diff --git a/flake.nix b/flake.nix
index 6b44ac1..454689f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,10 +29,31 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # Homelab inputs
+
     inputs.copyparty = {
       url = "github:9001/copyparty?tag=v1.20.16";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    tangled = {
+      url = "git+https://tangled.org/tangled.org/core?ref=refs/tags/v1.15.0-alpha";
+      inputs.nixpkgs.follows = "nixpkgs";
+      # Disable useless monorepo inputs
+      inputs.actor-typeahead-src.follows = "";
+      inputs.fenix.follows = "";
+      inputs.htmx-src.follows = "";
+      inputs.htmx-ws-src.follows = "";
+      inputs.ibm-plex-mono-src.follows = "";
+      inputs.inter-fonts-src.follows = "";
+      inputs.lucide-src.follows = "";
+      inputs.mermaid-src.follows = "";
+    };
+
+    inputs.tranquil = {
+      url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
diff --git a/hosts/fant0mib0t/default.nix b/hosts/fant0mib0t/default.nix
index ea993e2..87dd86b 100644
--- a/hosts/fant0mib0t/default.nix
+++ b/hosts/fant0mib0t/default.nix
@@ -11,6 +11,7 @@
   ++ builtins.map (i: ../../modules/${i}) ([
     "caddy"
     "radius"
+    "tangled"
   ]);
 
   # Bootloader
diff --git a/hosts/fant0mib0t/nfs.nix b/hosts/fant0mib0t/nfs.nix
new file mode 100644
index 0000000..12ca120
--- /dev/null
+++ b/hosts/fant0mib0t/nfs.nix
@@ -0,0 +1,9 @@
+{ ... }:
+{
+  fileSystems."/nas" = {
+    device = "172.16.20.10:/data";
+    fsType = "nfs";
+  };
+
+  boot.supportedFilesystems = [ "nfs" ];
+}
diff --git a/modules/caddy/common b/modules/caddy/common
new file mode 100644
index 0000000..d65ee63
--- /dev/null
+++ b/modules/caddy/common
@@ -0,0 +1,16 @@
+{
+  email simon@renoux.dev
+}
+
+(logging) {
+    log {
+        output file /var/log/{args[0]}.log
+        format console
+        # level error
+    }
+}
+
+@local_net client_ip 172.16.0.0/12
+@server_net client_ip 172.16.20.0/24
+@admin_net client_ip 172.16.10.0/24
+@guest_net client_ip 172.16.100.0/24
diff --git a/modules/caddy/conseil b/modules/caddy/conseil
index b7f263b..8141f8e 100644
--- a/modules/caddy/conseil
+++ b/modules/caddy/conseil
@@ -1,14 +1,4 @@
-{
-  email simon@renoux.dev
-}
-
-(logging) {
-    log {
-        output file /var/log/{args[0]}.log
-        format console
-        # level error
-    }
-}
+import common
 
 conseil.renoux.dev {
   respond "Welcome!"
@@ -26,6 +16,7 @@ files.fantomitechno.dev {
 
 s3.fantom.internal {
   import logging garage
+  abort not @server_net
   reverse_proxy 127.0.0.1:3900 {
     header_up X-Forwarded-For {remote_host}
     header_up X-Forwarded-Proto {scheme}
@@ -34,6 +25,7 @@ s3.fantom.internal {
 
 s3.fantom.home {
   import logging garage
+  abort not @local_net
   reverse_proxy 127.0.0.1:3901 {
     header_up X-Forwarded-For {remote_host}
     header_up X-Forwarded-Proto {scheme}
diff --git a/modules/caddy/default.nix b/modules/caddy/default.nix
index 6629b55..18646cc 100644
--- a/modules/caddy/default.nix
+++ b/modules/caddy/default.nix
@@ -4,5 +4,8 @@
     enableReload = true;
     configFile = "${dotfileFolder}/modules/caddy/${hostname}";
     openFirewall = true;
+
+    httpPort = 80;
+    httpsPort = 443;
   };
 }
diff --git a/modules/caddy/fant0mib0t b/modules/caddy/fant0mib0t
index 834cf99..7268fad 100644
--- a/modules/caddy/fant0mib0t
+++ b/modules/caddy/fant0mib0t
@@ -1,14 +1,4 @@
-{
-  email simon@renoux.dev
-}
-
-(logging) {
-    log {
-        output file /var/log/{args[0]}.log
-        format console
-        # level error
-    }
-}
+import common
 
 fant0mib0t.renoux.dev {
   respond "Welcome!"
diff --git a/modules/ssh.nix b/modules/ssh.nix
index f50bd63..ec0e006 100644
--- a/modules/ssh.nix
+++ b/modules/ssh.nix
@@ -1,6 +1,6 @@
-{ ... }: {
+{ lib, ... }: {
   services.openssh = {
-    enable = true;
+    enable = lib.mkDefault true;
     openFirewall = true;
     settings = {
       PasswordAuthentication = false;
@@ -10,5 +10,6 @@
       MaxAuthTries = 3;
       PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
     };
+    ports = [ 22 ];
   };
 }
diff --git a/modules/tangled/default.nix b/modules/tangled/default.nix
new file mode 100644
index 0000000..bfbf8d4
--- /dev/null
+++ b/modules/tangled/default.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./knot.nix
+    ./spindle.nix
+  ];
+}
diff --git a/modules/tangled/knot.nix b/modules/tangled/knot.nix
new file mode 100644
index 0000000..7fa9d07
--- /dev/null
+++ b/modules/tangled/knot.nix
@@ -0,0 +1,25 @@
+{ flakes, ... }: {
+  imports = [
+    flakes.inputs.tangled.nixosModules.knot
+  ];
+
+  services = {
+    tangled.knot = {
+      enable = true;
+      gitUser = "git";
+      stateDir = "/var/lib/tangled-knot";
+      repo.scanPath = "/nas/knot/repos";
+      motd = "mreoow";
+      server = {
+        listenAddr = "127.0.0.1:4000";
+        hostname = "knot.fantomitechno.dev";
+        owner = "did:plc:q2leouakch2kg4ruldreunip";
+      };
+    };
+
+    openssh = {
+      settings.AllowUsers = [ "git" ];
+      settings.AllowGroups = [ "git" ];
+    };
+  };
+}
diff --git a/modules/tangled/spindle.nix b/modules/tangled/spindle.nix
new file mode 100644
index 0000000..1b112b4
--- /dev/null
+++ b/modules/tangled/spindle.nix
@@ -0,0 +1,15 @@
+{ flakes, ... }: {
+  imports = [
+    flakes.inputs.tangled.nixosModules.spindle
+  ];
+
+  services.tangled.spindle = {
+    enable = true;
+    server = {
+      listenAddr = "127.0.0.1:4001";
+      hostname = "spindle.fantomitechno.dev";
+      owner = "did:plc:q2leouakch2kg4ruldreunip";
+    };
+    pipelines.workflowTimeout = "10m";
+  };
+}