diff --git a/flake.nix b/flake.nix
index 4b3c089..5562b16 100644
--- a/flake.nix
+++ b/flake.nix
@@ -114,13 +114,6 @@
             source = "rpool_orm";
             target = "rpool_elucredassa/backup/orm";
           };
-          "kalessin-state" = {
-            dataset = "state";
-            sourceHost = "kalessin";
-            targetHost = "elucredassa";
-            source = "rpool_kalessin";
-            target = "rpool_elucredassa/backup/kalessin";
-          };
         };
       };
 
diff --git a/flake/backup.nix b/flake/backup.nix
index dddda69..30bc5bc 100644
--- a/flake/backup.nix
+++ b/flake/backup.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.fountain.backup;
-  keys = import ../keys.nix;
 
   syncOptions = {
     dataset = lib.mkOption {
@@ -92,47 +91,36 @@ in
   # TODO: add some assertions to verify the options
 
   config.flake.colmena = lib.mkMerge (lib.mapAttrsToList
-    (name: sync:
-      let
-        inherit (sync) dataset sourceHost targetHost source target;
-        # TODO: don't want to have to dig into the node config for the fqdn
-        sourceFqdn = config.flake.nixosConfigurations.${sourceHost}.config.networking.fqdn;
-      in
-      {
-        ${sourceHost} = { pkgs, ... }: {
-          randomcat.services.zfs.datasets."${source}/${dataset}".zfsPermissions.users.backup = [ "hold" "send" ];
-
-          users.users.backup = {
-            group = "backup";
-            isSystemUser = true;
-            useDefaultShell = true;
-            openssh.authorizedKeys.keys = cfg.keys.${targetHost};
-            packages = with pkgs; [ mbuffer lzop ]; # syncoid uses these if available but doesn't pull them in automatically
-          };
-          users.groups.backup = { };
+    (name: sync: {
+      ${sync.sourceHost} = { pkgs, ... }: {
+        randomcat.services.zfs.datasets."${sync.source}/${sync.dataset}".zfsPermissions.users.backup = [ "hold" "send" ];
+        users.users.backup = {
+          group = "backup";
+          isSystemUser = true;
+          useDefaultShell = true;
+          openssh.authorizedKeys.keys = cfg.keys.${sync.targetHost};
+          packages = with pkgs; [ mbuffer lzop ]; # syncoid uses these if available but doesn't pull them in automatically
         };
+        users.groups.backup = { };
+      };
 
-        ${targetHost} = {
-          randomcat.services.zfs.datasets.${target}.zfsPermissions.users.syncoid = [ "mount" "create" "receive" "recordsize" ];
-
-          services.syncoid = {
-            enable = true;
-            interval = "*-*-* *:15:00";
-            commonArgs = [ "--no-sync-snap" ];
-            commands = {
-              ${name} = {
-                source = "backup@${sourceFqdn}:${source}/${dataset}";
-                target = "${target}/${dataset}";
-                recursive = true;
-                recvOptions = "ux recordsize o compression=lz4";
-              };
+      ${sync.targetHost} = {
+        randomcat.services.zfs.datasets."${sync.target}".zfsPermissions.users.syncoid = [ "mount" "create" "receive" "recordsize" ];
+        services.syncoid = {
+          enable = true;
+          interval = "*-*-* *:15:00";
+          commonArgs = [ "--no-sync-snap" ];
+          commands = {
+            ${name} = {
+              source = "backup@${config.flake.nixosConfigurations.${sync.sourceHost}.config.networking.fqdn}:${sync.source}/${sync.dataset}";
+              target = "${sync.target}/${sync.dataset}";
+              recursive = true;
+              recvOptions = "ux recordsize o compression=lz4";
             };
           };
-
-          # TODO: this should be handled by a networking module
-          programs.ssh.knownHosts.${sourceFqdn}.publicKey = keys.machines.${sourceHost};
         };
-      })
+      };
+    })
     cfg.sync
   );
 }
diff --git a/hosts/kalessin/default.nix b/hosts/kalessin/default.nix
index 473f587..a26ad8b 100644
--- a/hosts/kalessin/default.nix
+++ b/hosts/kalessin/default.nix
@@ -26,15 +26,5 @@ in
     authorizedKeys.keys = [ ];
   };
 
-  randomcat.services.zfs.datasets = {
-    "rpool_kalessin/state" = { mountpoint = "none"; };
-  };
-
-  services.sanoid.datasets."rpool_kalessin/state" = {
-    useTemplate = [ "production" ];
-    recursive = "zfs";
-    process_children_only = true;
-  };
-
   system.stateVersion = "23.11";
 }
diff --git a/hosts/orm/default.nix b/hosts/orm/default.nix
index 5ee04f6..0db3632 100644
--- a/hosts/orm/default.nix
+++ b/hosts/orm/default.nix
@@ -30,10 +30,12 @@
   services.sanoid.datasets."rpool_orm/state" = {
     useTemplate = [ "production" ];
     recursive = "zfs";
-    process_children_only = true;
   };
 
-  qenya.services.actual.enable = true;
+  qenya.services.actual = {
+    enable = true;
+    domain = "actual.qenya.tel";
+  };
 
   system.stateVersion = "23.11";
 }
diff --git a/services/actual.nix b/services/actual.nix
index d5a1599..c78e2ff 100644
--- a/services/actual.nix
+++ b/services/actual.nix
@@ -3,18 +3,20 @@
 with lib;
 let
   cfg = config.qenya.services.actual;
-  domain = "actual.qenya.tel";
 in
 {
   options.qenya.services.actual = {
-    enable = mkEnableOption "Actual Budget";
+    enable = mkEnableOption "Actual";
+    domain = mkOption {
+      type = types.str;
+    };
   };
 
   config = mkIf cfg.enable {
     services.nginx = {
       enable = true;
       virtualHosts = {
-        ${domain} = {
+        ${cfg.domain} = {
           forceSSL = true;
           enableACME = true;
           locations."/".proxyPass = "http://127.0.0.1:5006/";