diff --git a/.env b/.env
index 1895b59..dbd6669 100644
--- a/.env
+++ b/.env
@@ -2,7 +2,10 @@
 #/            public-key encryption for .env files          /
 #/       [how it works](https://dotenvx.com/encryption)     /
 #/----------------------------------------------------------/
+DOTENV_KEYS_LOADER=dotenvx
+DOTENV_KEYS_LOADED=1
 DOTENV_PUBLIC_KEY="020c13c2e7b3510fe62231d2968375be7f35972e0f8c7a6691110133f72274a2b5"
 
 # .env
-CLOUDFLARE_API_TOKEN="encrypted:BOT8ABBi1jJC+16WvSpKvhjY5ztfV/xQd7dJvdAATjENsLrqoSiUh70Wpc6G0aN4lwU+tT+/N8SvelKQXr86KbPM6efwCIz4vZpiRC31lVoyqnOqqk2QWiDzrY6U+Z74/aJ8evAjkqVDLxhS09/QE+OLJM+sTsymxiFLa1ZM7z0iRncu4m1AHx8="
+CLOUDFLARE_API_TOKEN="encrypted:BKv61BfHcaxS9Z9RnXsXP9YgcugK4Ai1UyYk/tlSOyECeQ1qwFsLvltrxbGOo5lqQ/jzma/Q5o3MgznaWx2/5joeJTAqI+wJkkVfu89bqv1LQzoS0g+MbKiTWDNr0WsQEpxDal+7EMIk9w9vCLc1IQgUYC2Z7cbNDE+GTLizf94JdPqSDTNW2Co="
+CLOUDFLARE_TOKEN="encrypted:BKv61BfHcaxS9Z9RnXsXP9YgcugK4Ai1UyYk/tlSOyECeQ1qwFsLvltrxbGOo5lqQ/jzma/Q5o3MgznaWx2/5joeJTAqI+wJkkVfu89bqv1LQzoS0g+MbKiTWDNr0WsQEpxDal+7EMIk9w9vCLc1IQgUYC2Z7cbNDE+GTLizf94JdPqSDTNW2Co="
diff --git a/.env.ci b/.env.ci
new file mode 100644
index 0000000..a87ec32
--- /dev/null
+++ b/.env.ci
@@ -0,0 +1,9 @@
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY_CI="03ac3fe2e5d6c422ed400943638069e65a838b2e39be52a18a703c06688430b3ab"
+
+# .env.ci
+CLOUDFLARE_API_TOKEN="encrypted:BOhYMDitRRd/48B6rhx8DltXcytmRCpsgTA6NBpgECvKWjb9rTwAf7DGxt5Zl9pTTPGLI/eDljDHL4Cos8cbAcRV6oFE93JW0wNcZui5ySGHBegdlV0yrCneR3AFB3CaCIWRel4hc2U7Qp5QHSXBBLDrRyRzkZB1XlRhVQYVqSC4sQXVLAJhwD0="
+CLOUDFLARE_TOKEN="encrypted:BCS1GqEP2oqMDVsmlEMh6kjR8OEORFX23yQtot9pGTwpGV07tynFGDTMcFvY2o1Eoz9b59mBhtz8nQB86wCmvedbNiqRNuW/tBE9vJMqmu4wAQX5dzsPIkap8FUNjLBA2LH3g1BcDcCFkPIDv5E3nBCihrYZWKS/2PKbRD3gED0baf7oTsGhv/I="
diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000..65ed6e0
--- /dev/null
+++ b/.envrc
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+# Workaround for pipenv since the secrets are encrypted via dotenvx
+export PIPENV_DONT_LOAD_ENV=1
+export PATH="$PWD/script:$PATH"
\ No newline at end of file
diff --git a/dns/andreijiroh.dev.yaml b/dns/andreijiroh.dev.yaml
new file mode 100644
index 0000000..daf6e1b
--- /dev/null
+++ b/dns/andreijiroh.dev.yaml
@@ -0,0 +1,123 @@
+---
+? ''
+: - octodns:
+      cloudflare:
+        auto-ttl: true
+        proxied: true
+    ttl: 300
+    type: ALIAS
+    value: ajhalili2006.helioho.st.
+  - ttl: 120
+    type: MX
+    value:
+      exchange: ajhalili2006.helioho.st.
+      preference: 10
+  - octodns:
+      cloudflare:
+        auto-ttl: true
+    ttl: 300
+    type: TXT
+    values:
+    - 'https://hackclub.com/arcade | #ajhalili2006-lair:hackclub.slack.com'
+    - 'v=spf1 a: ip4:65.19.154.94 ip6:2001:470:1:1ee::2002 include:_spf.mail.ru ~all'
+"*.stellapent-cier.tailnet":
+- ttl: 300
+  type: A
+  value: 100.87.227.94
+- ttl: 300
+  type: AAAA
+  value: fd7a:115c:a1e0::a401:e35e
+_domainkey:
+  ttl: 300
+  type: TXT
+  value: o=-
+_gh-andreijiroh-dev-o:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      comment: gh-org-challenge
+  ttl: 300
+  type: TXT
+  value: 16058f802f
+localdev:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      comment: local caddy server routes
+  ttl: 300
+  type: A
+  value: 127.0.0.1
+matrix:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      comment: Matrix homeserver on Hack Club Nest
+  ttl: 300
+  type: CNAME
+  value: ajhalili2006.hackclub.app.
+mg:
+- ttl: 300
+  type: TXT
+  values:
+  - "v=spf1 include:mailgun.org ~all"
+- ttl: 300
+  type: MX
+  values:
+  - exchange: mxa.mailgun.org.
+    priority: 10
+  - exchange: mxb.mailgun.org.
+    priority: 10
+email.mg:
+  ttl: 300
+  type: CNAME
+  value: mailgun.org.
+k1._domainkey.mg:
+  ttl: 300
+  type: TXT
+  value: k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAug+Y7/HrQqnT9mv30NZCIsMGHYO/fqIqejECU6SzJt6Voi+/VbnhfM8vGiGNbbhlfe81Tl7fqQviZui5zcgHTUj00nTSHHUyiZaOr3rNeQDmZmMTCbyf3c5tYrT442esAl1g1BLmQktQTZCZoTsjxFyZeqhdqLLOUsBVCdbxfIWw035STnbd/yLzhqBisbqzxqrGfdDGXx5/L46l7uPQLlXYVy7P7Opa225tqi4RrNx9aKBrXdv8wc8yE4aooJb+sNd67j/GcznUAIKWr29+eU06zeLp8MPTN21JcLU+Ehr7RdiCbkayrGsjLEVl8K0zjge+qzJA/MiY4RXYO0dE6wIDAQAB
+plesk:
+  octodns:
+    cloudflare:
+      comment: "Plesk dashboard for tommy2"
+      proxied: true
+  ttl: 300
+  type: CNAME
+  value: tommy2.heliohost.org.
+stellapent-cier.tailnet:
+- ttl: 300
+  type: A
+  value: 100.87.227.94
+- ttl: 300
+  type: AAAA
+  value: fd7a:115c:a1e0::a401:e35e
+tommy2heliohost._domainkey:
+  octodns:
+    cloudflare:
+      comment: DKIM setup on heliohost.org
+  ttl: 300
+  type: TXT
+  value: v=DKIM1\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqIQfQhkFCIelBwCGlLCm9FFb36ksaB7vb1Oj/rTzWhz/1xAtg6XtdHHrL2zTzodsEWGFl1eZ5Wjdktb8bqxieVFtdMJJ5r3sW+4Oimx9oDPtA9ZWRw2My231mux9OGSiVhOjKSI+eLzsOAKc/BcLqYrg1PnbkV8lK/T0MQpxX+lSbGidlVM5MVceUgeJ+Kq+D7cbBupFqv8atHO6OxRMDLRqDacwVLGkrjHnOMss9WfZ4st1bTxxCufUSRDKLCevyBcO2IKzsVTt+0nlQQ6UI9lTYqpLJDqA7X6P/o5jF2aAIn+G9mBGwuk/bb/i55oBiEI1+Wu4kVnL6IxEmhLVfwIDAQAB\;
+webmail:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      comment: webmail on heliohost
+      proxied: true
+  ttl: 300
+  type: CNAME
+  value: ajhalili2006.helioho.st.
+wikilab:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: CNAME
+  value: nyc.domcloud.co.
+www:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      proxied: true
+  ttl: 300
+  type: CNAME
+  value: ajhalili2006.helioho.st.
diff --git a/dns/andreijiroh.xyz.yaml b/dns/andreijiroh.xyz.yaml
index 3ddc25d..5557192 100644
--- a/dns/andreijiroh.xyz.yaml
+++ b/dns/andreijiroh.xyz.yaml
@@ -7,11 +7,19 @@
     ttl: 300
     type: ALIAS
     value: ajhalili2006.pages.dev.
-  - ttl: 60
+  - octodns:
+      cloudflare:
+        comment: "mail forwarders"
+        auto-ttl: true
+    ttl: 3000
     type: MX
-    value:
-      exchange: emx.mail.ru.
-      preference: 10
+    values:
+    - exchange: route1.mx.cloudflare.net.
+      preference: 35
+    - exchange: route2.mx.cloudflare.net.
+      preference: 56
+    - exchange: route3.mx.cloudflare.net.
+      preference: 31
   - octodns:
       cloudflare:
         auto-ttl: true
@@ -25,7 +33,8 @@
     - google-site-verification=GNgiK9k5Nox8i3Gq7WByPkHMhzx6FRPeQcbTTpDKe48
     - hosted-email-verify=inik0m2y
     - 'mailru-domain: 4UYCAEDf4JUbpbfM'
-    - v=spf1 redirect=_spf.mail.ru
+    - "v=spf1 include:_spf.mx.cloudflare.net ~all"
+
 '*':
   octodns:
     cloudflare:
@@ -33,6 +42,7 @@
   ttl: 300
   type: CNAME
   value: proxyparty.recaptime.dev.
+
 '*.cdn':
   octodns:
     cloudflare:
@@ -40,6 +50,7 @@
   ttl: 300
   type: CNAME
   value: link.storjshare.io.
+
 '*.docs':
   octodns:
     cloudflare:
@@ -47,6 +58,7 @@
   ttl: 300
   type: CNAME
   value: 5a21222659-hosting.gitbook.io.
+
 '*.localdev':
   octodns:
     cloudflare:
@@ -55,6 +67,7 @@
   ttl: 300
   type: A
   value: 127.0.0.1
+
 _atproto:
   octodns:
     cloudflare:
@@ -62,14 +75,7 @@ _atproto:
   ttl: 300
   type: TXT
   value: did=did:plc:wcx4c3osbuzrwmxkqdfqygwv
-_autodiscover._tcp:
-  ttl: 3000
-  type: SRV
-  value:
-    port: 443
-    priority: 0
-    target: autodiscover.migadu.com.
-    weight: 1
+
 _discord:
   octodns:
     cloudflare:
@@ -78,9 +84,11 @@ _discord:
   ttl: 300
   type: TXT
   value: dh=09859c73c2e139024bb4e94b43909ad94f517852
+
 _dkim.skiff:
   type: TXT
   value: v=DMARC1\; p=reject\; pct=100\; adkim=s\; aspf=s
+
 _dmarc:
   octodns:
     cloudflare:
@@ -88,6 +96,7 @@ _dmarc:
   ttl: 300
   type: TXT
   value: v=DMARC1\; p=quarantine\; rua=mailto:ajhalili2006@andreijiroh.xyz\; rua=mailto:6bb2e1410fb949eb81d0860a68aff331@dmarc-reports.cloudflare.net
+
 _doppler_hvaijucybwcgd:
   octodns:
     cloudflare:
@@ -95,6 +104,7 @@ _doppler_hvaijucybwcgd:
   ttl: 300
   type: TXT
   value: qWmWEi9vPS4SfRf9b6CtBSWCKfkzJM3S
+
 _ens:
   octodns:
     cloudflare:
@@ -102,6 +112,7 @@ _ens:
   ttl: 300
   type: TXT
   value: a=0x84609b9CAE3bf0AE977ECB016B5E59e85C8afaaE
+
 _gh-andreijiroh-dev-o:
   octodns:
     cloudflare:
@@ -110,6 +121,7 @@ _gh-andreijiroh-dev-o:
   ttl: 300
   type: TXT
   value: fd6d051542
+
 _github-pages-challenge-andreijiroh-dev:
   octodns:
     cloudflare:
@@ -118,6 +130,7 @@ _github-pages-challenge-andreijiroh-dev:
   ttl: 300
   type: TXT
   value: e99add8ce4ed5be46875c1cfa2b1cf
+
 _gitlab-pages-verification-code.garden:
   octodns:
     cloudflare:
@@ -126,30 +139,7 @@ _gitlab-pages-verification-code.garden:
   ttl: 300
   type: TXT
   value: gitlab-pages-verification-code=5c9b1d0a8b69ab44215430b4a0bea2c5
-_imaps._tcp:
-  ttl: 3000
-  type: SRV
-  value:
-    port: 993
-    priority: 0
-    target: imap.migadu.com.
-    weight: 1
-_pop3s._tcp:
-  ttl: 3000
-  type: SRV
-  value:
-    port: 995
-    priority: 0
-    target: pop.migadu.com.
-    weight: 1
-_submissions._tcp:
-  ttl: 3000
-  type: SRV
-  value:
-    port: 465
-    priority: 0
-    target: smtp.migadu.com.
-    weight: 1
+
 _vercel:
   octodns:
     cloudflare:
@@ -159,14 +149,7 @@ _vercel:
   values:
   - vc-domain-verify=comments.andreijiroh.xyz,0694106d259e775fb47f
   - vc-domain-verify=scrapbook.andreijiroh.xyz,d2d5ec153e35cafd5e2f
-autoconfig:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: true
-  ttl: 300
-  type: CNAME
-  value: autoconfig.migadu.com.
+
 blog:
   octodns:
     cloudflare:
@@ -175,6 +158,7 @@ blog:
   ttl: 300
   type: CNAME
   value: hashnode.network.
+
 bun-verify:
   octodns:
     cloudflare:
@@ -182,6 +166,7 @@ bun-verify:
   ttl: 300
   type: TXT
   value: 5241ab4fd04baa15cfa2f7d53a3735690e5b4d7d7563c0ad9d482008f87ff5d9
+
 calendar:
   octodns:
     cloudflare:
@@ -189,6 +174,7 @@ calendar:
   ttl: 300
   type: CNAME
   value: ghs.googlehosted.com.
+
 cdn:
   octodns:
     cloudflare:
@@ -197,6 +183,7 @@ cdn:
   ttl: 300
   type: CNAME
   value: link.storjshare.io.
+
 comments:
   octodns:
     cloudflare:
@@ -204,6 +191,7 @@ comments:
   ttl: 300
   type: CNAME
   value: cname.vercel-dns.com.
+
 docs:
   octodns:
     cloudflare:
@@ -211,13 +199,7 @@ docs:
   ttl: 300
   type: CNAME
   value: 5a21222659-hosting.gitbook.io.
-drive:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: CNAME
-  value: ghs.googlehosted.com.
+
 fromthebshq:
   octodns:
     cloudflare:
@@ -225,6 +207,7 @@ fromthebshq:
   ttl: 300
   type: A
   value: 66.6.44.4
+
 garden:
   octodns:
     cloudflare:
@@ -233,6 +216,7 @@ garden:
   ttl: 300
   type: CNAME
   value: proxypartylab.up.railway.app.
+
 go:
   octodns:
     cloudflare:
@@ -241,6 +225,7 @@ go:
   ttl: 300
   type: AAAA
   value: '100::'
+
 go-next:
   octodns:
     cloudflare:
@@ -249,6 +234,7 @@ go-next:
   ttl: 300
   type: AAAA
   value: '100::'
+
 key1._domainkey:
   octodns:
     cloudflare:
@@ -256,6 +242,7 @@ key1._domainkey:
   ttl: 300
   type: CNAME
   value: key1.andreijiroh.xyz._domainkey.migadu.com.
+
 key2._domainkey:
   octodns:
     cloudflare:
@@ -263,6 +250,7 @@ key2._domainkey:
   ttl: 300
   type: CNAME
   value: key2.andreijiroh.xyz._domainkey.migadu.com.
+
 key3._domainkey:
   octodns:
     cloudflare:
@@ -270,6 +258,7 @@ key3._domainkey:
   ttl: 300
   type: CNAME
   value: key3.andreijiroh.xyz._domainkey.migadu.com.
+
 lists:
   octodns:
     cloudflare:
@@ -277,6 +266,7 @@ lists:
   ttl: 300
   type: CNAME
   value: ghs.googlehosted.com.
+
 localdev:
   octodns:
     cloudflare:
@@ -285,13 +275,7 @@ localdev:
   ttl: 300
   type: A
   value: 127.0.0.1
-mail:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: CNAME
-  value: ghs.googlehosted.com.
+
 mailru._domainkey:
   octodns:
     cloudflare:
@@ -299,15 +283,16 @@ mailru._domainkey:
   ttl: 300
   type: TXT
   value: v=DKIM1\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjoVI/UccgpRhb9gqmGkp6DjipSXVIsYeJ9CgAyGVcqyjY9D9p8lEUTDjccf/xHTDjrEFE+EEfr7a2i2X5/B+DvQK/b7M+1q9UpXCsRqRwXICI31OY5Y4A6NRRATWCwMXYwAkgZdIBRmx15/OkSNJI/k5d1dLyJEg9oCxOX2gRfwIDAQAB
+
 matrix:
   octodns:
     cloudflare:
       auto-ttl: true
-      comment: Matrix homeserver on GCP
-      proxied: true
+      comment: Matrix homeserver on Hack Club Nest
   ttl: 300
-  type: A
-  value: 35.239.113.203
+  type: CNAME
+  value: ajhalili2006.hackclub.app.
+
 mc.cdn:
   octodns:
     cloudflare:
@@ -316,6 +301,7 @@ mc.cdn:
   ttl: 300
   type: CNAME
   value: link.storjshare.io.
+
 proxyparty:
   octodns:
     cloudflare:
@@ -324,6 +310,7 @@ proxyparty:
   ttl: 300
   type: CNAME
   value: proxypartylab.up.railway.app.
+
 readings:
   octodns:
     cloudflare:
@@ -332,6 +319,7 @@ readings:
   ttl: 300
   type: A
   value: 107.178.251.177
+
 releases:
   octodns:
     cloudflare:
@@ -340,6 +328,7 @@ releases:
   ttl: 300
   type: CNAME
   value: public.r2.dev.
+
 resend._domainkey.mail.services:
   octodns:
     cloudflare:
@@ -347,6 +336,7 @@ resend._domainkey.mail.services:
   ttl: 300
   type: TXT
   value: p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJJSgDRvWYXEqS6d9q4EqcUd4ZDHyfcLRd4k2gb0bwZ/UKFmQdDmJulZSrtNwtdDY6TG/gn6SV9CTXMNIPomKEaUOzVOWlaZgHJqyWQuE/wldiGna+9Hz2IFg34XLkhngB7b7cH8fAQbYKXPrsVzTKZDRQm57A4nD3BP5+RF5gNQIDAQAB
+
 scrapbook:
   octodns:
     cloudflare:
@@ -354,6 +344,7 @@ scrapbook:
   ttl: 300
   type: CNAME
   value: cname.vercel-dns.com.
+
 scripts:
   octodns:
     cloudflare:
@@ -361,6 +352,7 @@ scripts:
   ttl: 300
   type: CNAME
   value: andreijiroh-dev.github.io.
+
 send.mail.services:
 - octodns:
     cloudflare:
@@ -376,6 +368,7 @@ send.mail.services:
   ttl: 300
   type: TXT
   value: v=spf1 include:amazonses.com ~all
+
 sig1._domainkey:
   octodns:
     cloudflare:
@@ -384,6 +377,7 @@ sig1._domainkey:
   ttl: 300
   type: CNAME
   value: sig1.dkim.andreijiroh.xyz.at.icloudmailadmin.com.
+
 sites:
   octodns:
     cloudflare:
@@ -391,19 +385,7 @@ sites:
   ttl: 300
   type: CNAME
   value: ghs.googlehosted.com.
-skiff:
-- type: MX
-  value:
-    exchange: inbound-smtp.skiff.com.
-    preference: 10
-- type: TXT
-  value: v=spf1 include:po80qbuez9s8e6r.spf.skiff.com -all
-skiff1._domainkey.skiff:
-  type: CNAME
-  value: skiff1.po80qbuez9s8e6r.dkim.skiff.com.
-skiff2._domainkey.skiff:
-  type: CNAME
-  value: skiff2.po80qbuez9s8e6r.dkim.skiff.com.
+
 sponsors:
   octodns:
     cloudflare:
@@ -411,6 +393,7 @@ sponsors:
   ttl: 300
   type: CNAME
   value: 5a21222659-hosting.gitbook.io.
+
 staging.go-next:
   octodns:
     cloudflare:
@@ -419,6 +402,7 @@ staging.go-next:
   ttl: 300
   type: AAAA
   value: '100::'
+
 txt-cdn:
   octodns:
     cloudflare:
@@ -430,6 +414,7 @@ txt-cdn:
   - storj-access:jxcxf2ufbqwycq5wm5xk4p6yd66a
   - storj-root:ajhalili2006-files
   - storj-tls:true
+
 txt-mc.cdn:
   octodns:
     cloudflare:
@@ -441,6 +426,7 @@ txt-mc.cdn:
   - storj-access:juoitzpy3e3kg5ak66ni4b6xcada
   - storj-root:world-downloads
   - storj-tls:true
+
 txt-vod.cdn:
   octodns:
     cloudflare:
@@ -451,6 +437,7 @@ txt-vod.cdn:
   - storj-access:jx77ughm7pvjgpbyvbzlir3sqcbq
   - storj-root:vod-archive
   - storj-tls:true
+
 wiki:
   octodns:
     cloudflare:
@@ -459,6 +446,17 @@ wiki:
   ttl: 300
   type: CNAME
   value: ajhalili2006-garden.pages.dev.
+
+webmail:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      comment: webmail on heliohost
+      proxied: true
+  ttl: 300
+  type: CNAME
+  value: webmail.ajhalili2006.helioho.st.
+
 youtrack:
   octodns:
     cloudflare:
@@ -466,6 +464,7 @@ youtrack:
   ttl: 300
   type: CNAME
   value: ajhalili2006.youtrack.cloud.
+
 zb93278380:
   octodns:
     cloudflare:
@@ -474,6 +473,7 @@ zb93278380:
   ttl: 300
   type: CNAME
   value: zmverify.zoho.com.
+
 zmail._domainkey:
   octodns:
     cloudflare:
diff --git a/dns/octodns-config.yml b/dns/octodns-config.yml
index 135816f..6031f04 100644
--- a/dns/octodns-config.yml
+++ b/dns/octodns-config.yml
@@ -5,10 +5,14 @@ providers:
     enforce_order: False
   cf:
     class: octodns_cloudflare.CloudflareProvider
-    token: env/CLOUDFLARE_API_TOKEN
+    token: env/CLOUDFLARE_TOKEN
+    account_id: cf0bd808c6a294fd8c4d8f6d2cdeca05
     #main_ttl: 120
 
 zones:
+  andreijiroh.dev.:
+    sources: [config]
+    targets: [cf]
   andreijiroh.xyz.:
     sources: [config]
     targets: [cf]
diff --git a/docker/nest/.env.ghost b/docker/nest/.env.ghost
new file mode 100644
index 0000000..eba611c
--- /dev/null
+++ b/docker/nest/.env.ghost
@@ -0,0 +1,12 @@
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY_GHOST="02d8bc0e29587458c05a79f4e2e526f9c835673527ffb8ea60c332a0379d465dbb"
+
+# .env.ghost
+
+mail__transport="SMTP"
+mail__options__service="Mailgun"
+mail__options__auth__user="postmaster@mg.andreijiroh.dev"
+mail__options__auth__pass="encrypted:BCIFdEzkodPmfMBQkxvTWc1soCWh5GVVQ8RZLM5+f07I8E1uDg1TbD6NKXy9D76V0naUVveUUwU3q8Y2nmQXrtYw9y6ORwDmf+O6fBNFZTvTDZOni+FtVpCuyRf7+8uoHoTiRb3pcFxHMiZmA7/ezUxpPoAOUNdmBE5VhY3Wg9ZweULCkeQl8Fgudba7T1pSF65o"
\ No newline at end of file
diff --git a/docker/nest/docker-compose.yml b/docker/nest/docker-compose.yml
new file mode 100644
index 0000000..b3cf016
--- /dev/null
+++ b/docker/nest/docker-compose.yml
@@ -0,0 +1,34 @@
+version: "3.4"
+
+services:
+  ghost:
+    networks:
+    - internal
+    image: ghost:5-alpine
+    restart: unless-stopped
+    ports:
+      - 33291:2368
+    environment:
+      database__client: mysql
+      database__connection__host: db
+      database__connection__user: root
+      database__connection__password: mysql-cahos
+      database__connection__database: ghost
+      url: https://blog.andreijiroh.dev
+    env_file: .env.ghost.decrypted
+    volumes:
+      - ./data/ghost:/var/lib/ghost/content
+  db:
+    networks:
+    - internal
+    image: mysql:8.0
+    restart: always
+    environment:
+      MYSQL_ROOT_PASSWORD: mysql-chaos
+    volumes:
+      - ./data/mysql:/var/lib/mysql
+
+networks:
+  internal:
+    attachable: true
+
diff --git a/script/provider-auth b/script/provider-auth
index 3d8812f..fdb871f 100644
--- a/script/provider-auth
+++ b/script/provider-auth
@@ -6,8 +6,8 @@ if ! command -v dotenvx >> /dev/null; then
 fi
 
 if [[ $CI == "true" ]]; then
-    CLOUDFLARE_API_TOKEN=$(dotenvx get -f .env.ci -- CLOUDFLARE_API_TOKEN)
+    CLOUDFLARE_TOKEN=$(dotenvx get -f .env.ci -- CLOUDFLARE_API_TOKEN)
 else
-    CLOUDFLARE_API_TOKEN=$(dotenvx get CLOUDFLARE_API_TOKEN)
+    CLOUDFLARE_TOKEN=$(dotenvx get CLOUDFLARE_API_TOKEN)
 fi
-export CLOUDFLARE_API_TOKEN
\ No newline at end of file
+export CLOUDFLARE_TOKEN CLOUDFLARE_API_TOKEN=$CLOUDFLARE_TOKEN
\ No newline at end of file