diff --git a/hosts/caddy/default.nix b/hosts/caddy/default.nix
index 6a1576f..9340354 100644
--- a/hosts/caddy/default.nix
+++ b/hosts/caddy/default.nix
@@ -197,11 +197,6 @@ in
             host = "http://${p.hosts.docker}:3333";
             domain = p.domains.public;
           }
-          {
-            subdomain = "books";
-            host = "http://${p.hosts.docker-vm}:6060";
-            domain = p.domains.public;
-          }
         ];
 
       };
diff --git a/hosts/karakeep/default.nix b/hosts/karakeep/default.nix
index b6b50e1..9f33dd9 100644
--- a/hosts/karakeep/default.nix
+++ b/hosts/karakeep/default.nix
@@ -28,10 +28,10 @@ in
       extraEnvironment = {
         NEXTAUTH_URL = "https://keep.${p.domains.public}";
         CRAWLER_FULL_PAGE_SCREENSHOT = "true";
-        OPENAI_BASE_URL = "https://openrouter.ai/api/v1";
-        INFERENCE_IMAGE_MODEL = "openai/gpt-4o-mini";
-        INFERENCE_TEXT_MODEL = "openai/gpt-4.1-mini";
-        EMBEDDING_TEXT_MODEL = "openai/text-embedding-3-small";
+        OPENAI_BASE_URL = "https://litellm.ts.${p.domains.public}";
+        INFERENCE_IMAGE_MODEL = "GPT-4o Mini";
+        INFERENCE_TEXT_MODEL = "GPT-4.1 Mini";
+        EMBEDDING_TEXT_MODEL = "text-embedding-3-small";
         DISABLE_PASSWORD_AUTH = "true";
         OAUTH_PROVIDER_NAME = "Authentik";
         OAUTH_WELLKNOWN_URL = "https://auth.${p.domains.public}/application/o/karakeep/.well-known/openid-configuration";
@@ -41,5 +41,9 @@ in
     virtualisation.proxmox.enable = true;
   };
 
+  networking.firewall.allowedTCPPorts = [ 3000 ];
+
+  environment.systemPackages = with pkgs; [ ];
+
   system.stateVersion = "25.11";
 }
diff --git a/hosts/parameters.nix b/hosts/parameters.nix
index d031c4b..f189093 100644
--- a/hosts/parameters.nix
+++ b/hosts/parameters.nix
@@ -37,7 +37,6 @@ in
     collabora = "collabora.${private-domain}";
     actual = "actual-budget.${private-domain}";
     karakeep = "karakeep.${private-domain}";
-    docker-vm = "docker-vm.${private-domain}";
   };
   personal = {
     username = "pazpi";
diff --git a/modules/services/karakeep.nix b/modules/services/karakeep.nix
index 859a3b5..fc6ec19 100644
--- a/modules/services/karakeep.nix
+++ b/modules/services/karakeep.nix
@@ -80,9 +80,6 @@ in
         }
         // cfg.extraEnvironment;
       };
-
-      networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     })
 
     (lib.mkIf cfg.proxy.enable {
diff --git a/secrets/karakeep-env.age b/secrets/karakeep-env.age
index 771e4df..77a3695 100644
Binary files a/secrets/karakeep-env.age and b/secrets/karakeep-env.age differ