diff --git a/modules/wiki.nix b/modules/wiki.nix
index 9bcabe2..92f8342 100644
--- a/modules/wiki.nix
+++ b/modules/wiki.nix
@@ -5,9 +5,8 @@ let
 in
 {
   sops.secrets = {
-    "mediawiki/postgres".owner = config.users.users.mediawiki.name;
     "mediawiki/initial_admin".owner = config.users.users.mediawiki.name;
-    "mediawiki/ldapprovider".owner = config.users.users.mediawiki.name;
+    "mediawiki/oidc_secret".owner = config.users.users.mediawiki.name;
   };
 
   services = {
@@ -38,13 +37,12 @@ in
         $wgArticlePath = '/$1';
 
         // $wgLogo =  "https://www.c3d2.de/images/ck.png";
-        $wgEmergencyContact = "root@ifsr.de";
-        $wgPasswordSender   = "root@ifsr.de";
         $wgLanguageCode = "de";
 
+        $wgGroupPermissions['*']['read'] = false;
         $wgGroupPermissions['*']['edit'] = false;
-        $wgGroupPermissions['user']['edit'] = true;
-        $wgGroupPermissions['sysop']['interwiki'] = true;
+        $wgGroupPermissions['*']['createaccount'] = false;
+        $wgGroupPermissions['*']['autocreateaccount'] = true;
         $wgGroupPermissions['sysop']['userrights'] = true;
         $wgGroupPermissions['sysop']['deletelogentry'] = true;
         $wgGroupPermissions['sysop']['deleterevision'] = true;
@@ -56,62 +54,35 @@ in
 
         //TODO what about $wgUpgradeKey ?
 
-        $wgScribuntoDefaultEngine = 'luastandalone';
-
-        # LDAP
-        $LDAPProviderDomainConfigs = "${config.sops.secrets."mediawiki/ldapprovider".path}";
+        # Auth
         $wgPluggableAuth_EnableLocalLogin = true;
+        $wgPluggableAuth_Config["iFSR Login"] = [
+          "plugin" => "OpenIDConnect",
+          "data" => [
+            "providerURL" => "${config.services.portunus.domain}/dex",
+            "clientID" => "wiki",
+            "clientsecret" => file_get_contents('${config.sops.secrets."mediawiki/oidc_secret".path}'),
+          ],
+        ];
       '';
 
       extensions = {
-        CiteThisPage = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220627203556/https://extdist.wmflabs.org/dist/extensions/CiteThisPage-REL1_38-bb4881c.tar.gz";
-          sha256 = "sha256-sTZMCLlOkQBEmLiFz2BQJpWRxSDbpS40EZQ+f/jFjxI=";
-        };
-        ConfirmEdit = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220627203619/https://extdist.wmflabs.org/dist/extensions/ConfirmEdit-REL1_38-50f4dfd.tar.gz";
-          sha256 = "sha256-babZDzcQDE446TBuGW/olbt2xRbPjk+5o3o9DUFlCxk=";
-        };
-        Lockdown = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220627203048/https://extdist.wmflabs.org/dist/extensions/Lockdown-REL1_38-1915db4.tar.gz";
-          sha256 = "sha256-YCYsjh/3g2P8oT6IomP3UWjOoggH7jYjiiix7poOYnA=";
-        };
-        intersection = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220627203336/https://extdist.wmflabs.org/dist/extensions/intersection-REL1_38-8525097.tar.gz";
-          sha256 = "sha256-shgA0XLG6pgikqldOfda40hV9zC1eBp+NalGhevFq2Q=";
-        };
-        Interwiki = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220617074130/https://extdist.wmflabs.org/dist/extensions/Interwiki-REL1_38-223bbf8.tar.gz";
-          sha256 = "sha256-A4tQuISJNzzXPXJXv9N1jMat1VuZ7khYzk2jxoUqzIk=";
-        };
-        # requires PluggableAuth
-        LDAPAuthentication2 = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220807184305/https://extdist.wmflabs.org/dist/extensions/LDAPAuthentication2-master-6bc5848.tar.gz";
-          sha256 = "sha256-32xUhahDObS1S9vYJn61HsbpqyFuL0UAsV5+rmH3iWo=";
-        };
-        LDAPProvider = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220806214957/https://extdist.wmflabs.org/dist/extensions/LDAPProvider-master-80f8cc8.tar.gz";
-          sha256 = "sha256-Y59otw6onknVsjRhyH7L7I0MwnBkvQtuzwpj7c0GZzc=";
-        };
-        ParserFunctions = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220627203519/https://extdist.wmflabs.org/dist/extensions/ParserFunctions-REL1_38-bc6a7c6.tar.gz";
-          sha256 = "sha256-iDv4VSSFnTKEhvlVQcHHVp2hSWwDbv6jNCq1kOGuswo=";
-        };
         PluggableAuth = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220807185047/https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_38-126bad8.tar.gz";
-          sha256 = "sha256-cdJdhj7+qisVVePuyKDu6idoUy0+gYo3zMN0y6weH84=";
+          url = "https://web.archive.org/web/20230615112924/https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-068be5d.tar.gz";
+          hash = "sha256-kmdSPMQNaO0qgEzb8j0+eLlsNQLmfJfo0Ls4yvYgOFI=";
         };
-        #Scribunto = pkgs.fetchzip {
-        #  url = "https://web.archive.org/web/20220627202748/https://extdist.wmflabs.org/dist/extensions/Scribunto-REL1_38-9b9271a.tar.gz";
-        #  sha256 = "sha256-4sy2ZCnDFzx43WzfS4Enh+I0o0+sFl1RnNV4xGiyU0k=";
-        #};
-        SyntaxHightlight = pkgs.fetchzip {
-          url = "https://web.archive.org/web/20220627203440/https://extdist.wmflabs.org/dist/extensions/SyntaxHighlight_GeSHi-REL1_38-79031cd.tar.gz";
-          sha256 = "sha256-r1NgrhSratleQ356imxmF7KmAANvWvKpAgnLkm8IdKY=";
+        OpenIDConnect = pkgs.fetchzip {
+          url = "https://web.archive.org/web/20230615113527/https://extdist.wmflabs.org/dist/extensions/OpenIDConnect-REL1_39-42e4d75.tar.gz";
+          hash = "sha256-VN0G0Crjlx0DTLeDvaSFtMmYsfB7VzgYkSNDS+nkIyQ=";
         };
       };
     };
 
+    portunus.dex.oidcClients = [{
+      id = "wiki";
+      callbackURL = "https://${domain}/Spezial:PluggableAuthLogin";
+    }];
+
     nginx = {
       recommendedProxySettings = true;
       virtualHosts.${domain} = {
diff --git a/secrets/quitte.yaml b/secrets/quitte.yaml
index 6b171eb..ee2f080 100644
--- a/secrets/quitte.yaml
+++ b/secrets/quitte.yaml
@@ -2,16 +2,15 @@ nextcloud_adminpass: ENC[AES256_GCM,data:AJHISi8zIVXOMPZAghgBhEsIYS9NT4XogmyCC5T
 hedgedoc_session_secret: ENC[AES256_GCM,data:l5a9sd731MDjNRu85XNOWJcGmNkMLsyW1jHbucn9fGg=,iv:SZhcy7IWD0pwCnL03QH5VKHsIvvAL/Ex7zFiSp2JQ60=,tag:chWdf27vLwb4W4SQl/Y7Ug==,type:str]
 wg-fsr: ENC[AES256_GCM,data:g4h7yCox7rLhJOVkvEPJi0g8pVMf6OduI5LpcmXBOrQHEbnyj6OajD3nbO0=,iv:WWyvftIoWwUv7MmcnVobcyFYyLdpbK5zDhj17j30VQk=,tag:ZxSkrRGfSL119/E4eNcntA==,type:str]
 dex:
-    environment: ENC[AES256_GCM,data:fUrU7LODoV8OSQpONZO1+e2VloOg03w/ITr/8XKExBbrGRVRyNfcvUc9mX8xW+RD+1JbvDLKA4IP4qdP+ABTgNmNj0EIi+/A4TdH5zvPkVtDVDb8Vc7VIG2CadRhC4u3OQDm25Qnh5zenL5tKAMm76Yl/8KARb/JEMFglY+a2Xc3Tm25GJF1UwN97CqrqObEWV4UYBHjUe87ZA+x6lTJ0tTJa1mZsgLLB6535fEEw+WRGg/dVRAjSG9Ym0l76C0Ka3y2bYwTofJFqK80o3Xr/7E1JsmI,iv:W8hEPM1exRJzN85hdSYm2yFeJvy+XkalA5AREAVbXHs=,tag:cvPS/BgRExxE9nWiJd9hCw==,type:str]
+    environment: ENC[AES256_GCM,data:98xqoRjGZX40f2+gqTiLITuj3285sa359gapa2XurQQD6zg0mqmDTxgcU2dj0Q6k9GE0l5xF5bkguA1eVofylTY9mbidWy5BThisqb1Krv6/gdfybY8Vft/x/A8Y5S71iAzyQkSeLj9Dyoh2Jjro5eSpiA5GnAgTnFL3q3mhy8herANRNMSP6s2A5Exzsw0qzTC22KGlmAycGP2jlm3OU9cqwLYWR0WItJBE/2hYaRSaow/VVuQLTY2zdqrs6cp8SmOiMDdJ5teu910/FLi13jah9148jNKZqLtKx3gxiHweBKjjFglj+jZMTQu3O9aGF7CR3y/EuzAAnqMR5dahONURu06w/0KSXCHX14DxfFU=,iv:meB+u6JhU24aqOHJLmxH37k7DOuuDc61V7R3rMm/qic=,tag:eAzSueiRa3EfSnpZxxGiXw==,type:str]
 portunus:
     admin-password: ENC[AES256_GCM,data:9EglcINrzDw1d4VaZALOFy3KddlwAvaWRuUZvXXCmE8=,iv:Z33gf3BqmtvSTNadrAQl0LgU1fZ8fReyO4fFBvy+vlw=,tag:zPTvOeEsc+MvqigesaBMkw==,type:str]
     search-password: ENC[AES256_GCM,data:Rf69jCganUJJxyR44mbEgB475SitvvqGCmsMXHH5VAw=,iv:ilOVy1r+HAY3t26yJiO6jExtrl7kll8Mi6fqzBcjYRQ=,tag:KyZCbPhlLSkgkxGT2Du5AQ==,type:str]
 dovecot_ldap_search: ENC[AES256_GCM,data:e19xmqOra7xJPPVnW7FtCV6q1JfTDnzgtvEpAY3SFuxCJ8Ucnt/6c/ZlJEM=,iv:XlYw6XpvENraLCnoGpEnqa2pg7VIuU0WyFZJRqjusmc=,tag:UaPkh/Vtv61kRaW3s1dznw==,type:str]
 rspamd-password: ENC[AES256_GCM,data:mn8UWBlXKG1s7cP/sLW6DWiqbAydEbv8q1rJzX5zNaZEMjpYAxrGj54Md5XmwQ==,iv:C9vvICgL7GbsOsWx5FyFktospIomfZK4qPh8qMqCELo=,tag:stOGL8UmHocAGWjjjRNZVw==,type:str]
 mediawiki:
-    postgres: ENC[AES256_GCM,data:EplJskUzYHDT/qu6IG+XrOEZ5aW3J3XN9w35xGku6Fc=,iv:8U+qlD1SQzxUyD/6QK4SdwRCDyMODK/lP0IDrLlcQ4U=,tag:qVoagL+tYtvj2RHgVa5geA==,type:str]
-    initial_admin: ENC[AES256_GCM,data:VLOTTj4cl7sSh2k7AKNuOHsxeNaHU5pu/jNDWtEkOa8=,iv:11iDbCrpzjCdyAB22R8NknJ6vzcpVZXCXB3iWsGWXw0=,tag:osQCjkvWo4Yt53OszQWRMA==,type:str]
-    ldapprovider: ENC[AES256_GCM,data:gHoj3B0HV2cvd94VzCQS1RqvVp7E07UMjd+noNwgc3tOb6WoBr6Uc+r7NZcRmbdxLsdDjvdix0QqHZCCF1m8plJJgWisoDKjDnKVl89bWeEZ0liG78nZ8DGfqNdl3p5zwm7dh8Dtuf3nNkwdWv6LtciaqUpn9NhhccTWdlgiwmTZqv5ZxtfcCHAauFaBi+HLcxTzsXFx5DLyj8xHgzkw9N/rZ3RgL0CNbrwsy3JmDi/NbL91lY7i+Is0NylCbr5pL6QUSCfgjU1cscehEh87jNMhdPS/re4s9yQ1uVaa/X/j7fEkjCDGYuqHogR5B9EjdGO6k8cnf6kjvyVyk19fHDZgmkwR7AK2t7iMpagq7J4T+QqZf0Yvy+NKWGcH+X8f6gA2LOGHVWghU/FnsaefDadAiHoVZBrkze69L6luhORzeMu/JMC8BNJbP5TqUaKIyPG0cZSPLJCvqmc0frNv2bIM6+8z1FkUCBDzucNVzTt/Fhxto7Epb+TcAqrOgEC1/sqr7sANOT2in+KnmZE0JUIsF1JDgH1FuLxX2XQnglmcPmm84NA9erhf6IbY3jyFswPnb3yyG9nPf+bVgkBS3fYhl+psLIrjgGidtlyg/vRABK5VNURs1oojRHCjQmKB1F7+ovd8gR/UTdpRT9o9Px6Uue5RuNAf6O34FSBO4SiaBkMJnvbR9wv++JqXNjQh7wUSEfdkP/FiNq3C7kaMcVvdzIjnKMdyQRuBe+NbF9Ak8JtALHMuPRVm9cbRHCuWyf3sMPxk2Bl5EVXM1pPxfrI=,iv:n2XOs6F7kuMmjPCc14s2MQl37vjVTtmAVkYQp7kqjgc=,tag:qdrPN6BscKHLz/kMmB/3Bw==,type:str]
+    initial_admin: ENC[AES256_GCM,data:osX7QwHPfmFAJHGuXHY/td7Z+JNzHicixZRvWNLfG+o=,iv:SuKTItyOipoVqx/39+UTDg8npsp0jDaK94k9rPfYdkA=,tag:emNMythpZGwm3Rp8Nx5xCw==,type:str]
+    oidc_secret: ENC[AES256_GCM,data:2JRvHObJ5xB3A0XduUwdF9a7zzeEPz1nElLEzWC6Hz4=,iv:1tKMlme1bR5JcEk07Xpq99+OHxdtCxjc4xHNlBxq7X0=,tag:cyhstQYvEmjI5Zjj2GWtFQ==,type:str]
 mautrix-telegram_env: ENC[AES256_GCM,data:cuQLaLyZ/hSQsN0DnyuBSsIuoZGTUrDsV0lNq6Ky/1pgd5Ull9OYJu5bsgMWauki6lOprxqBE+32TSoWPb8WFUT9/NO7U9b+aoaCs/R8HeePxnaIyiBiGv881YY54Ze8jLXFU3XAxj4VHESSCNSEktApTvJvd1VXJjJGoV3iFWZhl1VbLsE+lQSHSiDLU6JqUyXa6k1BGUepGrkwObGoKyLVFODF3uahXsXtcfgbMQ4UfqZevh44dj+kDDtohXje,iv:jmcWTyVkqu9nDc1ws2NxkMKrHPZ13i3jqDkk4Y0kejw=,tag:h7llbDCz8PmvfxLzrQlrCA==,type:str]
 postfix_ldap_aliases: ENC[AES256_GCM,data:BVLLg5m20/tUNVQcefFJz8sKWNHaGve+FUoOaSuMNFjIzVjIbpyZPfRDk8Pr+h6Kz2Lt/gQYAynO9xgk5RvUvrPzdq5xnp+TU3eSPpteh4lg+ey83xesstB2BXVEDzAKMwsa5QGca7vdtOIIEhr0CYAWoGlzR6fKDuUxmpWZ7DYwkhPppfdEIyPnbwt0v7Ll2K9dRQ1ZicS9y+Mgfs7LgV830si+Fv52tv4jrLpzVPaY2IQfIO1u5wdx6YDnnnOC4Fv73hM6BjYD1r3sgbiUvh0IVEl/LKdTnlEfEdpTvtZHAdY=,iv:Itf6cCQtolbaAAd84ymT889poOB0xn4yO3QHK7tl/n0=,tag:0GslHkKaj9aNzvRukBU11A==,type:str]
 vaultwarden_env: ENC[AES256_GCM,data:lGDemdGgYemaaWhWBPEMuP4yie5Ceum5ZZ0hKRLz8TJENrBNuTGGnG9cQ+L5m0uC4c0+GmRYHZZFAbWxz2JAjx8rR3lGQkSzbynTWKPuVMMulsjMO1DLVcRv5MzLRNAKgZnqiNYGXOMVhGNyTq+qNgp02TEpDJytfP5U1ZzQcjaPKmCUkEUSH0I=,iv:foByTYQw1KnB1MmwSQqmwza9PJJmdYdZbIHKrZ9vog4=,tag:OoqJ5kIjNaJZYyno31x5rA==,type:str]
@@ -37,8 +36,8 @@ sops:
             dFpScGZzYlFQZWMyUEErOVhVVjc4SlkK3KUct/NJwDdeGeWrqbZ5eAIb/G8f/ZCI
             T4gO0Y/fznXkNf1fm5d3JHwTC8yAzxmSSGu2f/LLzKx1oNeAw0Ll4Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-14T09:31:12Z"
-    mac: ENC[AES256_GCM,data:0/gNAktF8rg+C45Hl8KSTFZAlHtrkpr60xzrpQv0GlRjmiZnB5uRuVEd8NucAGVFRi84MlZIktbnhoiCjk5It6FfQaAPkWI8UN2BS+A8r+ke7nGLaxuhhjriCgV9tw66ypJ6qTrNG4P0rj1bgD4+tfaI5jM2qtwscfNbqiLFMCY=,iv:d+ZZoQdKDoyWM+Q3D+/hOZdxBXUxnKdKp1ExfYMqG/w=,tag:iaTDHOBirQO7o3y2wszIAQ==,type:str]
+    lastmodified: "2023-08-16T11:51:53Z"
+    mac: ENC[AES256_GCM,data:aVF7WJ1MjgLPBN7qv8KO/HQbpyyCLQyW6U8rQCSN/VjSDW7vGf7hU0NtL51/L/daHcPWI5QJqpZtuYO1WZuwYyiDqBdtgQbhUIeIp8N9fIioxV7iW7PXSrwnLsnlIQl5HC3wxWGMsgQmYBz/CijJMRZkf06ITOuiS8llOphd+Ho=,iv:gmO9iGB4qfoeCPMmXBhz0jRymsuz2s2mBgHKrkm5gCc=,tag:kPu9MDFeju3T/OA720NQlg==,type:str]
     pgp:
         - created_at: "2023-08-14T09:07:55Z"
           enc: |