diff --git a/nvfetcher.toml b/nvfetcher.toml
--- a/nvfetcher.toml
+++ b/nvfetcher.toml
@@ -40,6 +40,10 @@
 src.git = "https://tangled.org/@ptr.pet/nsid-tracker"
 fetch.git = "https://tangled.org/@ptr.pet/nsid-tracker"
 
+[nucleus]
+src.git = "https://tangled.org/@ptr.pet/nucleus"
+fetch.git = "https://tangled.org/@ptr.pet/nucleus"
+
 ## TANGLED ##
 
 [tangled]
diff --git a/_sources/generated.json b/_sources/generated.json
--- a/_sources/generated.json
+++ b/_sources/generated.json
@@ -246,6 +246,26 @@
         },
         "version": "2683e619932808b8aa78ec7100de6324c8216daf"
     },
+    "nucleus": {
+        "cargoLocks": null,
+        "date": "2025-10-31",
+        "extract": null,
+        "name": "nucleus",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "deepClone": false,
+            "fetchSubmodules": false,
+            "leaveDotGit": false,
+            "name": null,
+            "rev": "424bd6cfb7aaa5f178dc32e79a997d229c7bd823",
+            "sha256": "sha256-jK+4I2WT60bFQaq6ItlPFzvDj9P3pu386m1AtrzUmc4=",
+            "sparseCheckout": [],
+            "type": "git",
+            "url": "https://tangled.org/@ptr.pet/nucleus"
+        },
+        "version": "424bd6cfb7aaa5f178dc32e79a997d229c7bd823"
+    },
     "stylix": {
         "cargoLocks": null,
         "date": "2025-10-28",
diff --git a/_sources/generated.nix b/_sources/generated.nix
--- a/_sources/generated.nix
+++ b/_sources/generated.nix
@@ -155,6 +155,20 @@
     };
     date = "2025-09-11";
   };
+  nucleus = {
+    pname = "nucleus";
+    version = "424bd6cfb7aaa5f178dc32e79a997d229c7bd823";
+    src = fetchgit {
+      url = "https://tangled.org/@ptr.pet/nucleus";
+      rev = "424bd6cfb7aaa5f178dc32e79a997d229c7bd823";
+      fetchSubmodules = false;
+      deepClone = false;
+      leaveDotGit = false;
+      sparseCheckout = [ ];
+      sha256 = "sha256-jK+4I2WT60bFQaq6ItlPFzvDj9P3pu386m1AtrzUmc4=";
+    };
+    date = "2025-10-31";
+  };
   stylix = {
     pname = "stylix";
     version = "f8f4e3c3658ee962f8f332a56720c8dfc2836f7a";
diff --git a/dns/dnsconfig.js b/dns/dnsconfig.js
--- a/dns/dnsconfig.js
+++ b/dns/dnsconfig.js
@@ -20,13 +20,14 @@
     A("spindle", WOLUMONDE_IP, CF_PROXY_OFF),
     A("skeetdeck", WOLUMONDE_IP, CF_PROXY_OFF),
     A("likes", WOLUMONDE_IP, CF_PROXY_OFF),
-    A("vpn", DZWONEK_IP, CF_PROXY_OFF),
     A("id", WOLUMONDE_IP, CF_PROXY_OFF),
     A("test", WOLUMONDE_IP, CF_PROXY_OFF),
     // atp handles
     A("dawn", WOLUMONDE_IP, CF_PROXY_OFF),
     A("guestbook", WOLUMONDE_IP, CF_PROXY_OFF),
     A("drew", WOLUMONDE_IP, CF_PROXY_OFF),
+    // dzwonek
+    A("vpn", DZWONEK_IP, CF_PROXY_OFF),
     // A("meow", WOLUMONDE_IP, CF_PROXY_OFF),
     // thing
     // TXT("id", "a data endpoint for entity with serial id /90008/."),
@@ -97,6 +98,7 @@
     DefaultTTL(1),
     A("@", WOLUMONDE_IP, CF_PROXY_OFF),
     A("test", WOLUMONDE_IP, CF_PROXY_OFF),
+    A("nucleus", DZWONEK_IP, CF_PROXY_OFF),
     // atproto
     TXT("_atproto", "did=did:plc:dfl62fgb7wtjj3fcbb72naae"),
     A("nil", WOLUMONDE_IP, CF_PROXY_OFF),
diff --git a/modules/stylix-null.nix b/modules/stylix-null.nix
new file mode 100644
--- /dev/null
+++ b/modules/stylix-null.nix
@@ -0,0 +1,16 @@
+{lib, ...}:
+let
+  options = {
+    stylix = lib.mkOption {
+      type = lib.types.raw;
+    };
+  };
+in
+{
+  inherit options;
+  config = {
+    home-manager.sharedModules = [{
+      inherit options;
+    }];
+  };
+}
diff --git a/hosts/dzwonek/default.nix b/hosts/dzwonek/default.nix
--- a/hosts/dzwonek/default.nix
+++ b/hosts/dzwonek/default.nix
@@ -11,6 +11,7 @@
     "${inputs.home}/nixos"
     "${inputs.disko}/module.nix"
     ../../modules
+    ../../modules/stylix-null.nix
     ../../users/root
     ./disk-config.nix
   ]
diff --git a/hosts/dzwonek/modules/nucleus.nix b/hosts/dzwonek/modules/nucleus.nix
new file mode 100644
--- /dev/null
+++ b/hosts/dzwonek/modules/nucleus.nix
@@ -0,0 +1,22 @@
+{pkgs, inputs, ...}:
+let
+  rootDomain = "vpn.gaze.systems";
+  domain = "nucleus.ptr.pet";
+  pkg = pkgs.callPackage "${inputs.nucleus}/nix" {
+    nucleus-modules = pkgs.callPackage "${inputs.nucleus}/nix/modules.nix" {};
+    PUBLIC_DOMAIN = "https://${domain}";
+  };
+in
+{
+  security.acme.certs.${rootDomain}.extraDomainNames = [domain];
+  services.nginx.virtualHosts.${domain} = {
+    useACMEHost = rootDomain;
+    forceSSL = true;
+    quic = true;
+    kTLS = true;
+    locations."/" = {
+      root = pkg;
+      tryFiles = "$uri $uri/ /index.html";
+    };
+  };
+}