diff --git a/hosts/valefar/default.nix b/hosts/valefar/default.nix
index 5f6a2c7..15e932d 100644
--- a/hosts/valefar/default.nix
+++ b/hosts/valefar/default.nix
@@ -25,6 +25,7 @@
     ./remote-builder.nix
     ./spindle.nix
     ./sorcery.nix
+    ./web-extract-public.nix
   ];
 
   services.proxmox-ve = {
diff --git a/hosts/valefar/web-extract-public.nix b/hosts/valefar/web-extract-public.nix
new file mode 100644
index 0000000..43a2e34
--- /dev/null
+++ b/hosts/valefar/web-extract-public.nix
@@ -0,0 +1,24 @@
+# search.nkp.pet: the public side of web-extract, which runs on vassago (the
+# Mac mini). baal's caddy terminates TLS but is not on the tailnet, so it reaches
+# vassago through this proxy on valefar's wisp mesh address. Plain TCP, so
+# caddy's X-Forwarded-For reaches web-extract unchanged; web-extract trusts it
+# from valefar's tailnet address (TRUSTED_PROXIES).
+{ config, ... }:
+let
+  port = 8787;
+in
+{
+  systemd.sockets.web-extract-public = {
+    wantedBy = [ "sockets.target" ];
+    listenStreams = [ "10.88.0.10:${toString port}" ];
+    socketConfig.FreeBind = true;
+  };
+  systemd.services.web-extract-public = {
+    description = "Proxy from the wisp mesh to web-extract on vassago";
+    serviceConfig = {
+      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=10min 100.64.0.16:${toString port}";
+      DynamicUser = true;
+      PrivateTmp = true;
+    };
+  };
+}