
-          opentelemetry_api
-          opentelemetry_telemetry
-          telemetry
-        ];
-      };
-
-      opentelemetry_logger_metadata = buildMix rec {
-        name = "opentelemetry_logger_metadata";
-        version = "0.1.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_logger_metadata";
-          version = "${version}";
-          sha256 = "772976d3c59651cf9c4600edc238bb9cadf7f5edaed1a1c5c59bf3e773dfe9fc";
-        };
-
-        beamDeps = [ opentelemetry_api ];
-      };
-
-      opentelemetry_phoenix = buildMix rec {
-        name = "opentelemetry_phoenix";
-        version = "2.0.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_phoenix";
-          version = "${version}";
-          sha256 = "c2c0969c561a87703cda64e9f0c37e9dec6dceee11c2d2eafef8d3f4138ec364";
-        };
-
-        beamDeps = [
-          nimble_options
-          opentelemetry_api
-          opentelemetry_process_propagator
-          opentelemetry_semantic_conventions
-          opentelemetry_telemetry
-          otel_http
-          plug
-          telemetry
-        ];
-      };
-
-      opentelemetry_process_propagator = buildMix rec {
-        name = "opentelemetry_process_propagator";
-        version = "0.3.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_process_propagator";
-          version = "${version}";
-          sha256 = "7243cb6de1523c473cba5b1aefa3f85e1ff8cc75d08f367104c1e11919c8c029";
-        };
-
-        beamDeps = [ opentelemetry_api ];
-      };
-
-      opentelemetry_semantic_conventions = buildMix rec {
-        name = "opentelemetry_semantic_conventions";
-        version = "1.27.0";
-
-        src = fetchHex {
-          pkg = "opentelemetry_semantic_conventions";
-          version = "${version}";
-          sha256 = "9681ccaa24fd3d810b4461581717661fd85ff7019b082c2dff89c7d5b1fc2864";
-        };
-
-        beamDeps = [ ];
-      };
-
-      opentelemetry_telemetry = buildMix rec {
-        name = "opentelemetry_telemetry";
-        version = "1.1.2";
-
-        src = fetchHex {
-          pkg = "opentelemetry_telemetry";
-          version = "${version}";
-          sha256 = "641ab469deb181957ac6d59bce6e1321d5fe2a56df444fc9c19afcad623ab253";
-        };
-
-        beamDeps = [
-          opentelemetry_api
-          telemetry
-        ];
-      };
-
-      otel_http = buildRebar3 rec {
-        name = "otel_http";
-        version = "0.2.0";
-
-        src = fetchHex {
-          pkg = "otel_http";
-          version = "${version}";
-          sha256 = "f2beadf922c8cfeb0965488dd736c95cc6ea8b9efce89466b3904d317d7cc717";
-        };
-
-        beamDeps = [ ];
-      };
-
-      parse_trans = buildRebar3 rec {
-        name = "parse_trans";
-        version = "3.4.1";
-
-        src = fetchHex {
-          pkg = "parse_trans";
-          version = "${version}";
-          sha256 = "620a406ce75dada827b82e453c19cf06776be266f5a67cff34e1ef2cbb60e49a";
-        };
-
-        beamDeps = [ ];
-      };
-
-      phoenix = buildMix rec {
-        name = "phoenix";
-        version = "1.7.14";
-
-        src = fetchHex {
-          pkg = "phoenix";
-          version = "${version}";
-          sha256 = "c7859bc56cc5dfef19ecfc240775dae358cbaa530231118a9e014df392ace61a";
-        };
-
-        beamDeps = [
-          castore
-          jason
-          phoenix_pubsub
-          phoenix_template
-          phoenix_view
-          plug
-          plug_cowboy
-          plug_crypto
-          telemetry
-          websock_adapter
-        ];
-      };
-
-      phoenix_ecto = buildMix rec {
-        name = "phoenix_ecto";
-        version = "4.6.3";
-
-        src = fetchHex {
-          pkg = "phoenix_ecto";
-          version = "${version}";
-          sha256 = "909502956916a657a197f94cc1206d9a65247538de8a5e186f7537c895d95764";
-        };
-
-        beamDeps = [
-          ecto
-          phoenix_html
-          plug
-          postgrex
-        ];
-      };
-
-      phoenix_html = buildMix rec {
-        name = "phoenix_html";
-        version = "4.2.0";
-
-        src = fetchHex {
-          pkg = "phoenix_html";
-          version = "${version}";
-          sha256 = "9713b3f238d07043583a94296cc4bbdceacd3b3a6c74667f4df13971e7866ec8";
-        };
-
-        beamDeps = [ ];
-      };
-
-      phoenix_live_reload = buildMix rec {
-        name = "phoenix_live_reload";
-        version = "1.5.3";
-
-        src = fetchHex {
-          pkg = "phoenix_live_reload";
-          version = "${version}";
-          sha256 = "b4ec9cd73cb01ff1bd1cac92e045d13e7030330b74164297d1aee3907b54803c";
-        };
-
-        beamDeps = [
-          file_system
-          phoenix
-        ];
-      };
-
-      phoenix_live_view = buildMix rec {
-        name = "phoenix_live_view";
-        version = "1.0.0-rc.6";
-
-        src = fetchHex {
-          pkg = "phoenix_live_view";
-          version = "${version}";
-          sha256 = "e56e4f1642a0b20edc2488cab30e5439595e0d8b5b259f76ef98b1c4e2e5b527";
-        };
-
-        beamDeps = [
-          floki
-          jason
-          phoenix
-          phoenix_html
-          phoenix_template
-          phoenix_view
-          plug
-          telemetry
-        ];
-      };
-
-      phoenix_pubsub = buildMix rec {
-        name = "phoenix_pubsub";
-        version = "2.1.3";
-
-        src = fetchHex {
-          pkg = "phoenix_pubsub";
-          version = "${version}";
-          sha256 = "bba06bc1dcfd8cb086759f0edc94a8ba2bc8896d5331a1e2c2902bf8e36ee502";
-        };
-
-        beamDeps = [ ];
-      };
-
-      phoenix_swoosh = buildMix rec {
-        name = "phoenix_swoosh";
-        version = "1.2.1";
-
-        src = fetchHex {
-          pkg = "phoenix_swoosh";
-          version = "${version}";
-          sha256 = "4000eeba3f9d7d1a6bf56d2bd56733d5cadf41a7f0d8ffe5bb67e7d667e204a2";
-        };
-
-        beamDeps = [
-          finch
-          hackney
-          phoenix
-          phoenix_html
-          phoenix_view
-          swoosh
-        ];
-      };
-
-      phoenix_template = buildMix rec {
-        name = "phoenix_template";
-        version = "1.0.4";
-
-        src = fetchHex {
-          pkg = "phoenix_template";
-          version = "${version}";
-          sha256 = "2c0c81f0e5c6753faf5cca2f229c9709919aba34fab866d3bc05060c9c444206";
-        };
-
-        beamDeps = [ phoenix_html ];
-      };
-
-      phoenix_view = buildMix rec {
-        name = "phoenix_view";
-        version = "2.0.4";
-
-        src = fetchHex {
-          pkg = "phoenix_view";
-          version = "${version}";
-          sha256 = "4e992022ce14f31fe57335db27a28154afcc94e9983266835bb3040243eb620b";
-        };
-
-        beamDeps = [
-          phoenix_html
-          phoenix_template
-        ];
-      };
-
-      plug = buildMix rec {
-        name = "plug";
-        version = "1.16.1";
-
-        src = fetchHex {
-          pkg = "plug";
-          version = "${version}";
-          sha256 = "a13ff6b9006b03d7e33874945b2755253841b238c34071ed85b0e86057f8cddc";
-        };
-
-        beamDeps = [
-          mime
-          plug_crypto
-          telemetry
-        ];
-      };
-
-      plug_cowboy = buildMix rec {
-        name = "plug_cowboy";
-        version = "2.7.2";
-
-        src = fetchHex {
-          pkg = "plug_cowboy";
-          version = "${version}";
-          sha256 = "245d8a11ee2306094840c000e8816f0cbed69a23fc0ac2bcf8d7835ae019bb2f";
-        };
-
-        beamDeps = [
-          cowboy
-          cowboy_telemetry
-          plug
-        ];
-      };
-
-      plug_crypto = buildMix rec {
-        name = "plug_crypto";
-        version = "2.1.0";
-
-        src = fetchHex {
-          pkg = "plug_crypto";
-          version = "${version}";
-          sha256 = "131216a4b030b8f8ce0f26038bc4421ae60e4bb95c5cf5395e1421437824c4fa";
-        };
-
-        beamDeps = [ ];
-      };
-
-      postgrex = buildMix rec {
-        name = "postgrex";
-        version = "0.19.3";
-
-        src = fetchHex {
-          pkg = "postgrex";
-          version = "${version}";
-          sha256 = "d31c28053655b78f47f948c85bb1cf86a9c1f8ead346ba1aa0d0df017fa05b61";
-        };
-
-        beamDeps = [
-          db_connection
-          decimal
-          jason
-        ];
-      };
-
-      ranch = buildRebar3 rec {
-        name = "ranch";
-        version = "1.8.0";
-
-        src = fetchHex {
-          pkg = "ranch";
-          version = "${version}";
-          sha256 = "49fbcfd3682fab1f5d109351b61257676da1a2fdbe295904176d5e521a2ddfe5";
-        };
-
-        beamDeps = [ ];
-      };
-
-      recon = buildMix rec {
-        name = "recon";
-        version = "2.5.6";
-
-        src = fetchHex {
-          pkg = "recon";
-          version = "${version}";
-          sha256 = "96c6799792d735cc0f0fd0f86267e9d351e63339cbe03df9d162010cefc26bb0";
-        };
-
-        beamDeps = [ ];
-      };
-
-      remote_ip = buildMix rec {
-        name = "remote_ip";
-        version = "1.2.0";
-
-        src = fetchHex {
-          pkg = "remote_ip";
-          version = "${version}";
-          sha256 = "2ff91de19c48149ce19ed230a81d377186e4412552a597d6a5137373e5877cb7";
-        };
-
-        beamDeps = [
-          combine
-          plug
-        ];
-      };
-
-      sizeable = buildMix rec {
-        name = "sizeable";
-        version = "1.0.2";
-
-        src = fetchHex {
-          pkg = "sizeable";
-          version = "${version}";
-          sha256 = "4bab548e6dfba777b400ca50830a9e3a4128e73df77ab1582540cf5860601762";
-        };
-
-        beamDeps = [ ];
-      };
-
-      sobelow = buildMix rec {
-        name = "sobelow";
-        version = "0.13.0";
-
-        src = fetchHex {
-          pkg = "sobelow";
-          version = "${version}";
-          sha256 = "cd6e9026b85fc35d7529da14f95e85a078d9dd1907a9097b3ba6ac7ebbe34a0d";
-        };
-
-        beamDeps = [ jason ];
-      };
-
-      ssl_verify_fun = buildRebar3 rec {
-        name = "ssl_verify_fun";
-        version = "1.1.7";
-
-        src = fetchHex {
-          pkg = "ssl_verify_fun";
-          version = "${version}";
-          sha256 = "fe4c190e8f37401d30167c8c405eda19469f34577987c76dde613e838bbc67f8";
-        };
-
-        beamDeps = [ ];
-      };
-
-      swoosh = buildMix rec {
-        name = "swoosh";
-        version = "1.17.0";
-
-        src = fetchHex {
-          pkg = "swoosh";
-          version = "${version}";
-          sha256 = "659b8bc25f7483b872d051a7f0731fb8d5312165be0d0302a3c783b566b0a290";
-        };
-
-        beamDeps = [
-          bandit
-          cowboy
-          finch
-          gen_smtp
-          hackney
-          jason
-          mail
-          mime
-          mua
-          multipart
-          plug
-          plug_cowboy
-          telemetry
-        ];
-      };
-
-      tailwind = buildMix rec {
-        name = "tailwind";
-        version = "0.2.3";
-
-        src = fetchHex {
-          pkg = "tailwind";
-          version = "${version}";
-          sha256 = "8e45e7a34a676a7747d04f7913a96c770c85e6be810a1d7f91e713d3a3655b5d";
-        };
-
-        beamDeps = [ castore ];
-      };
-
-      telemetry = buildRebar3 rec {
-        name = "telemetry";
-        version = "1.3.0";
-
-        src = fetchHex {
-          pkg = "telemetry";
-          version = "${version}";
-          sha256 = "7015fc8919dbe63764f4b4b87a95b7c0996bd539e0d499be6ec9d7f3875b79e6";
-        };
-
-        beamDeps = [ ];
-      };
-
-      telemetry_metrics = buildMix rec {
-        name = "telemetry_metrics";
-        version = "1.0.0";
-
-        src = fetchHex {
-          pkg = "telemetry_metrics";
-          version = "${version}";
-          sha256 = "f23713b3847286a534e005126d4c959ebcca68ae9582118ce436b521d1d47d5d";
-        };
-
-        beamDeps = [ telemetry ];
-      };
-
-      telemetry_poller = buildRebar3 rec {
-        name = "telemetry_poller";
-        version = "1.1.0";
-
-        src = fetchHex {
-          pkg = "telemetry_poller";
-          version = "${version}";
-          sha256 = "9eb9d9cbfd81cbd7cdd24682f8711b6e2b691289a0de6826e58452f28c103c8f";
-        };
-
-        beamDeps = [ telemetry ];
-      };
-
-      tesla = buildMix rec {
-        name = "tesla";
-        version = "1.12.1";
-
-        src = fetchHex {
-          pkg = "tesla";
-          version = "${version}";
-          sha256 = "2391efc6243d37ead43afd0327b520314c7b38232091d4a440c1212626fdd6e7";
-        };
-
-        beamDeps = [
-          castore
-          finch
-          hackney
-          jason
-          mime
-          mint
-          telemetry
-        ];
-      };
-
-      thousand_island = buildMix rec {
-        name = "thousand_island";
-        version = "1.3.5";
-
-        src = fetchHex {
-          pkg = "thousand_island";
-          version = "${version}";
-          sha256 = "2be6954916fdfe4756af3239fb6b6d75d0b8063b5df03ba76fd8a4c87849e180";
-        };
-
-        beamDeps = [ telemetry ];
-      };
-
-      tls_certificate_check = buildRebar3 rec {
-        name = "tls_certificate_check";
-        version = "1.26.0";
-
-        src = fetchHex {
-          pkg = "tls_certificate_check";
-          version = "${version}";
-          sha256 = "1bad73d88637f788b554a8e939c25db2bdaac88b10fffd5bba9d1b65f43a6b54";
-        };
-
-        beamDeps = [ ssl_verify_fun ];
-      };
-
-      tzdata = buildMix rec {
-        name = "tzdata";
-        version = "1.1.2";
-
-        src = fetchHex {
-          pkg = "tzdata";
-          version = "${version}";
-          sha256 = "cec7b286e608371602318c414f344941d5eb0375e14cfdab605cca2fe66cba8b";
-        };
-
-        beamDeps = [ hackney ];
-      };
-
-      unicode_util_compat = buildRebar3 rec {
-        name = "unicode_util_compat";
-        version = "0.7.0";
-
-        src = fetchHex {
-          pkg = "unicode_util_compat";
-          version = "${version}";
-          sha256 = "25eee6d67df61960cf6a794239566599b09e17e668d3700247bc498638152521";
-        };
-
-        beamDeps = [ ];
-      };
-
-      wallaby = buildMix rec {
-        name = "wallaby";
-        version = "0.30.9";
-
-        src = fetchHex {
-          pkg = "wallaby";
-          version = "${version}";
-          sha256 = "62e3ccb89068b231b50ed046219022020516d44f443eebef93a19db4be95b808";
-        };
-
-        beamDeps = [
-          ecto_sql
-          httpoison
-          jason
-          phoenix_ecto
-          web_driver_client
-        ];
-      };
-
-      web_driver_client = buildMix rec {
-        name = "web_driver_client";
-        version = "0.2.0";
-
-        src = fetchHex {
-          pkg = "web_driver_client";
-          version = "${version}";
-          sha256 = "83cc6092bc3e74926d1c8455f0ce927d5d1d36707b74d9a65e38c084aab0350f";
-        };
-
-        beamDeps = [
-          hackney
-          jason
-          tesla
-        ];
-      };
-
-      websock = buildMix rec {
-        name = "websock";
-        version = "0.5.3";
-
-        src = fetchHex {
-          pkg = "websock";
-          version = "${version}";
-          sha256 = "6105453d7fac22c712ad66fab1d45abdf049868f253cf719b625151460b8b453";
-        };
-
-        beamDeps = [ ];
-      };
-
-      websock_adapter = buildMix rec {
-        name = "websock_adapter";
-        version = "0.5.7";
-
-        src = fetchHex {
-          pkg = "websock_adapter";
-          version = "${version}";
-          sha256 = "d0f478ee64deddfec64b800673fd6e0c8888b079d9f3444dd96d2a98383bdbd1";
-        };
-
-        beamDeps = [
-          bandit
-          plug
-          plug_cowboy
-          websock
-        ];
-      };
-
-      workos = buildMix rec {
-        name = "workos";
-        version = "1.1.0";
-
-        src = fetchHex {
-          pkg = "workos";
-          version = "${version}";
-          sha256 = "88034983748821353cc28660278e0fd1886378bd4888ea77651889c0d126f3d5";
-        };
-
-        beamDeps = [
-          hackney
-          jason
-          plug_crypto
-          tesla
-        ];
-      };
-
-      yamerl = buildRebar3 rec {
-        name = "yamerl";
-        version = "0.10.0";
-
-        src = fetchHex {
-          pkg = "yamerl";
-          version = "${version}";
-          sha256 = "346adb2963f1051dc837a2364e4acf6eb7d80097c0f53cbdc3046ec8ec4b4e6e";
-        };
-
-        beamDeps = [ ];
-      };
-
-      yaml_elixir = buildMix rec {
-        name = "yaml_elixir";
-        version = "2.11.0";
-
-        src = fetchHex {
-          pkg = "yaml_elixir";
-          version = "${version}";
-          sha256 = "53cc28357ee7eb952344995787f4bb8cc3cecbf189652236e9b163e8ce1bc242";
-        };
-
-        beamDeps = [ yamerl ];
-      };
-
-      ymlr = buildMix rec {
-        name = "ymlr";
-        version = "5.1.3";
-
-        src = fetchHex {
-          pkg = "ymlr";
-          version = "${version}";
-          sha256 = "8663444fa85101a117887c170204d4c5a2182567e5f84767f0071cf15f2efb1e";
-        };
-
-        beamDeps = [ ];
-      };
-    };
-in
-self
diff --git a/pkgs/firezone-server-domain/package.nix b/pkgs/firezone-server-domain/package.nix
deleted file mode 100644
index ba316f5..0000000
--- a/pkgs/firezone-server-domain/package.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-import ./generic.nix {
-  mixReleaseName = "domain";
-}
diff --git a/pkgs/firezone-server-web/package.nix b/pkgs/firezone-server-web/package.nix
deleted file mode 100644
index 3074a00..0000000
--- a/pkgs/firezone-server-web/package.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-import ../firezone-server-domain/generic.nix {
-  mixReleaseName = "web";
-}