diff --git a/.envrc b/.envrc
index 95ed6fb..9222bda 100644
--- a/.envrc
+++ b/.envrc
@@ -1,10 +1,8 @@
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
+if ! has nix_direnv_version || ! nix_direnv_version 2.4.0; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.4.0/direnvrc" "sha256-XQzUAvL6pysIJnRJyR7uVpmUSZfc7LSgWQwq/4mBr1U="
 fi
 
+nix_direnv_watch_file ./flake/checks.nix
+nix_direnv_watch_file ./flake/dev-shells.nix
+
 use flake
-
-watch_file ./flake/checks.nix
-watch_file ./flake/dev-shells.nix
-
-eval "$shellHooks"
diff --git a/flake.lock b/flake.lock
index 3d28d8d..cd8218c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -11,11 +11,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1690228878,
-        "narHash": "sha256-9Xe7JV0krp4RJC9W9W9WutZVlw6BlHTFMiUP/k48LQY=",
+        "lastModified": 1695384796,
+        "narHash": "sha256-TYlE4B0ktPtlJJF9IFxTWrEeq+XKG8Ny0gc2FGEAdj0=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "d8c973fd228949736dedf61b7f8cc1ece3236792",
+        "rev": "1f677b3e161d3bdbfd08a939e8f25de2568e0ef4",
         "type": "github"
       },
       "original": {
@@ -131,11 +131,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1694585439,
-        "narHash": "sha256-70BlfEsdURx5f8sioj8JuM+R4/SZFyE8UYrULMknxlI=",
+        "lastModified": 1695738267,
+        "narHash": "sha256-LTNAbTQ96xSj17xBfsFrFS9i56U2BMLpD0BduhrsVkU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a0ddf43b6268f1717afcda54133dea30435eb178",
+        "rev": "0f4e5b4999fd6a42ece5da8a3a2439a50e48e486",
         "type": "github"
       },
       "original": {
@@ -145,13 +145,29 @@
         "type": "github"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1694622745,
+        "narHash": "sha256-z397+eDhKx9c2qNafL1xv75lC0Q4nOaFlhaU1TINqb8=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "e9643d08d0d193a2e074a19d4d90c67a874d932e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1694422566,
-        "narHash": "sha256-lHJ+A9esOz9vln/3CJG23FV6Wd2OoOFbDeEs4cMGMqc=",
+        "lastModified": 1695644571,
+        "narHash": "sha256-asS9dCCdlt1lPq0DLwkVBbVoEKuEuz+Zi3DG7pR/RxA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3a2786eea085f040a66ecde1bc3ddc7099f6dbeb",
+        "rev": "6500b4580c2a1f3d0f980d32d285739d8e156d92",
         "type": "github"
       },
       "original": {
@@ -163,11 +179,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1694601892,
-        "narHash": "sha256-rGK2Y9vQJQ+v729LfpvTuxDfTE7ns2g34XAPSr9+Z0E=",
+        "lastModified": 1695824843,
+        "narHash": "sha256-c1Z+y9oUXOkcU8gVBCyaujUqYLpYoI2b6L9Cq4ywOcA=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "71a739d93f1e95967e9d641623cbb97d0c8b801a",
+        "rev": "8349f3e37cf21a9da032a2fdb8e7ac45366d01f3",
         "type": "github"
       },
       "original": {
@@ -192,11 +208,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1694364351,
-        "narHash": "sha256-oadhSCqopYXxURwIA6/Anpe5IAG11q2LhvTJNP5zE6o=",
+        "lastModified": 1695576016,
+        "narHash": "sha256-71KxwRhTfVuh7kNrg3/edNjYVg9DCyKZl2QIKbhRggg=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "4f883a76282bc28eb952570afc3d8a1bf6f481d7",
+        "rev": "cb770e93516a1609652fa8e945a0f310e98f10c0",
         "type": "github"
       },
       "original": {
@@ -212,6 +228,7 @@
         "flake-parts": "flake-parts",
         "futils": "futils",
         "home-manager": "home-manager",
+        "impermanence": "impermanence",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
         "pre-commit-hooks": "pre-commit-hooks"
diff --git a/flake.nix b/flake.nix
index 8e46ea3..7970759 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,6 +39,13 @@
       };
     };
 
+    impermanence = {
+      type = "github";
+      owner = "nix-community";
+      repo = "impermanence";
+      ref = "master";
+    };
+
     nixpkgs = {
       type = "github";
       owner = "NixOS";
diff --git a/home/calibre/default.nix b/home/calibre/default.nix
index e0f2069..6edf654 100644
--- a/home/calibre/default.nix
+++ b/home/calibre/default.nix
@@ -9,7 +9,7 @@ in
 
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
-      calibre # NOTE: relies on my overlay to add necessary plug-in dependencies
+      calibre
     ];
   };
 }
diff --git a/home/comma/default.nix b/home/comma/default.nix
index cc6a0ad..60de863 100644
--- a/home/comma/default.nix
+++ b/home/comma/default.nix
@@ -5,25 +5,11 @@ in
 {
   options.my.home.comma = with lib; {
     enable = my.mkDisableOption "comma configuration";
-
-    pkgsFlake = mkOption {
-      type = types.str;
-      default = "pkgs";
-      example = "nixpkgs";
-      description = ''
-        Which flake from the registry should be used with
-        <command>nix shell</command>.
-      '';
-    };
   };
 
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       ambroisie.comma
     ];
-
-    home.sessionVariables = {
-      COMMA_PKGS_FLAKE = cfg.pkgsFlake;
-    };
   };
 }
diff --git a/home/xdg/default.nix b/home/xdg/default.nix
index 3fd8dc9..af9ec18 100644
--- a/home/xdg/default.nix
+++ b/home/xdg/default.nix
@@ -47,6 +47,7 @@ in
     LESSHISTFILE = "${dataHome}/less/history";
     LESSKEY = "${configHome}/less/lesskey";
     PSQL_HISTORY = "${dataHome}/psql_history";
+    REPO_CONFIG_DIR = "${configHome}/repo";
     REDISCLI_HISTFILE = "${dataHome}/redis/rediscli_history";
     XCOMPOSECACHE = "${dataHome}/X11/xcompose";
   };
diff --git a/hosts/homes/ambroisie@mousqueton/default.nix b/hosts/homes/ambroisie@mousqueton/default.nix
index f54453b..0bd2272 100644
--- a/hosts/homes/ambroisie@mousqueton/default.nix
+++ b/hosts/homes/ambroisie@mousqueton/default.nix
@@ -1,5 +1,5 @@
 # Google Cloudtop configuration
-{ ... }:
+{ lib, pkgs, ... }:
 {
   # Google specific configuration
   home.homeDirectory = "/usr/local/google/home/ambroisie";
@@ -13,6 +13,10 @@
     LD_PRELOAD = "/lib/x86_64-linux-gnu/libnss_cache.so.2\${LD_PRELOAD:+:}$LD_PRELOAD";
   };
 
+  programs.git.package = lib.mkForce pkgs.emptyDirectory;
+
+  services.gpg-agent.enable = lib.mkForce false;
+
   # I use scripts that use the passthrough sequence often on this host
   my.home.tmux.enablePassthrough = true;
 }
diff --git a/hosts/nixos/porthos/secrets/matrix/sliding-sync-secret.age b/hosts/nixos/porthos/secrets/matrix/sliding-sync-secret.age
new file mode 100644
index 0000000..d375a35
--- /dev/null
+++ b/hosts/nixos/porthos/secrets/matrix/sliding-sync-secret.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 cKojmg N182xey8TWRVUWTRP16rT0zlhYZNr/pOZVR7YRnlIkk
+HVqAag55z1cKLgjR3WsUj2wvaVjxm169JcDRJGRvCVU
+-> ssh-ed25519 jPowng Dc+aaUTxDsMTY+oOst0SC3ldq1e6zX8F5A5uBL5RHhc
+JWZou6+VaFc5f2OLRIrmFFWg3Er6WSY+TloXU0mP1K8
+-> |9_9Aqh%-grease $ X8Mn|5 aKnl' fl<D{T-
++fAc0cajqxhYWu55HCY
+--- SrmtWXQXGYxNTabSrb5tBRXHnK1F22Qoiy7hKYrrF+0
+ñD·û²:,õn0i�½Àß^ÆŠ`üÔ2Æ#y'ý9ÖñÓÒŽéÿæ�r]ÀØ›¹x“³S=ú°ˆôuJéEÛóc€lH Ê~eÅ‚›ŸKtévo'êv+
\ No newline at end of file
diff --git a/hosts/nixos/porthos/secrets/secrets.nix b/hosts/nixos/porthos/secrets/secrets.nix
index 8eac0f5..ed6c2fd 100644
--- a/hosts/nixos/porthos/secrets/secrets.nix
+++ b/hosts/nixos/porthos/secrets/secrets.nix
@@ -35,6 +35,9 @@ in
     owner = "matrix-synapse";
     publicKeys = all;
   };
+  "matrix/sliding-sync-secret.age" = {
+    publicKeys = all;
+  };
 
   "miniflux/credentials.age".publicKeys = all;
 
diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 863048c..d73cdc1 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -64,6 +64,9 @@ in
       mailConfigFile = secrets."matrix/mail".path;
       # Only necessary when doing the initial registration
       secretFile = secrets."matrix/secret".path;
+      slidingSync = {
+        secretFile = secrets."matrix/sliding-sync-secret".path;
+      };
     };
     miniflux = {
       enable = true;
@@ -116,7 +119,13 @@ in
       secretKeyFile = secrets."paperless/secret-key".path;
     };
     # The whole *arr software suite
-    pirate.enable = true;
+    pirate = {
+      enable = true;
+      # ... But not Lidarr because I don't care for music that much
+      lidarr = {
+        enable = false;
+      };
+    };
     # Podcast automatic downloader
     podgrab = {
       enable = true;
diff --git a/modules/hardware/bluetooth/default.nix b/modules/hardware/bluetooth/default.nix
index 2d840f9..3dd44e6 100644
--- a/modules/hardware/bluetooth/default.nix
+++ b/modules/hardware/bluetooth/default.nix
@@ -18,6 +18,13 @@ in
       services.blueman.enable = true;
     }
 
+    # Persist bluetooth files
+    {
+      my.system.persist.directories = [
+        "/var/lib/bluetooth"
+      ];
+    }
+
     # Support for additional bluetooth codecs
     (lib.mkIf cfg.loadExtraCodecs {
       hardware.pulseaudio = {
diff --git a/modules/hardware/networking/default.nix b/modules/hardware/networking/default.nix
index f0806fe..51dcfce 100644
--- a/modules/hardware/networking/default.nix
+++ b/modules/hardware/networking/default.nix
@@ -22,6 +22,11 @@ in
   config = lib.mkMerge [
     (lib.mkIf cfg.wireless.enable {
       networking.networkmanager.enable = true;
+
+      # Persist NetworkManager files
+      my.system.persist.directories = [
+        "/etc/NetworkManager/system-connections"
+      ];
     })
   ];
 }
diff --git a/modules/services/blog/default.nix b/modules/services/blog/default.nix
index 4b646c3..6752ac2 100644
--- a/modules/services/blog/default.nix
+++ b/modules/services/blog/default.nix
@@ -42,5 +42,12 @@ in
 
     # Those are all subdomains, no problem
     my.services.nginx.virtualHosts = hostsInfo;
+
+    my.system.persist.directories = [
+      "/var/www/blog"
+      "/var/www/cv"
+      "/var/www/dev"
+      "/var/www/key"
+    ];
   };
 }
diff --git a/modules/services/calibre-web/default.nix b/modules/services/calibre-web/default.nix
index 858851c..b6e70d8 100644
--- a/modules/services/calibre-web/default.nix
+++ b/modules/services/calibre-web/default.nix
@@ -54,6 +54,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      "/var/lib/${config.services.calibre-web.dataDir}"
+      cfg.libraryPath
+    ];
+
     services.fail2ban.jails = {
       calibre-web = ''
         enabled = true
diff --git a/modules/services/flood/default.nix b/modules/services/flood/default.nix
index ff5d941..79b6c75 100644
--- a/modules/services/flood/default.nix
+++ b/modules/services/flood/default.nix
@@ -46,5 +46,9 @@ in
         inherit (cfg) port;
       }
     ];
+
+    my.system.persist.directories = [
+      "/var/lib/${cfg.stateDir}"
+    ];
   };
 }
diff --git a/modules/services/gitea/default.nix b/modules/services/gitea/default.nix
index 28a448d..93edf57 100644
--- a/modules/services/gitea/default.nix
+++ b/modules/services/gitea/default.nix
@@ -135,6 +135,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.gitea.lfs.contentDir
+      config.services.gitea.repositoryRoot
+    ];
+
     services.fail2ban.jails = {
       gitea = ''
         enabled = true
diff --git a/modules/services/grocy/default.nix b/modules/services/grocy/default.nix
index 87927d6..4a3183e 100644
--- a/modules/services/grocy/default.nix
+++ b/modules/services/grocy/default.nix
@@ -36,5 +36,8 @@ in
       forceSSL = true;
       useACMEHost = config.networking.domain;
     };
+
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/services/indexers/default.nix b/modules/services/indexers/default.nix
index fb06a0b..28a7007 100644
--- a/modules/services/indexers/default.nix
+++ b/modules/services/indexers/default.nix
@@ -34,6 +34,10 @@ in
           port = jackettPort;
         }
       ];
+
+      my.system.persist.directories = [
+        config.services.jackett.dataDir
+      ];
     })
 
     (lib.mkIf cfg.nzbhydra.enable {
@@ -47,6 +51,10 @@ in
           port = nzbhydraPort;
         }
       ];
+
+      my.system.persist.directories = [
+        config.services.nzbhydra2.dataDir
+      ];
     })
 
     (lib.mkIf cfg.prowlarr.enable {
@@ -61,6 +69,10 @@ in
         }
       ];
 
+      my.system.persist.directories = [
+        "/var/lib/${config.systemd.services.prowlarr.serviceConfig.StateDirectory}"
+      ];
+
       services.fail2ban.jails = {
         prowlarr = ''
           enabled = true
diff --git a/modules/services/jellyfin/default.nix b/modules/services/jellyfin/default.nix
index 2fcf51e..0692dcc 100644
--- a/modules/services/jellyfin/default.nix
+++ b/modules/services/jellyfin/default.nix
@@ -35,5 +35,9 @@ in
         };
       }
     ];
+
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.jellyfin.serviceConfig.StateDirectory}"
+    ];
   };
 }
diff --git a/modules/services/lohr/default.nix b/modules/services/lohr/default.nix
index 245567c..7aac1ac 100644
--- a/modules/services/lohr/default.nix
+++ b/modules/services/lohr/default.nix
@@ -104,5 +104,9 @@ in
         inherit (cfg) port;
       }
     ];
+
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.lohr.serviceConfig.StateDirectory}"
+    ];
   };
 }
diff --git a/modules/services/matrix/default.nix b/modules/services/matrix/default.nix
index c73afed..87494c9 100644
--- a/modules/services/matrix/default.nix
+++ b/modules/services/matrix/default.nix
@@ -13,6 +13,7 @@ let
   federationPort = { public = 8448; private = 11338; };
   clientPort = { public = 443; private = 11339; };
   domain = config.networking.domain;
+  matrixDomain = "matrix.${domain}";
 in
 {
   options.my.services.matrix = with lib; {
@@ -25,6 +26,21 @@ in
       description = "Shared secret to register users";
     };
 
+    slidingSync = {
+      port = mkOption {
+        type = types.port;
+        default = 8009;
+        example = 8084;
+        description = "Port used by sliding sync server";
+      };
+
+      secretFile = mkOption {
+        type = types.str;
+        example = "/var/lib/matrix/sliding-sync-secret-file.env";
+        description = "Secret file which contains SYNCV3_SECRET definition";
+      };
+    };
+
     mailConfigFile = mkOption {
       type = types.str;
       example = "/var/lib/matrix/email-config.yaml";
@@ -52,7 +68,7 @@ in
 
       settings = {
         server_name = domain;
-        public_baseurl = "https://matrix.${domain}";
+        public_baseurl = "https://${matrixDomain}";
 
         enable_registration = false;
 
@@ -88,6 +104,17 @@ in
       extraConfigFiles = [
         cfg.mailConfigFile
       ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile;
+
+      sliding-sync = {
+        enable = true;
+
+        settings = {
+          SYNCV3_SERVER = "https://${matrixDomain}";
+          SYNCV3_BINDADDR = "127.0.0.1:${toString cfg.slidingSync.port}";
+        };
+
+        environmentFile = cfg.slidingSync.secretFile;
+      };
     };
 
     my.services.nginx.virtualHosts = [
@@ -98,12 +125,15 @@ in
           conf = {
             default_server_config = {
               "m.homeserver" = {
-                "base_url" = "https://matrix.${domain}";
+                "base_url" = "https://${matrixDomain}";
                 "server_name" = domain;
               };
               "m.identity_server" = {
                 "base_url" = "https://vector.im";
               };
+              "org.matrix.msc3575.proxy" = {
+                "url" = "https://matrix-sync.${domain}";
+              };
             };
             showLabsSettings = true;
             defaultCountryCode = "FR"; # cocorico
@@ -116,11 +146,25 @@ in
           };
         };
       }
+      # Dummy VHosts for port collision detection
+      {
+        subdomain = "matrix-federation";
+        port = federationPort.private;
+      }
+      {
+        subdomain = "matrix-client";
+        port = clientPort.private;
+      }
+      # Sliding sync
+      {
+        subdomain = "matrix-sync";
+        inherit (cfg.slidingSync) port;
+      }
     ];
 
     # Those are too complicated to use my wrapper...
     services.nginx.virtualHosts = {
-      "matrix.${domain}" = {
+      ${matrixDomain} = {
         onlySSL = true;
         useACMEHost = domain;
 
@@ -138,6 +182,11 @@ in
 
             "/_matrix" = proxyToClientPort;
             "/_synapse/client" = proxyToClientPort;
+
+            # Sliding sync
+            "~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)" = {
+              proxyPass = "http://${config.services.matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
+            };
           };
 
         listen = [
@@ -148,9 +197,9 @@ in
       };
 
       # same as above, but listening on the federation port
-      "matrix.${domain}_federation" = {
+      "${matrixDomain}_federation" = {
         onlySSL = true;
-        serverName = "matrix.${domain}";
+        serverName = matrixDomain;
         useACMEHost = domain;
 
         locations."/".return = "404";
@@ -171,7 +220,7 @@ in
 
         locations."= /.well-known/matrix/server".extraConfig =
           let
-            server = { "m.server" = "matrix.${domain}:${toString federationPort.public}"; };
+            server = { "m.server" = "${matrixDomain}:${toString federationPort.public}"; };
           in
           ''
             add_header Content-Type application/json;
@@ -181,8 +230,9 @@ in
         locations."= /.well-known/matrix/client".extraConfig =
           let
             client = {
-              "m.homeserver" = { "base_url" = "https://matrix.${domain}"; };
+              "m.homeserver" = { "base_url" = "https://${matrixDomain}"; };
               "m.identity_server" = { "base_url" = "https://vector.im"; };
+              "org.matrix.msc3575.proxy" = { "url" = "https://matrix-sync.${domain}"; };
             };
             # ACAO required to allow element-web on any URL to request this json file
           in
@@ -207,5 +257,9 @@ in
         config.services.matrix-synapse.dataDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.matrix-synapse.dataDir
+    ];
   };
 }
diff --git a/modules/services/miniflux/default.nix b/modules/services/miniflux/default.nix
index 6d9ffc8..4667912 100644
--- a/modules/services/miniflux/default.nix
+++ b/modules/services/miniflux/default.nix
@@ -49,5 +49,8 @@ in
         inherit (cfg) port;
       }
     ];
+
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/services/monitoring/default.nix b/modules/services/monitoring/default.nix
index 829bfe0..c7489f4 100644
--- a/modules/services/monitoring/default.nix
+++ b/modules/services/monitoring/default.nix
@@ -131,5 +131,10 @@ in
         inherit (cfg.grafana) port;
       }
     ];
+
+    my.system.persist.directories = [
+      config.services.grafana.dataDir
+      "/var/lib/${config.services.prometheus.stateDir}"
+    ];
   };
 }
diff --git a/modules/services/navidrome/default.nix b/modules/services/navidrome/default.nix
index 6c001fd..08c6a88 100644
--- a/modules/services/navidrome/default.nix
+++ b/modules/services/navidrome/default.nix
@@ -53,5 +53,9 @@ in
         inherit (cfg) port;
       }
     ];
+
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.navidrome.serviceConfig.StateDirectory}"
+    ];
   };
 }
diff --git a/modules/services/nextcloud/default.nix b/modules/services/nextcloud/default.nix
index 1477c13..55972ab 100644
--- a/modules/services/nextcloud/default.nix
+++ b/modules/services/nextcloud/default.nix
@@ -83,5 +83,10 @@ in
         "${config.services.nextcloud.home}/data/appdata_*/preview"
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.nextcloud.home
+      config.services.nextcloud.datadir
+    ];
   };
 }
diff --git a/modules/services/nginx/default.nix b/modules/services/nginx/default.nix
index dcaaa0f..a2f357f 100644
--- a/modules/services/nginx/default.nix
+++ b/modules/services/nginx/default.nix
@@ -470,5 +470,9 @@ in
         }
       ];
     };
+
+    my.system.persist.directories = [
+      config.users.user.acme.home
+    ];
   };
 }
diff --git a/modules/services/paperless/default.nix b/modules/services/paperless/default.nix
index c9d6220..702627d 100644
--- a/modules/services/paperless/default.nix
+++ b/modules/services/paperless/default.nix
@@ -73,6 +73,10 @@ in
           # OCR settings
           PAPERLESS_OCR_LANGUAGE = "fra+eng";
 
+          # Workers
+          PAPERLESS_TASK_WORKERS = 3;
+          PAPERLESS_THREADS_PER_WORKER = 4;
+
           # Misc
           PAPERLESS_TIME_ZONE = config.time.timeZone;
           PAPERLESS_ADMIN_USER = cfg.username;
@@ -160,5 +164,10 @@ in
         config.services.paperless.mediaDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.paperless-ng.dataDir
+      config.services.paperless-ng.mediaDir
+    ];
   };
 }
diff --git a/modules/services/pirate/default.nix b/modules/services/pirate/default.nix
index 7c341e7..cfabc90 100644
--- a/modules/services/pirate/default.nix
+++ b/modules/services/pirate/default.nix
@@ -18,6 +18,11 @@ let
       enable = true;
       group = "media";
     };
+
+    # Thankfully those old style services all define users with homes
+    my.system.persist.directories = [
+      config.users.user.${service}.home
+    ];
   };
 
   mkRedirection = service: {
@@ -29,7 +34,7 @@ let
     ];
   };
 
-  mkFail2Ban = service: {
+  mkFail2Ban = service: lib.mkIf cfg.${service}.enable {
     services.fail2ban.jails = {
       ${service} = ''
         enabled = true
@@ -47,14 +52,30 @@ let
     };
   };
 
-  mkFullConfig = service: lib.mkMerge [
+  mkFullConfig = service: lib.mkIf cfg.${service}.enable (lib.mkMerge [
     (mkService service)
     (mkRedirection service)
-  ];
+  ]);
 in
 {
   options.my.services.pirate = {
     enable = lib.mkEnableOption "Media automation";
+
+    bazarr = {
+      enable = lib.my.mkDisableOption "Bazarr";
+    };
+
+    lidarr = {
+      enable = lib.my.mkDisableOption "Lidarr";
+    };
+
+    radarr = {
+      enable = lib.my.mkDisableOption "Radarr";
+    };
+
+    sonarr = {
+      enable = lib.my.mkDisableOption "Sonarr";
+    };
   };
 
   config = lib.mkIf cfg.enable (lib.mkMerge [
diff --git a/modules/services/podgrab/default.nix b/modules/services/podgrab/default.nix
index 9793d60..2994fc8 100644
--- a/modules/services/podgrab/default.nix
+++ b/modules/services/podgrab/default.nix
@@ -37,5 +37,10 @@ in
         inherit (cfg) port;
       }
     ];
+
+    my.system.persist.directories =
+      builtins.map
+        (d: "/var/lib/${d}")
+        config.systemd.services.podgrab.serviceConfig.StateDirectory;
   };
 }
diff --git a/modules/services/postgresql-backup/default.nix b/modules/services/postgresql-backup/default.nix
index dff5494..3d6c03b 100644
--- a/modules/services/postgresql-backup/default.nix
+++ b/modules/services/postgresql-backup/default.nix
@@ -24,5 +24,9 @@ in
         (config.services.postgresqlBackup.location + "/*.prev.sql.gz")
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.postgresqlBackup.location
+    ];
   };
 }
diff --git a/modules/services/postgresql/default.nix b/modules/services/postgresql/default.nix
index 6f51f3e..175c1ce 100644
--- a/modules/services/postgresql/default.nix
+++ b/modules/services/postgresql/default.nix
@@ -18,6 +18,13 @@ in
       };
     })
 
+    # Only persist directory if the actual service is enabled
+    (lib.mkIf config.services.postgresql.enable {
+      my.system.persist.directories = [
+        config.services.postgresql.dataDir
+      ];
+    })
+
     # Taken from the manual
     (lib.mkIf cfg.upgradeScript {
       containers.temp-pg.config.services.postgresql = {
diff --git a/modules/services/quassel/default.nix b/modules/services/quassel/default.nix
index ec686e1..18d084a 100644
--- a/modules/services/quassel/default.nix
+++ b/modules/services/quassel/default.nix
@@ -46,5 +46,9 @@ in
       # Because Quassel does not use the socket, I simply trust its connection
       authentication = "host quassel quassel localhost trust";
     };
+
+    my.system.persist.directories = [
+      config.services.quassel.dataDir
+    ];
   };
 }
diff --git a/modules/services/rss-bridge/default.nix b/modules/services/rss-bridge/default.nix
index 85e37c2..66858dc 100644
--- a/modules/services/rss-bridge/default.nix
+++ b/modules/services/rss-bridge/default.nix
@@ -20,5 +20,9 @@ in
       forceSSL = true;
       useACMEHost = config.networking.domain;
     };
+
+    my.system.persist.directories = [
+      config.services.rss-bridge.dataDir
+    ];
   };
 }
diff --git a/modules/services/sabnzbd/default.nix b/modules/services/sabnzbd/default.nix
index 7ab145f..ef13d4b 100644
--- a/modules/services/sabnzbd/default.nix
+++ b/modules/services/sabnzbd/default.nix
@@ -25,6 +25,10 @@ in
       }
     ];
 
+    my.system.persist.files = [
+      config.services.sabnzbd.configFile
+    ];
+
     services.fail2ban.jails = {
       sabnzbd = ''
         enabled = true
diff --git a/modules/services/ssh-server/default.nix b/modules/services/ssh-server/default.nix
index 9ae0fa8..0cabc6f 100644
--- a/modules/services/ssh-server/default.nix
+++ b/modules/services/ssh-server/default.nix
@@ -20,6 +20,14 @@ in
       };
     };
 
+    # Persist SSH keys
+    my.system.persist.files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+
     # Opens the relevant UDP ports.
     programs.mosh.enable = true;
   };
diff --git a/modules/services/tandoor-recipes/default.nix b/modules/services/tandoor-recipes/default.nix
index d78bef3..82350d7 100644
--- a/modules/services/tandoor-recipes/default.nix
+++ b/modules/services/tandoor-recipes/default.nix
@@ -75,5 +75,8 @@ in
         inherit (cfg) port;
       }
     ];
+
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/services/transmission/default.nix b/modules/services/transmission/default.nix
index dcba0aa..37e4f0f 100644
--- a/modules/services/transmission/default.nix
+++ b/modules/services/transmission/default.nix
@@ -3,7 +3,7 @@
 # Inspired by [1]
 #
 # [1]: https://github.com/delroth/infra.delroth.net/blob/master/roles/seedbox.nix
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
   cfg = config.my.services.transmission;
 in
@@ -45,6 +45,7 @@ in
   config = lib.mkIf cfg.enable {
     services.transmission = {
       enable = true;
+      package = pkgs.transmission_4;
       group = "media";
 
       downloadDirPermissions = "775";
@@ -90,5 +91,9 @@ in
       allowedTCPPorts = [ cfg.peerPort ];
       allowedUDPPorts = [ cfg.peerPort ];
     };
+
+    my.system.persist.directories = [
+      config.services.transmission.home
+    ];
   };
 }
diff --git a/modules/services/vikunja/default.nix b/modules/services/vikunja/default.nix
index 1cdef5f..076dd4a 100644
--- a/modules/services/vikunja/default.nix
+++ b/modules/services/vikunja/default.nix
@@ -119,5 +119,7 @@ in
         config.services.vikunja.settings.files.basepath
       ];
     };
+
+    # FIXME: persistence
   };
 }
diff --git a/modules/services/woodpecker/agent-docker/default.nix b/modules/services/woodpecker/agent-docker/default.nix
index b18d075..79d3299 100644
--- a/modules/services/woodpecker/agent-docker/default.nix
+++ b/modules/services/woodpecker/agent-docker/default.nix
@@ -27,9 +27,6 @@ in
     # Make sure it is activated in that case
     my.system.docker.enable = true;
 
-    # FIXME: figure out the issue
-    services.unbound.resolveLocalQueries = false;
-
     # Adjust runner service for nix usage
     systemd.services.woodpecker-agent-docker = {
       after = [ "docker.socket" ]; # Needs the socket to be available
diff --git a/modules/system/default.nix b/modules/system/default.nix
index 9fe3b57..b3d9385 100644
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -9,6 +9,7 @@
     ./language
     ./nix
     ./packages
+    ./persist
     ./podman
     ./users
   ];
diff --git a/modules/system/persist/default.nix b/modules/system/persist/default.nix
new file mode 100644
index 0000000..18302f3
--- /dev/null
+++ b/modules/system/persist/default.nix
@@ -0,0 +1,68 @@
+# Ephemeral root configuration
+{ config, inputs, lib, ... }:
+let
+  cfg = config.my.system.persist;
+in
+{
+  imports = [
+    inputs.impermanence.nixosModules.impermanence
+  ];
+
+  options.my.system.persist = with lib; {
+    enable = mkEnableOption "stateless system configuration";
+
+    mountPoint = lib.mkOption {
+      type = types.str;
+      default = "/persistent";
+      example = "/etc/nix/persist";
+      description = ''
+        Which mount point should be used to persist this system's files and
+        directories.
+      '';
+    };
+
+    files = lib.mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [
+        "/etc/nix/id_rsa"
+      ];
+      description = ''
+        Additional files in the root to link to persistent storage.
+      '';
+    };
+
+    directories = lib.mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [
+        "/var/lib/libvirt"
+      ];
+      description = ''
+        Additional directories in the root to link to persistent storage.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.persistence."${cfg.mountPoint}" = {
+      files = [
+        "/etc/machine-id"
+      ]
+      ++ cfg.files
+      ;
+
+      directories = [
+        "/etc/nixos"
+        "/var/log"
+        "/var/lib/systemd/coredump"
+      ]
+      ++ (lib.optionals config.virtualisation.docker.enable [
+        "/var/lib/docker"
+      ])
+      # FIXME: podman
+      ++ cfg.directories
+      ;
+    };
+  };
+}
diff --git a/modules/system/users/default.nix b/modules/system/users/default.nix
index 27557bd..655b31e 100644
--- a/modules/system/users/default.nix
+++ b/modules/system/users/default.nix
@@ -17,11 +17,11 @@ in
 
       users = {
         root = {
-          passwordFile = secrets."users/root/hashed-password".path;
+          hashedPasswordFile = secrets."users/root/hashed-password".path;
         };
 
         ${config.my.user.name} = {
-          passwordFile = secrets."users/ambroisie/hashed-password".path;
+          hashedPasswordFile = secrets."users/ambroisie/hashed-password".path;
           description = "Bruno BELANYI";
           isNormalUser = true;
           shell = pkgs.zsh;
diff --git a/pkgs/comma/comma b/pkgs/comma/comma
index ba5c6ae..4367a26 100755
--- a/pkgs/comma/comma
+++ b/pkgs/comma/comma
@@ -30,4 +30,4 @@ if [ -z "$PROGRAM" ]; then
     exit 1
 fi
 
-nix shell "${COMMA_PKGS_FLAKE:-nixpkgs}#$PROGRAM" -c "$@"
+nix shell "${COMMA_NIXPKGS_FLAKE:-nixpkgs}#$PROGRAM" -c "$@"
diff --git a/pkgs/rbw-pass/rbw-pass b/pkgs/rbw-pass/rbw-pass
index 90e916c..23363dc 100755
--- a/pkgs/rbw-pass/rbw-pass
+++ b/pkgs/rbw-pass/rbw-pass
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 usage() {
-    printf '%s\n' "Usage: bw-pass [directory name] <account name>" >&2
+    printf '%s\n' "Usage: rbw-pass [directory name] <account name>" >&2
 }
 
 error_out() {
diff --git a/templates/c++-cmake/.envrc b/templates/c++-cmake/.envrc
index 95ed6fb..ccf325e 100644
--- a/templates/c++-cmake/.envrc
+++ b/templates/c++-cmake/.envrc
@@ -1,10 +1,5 @@
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
+if ! has nix_direnv_version || ! nix_direnv_version 2.4.0; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.4.0/direnvrc" "sha256-XQzUAvL6pysIJnRJyR7uVpmUSZfc7LSgWQwq/4mBr1U="
 fi
 
 use flake
-
-watch_file ./flake/checks.nix
-watch_file ./flake/dev-shells.nix
-
-eval "$shellHooks"
diff --git a/templates/c++-meson/.envrc b/templates/c++-meson/.envrc
index 95ed6fb..ccf325e 100644
--- a/templates/c++-meson/.envrc
+++ b/templates/c++-meson/.envrc
@@ -1,10 +1,5 @@
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
+if ! has nix_direnv_version || ! nix_direnv_version 2.4.0; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.4.0/direnvrc" "sha256-XQzUAvL6pysIJnRJyR7uVpmUSZfc7LSgWQwq/4mBr1U="
 fi
 
 use flake
-
-watch_file ./flake/checks.nix
-watch_file ./flake/dev-shells.nix
-
-eval "$shellHooks"