diff --git a/profiles/gitea/default.nix b/profiles/gitea/default.nix
index 95ed9bb3..642c33ae 100644
--- a/profiles/gitea/default.nix
+++ b/profiles/gitea/default.nix
@@ -9,7 +9,7 @@
     httpPort = 3001;
     database = {
       type = "postgres";
-      # passwordFile = "/run/secrets/gitea-dbpass"; # supplied by agenix
+      # passwordFile = "/run/secrets/gitea-dbpass"; # TODO supplied by agenix
       password = "somethingunknowablesorry";
     };
     settings = {
@@ -32,10 +32,12 @@
       ''
         gitea-users gitea gitea
       '';
-    ensureDatabases = [ "gitea" ];
+    # ensureDatabases = [ "gitea" ];
     ensureUsers = [
-      { name = "gitea"; ensurePermissions."DATABASE gitea" = "ALLPRIVLEGES"; }
+      { name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVLEGES"; }
     ];
+    # TODO
+    # initialScript # set password for gitea user
   };
 
   services.nginx = {
@@ -46,8 +48,8 @@
     recommendedTlsSettings = true;
     virtualHosts."git.sealight.xyz" = {
       # Gitea hostname
-      enableACME = true; # Use ACME certs
-      forceSSL = true; # Force SSL
+      # enableACME = true; # Use ACME certs
+      # forceSSL = true; # Force SSL
       locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea
     };
   };
diff --git a/profiles/matrix/default.nix b/profiles/matrix/default.nix
index ae29709a..b7a28840 100644
--- a/profiles/matrix/default.nix
+++ b/profiles/matrix/default.nix
@@ -97,11 +97,12 @@
     group = "turnserver";
   };
 
-  services.jitsi-meet = {
-    enable = true;
-    hostName = "jitsi.sealight.xyz";
-  };
-  services.jitsi-videobridge.enable = true;
+  # TODO fix up jitsi bridge stuff
+  ## services.jitsi-meet = {
+  ##   enable = true;
+  ##   hostName = "jitsi.sealight.xyz";
+  ## };
+  ## services.jitsi-videobridge.enable = true;
 
   services.mautrix-telegram = {
     enable = true;
@@ -177,8 +178,9 @@
     ## postgresql user and db name remains in the
     ## service.matrix-synapse.database_args setting which
     ## by default is matrix-synapse
+    # TODO agenix
     initialScript = pkgs.writeText "synapse-init.sql" ''
-      CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
+      CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; 
       CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
           TEMPLATE template0
           LC_COLLATE = "C"
@@ -254,8 +256,8 @@
       ## virtual host for Synapse
       "chat.sealight.xyz" = {
         #forceSSL = true;
-        #enableACME = true;
-        #useACMEHost = "sealight.xyz";
+        #enableACME = true; # TODO
+        #useACMEHost = "sealight.xyz"; # TODO
         locations."/" = {
           proxyPass = "http://localhost:8448";
         };
@@ -263,16 +265,16 @@
       ## virtual host for Riot/Web
       "element.sealight.xyz" = {
         #forceSSL = true;
-        #enableACME = true;
-        #useACMEHost = "sealight.xyz";
+        #enableACME = true; # TODO
+        #useACMEHost = "sealight.xyz"; # TODO
         ## root points to the riot-web package content, also configured via Nix
         locations."/" = {
           root = pkgs.element-web;
         };
       };
       ${config.services.jitsi-meet.hostName} = {
-        #enableACME = true;
-        #forceSSL = true;
+        #enableACME = true; # TODO
+        #forceSSL = true; # TODO
       };
     };
     ## other nginx specific best practices