diff --git a/deployment/check/cli/constants.nix b/deployment/check/cli/constants.nix
index 3e23d9e9..ce3b5e4d 100644
--- a/deployment/check/cli/constants.nix
+++ b/deployment/check/cli/constants.nix
@@ -4,7 +4,6 @@
     "mastodon"
     "peertube"
     "pixelfed"
-    "attic"
   ];
   pathToRoot = ../../..;
   pathFromRoot = ./.;
diff --git a/deployment/check/cli/nixosTest.nix b/deployment/check/cli/nixosTest.nix
index 00f72475..40331209 100644
--- a/deployment/check/cli/nixosTest.nix
+++ b/deployment/check/cli/nixosTest.nix
@@ -70,11 +70,6 @@ in
             s3AccessKeyFile = dummyFile;
             s3SecretKeyFile = dummyFile;
           };
-          attic = {
-            enable = true;
-            s3AccessKeyFile = dummyFile;
-            s3SecretKeyFile = dummyFile;
-          };
           temp.cores = 1;
           temp.initialUser = {
             username = "dummy";
@@ -99,7 +94,6 @@ in
   nodes.mastodon.virtualisation.memorySize = 4 * 1024;
   nodes.pixelfed.virtualisation.memorySize = 4 * 1024;
   nodes.peertube.virtualisation.memorySize = 5 * 1024;
-  nodes.attic.virtualisation.memorySize = 2 * 1024;
 
   ## FIXME: The test of presence of the services are very simple: we only
   ## check that there is a systemd service of the expected name on the
@@ -114,7 +108,6 @@ in
       mastodon.fail("systemctl status mastodon-web.service")
       peertube.fail("systemctl status peertube.service")
       pixelfed.fail("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
 
     with subtest("Run deployment with no services enabled"):
       deployer.succeed("nixops4 apply check-deployment-cli-nothing --show-trace --no-interactive 1>&2")
@@ -124,7 +117,6 @@ in
       mastodon.fail("systemctl status mastodon-web.service")
       peertube.fail("systemctl status peertube.service")
       pixelfed.fail("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
 
     with subtest("Run deployment with Mastodon and Pixelfed enabled"):
       deployer.succeed("nixops4 apply check-deployment-cli-mastodon-pixelfed --show-trace --no-interactive 1>&2")
@@ -134,7 +126,6 @@ in
       mastodon.succeed("systemctl status mastodon-web.service")
       peertube.fail("systemctl status peertube.service")
       pixelfed.succeed("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
 
     with subtest("Run deployment with only Peertube enabled"):
       deployer.succeed("nixops4 apply check-deployment-cli-peertube --show-trace --no-interactive 1>&2")
@@ -144,6 +135,5 @@ in
       mastodon.fail("systemctl status mastodon-web.service")
       peertube.succeed("systemctl status peertube.service")
       pixelfed.fail("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
   '';
 }
diff --git a/deployment/check/panel/constants.nix b/deployment/check/panel/constants.nix
index 3e23d9e9..ce3b5e4d 100644
--- a/deployment/check/panel/constants.nix
+++ b/deployment/check/panel/constants.nix
@@ -4,7 +4,6 @@
     "mastodon"
     "peertube"
     "pixelfed"
-    "attic"
   ];
   pathToRoot = ../../..;
   pathFromRoot = ./.;
diff --git a/deployment/check/panel/nixosTest.nix b/deployment/check/panel/nixosTest.nix
index a7de8ed8..ffcb8e53 100644
--- a/deployment/check/panel/nixosTest.nix
+++ b/deployment/check/panel/nixosTest.nix
@@ -33,7 +33,6 @@ let
       enableMastodon,
       enablePeertube,
       enablePixelfed,
-      enableAttic,
     }:
     hostPkgs.writers.writePython3Bin "interact-with-panel"
       {
@@ -95,7 +94,6 @@ let
         checkbox_set(driver.find_element(By.XPATH, "//input[@name = 'mastodon.enable']"), ${toPythonBool enableMastodon})
         checkbox_set(driver.find_element(By.XPATH, "//input[@name = 'peertube.enable']"), ${toPythonBool enablePeertube})
         checkbox_set(driver.find_element(By.XPATH, "//input[@name = 'pixelfed.enable']"), ${toPythonBool enablePixelfed})
-        checkbox_set(driver.find_element(By.XPATH, "//input[@name = 'attic.enable']"), ${toPythonBool enableAttic})
 
         print("Start deployment...")
         driver.find_element(By.XPATH, "//button[@id = 'deploy-button']").click()
@@ -210,11 +208,6 @@ in
             s3AccessKeyFile = dummyFile;
             s3SecretKeyFile = dummyFile;
           };
-          attic = {
-            enable = true;
-            s3AccessKeyFile = dummyFile;
-            s3SecretKeyFile = dummyFile;
-          };
           temp.cores = 1;
           temp.initialUser = {
             username = "dummy";
@@ -260,7 +253,6 @@ in
   nodes.mastodon.virtualisation.memorySize = 4 * 1024;
   nodes.pixelfed.virtualisation.memorySize = 4 * 1024;
   nodes.peertube.virtualisation.memorySize = 5 * 1024;
-  nodes.attic.virtualisation.memorySize = 4 * 1024;
 
   ## FIXME: The test of presence of the services are very simple: we only
   ## check that there is a systemd service of the expected name on the
@@ -333,7 +325,6 @@ in
       mastodon.fail("systemctl status mastodon-web.service")
       peertube.fail("systemctl status peertube.service")
       pixelfed.fail("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
 
     with subtest("Run deployment with no services enabled"):
       client.succeed("${
@@ -342,7 +333,6 @@ in
           enableMastodon = false;
           enablePeertube = false;
           enablePixelfed = false;
-          enableAttic = false;
         }
       }/bin/interact-with-panel >&2")
 
@@ -351,7 +341,6 @@ in
       mastodon.fail("systemctl status mastodon-web.service")
       peertube.fail("systemctl status peertube.service")
       pixelfed.fail("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
 
     with subtest("Run deployment with Mastodon and Pixelfed enabled"):
       client.succeed("${
@@ -360,7 +349,6 @@ in
           enableMastodon = true;
           enablePeertube = false;
           enablePixelfed = true;
-          enableAttic = false;
         }
       }/bin/interact-with-panel >&2")
 
@@ -369,7 +357,6 @@ in
       mastodon.succeed("systemctl status mastodon-web.service")
       peertube.fail("systemctl status peertube.service")
       pixelfed.succeed("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
 
     with subtest("Run deployment with only Peertube enabled"):
       client.succeed("${
@@ -378,7 +365,6 @@ in
           enableMastodon = false;
           enablePeertube = true;
           enablePixelfed = false;
-          enableAttic = false;
         }
       }/bin/interact-with-panel >&2")
 
@@ -387,6 +373,5 @@ in
       mastodon.fail("systemctl status mastodon-web.service")
       peertube.succeed("systemctl status peertube.service")
       pixelfed.fail("systemctl status phpfpm-pixelfed.service")
-      attic.fail("systemctl status atticd.service")
   '';
 }
diff --git a/deployment/configuration.sample.json b/deployment/configuration.sample.json
index efe73459..d444a842 100644
--- a/deployment/configuration.sample.json
+++ b/deployment/configuration.sample.json
@@ -3,7 +3,6 @@
   "mastodon": { "enable": false },
   "peertube": { "enable": false },
   "pixelfed": { "enable": false },
-  "attic": { "enable": false },
   "initialUser": {
     "displayName": "Testy McTestface",
     "username": "test",
diff --git a/deployment/default.nix b/deployment/default.nix
index 4024cce9..c76489bd 100644
--- a/deployment/default.nix
+++ b/deployment/default.nix
@@ -24,7 +24,6 @@
   mastodonConfigurationResource,
   peertubeConfigurationResource,
   pixelfedConfigurationResource,
-  atticConfigurationResource,
 }:
 
 ## From the hosting provider's perspective, the function is meant to be
@@ -56,7 +55,6 @@ let
     mastodon = nonNull panelConfigNullable.mastodon { enable = false; };
     peertube = nonNull panelConfigNullable.peertube { enable = false; };
     pixelfed = nonNull panelConfigNullable.pixelfed { enable = false; };
-    attic = nonNull panelConfigNullable.attic { enable = false; };
   };
 in
 
@@ -109,13 +107,6 @@ in
             s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GKb5615457d44214411e673b7b";
             s3SecretKeyFile = pkgs.writeText "s3SecretKey" "5be6799a88ca9b9d813d1a806b64f15efa49482dbe15339ddfaf7f19cf434987";
           };
-        atticS3KeyConfig =
-          { pkgs, ... }:
-          {
-            # REVIEW: how were these generated above? how do i add one?
-            s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GKaaaaaaaaaaaaaaaaaaaaaaaa";
-            s3SecretKeyFile = pkgs.writeText "s3SecretKey" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-          };
 
         makeConfigurationResource = resourceModule: config: {
           type = providers.local.exec;
@@ -149,14 +140,13 @@ in
       {
         garage-configuration = makeConfigurationResource garageConfigurationResource (
           { pkgs, ... }:
-          mkIf (cfg.mastodon.enable || cfg.peertube.enable || cfg.pixelfed.enable || cfg.attic.enable) {
+          mkIf (cfg.mastodon.enable || cfg.peertube.enable || cfg.pixelfed.enable) {
             fediversity = {
               inherit (cfg) domain;
               garage.enable = true;
               pixelfed = pixelfedS3KeyConfig { inherit pkgs; };
               mastodon = mastodonS3KeyConfig { inherit pkgs; };
               peertube = peertubeS3KeyConfig { inherit pkgs; };
-              attic = atticS3KeyConfig { inherit pkgs; };
             };
           }
         );
@@ -223,25 +213,6 @@ in
             };
           }
         );
-
-        attic-configuration = makeConfigurationResource atticConfigurationResource (
-          { pkgs, ... }:
-          mkIf cfg.attic.enable {
-            fediversity = {
-              inherit (cfg) domain;
-              temp.initialUser = {
-                inherit (cfg.initialUser) username email displayName;
-                # FIXME: disgusting, but nvm, this is going to be replaced by
-                # proper central authentication at some point
-                passwordFile = pkgs.writeText "password" cfg.initialUser.password;
-              };
-
-              attic = atticS3KeyConfig { inherit pkgs; } // {
-                enable = true;
-              };
-            };
-          }
-        );
       };
   };
 }
diff --git a/deployment/options.nix b/deployment/options.nix
index 3e48208c..c0a5e8d7 100644
--- a/deployment/options.nix
+++ b/deployment/options.nix
@@ -71,19 +71,6 @@ in
         });
       default = null;
     };
-    attic = mkOption {
-      description = ''
-        Configuration for the Attic service
-      '';
-      type =
-        with types;
-        nullOr (submodule {
-          options = {
-            enable = lib.mkEnableOption "Attic";
-          };
-        });
-      default = null;
-    };
     initialUser = mkOption {
       description = ''
         Some services require an initial user to access them.
diff --git a/infra/flake-part.nix b/infra/flake-part.nix
index ffdf7ec4..53c25830 100644
--- a/infra/flake-part.nix
+++ b/infra/flake-part.nix
@@ -103,12 +103,6 @@ let
             ../machines/operator/test04
           ];
         };
-        atticConfigurationResource = {
-          imports = [
-            commonResourceModule
-            ../machines/operator/test12
-          ];
-        };
       };
 
   nixops4ResourceNixosMockOptions = {
diff --git a/machines/dev/fedi200/default.nix b/machines/dev/fedi200/default.nix
index 36383199..89dfdc95 100644
--- a/machines/dev/fedi200/default.nix
+++ b/machines/dev/fedi200/default.nix
@@ -17,4 +17,10 @@
       gateway = "2a00:51c0:13:1305::1";
     };
   };
+
+  nixos.module = {
+    imports = [
+      ../../../services/fediversity/attic
+    ];
+  };
 }
diff --git a/services/fediversity/attic/default.nix b/services/fediversity/attic/default.nix
index 8a23ea76..66bda1e6 100644
--- a/services/fediversity/attic/default.nix
+++ b/services/fediversity/attic/default.nix
@@ -5,328 +5,318 @@
   ...
 }:
 let
-  inherit (lib) mkIf mkMerge;
   sources = import ../../../npins;
   inherit (import "${sources.nix-templating}/lib.nix" { inherit pkgs; }) fileContents template_text;
+  s3 = {
+    # REVIEW: how were these generated above? how do i add one?
+    s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GKaaaaaaaaaaaaaaaaaaaaaaaa";
+    s3SecretKeyFile = pkgs.writeText "s3SecretKey" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+  };
 in
 {
   imports = with sources; [
-    ./options.nix
     "${vars}/options.nix"
     "${vars}/backends/on-machine.nix"
   ];
 
-  config = mkMerge [
-    (mkIf
-      (
-        config.fediversity.garage.enable
-        && config.fediversity.attic.s3AccessKeyFile != null
-        && config.fediversity.attic.s3SecretKeyFile != null
-      )
+  # fediversity.garage = {
+  #   ensureBuckets = {
+  #     attic = {
+  #       website = true;
+  #       # TODO: these are too broad, after getting everything to work narrow it down to the domain we actually want
+  #       corsRules = {
+  #         enable = true;
+  #         allowedHeaders = [ "*" ];
+  #         allowedMethods = [ "GET" ];
+  #         allowedOrigins = [ "*" ];
+  #       };
+  #     };
+  #   };
+  #   ensureKeys = {
+  #     attic = {
+  #       inherit (s3) s3AccessKeyFile s3SecretKeyFile;
+  #       ensureAccess = {
+  #         attic = {
+  #           read = true;
+  #           write = true;
+  #           owner = true;
+  #         };
+  #       };
+  #     };
+  #   };
+  # };
+
+  services.postgresql = {
+    enable = true;
+    authentication = lib.mkForce ''
+      local all all trust
+    '';
+    ensureDatabases = [
+      "atticd"
+    ];
+    ensureUsers = [
       {
-        fediversity.garage = {
-          ensureBuckets = {
-            attic = {
-              website = true;
-              # TODO: these are too broad, after getting everything to work narrow it down to the domain we actually want
-              corsRules = {
-                enable = true;
-                allowedHeaders = [ "*" ];
-                allowedMethods = [ "GET" ];
-                allowedOrigins = [ "*" ];
-              };
-            };
-          };
-          ensureKeys = {
-            attic = {
-              inherit (config.fediversity.attic) s3AccessKeyFile s3SecretKeyFile;
-              ensureAccess = {
-                attic = {
-                  read = true;
-                  write = true;
-                  owner = true;
-                };
-              };
-            };
-          };
-        };
+        name = "atticd";
+        ensureDBOwnership = true;
       }
-    )
-    (mkIf config.fediversity.attic.enable {
+    ];
+  };
 
-      services.postgresql = {
-        enable = true;
-        authentication = lib.mkForce ''
-          local all all trust
-        '';
-        ensureDatabases = [
-          "atticd"
-        ];
-        ensureUsers = [
-          {
-            name = "atticd";
-            ensureDBOwnership = true;
-          }
-        ];
-      };
-
-      # open up access. 80 is necessary if only for ACME
-      networking.firewall.allowedTCPPorts = [
-        80
-        443
-        8080
-        9000
-      ];
-
-      # https://wiki.nixos.org/wiki/Nginx#TLS_reverse_proxy
-      services.nginx = {
-        enable = true;
-        recommendedProxySettings = true;
-        recommendedTlsSettings = true;
-        virtualHosts."attic.${config.fediversity.domain}" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:8080";
-            proxyWebsockets = true; # needed if you need to use WebSocket
-            extraConfig =
-              # required when the target is also TLS server with multiple hosts
-              "proxy_ssl_server_name on;"
-              +
-                # required when the server wants to use HTTP Authentication
-                "proxy_pass_header Authorization;";
-          };
-        };
-      };
-
-      vars.settings.on-machine.enable = true;
-
-      vars.generators.attic = {
-        runtimeInputs = [
-          pkgs.coreutils
-          pkgs.openssl
-        ];
-        files.token = {
-          secret = true;
-          owner = "atticd";
-        };
-        script = ''
-          openssl genrsa -traditional 4096 | base64 -w0 > "$out"/token
-        '';
-      };
-
-      systemd.services.atticd.serviceConfig = {
-        EnvironmentFile = lib.mkForce "-/tmp/attic.env";
-        ExecStartPre = "${
-          template_text {
-            # FIXME find a place not public
-            outPath = "/tmp/attic.env";
-            text = ''
-              ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="${fileContents config.vars.generators.attic.files.token.path}"
-              AWS_ACCESS_KEY_ID="${fileContents config.fediversity.attic.s3AccessKeyFile}"
-              AWS_SECRET_ACCESS_KEY="${fileContents config.fediversity.attic.s3SecretKeyFile}"
-            '';
-            name = "write";
-          }
-        }/bin/write";
-      };
-
-      services.atticd = {
-        enable = true;
-        environmentFile = "/dev/null"; # set dummy to overwrite
-        # one `monolithic` and any number of `api-server` nodes
-        mode = "monolithic";
-
-        # https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
-        settings = {
-          # Socket address to listen on
-          listen = "127.0.0.1:8080";
-
-          # Allowed `Host` headers
-          #
-          # This _must_ be configured for production use. If unconfigured or the
-          # list is empty, all `Host` headers are allowed.
-          allowed-hosts = [ ];
-
-          # The canonical API endpoint of this server
-          #
-          # This is the endpoint exposed to clients in `cache-config` responses.
-          #
-          # This _must_ be configured for production use. If not configured, the
-          # API endpoint is synthesized from the client's `Host` header which may
-          # be insecure.
-          #
-          # The API endpoint _must_ end with a slash (e.g., `https://domain.tld/attic/`
-          # not `https://domain.tld/attic`).
-          api-endpoint = "https://${config.fediversity.attic.domain}/";
-
-          # Whether to soft-delete caches
-          #
-          # If this is enabled, caches are soft-deleted instead of actually
-          # removed from the database. Note that soft-deleted caches cannot
-          # have their names reused as long as the original database records
-          # are there.
-          #soft-delete-caches = false;
-
-          # Whether to require fully uploading a NAR if it exists in the global cache.
-          #
-          # If set to false, simply knowing the NAR hash is enough for
-          # an uploader to gain access to an existing NAR in the global
-          # cache.
-          #require-proof-of-possession = true;
-
-          # Database connection
-          database = {
-            # Connection URL
-            #
-            # For production use it's recommended to use PostgreSQL.
-            # url = "postgresql:///atticd:password@127.0.0.1:5432/atticd";
-            url = "postgresql:///atticd?host=/run/postgresql";
-
-            # Whether to enable sending on periodic heartbeat queries
-            #
-            # If enabled, a heartbeat query will be sent every minute
-            #heartbeat = false;
-          };
-
-          # File storage configuration
-          storage = {
-            # Storage type
-            #
-            # Can be "local" or "s3".
-            type = "s3";
-
-            # ## Local storage
-
-            # The directory to store all files under
-            # path = "%storage_path%";
-
-            # ## S3 Storage (set type to "s3" and uncomment below)
-
-            # The AWS region
-            region = "garage";
-
-            # The name of the bucket
-            bucket = "attic";
-
-            # Custom S3 endpoint
-            #
-            # Set this if you are using an S3-compatible object storage (e.g., Minio).
-            endpoint = config.fediversity.garage.api.url;
-
-            # Credentials
-            #
-            # If unset, the credentials are read from the `AWS_ACCESS_KEY_ID` and
-            # `AWS_SECRET_ACCESS_KEY` environment variables.
-            # storage.credentials = {
-            #   access_key_id = "";
-            #   secret_access_key = "";
-            # };
-          };
-
-          # Data chunking
-          #
-          # Warning: If you change any of the values here, it will be
-          # difficult to reuse existing chunks for newly-uploaded NARs
-          # since the cutpoints will be different. As a result, the
-          # deduplication ratio will suffer for a while after the change.
-          chunking = {
-            # The minimum NAR size to trigger chunking
-            #
-            # If 0, chunking is disabled entirely for newly-uploaded NARs.
-            # If 1, all NARs are chunked.
-            nar-size-threshold = 65536; # chunk files that are 64 KiB or larger
-
-            # The preferred minimum size of a chunk, in bytes
-            min-size = 16384; # 16 KiB
-
-            # The preferred average size of a chunk, in bytes
-            avg-size = 65536; # 64 KiB
-
-            # The preferred maximum size of a chunk, in bytes
-            max-size = 262144; # 256 KiB
-          };
-
-          # Compression
-          compression = {
-            # Compression type
-            #
-            # Can be "none", "brotli", "zstd", or "xz"
-            type = "zstd";
-
-            # Compression level
-            #level = 8;
-          };
-
-          # Garbage collection
-          garbage-collection = {
-            # The frequency to run garbage collection at
-            #
-            # By default it's 12 hours. You can use natural language
-            # to specify the interval, like "1 day".
-            #
-            # If zero, automatic garbage collection is disabled, but
-            # it can still be run manually with `atticd --mode garbage-collector-once`.
-            interval = "12 hours";
-
-            # Default retention period
-            #
-            # Zero (default) means time-based garbage-collection is
-            # disabled by default. You can enable it on a per-cache basis.
-            #default-retention-period = "6 months";
-          };
-
-          # jwt = {
-          # WARNING: Changing _anything_ in this section will break any existing
-          # tokens. If you need to regenerate them, ensure that you use the the
-          # correct secret and include the `iss` and `aud` claims.
-
-          # JWT `iss` claim
-          #
-          # Set this to the JWT issuer that you want to validate.
-          # If this is set, all received JWTs will validate that the `iss` claim
-          # matches this value.
-          #token-bound-issuer = "some-issuer";
-
-          # JWT `aud` claim
-          #
-          # Set this to the JWT audience(s) that you want to validate.
-          # If this is set, all received JWTs will validate that the `aud` claim
-          # contains at least one of these values.
-          #token-bound-audiences = ["some-audience1", "some-audience2"];
-          # };
-
-          # jwt.signing = {
-          # You must configure JWT signing and verification inside your TOML configuration by setting one of the following options in the [jwt.signing] block:
-          # * token-rs256-pubkey-base64
-          # * token-rs256-secret-base64
-          # * token-hs256-secret-base64
-          # or by setting one of the following environment variables:
-          # * ATTIC_SERVER_TOKEN_RS256_PUBKEY_BASE64
-          # * ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64
-          # * ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
-          # Options will be tried in that same order (configuration options first, then environment options if none of the configuration options were set, starting with the respective RSA pubkey option, the RSA secret option, and finally the HMAC secret option). The first option that is found will be used.
-          # If an RS256 pubkey (asymmetric RSA PEM PKCS1 public key) is provided, it will only be possible to verify received JWTs, and not sign new JWTs.
-          # If an RS256 secret (asymmetric RSA PEM PKCS1 private key) is provided, it will be used for both signing new JWTs and verifying received JWTs.
-          # If an HS256 secret (symmetric HMAC secret) is provided, it will be used for both signing new JWTs and verifying received JWTs.
-
-          # JWT RS256 secret key
-          #
-          # Set this to the base64-encoded private half of an RSA PEM PKCS1 key.
-          # TODO
-          # You can also set it via the `ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64`
-          # environment variable.
-          # token-rs256-secret-base64 = "%token_rs256_secret_base64%";
-
-          # JWT HS256 secret key
-          #
-          # Set this to the base64-encoded HMAC secret key.
-          # You can also set it via the `ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64`
-          # environment variable.
-          #token-hs256-secret-base64 = "";
-          # };
-        };
-      };
-    })
+  # open up access. 80 is necessary if only for ACME
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+    8080
+    9000
   ];
+
+  # https://wiki.nixos.org/wiki/Nginx#TLS_reverse_proxy
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts."attic.fediversity.net" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8080";
+        proxyWebsockets = true; # needed if you need to use WebSocket
+        extraConfig =
+          # required when the target is also TLS server with multiple hosts
+          "proxy_ssl_server_name on;"
+          +
+            # required when the server wants to use HTTP Authentication
+            "proxy_pass_header Authorization;";
+      };
+    };
+  };
+
+  vars.settings.on-machine.enable = true;
+
+  vars.generators.attic = {
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.openssl
+    ];
+    files.token = {
+      secret = true;
+      owner = "atticd";
+    };
+    script = ''
+      openssl genrsa -traditional 4096 | base64 -w0 > "$out"/token
+    '';
+  };
+
+  systemd.services.atticd.serviceConfig = {
+    EnvironmentFile = lib.mkForce "-/tmp/attic.env";
+    ExecStartPre = "${
+      template_text {
+        # FIXME find a place not public
+        outPath = "/tmp/attic.env";
+        text = ''
+          ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="${fileContents config.vars.generators.attic.files.token.path}"
+          AWS_ACCESS_KEY_ID="${fileContents s3.s3AccessKeyFile}"
+          AWS_SECRET_ACCESS_KEY="${fileContents s3.s3SecretKeyFile}"
+        '';
+        name = "write";
+      }
+    }/bin/write";
+  };
+
+  services.atticd = {
+    enable = true;
+    environmentFile = "/dev/null"; # set dummy to overwrite
+    # one `monolithic` and any number of `api-server` nodes
+    mode = "monolithic";
+
+    # https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
+    settings = {
+      # Socket address to listen on
+      listen = "127.0.0.1:8080";
+
+      # Allowed `Host` headers
+      #
+      # This _must_ be configured for production use. If unconfigured or the
+      # list is empty, all `Host` headers are allowed.
+      allowed-hosts = [ ];
+
+      # The canonical API endpoint of this server
+      #
+      # This is the endpoint exposed to clients in `cache-config` responses.
+      #
+      # This _must_ be configured for production use. If not configured, the
+      # API endpoint is synthesized from the client's `Host` header which may
+      # be insecure.
+      #
+      # The API endpoint _must_ end with a slash (e.g., `https://domain.tld/attic/`
+      # not `https://domain.tld/attic`).
+      api-endpoint = "https://attic.fediversity.net/";
+
+      # Whether to soft-delete caches
+      #
+      # If this is enabled, caches are soft-deleted instead of actually
+      # removed from the database. Note that soft-deleted caches cannot
+      # have their names reused as long as the original database records
+      # are there.
+      #soft-delete-caches = false;
+
+      # Whether to require fully uploading a NAR if it exists in the global cache.
+      #
+      # If set to false, simply knowing the NAR hash is enough for
+      # an uploader to gain access to an existing NAR in the global
+      # cache.
+      #require-proof-of-possession = true;
+
+      # Database connection
+      database = {
+        # Connection URL
+        #
+        # For production use it's recommended to use PostgreSQL.
+        # url = "postgresql:///atticd:password@127.0.0.1:5432/atticd";
+        url = "postgresql:///atticd?host=/run/postgresql";
+
+        # Whether to enable sending on periodic heartbeat queries
+        #
+        # If enabled, a heartbeat query will be sent every minute
+        #heartbeat = false;
+      };
+
+      # File storage configuration
+      storage = {
+        # Storage type
+        #
+        # Can be "local" or "s3".
+        type = "s3";
+
+        # ## Local storage
+
+        # The directory to store all files under
+        # path = "%storage_path%";
+
+        # ## S3 Storage (set type to "s3" and uncomment below)
+
+        # The AWS region
+        region = "garage";
+
+        # The name of the bucket
+        bucket = "attic";
+
+        # Custom S3 endpoint
+        #
+        # Set this if you are using an S3-compatible object storage (e.g., Minio).
+        endpoint = "http://s3.garage.fediversity.net:3900";
+
+        # Credentials
+        #
+        # If unset, the credentials are read from the `AWS_ACCESS_KEY_ID` and
+        # `AWS_SECRET_ACCESS_KEY` environment variables.
+        # storage.credentials = {
+        #   access_key_id = "";
+        #   secret_access_key = "";
+        # };
+      };
+
+      # Data chunking
+      #
+      # Warning: If you change any of the values here, it will be
+      # difficult to reuse existing chunks for newly-uploaded NARs
+      # since the cutpoints will be different. As a result, the
+      # deduplication ratio will suffer for a while after the change.
+      chunking = {
+        # The minimum NAR size to trigger chunking
+        #
+        # If 0, chunking is disabled entirely for newly-uploaded NARs.
+        # If 1, all NARs are chunked.
+        nar-size-threshold = 65536; # chunk files that are 64 KiB or larger
+
+        # The preferred minimum size of a chunk, in bytes
+        min-size = 16384; # 16 KiB
+
+        # The preferred average size of a chunk, in bytes
+        avg-size = 65536; # 64 KiB
+
+        # The preferred maximum size of a chunk, in bytes
+        max-size = 262144; # 256 KiB
+      };
+
+      # Compression
+      compression = {
+        # Compression type
+        #
+        # Can be "none", "brotli", "zstd", or "xz"
+        type = "zstd";
+
+        # Compression level
+        #level = 8;
+      };
+
+      # Garbage collection
+      garbage-collection = {
+        # The frequency to run garbage collection at
+        #
+        # By default it's 12 hours. You can use natural language
+        # to specify the interval, like "1 day".
+        #
+        # If zero, automatic garbage collection is disabled, but
+        # it can still be run manually with `atticd --mode garbage-collector-once`.
+        interval = "12 hours";
+
+        # Default retention period
+        #
+        # Zero (default) means time-based garbage-collection is
+        # disabled by default. You can enable it on a per-cache basis.
+        #default-retention-period = "6 months";
+      };
+
+      # jwt = {
+      # WARNING: Changing _anything_ in this section will break any existing
+      # tokens. If you need to regenerate them, ensure that you use the the
+      # correct secret and include the `iss` and `aud` claims.
+
+      # JWT `iss` claim
+      #
+      # Set this to the JWT issuer that you want to validate.
+      # If this is set, all received JWTs will validate that the `iss` claim
+      # matches this value.
+      #token-bound-issuer = "some-issuer";
+
+      # JWT `aud` claim
+      #
+      # Set this to the JWT audience(s) that you want to validate.
+      # If this is set, all received JWTs will validate that the `aud` claim
+      # contains at least one of these values.
+      #token-bound-audiences = ["some-audience1", "some-audience2"];
+      # };
+
+      # jwt.signing = {
+      # You must configure JWT signing and verification inside your TOML configuration by setting one of the following options in the [jwt.signing] block:
+      # * token-rs256-pubkey-base64
+      # * token-rs256-secret-base64
+      # * token-hs256-secret-base64
+      # or by setting one of the following environment variables:
+      # * ATTIC_SERVER_TOKEN_RS256_PUBKEY_BASE64
+      # * ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64
+      # * ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
+      # Options will be tried in that same order (configuration options first, then environment options if none of the configuration options were set, starting with the respective RSA pubkey option, the RSA secret option, and finally the HMAC secret option). The first option that is found will be used.
+      # If an RS256 pubkey (asymmetric RSA PEM PKCS1 public key) is provided, it will only be possible to verify received JWTs, and not sign new JWTs.
+      # If an RS256 secret (asymmetric RSA PEM PKCS1 private key) is provided, it will be used for both signing new JWTs and verifying received JWTs.
+      # If an HS256 secret (symmetric HMAC secret) is provided, it will be used for both signing new JWTs and verifying received JWTs.
+
+      # JWT RS256 secret key
+      #
+      # Set this to the base64-encoded private half of an RSA PEM PKCS1 key.
+      # TODO
+      # You can also set it via the `ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64`
+      # environment variable.
+      # token-rs256-secret-base64 = "%token_rs256_secret_base64%";
+
+      # JWT HS256 secret key
+      #
+      # Set this to the base64-encoded HMAC secret key.
+      # You can also set it via the `ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64`
+      # environment variable.
+      #token-hs256-secret-base64 = "";
+      # };
+    };
+  };
 }
diff --git a/services/fediversity/attic/options.nix b/services/fediversity/attic/options.nix
deleted file mode 100644
index efb9c690..00000000
--- a/services/fediversity/attic/options.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ config, lib, ... }:
-
-{
-  options.fediversity.attic =
-    (import ../sharedOptions.nix {
-      inherit config lib;
-      serviceName = "attic";
-      serviceDocName = "Attic Nix Cache server";
-    })
-    //
-
-    {
-    };
-}
diff --git a/services/fediversity/default.nix b/services/fediversity/default.nix
index a516eac4..184f7dba 100644
--- a/services/fediversity/default.nix
+++ b/services/fediversity/default.nix
@@ -13,7 +13,6 @@ in
     ./mastodon
     ./pixelfed
     ./peertube
-    ./attic
   ];
 
   options = {