diff --git a/hosts/caddy/default.nix b/hosts/caddy/default.nix
index 9340354..6a1576f 100644
--- a/hosts/caddy/default.nix
+++ b/hosts/caddy/default.nix
@@ -197,6 +197,11 @@ in
             host = "http://${p.hosts.docker}:3333";
             domain = p.domains.public;
           }
+          {
+            subdomain = "books";
+            host = "http://${p.hosts.docker-vm}:6060";
+            domain = p.domains.public;
+          }
         ];
 
       };
diff --git a/hosts/karakeep/default.nix b/hosts/karakeep/default.nix
index 9f33dd9..b6b50e1 100644
--- a/hosts/karakeep/default.nix
+++ b/hosts/karakeep/default.nix
@@ -28,10 +28,10 @@ in
       extraEnvironment = {
         NEXTAUTH_URL = "https://keep.${p.domains.public}";
         CRAWLER_FULL_PAGE_SCREENSHOT = "true";
-        OPENAI_BASE_URL = "https://litellm.ts.${p.domains.public}";
-        INFERENCE_IMAGE_MODEL = "GPT-4o Mini";
-        INFERENCE_TEXT_MODEL = "GPT-4.1 Mini";
-        EMBEDDING_TEXT_MODEL = "text-embedding-3-small";
+        OPENAI_BASE_URL = "https://openrouter.ai/api/v1";
+        INFERENCE_IMAGE_MODEL = "openai/gpt-4o-mini";
+        INFERENCE_TEXT_MODEL = "openai/gpt-4.1-mini";
+        EMBEDDING_TEXT_MODEL = "openai/text-embedding-3-small";
         DISABLE_PASSWORD_AUTH = "true";
         OAUTH_PROVIDER_NAME = "Authentik";
         OAUTH_WELLKNOWN_URL = "https://auth.${p.domains.public}/application/o/karakeep/.well-known/openid-configuration";
@@ -41,9 +41,5 @@ in
     virtualisation.proxmox.enable = true;
   };
 
-  networking.firewall.allowedTCPPorts = [ 3000 ];
-
-  environment.systemPackages = with pkgs; [ ];
-
   system.stateVersion = "25.11";
 }
diff --git a/hosts/parameters.nix b/hosts/parameters.nix
index f189093..d031c4b 100644
--- a/hosts/parameters.nix
+++ b/hosts/parameters.nix
@@ -37,6 +37,7 @@ in
     collabora = "collabora.${private-domain}";
     actual = "actual-budget.${private-domain}";
     karakeep = "karakeep.${private-domain}";
+    docker-vm = "docker-vm.${private-domain}";
   };
   personal = {
     username = "pazpi";
diff --git a/modules/services/karakeep.nix b/modules/services/karakeep.nix
index fc6ec19..859a3b5 100644
--- a/modules/services/karakeep.nix
+++ b/modules/services/karakeep.nix
@@ -80,6 +80,9 @@ in
         }
         // cfg.extraEnvironment;
       };
+
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
+
     })
 
     (lib.mkIf cfg.proxy.enable {
diff --git a/secrets/karakeep-env.age b/secrets/karakeep-env.age
index 77a3695..771e4df 100644
Binary files a/secrets/karakeep-env.age and b/secrets/karakeep-env.age differ