diff --git a/hosts/lala/netbird.nix b/hosts/lala/netbird.nix
index fb87592..af2e2be 100644
--- a/hosts/lala/netbird.nix
+++ b/hosts/lala/netbird.nix
@@ -6,16 +6,20 @@
   ...
 }:
 let
+  unstable = inputs.unstable.legacyPackages.${pkgs.stdenv.hostPlatform.system};
   domain = "moppu.dev";
   netbirdDomain = "netbird.${domain}";
   netbirdUrl = "https://${netbirdDomain}";
   stateDir = "/var/lib/netbird-mgmt";
   dashboardPort = 1234;
   relayPort = 33080;
+  proxyPort = 8443;
   coturnPass = config.sops.secrets."lala/netbird/coturnPass".path;
   dataStoreKey = config.sops.secrets."lala/netbird/dataStoreKey".path;
   relaySecret = config.sops.secrets."lala/netbird/relaySecret".path;
   relaySecretEnv = config.sops.secrets."lala/netbird/relaySecretEnv".path;
+  proxySecret = config.sops.secrets."lala/netbird/proxySecret".path;
+  proxySecretEnv = config.sops.secrets."lala/netbird/proxySecretEnv".path;
   idpKey = config.sops.secrets."lala/netbird/idpKey".path;
 in
 {
@@ -24,6 +28,8 @@ in
     "lala/netbird/dataStoreKey" = { };
     "lala/netbird/relaySecret" = { };
     "lala/netbird/relaySecretEnv" = { };
+    "lala/netbird/proxySecret" = { };
+    "lala/netbird/proxySecretEnv" = { };
     "lala/netbird/idpKey" = { };
   };
 
@@ -64,6 +70,20 @@ in
       log.level = "INFO";
     };
     dynamicConfigOptions = {
+      tcp = {
+        routers = {
+          proxy-passthrough = {
+            rule = "HostSNI(`*`)";
+            entryPoints = "websecure";
+            tls.passthrough = true;
+            service = "proxy-tls";
+            priority = 1;
+          };
+        };
+        services.proxy-tls.loadBalancer.servers = [
+          { address = "localhost:${toString proxyPort}"; }
+        ];
+      };
       http = {
         routers = {
           netbird-dashboard = {
@@ -71,7 +91,7 @@ in
             entryPoints = "websecure";
             tls.certResolver = "letsencrypt";
             service = "netbird-dash";
-            priority = 1;
+            priority = 10;
           };
           netbird-signal = {
             rule = "Host(`${netbirdDomain}`) && PathPrefix(`/ws-proxy/signal`)";
@@ -198,45 +218,93 @@ in
     };
   };
 
-  systemd.services.netbird-relay = {
-    enable = true;
-    description = "The relay service for Netbird, a wireguard VPN";
-    documentation = [ "https://netbird.io/docs/" ];
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    environment = {
-      NB_LOG_LEVEL = "info";
-      NB_LISTEN_ADDRESS = ":${toString relayPort}";
-      NB_EXPOSED_ADDRESS = "rels://${netbirdDomain}:${toString relayPort}";
-      NB_HEALTH_LISTEN_ADDRESS = ":9999";
-      NB_METRICS_PORT = "9998";
-      NB_TLS_CERT_FILE = "/var/lib/acme/${netbirdDomain}/fullchain.pem";
-      NB_TLS_KEY_FILE = "/var/lib/acme/${netbirdDomain}/key.pem";
+  systemd.services = {
+    netbird-relay = {
+      enable = true;
+      description = "The relay service for Netbird, a wireguard VPN";
+      documentation = [ "https://netbird.io/docs/" ];
+      after = [
+        "network.target"
+        "netbird-management.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        NB_LOG_LEVEL = "info";
+        NB_LISTEN_ADDRESS = ":${toString relayPort}";
+        NB_EXPOSED_ADDRESS = "rels://${netbirdDomain}:${toString relayPort}";
+        NB_HEALTH_LISTEN_ADDRESS = ":9999";
+        NB_METRICS_PORT = "9998";
+        NB_TLS_CERT_FILE = "/var/lib/acme/${netbirdDomain}/fullchain.pem";
+        NB_TLS_KEY_FILE = "/var/lib/acme/${netbirdDomain}/key.pem";
+      };
+      serviceConfig = {
+        EnvironmentFile = relaySecretEnv;
+        ExecStart = lib.getExe pkgs.netbird-relay;
+        Restart = "always";
+
+        # hardening
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+      stopIfChanged = false;
     };
-    serviceConfig = {
-      EnvironmentFile = relaySecretEnv;
-      ExecStart = lib.getExe pkgs.netbird-relay;
-      Restart = "always";
+    netbird-proxy = {
+      enable = true;
+      description = "The proxy service for Netbird, a wireguard VPN";
+      documentation = [ "https://netbird.io/docs/" ];
+      after = [
+        "network.target"
+        "netbird-management.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        NB_PROXY_DOMAIN = "proxy.moppu.dev";
+        NB_PROXY_MANAGEMENT_ADDRESS = "http://localhost:${toString config.services.netbird.server.management.port}";
+        NB_PROXY_ALLOW_INSECURE = "true";
+        NB_PROXY_ADDRESS = ":${toString proxyPort}";
+        NB_PROXY_ACME_CERTIFICATES = "true";
+        NB_PROXY_ACME_CHALLENGE_TYPE = "tls-alpn-01";
+        NB_PROXY_CERTIFICATE_DIRECTORY = "/var/lib/proxy-certs";
+        NB_PROXY_LOG_LEVEL = "info";
+      };
+      serviceConfig = {
+        EnvironmentFile = proxySecretEnv;
+        ExecStart = lib.getExe unstable.netbird-proxy;
+        Restart = "always";
 
-      # hardening
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateMounts = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectSystem = true;
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
+        # hardening
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+      stopIfChanged = false;
     };
-    stopIfChanged = false;
   };
-
 }
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 5b2abf6..f39fb84 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -24,6 +24,8 @@ lala:
         coturnPass: ENC[AES256_GCM,data:Fg9L5wYvnt30o5ZIeqlbJRKMqEMH44GUohALMXbNzrcna0Yg5LmaLCaufRs=,iv:aB7DnpO12N7uKkzkm+uzTlT+ZgSfcj8fnobyJ74Kwnk=,tag:H219S1nkkFroDoud/nZ6bA==,type:str]
         relaySecret: ENC[AES256_GCM,data:p8nTOVTYmdzrXdj+d3ETCza+lKWpmY9xZLAwI+UrDLMWngxZEa9hijR5FQ==,iv:mmomIjHtLwxTEfjOyorCom3rRoSoghH9MaXTA5ML8PY=,tag:nLCWh0dYE9QaGIfZ+eAf/g==,type:str]
         relaySecretEnv: ENC[AES256_GCM,data:1OfDN3huvHHcpIau8Y328GKxqEcGVTRfGuvXq1ICkZhnM7G2OLFnx+30KCdaBzW/m0BMUOdNjoqjOA==,iv:QzS5smYdOXXKA2HC1yhek9V+4RKIB3i/P27WYvDRdPk=,tag:uD3EoqMf20DwLidLVNSkhQ==,type:str]
+        proxySecret: ENC[AES256_GCM,data:+vRwKDTDNuDepMPwpzMvE3xFcTg5gKPjpnhdzmLRlmUsQAe/32x+Rg==,iv:SOqmUXLP/0EAgkAI2KRBLFm0b6co0SHwhCfMxatCXM0=,tag:UDJPE0Ucv0vYdwGHOtODNQ==,type:str]
+        proxySecretEnv: ENC[AES256_GCM,data:HgtbB/SB3BMMSbDghuRKGVzr2QnZl1NkoM+Tg2SuzupJ/vK+aMe6bYuO+VPsms8njXprAQ7dCA==,iv:dgP2Md3WSMl2J/b19BqNgaWhTL5ctU4cKNI4yxX79T8=,tag:e1uFaNHzcJWcZQgd6/V2sQ==,type:str]
         dataStoreKey: ENC[AES256_GCM,data:Em3LERUK78OtbPm57lo+j1qyn3Pkle42ThT7zSiAV0pJZnVHqtTxAxRnSJU=,iv:LFwhbCjv0HVhlKuV9f9REf01G/SKZOt8vB+pvx/CjdU=,tag:o6hUi/BQCRMxyWYxIRQXkw==,type:str]
         idpKey: ENC[AES256_GCM,data:cRgySkw7V8E+DnAg7HecynO1PUeR+lth6rQQJ/85W6rCxD5KIuzZ9zcwmRA=,iv:/Hcm7xpALsMX6qceL6/hpRocQxB7JJ56A8wnh8QVNVs=,tag:JK5T8QsXU9rEb05sJAjG6w==,type:str]
 sops:
@@ -73,7 +75,7 @@ sops:
             JFaroA1RPAmhCC0nSl4seBSIuRl8QrPjfcBJy4mFycll5Mp/0/WwLA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpqgsevvfgk0nnmxacsdcwsrkefd0xcx7wkdlyaqj8vgvfvnm4rq4npjv6
-    lastmodified: "2026-07-30T13:09:48Z"
-    mac: ENC[AES256_GCM,data:qehkFqLIWN9haeT7/K7s7JlSwStm9xF+PgEKHHOmso8KEd8yDL+vvBeGktmkIfH6uRAQzqm6Y+BkL0W6m7PVQVstGs0NdrWvQOXTY6vptGKaudKsA6w8NNtqG0Q4EmuhL2ohl7kZcH3DGLEqKSDjcXfVgnbNllZnrs+QKEs9G9o=,iv:Txb8+9DRmD5+3es+CFTaD+x5kewFY0THFVsOLrJHxEE=,tag:23dzRhE0kr800Bci0oSpVg==,type:str]
+    lastmodified: "2026-07-31T19:45:38Z"
+    mac: ENC[AES256_GCM,data:GxNVjmDBxuCAjg1UvBhaHw0eUF+SF1g4dteov2rcIhJEuAVfNQwGIMqDXppI28cdVTQ4B2mMgkFwmLR+EBsdYh86Sl5m1Vs6vuz21u52+kjC6GKDDBIRQyhXKR8375jPhn2LYTOgxpRClVp5TlJ3/2TjLZFAULywFd4fWQoHZiI=,iv:PZxTdSrF82m8/pmIfC6lI4y+9snq0UE3qCjFCHWs6zk=,tag:6r3y7Ups+Gh3ZF3CMfWm+Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3