diff --git a/home/neovim/avante.nix b/home/neovim/avante.nix
index 2fd7092..40c9725 100644
--- a/home/neovim/avante.nix
+++ b/home/neovim/avante.nix
@@ -1,4 +1,3 @@
-{ pkgs, ... }:
 {
   # Avante: AI-powered coding assistant (Cursor-like experience in Neovim)
   programs.nixvim = {
@@ -29,7 +28,7 @@
             };
 
             ollama = {
-              endpoint = "http://100.109.179.25:11434"; # tailscale IP, no /v1 suffix
+              endpoint = "http://10.10.0.2:11434";
               model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b"
               timeout = 60000; # local + small model can be slow on first load
               disable_tools = true; # these small models aren't reliable at tool calling
diff --git a/home/opencode.nix b/home/opencode.nix
index d4f3152..898bd96 100644
--- a/home/opencode.nix
+++ b/home/opencode.nix
@@ -12,7 +12,7 @@ _: {
           npm = "@ai-sdk/openai-compatible";
           name = "Ollama (tailscale)";
           options = {
-            baseURL = "http://100.109.179.25:11434/v1";
+            baseURL = "http://10.10.0.2:11434/v1";
           };
           models = {
             "llama3.2:3b" = {
diff --git a/nixos/roles/matrix/postgres-backup.nix b/nixos/roles/matrix/postgres-backup.nix
index fd06baf..96677ad 100644
--- a/nixos/roles/matrix/postgres-backup.nix
+++ b/nixos/roles/matrix/postgres-backup.nix
@@ -50,7 +50,7 @@
                 --network host \
                 postgres:17 \
                 pg_basebackup \
-                  --host=100.109.10.91 \
+                  --host=10.10.0.1 \
                   --port=5432 \
                   --username=replicator \
                   --pgdata=/out/postgresql-replica \
@@ -64,7 +64,7 @@
 
               # primary conninfo
               cat > "$DATADIR/postgresql.auto.conf" <<EOF
-      primary_conninfo = 'host=100.109.10.91 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
+      primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
       EOF
 
               # minimal postgresql.conf
diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix
index c0a67ea..8860773 100644
--- a/nixos/roles/matrix/synapse.nix
+++ b/nixos/roles/matrix/synapse.nix
@@ -149,7 +149,7 @@ in
             type = "metrics";
             bind_addresses = [
               "127.0.0.1"
-              "100.109.10.91"
+              "10.10.0.1"
             ];
             resources = [ ];
           }
@@ -250,7 +250,7 @@ in
         wal_level = "replica";
         max_wal_senders = 5;
         wal_keep_size = "512MB";
-        listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
+        listen_addresses = lib.mkForce "127.0.0.1,10.10.0.1";
         ssl = true;
       };
       authentication = lib.mkAfter ''
diff --git a/nixos/roles/monitoring.nix b/nixos/roles/monitoring.nix
index d92517d..555d479 100644
--- a/nixos/roles/monitoring.nix
+++ b/nixos/roles/monitoring.nix
@@ -134,7 +134,7 @@ in
           metrics_path = "/_synapse/metrics";
           static_configs = [
             {
-              targets = [ "100.109.10.91:9009" ];
+              targets = [ "10.10.0.1:9009" ];
               labels = {
                 instance = "cyper-proxy";
                 job = "master";
@@ -158,7 +158,7 @@ in
           job_name = "postgresql-proxy";
           static_configs = [
             {
-              targets = [ "100.109.10.91:9188" ];
+              targets = [ "10.10.0.1:9188" ];
               labels = {
                 instance = "cyper-proxy";
               };
diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix
index 5f26782..44c5660 100644
--- a/nixos/roles/nginx.nix
+++ b/nixos/roles/nginx.nix
@@ -1,6 +1,6 @@
 _:
 let
-  upstream = "100.109.179.25";
+  upstream = "10.10.0.2";
 
   mkProxy = port: {
     forceSSL = true;
diff --git a/nixos/roles/paperless-ngx.nix b/nixos/roles/paperless-ngx.nix
index 43b9237..184d974 100644
--- a/nixos/roles/paperless-ngx.nix
+++ b/nixos/roles/paperless-ngx.nix
@@ -22,10 +22,10 @@
     settings = {
       PAPERLESS_USE_X_FORWARDED_HOST = true;
       PAPERLESS_USE_X_FORWARDED_PORT = true;
-      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost";
+      PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,10.10.0.2,localhost";
       PAPERLESS_CSRF_TRUSTED_ORIGINS = [
         "https://ngx.cyperpunk.de"
-        "http://100.109.179.25:28101"
+        "http://10.10.0.2:28101"
       ];
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
       PAPERLESS_CONSUMER_POLLING = 60;
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 558deb6..114bf46 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -34,7 +34,6 @@ gitea:
 ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545QgcvDqDFmW0rFBmPJyipaya2srJNoWvKJbnvxWtTYeJh2tPAybRMoUicStIFMUn3FPNfjx/WuQFLhKLoU3UOHHPJnkFqkQ9MBqLq2k5K7MVsNNFTxIDCKS1jPgkTmAWjRZ0EFiRXLa+Gvnz3GP5ltgfjDwdPeb5xp0/AqKPD8jea9w5ClR6ckrRHCLsfXhL2e9IaF4B96JlIv4rICLX3HmeIgM2PKl2MnSt8we5z39bBoLSA0yWG6BvpiMBaFqbo7jeHf1SxI6R404/emHhwW3pwSCDrq2ZE1ATG2UmA5NssFcVuaBPBoQer+n5haVYMNpNUp6rtKZeAIbf5JEOXJ6CJqiInfnnzOMNGhGFkGUYkhsy3p6Ti/lmNMPX/xtY+8ZqMwXf5drssm5KgnQ5nDbVqnTWAhoT/D3t+cJVAaXGTGw88fU0X95dZr8vaL/5nBCj1uUdv5cRBJ8PGhqbBX8PoiXrtGooBGhxf6nHbxIneSzG1++MZGo3e1G,iv:D1lgCnZKm3Gyv6cZpQ7zGW7JXN5RCwoaas+LroTkhPc=,tag:WI6Nr1cX8gm5pjFpu/Ok0w==,type:str]
 ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str]
 nix_cache_priv_key: ENC[AES256_GCM,data:FbRHM4n7BDMDgZYtTOdpS0SQx80afxMC3uw6PtdKb1zcAjyQRYwJe0esTDLklLDh8Kx6dgZOJbrf2sYIzF5xVv09U1Uz0C1UnF4M6yhbg+Nqg0HfVj55L3Z6ulrxNlgq7gY=,iv:F9DZUsyzZocKoB0yByeBcrCw9Ytcp+Xk6y8+ZH4OV7k=,tag:mSf1zVciPkifzr3kVFAt0g==,type:str]
-tailscale_auth_key: ENC[AES256_GCM,data:jJU2WKuiYTLcYyoCXeBMpc/mmjOH6JupIofo5CQbs0bGcnBrv3wNtmI2TR2dqdyohx9d7DJUkjrIgi2OWRI=,iv:zWPqc7cErVZaI6vRbSbPrcEKZmKCoEsDKhnjKTlgsJA=,tag:TLwUzfyyKnmOuWdpTG7Uow==,type:str]
 wireguard:
     cyper-proxy: ENC[AES256_GCM,data:ohe1JLavTPpEcQl+EGPcmJodBn6KaLf7S7aCLrHEgROklcX28Yjm1m4uW0Q=,iv:4iEO3ay0sqaRUxsqR3P7XFpbD6mnnq73yNsZbT22iGU=,tag:HwQaId/xi6OF99z9bZf6ew==,type:str]
     cyper-desktop: ENC[AES256_GCM,data:pABywoxw/BURnpwCfsvXD7jmN+fa6NyHmJIKpR6pkTUNHE2h1xsD64M54JE=,iv:UcDWk1ULbbxBDad/MDD94Iaj2bB/xlpLWtsuPTP6E7c=,tag:La/PWVzumCusn9IaAFkxwQ==,type:str]
@@ -53,7 +52,7 @@ sops:
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t
-    lastmodified: "2026-06-29T09:16:03Z"
-    mac: ENC[AES256_GCM,data:IN9vRP9kYa/KRo2R6A/g2azBLOj/twoX4NY88iT9JG092QVeeSmvgDoQ+heb0b8rBcfFbEtVFZkGZkjr9eUBfp2gaFw1j958PahH/Mm03R++SSoYr29yHlPkBuWUkQzhUv4vQ8nQQvueY8U9FmFEUoP6uV+MBhYkhUyAsONWGZk=,iv:H6zeAUndn98wTGs1elTVPkLJDYbm/n5l5wdD9HBU8qU=,tag:PAYt8w3X/6o+z3h3NHINRA==,type:str]
+    lastmodified: "2026-06-29T09:28:59Z"
+    mac: ENC[AES256_GCM,data:61grzRKB5rRaVat0sIko5B/V5+avtSEoyRwOH3jkWSgcsmVyjigIxfWSWFoMWTEkv1VmxbXA02WXZmMTqUQGsBwHD2chkUV63lTQOQql9yweRk0lLq1kUheDTuRTPwwnerA/1z1ANeUwHknvDzPF1dTisYhlRdH7p8oBRfISmp4=,iv:JxWfbEja2TLBvN/tg6Ub1pFZSJURUeSEkSHnivOGxfo=,tag:eLN5OjHarcQ9u7BYPsO4AA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1