feat: try rework

config/services.nix

@@ -0,0 +1,35 @@
+# Config-backed service registry.
+# NOTE: VPN credentials are temporarily stored here and will be moved
+# to the dedicated secret system in a later migration step.
+let
+  storage_data = import ../config/storage.nix;
+  secrets = import ../intermediate/secrets.nix;
+in
+rec {
+  continuwuity = {
+    port = 6167;
+  };
+
+  qbittorrent = {
+    port = 8085;
+    root_dir = "${storage_data.ssd.path}/qbittorrent";
+    vpn = {
+      username_file = secrets.byName.qbittorrent_vpn_username.path;
+      password_file = secrets.byName.qbittorrent_vpn_password.path;
+    };
+  };
+
+  kiwix = {
+    port = 8086;
+    root_dir = "${storage_data.ssd.path}/kiwix";
+    urls = [
+      "https://ftp.fau.de/kiwix/zim/wikipedia/wikipedia_en_all_nopic_2025-08.zim"
+      "https://download.kiwix.org/zim/wikipedia/wikipedia_de_all_nopic_2026-01.zim"
+    ];
+  };
+
+  matrix = {
+    trusted_servers = [ "matrix.org" ];
+  };
+
+}