diff --git a/flake.lock b/flake.lock
index d790a56a..fc35b3a7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -459,7 +459,8 @@
         "nixpkgs": "nixpkgs",
         "nvf": "nvf",
         "tangled": "tangled",
-        "treefmt-nix": "treefmt-nix"
+        "treefmt-nix": "treefmt-nix",
+        "tsnsrv": "tsnsrv"
       }
     },
     "sqlite-lib-src": {
@@ -618,6 +619,29 @@
         "repo": "treefmt-nix",
         "type": "github"
       }
+    },
+    "tsnsrv": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773758407,
+        "narHash": "sha256-DqieJ48Jf+gmJtfMnE7QXpnJnW7acnT624N/iA6pzVI=",
+        "owner": "boinkor-net",
+        "repo": "tsnsrv",
+        "rev": "9f36a4f264540d05b8f758a67eee3e57dca4eea6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "boinkor-net",
+        "repo": "tsnsrv",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 7e4150d5..c7aa3ab9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -95,6 +95,11 @@
       inputs.lucide-src.follows = "";
       inputs.mermaid-src.follows = "";
     };
+    tsnsrv = {
+      url = "github:boinkor-net/tsnsrv";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
+    };
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/hosts/default.nix b/hosts/default.nix
index 65786a42..a22c752d 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -33,6 +33,7 @@
           inputs.golink.nixosModules.default
           inputs.tangled.nixosModules.knot
           inputs.tangled.nixosModules.spindle
+          inputs.tsnsrv.nixosModules.default
         ];
       };
       prefect = {
diff --git a/hosts/marvin/default.nix b/hosts/marvin/default.nix
index 33426b1b..c0fbb22a 100644
--- a/hosts/marvin/default.nix
+++ b/hosts/marvin/default.nix
@@ -36,6 +36,7 @@
     ./services/syncthing.nix
     ./services/tailscale.nix
     ./services/tangled.nix
+    ./services/tsnsrv.nix
     ./services/vaultwarden.nix
     ./services/zfs.nix
     # keep-sorted end
diff --git a/hosts/marvin/services/pinchflat.nix b/hosts/marvin/services/pinchflat.nix
index 96acc4d1..87563750 100644
--- a/hosts/marvin/services/pinchflat.nix
+++ b/hosts/marvin/services/pinchflat.nix
@@ -19,6 +19,11 @@ in
       YT_DLP_WORKER_CONCURRENCY = 2;
     };
   };
+  users.users.pinchflat = lib.mkIf cfg.enable {
+    isSystemUser = true;
+    group = "pinchflat";
+  };
+  users.groups.pinchflat = lib.mkIf cfg.enable { };
   systemd.services.pinchflat = lib.mkIf cfg.enable {
     serviceConfig = {
       DynamicUser = lib.mkForce false;
@@ -26,11 +31,6 @@ in
       Group = lib.mkForce "pinchflat";
     };
   };
-  users.users.pinchflat = lib.mkIf cfg.enable {
-    isSystemUser = true;
-    group = "pinchflat";
-  };
-  users.groups.pinchflat = lib.mkIf cfg.enable { };
   age.secrets = lib.mkIf cfg.enable {
     pinchflat-secrets = {
       owner = "pinchflat";
@@ -38,6 +38,14 @@ in
       file = ./secrets/pinchflat-secrets.age;
     };
   };
+
+  # tsnsrv sidecar
+  services.tsnsrv.services.yt = {
+    urlParts = {
+      port = d.port;
+    };
+  };
+
   # BGUtil Docker Container for yt-dlp
   virtualisation.oci-containers.containers.ytdlp-bgutil-provider = lib.mkIf cfg.enable {
     image = "brainicism/bgutil-ytdlp-pot-provider";
diff --git a/hosts/marvin/services/secrets/secrets.nix b/hosts/marvin/services/secrets/secrets.nix
index 516f85c5..f5945b93 100644
--- a/hosts/marvin/services/secrets/secrets.nix
+++ b/hosts/marvin/services/secrets/secrets.nix
@@ -32,6 +32,7 @@ in
   "pinchflat-secrets.age".publicKeys = pqKeys;
   "planka-env.age".publicKeys = marvinDefault;
   "pocket-id-secrets.age".publicKeys = marvinDefault;
+  "tsnsrv-auth-key.age".publicKeys = pqKeys;
   "vaultwarden-vars.age".publicKeys = pqKeys;
 
   "buildbot/gitea-token.age".publicKeys = marvinDefault;
diff --git a/hosts/marvin/services/secrets/tsnsrv-auth-key.age b/hosts/marvin/services/secrets/tsnsrv-auth-key.age
new file mode 100644
index 00000000..30c6f772
--- /dev/null
+++ b/hosts/marvin/services/secrets/tsnsrv-auth-key.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> mlkem768x25519 GoUecBehZDptYgEVbBJvqFQVlq2kRaMqh4cRZG44VXf8+90zZmzHmlCaphCCUv+lgkNGVvJe9Ss5LE0LAI9QtRIYtoJuq3r+GgPLI83uKHqV5joygyxM/namAln2HoQuXa2zk+mgKkUltJxlx9OkU6d6cejt0xpMlnPk3tO4qBoIdF6MTHFl25uFbByFtF4zHT+Pv8mcjqHBeCcKUJabX/tFfWt7oUtFiMeI7KYzu5qEaXsDzPI43glZdMdbcGls/xN0/eURNKlK3MDS2yDCQzPZD2JfTGCyXaRqoazWSnX6vJPgLY5RVeqiXdx+KiuibO+mZuVSj0+9ZH0+As+58Q14PROhbITeSvAwFgWExtnPO14yEDyyHcKNPDGqlPmC12MiMRO35XVNha31veJxO92ZIDeaAAaJQ63wwP9ZHPup+fFUM0FTZYHiK9rpOp0MxX2KDWS7eCUQsPr8ShUUewVwNIovKpHkrbbnseitKGW3RngNv8nYzNSMZuOGeAot9oOlqDp0a5yhZ6fT/WwSKrABtsBSf1qQmegVG6Huto2udY1Sb4DmLsyPdBbxF/atCnlkcOn/uZsjshcWlN8SsrZzMR68pBDB7by6j87BWdPYYQvL5oA2u5J7m1c6f/WqnropK2/OXorYscfJ2HPHztLJcNnY3DjgjSukUdmtfReZDr8sJ/8FUgLPgXwN5DuQlA1AsJ4MdPBjvqyI9UPU0mNHAorwipXiUjjGNLKZ8XXfidRWmRd1qZ3UMdmQAhFigNhgpyx6UWwiXw4+AE49FzcAD4YEBlwxB7R15BcQ2GiJ9P7iAnLaPhRoOzCzFoHtULPj/5X6qI/J4s532+NWXB5MBfFgUU47nJYt0j2FzzQjB08q7z6j/8S2xZobIBm2N6kwdr0nxfWPsHfTSZeDftkRg++UM9OLX1q5WGDj8nR4N2TR8JpEnGfO8ir/BP+JoLCoPQyliWINt3CybZgu/vugydJRqH1E2AREAwxkHoh40ng2hqXO1Ms8K63xUEfDCvY5zjwwG++A+BpRgDk824Jy6ykVtyeVOniRkP/X1jAI2UBnsdRYebHGWssHzGQVzE1T+DirlxuQbSl+dP8rtZXIMWzDGdO6bii6KliCT2Xt7nDHP5tzQSXdvQqy/SzPWRtLDiNDLfX+x+ra1N1clMadvP8eFmvA5qn6+tyWwzvhLjyN9u/5mXGCAyPsseu3jyH7mjfTjsepANYONLAKtwGUrK6z87ZVPCXSHsHuICbY5ajQ5d5hyxtum1kByvMNzmZKahMDI8L269prU9JwasR7KcaEmvpSkOXYPkx4iatHu2NpG8EXhi3eSYUltZDTbAEyenvpmEvIl3VT8YlAhaPvbmP4Ms3n39pwWqT48+CiY9guztjxvoAaf3Wd8oTH+77HBat8aieCna5TdPiM7Sa0oMkfKBGsLk41Iu2SNOu6ENEJYLjCZZ22LguDU3kPod+brE1R64nvM0yLd2PzEA
+V05ILXHPZQamw1DVmfnzcf5eNOf7r4GPPgJBQdpU2mM
+-> mlkem768x25519 0z6oDv7hmmC3ihhvnfj5d+/cvVscOzl4oqQwDfAYgUgYUXCC0wPdoAizWRjIOuGPT5XiHS7oR7PW6NP4X+d1ccJVwkjkbl7z7dM1sEh49PuKAW63FWbXbkMdoQPqs8jlDctyi0BqdWo3rg2zd6R9JKGqnGMfwYVYdvKtN+3EB7wYXx9386i4POwMOZrJQ4fwRqCVWih75SJt4KOtJFVTrVOvr5i/VdQD7CXIiAvjw4vdInNQKzfqe258hdQRRSdneNkREUMIeum36gKzhSwVmRkuruoHAMpcrKP6gY0QiBKJrMGCThoxkRKjVjQ9xMYDKbFadUz0z89BjWwnfC89FeeXurGpo/bmamr3kb4IcR4kwKurXGL0oT/F5zpXC7D79H6a3H/OvhvVj16YPKenPxsun9Awmxms7uAYsClrUOZEwAXhKBboHk7SwTixA3jkqWhvFXr1//KwF9uPCunDawOwYmrfbzvQg731iz9yEYn1th6Vhxi8yIeKamYaauaCKtLXFQ7xI+L5YgTJfqacpqGue/+nxGOi/3sLoEBI0xHV219NkJrjgII6CUE6BsKht8HIK/T9Jqj6oyilDRkdKMDTb1AlBYQ40XRRW1nzhnvfPK70evfqt7k+VqCd3SxgvQXIHK1nAOqGOaONopqaVgfnRjLjYYkxsHxnzT06ahDWUof70QuLG4vdSOjXUU4s0BN7ShZQm4Ws454bJUDx+LVLqN8g3yGF1SwPUCTe2vjC8lXRVcRhnljCv8930MHBAytTWS/aqDrP3DvJ4bmQ/BBeTMoBiSzLeun7T1eH4IHWJ6uxU618UAMlfFasZFVQKnIWDJu3BXnrX9UedDtp/lRHFk4WfpHIf+8UMIcs3RekrBKJoJGPzU6O3qn232acSRaPv2S6Wmb1FelhF/0oGPobEgrkJlmAk2X9YSpGKXJUibaLSNNwmZ4iceEGEqaHCaVIF3aDIb/S1ursosTIVWVsaliuwTspSQZEcR/AgM1jp8AwY3NUfz9XIoITTJCjJy75Qfyt5Q358D/fACSOrOoRJlWjQMz7TkMXOXB0UYbG71qmIUoWDs6jwkPIMgYsN06fu7f4i616GdStkv6VuQlA5GDQkQiAshd5Z83Nl2GaN9U7bWwSZTT23LD9+g4/K6LR8nWeC3VNBIpQRaaa+QHHcyfIyr+oPmnIYdlVlO2tSnQKQhJBnCfIqSL8JPIVHXFDp1muJ/r1ZURcBhnkJUpemyxDn2lHkrCG1UqMHTZar0Q3qi2IX0HYWsWLTpfsm01j5rddXHGSw/QJfgw9MWY1ST9XzaacVHgWq7IgckgAk2WbaSNbecaMnXI6flhOTIUI0X61cIdYJRsJgVnZEddzdP7NNiOPCcSBeJOLPAA2w/oE5i4P/diV627FNhFeVIhTjh/RVBcjRHeGkrZ8PPMS9r8GCVB4+EEIp74y4rAva9/hylc2KdDt9uBN4btRb1HEIvR+y0VKTr3qPxjENg
+ePNf6b/9FKjkhPeV0SOpa8GrEHjs0zlbFmFiISpxNs8
+--- Ju74gVI7Zs4BsYApIRexGCL7eL6rLB9/O+18Ca51DNc
+�yM5}{�u���]q��}]��IHũ�b�����H�:pʾj�o��0:P;(�S�!�?��Q�JWwF�_��]!\���f(�>�5J;���F
\ No newline at end of file
diff --git a/hosts/marvin/services/tsnsrv.nix b/hosts/marvin/services/tsnsrv.nix
new file mode 100644
index 00000000..b361a4bd
--- /dev/null
+++ b/hosts/marvin/services/tsnsrv.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  inputs',
+  ...
+}:
+let
+  sec = config.age.secrets;
+  patched = inputs'.tsnsrv.packages.tsnsrv.overrideAttrs (old: {
+    postPatch = (old.postPatch or "") + ''
+      substituteInPlace proxy.go --replace-fail "slog.Info" "slog.Debug"
+    '';
+  });
+in
+{
+  services.tsnsrv.enable = true;
+  services.tsnsrv.defaults = {
+    authKeyPath = sec.tsnsrv-auth-key.path;
+    package = patched;
+    ephemeral = false;
+    urlParts = {
+      protocol = "http";
+      host = "127.0.0.1";
+      port = 8080;
+    };
+  };
+
+  age.secrets.tsnsrv-auth-key = {
+    file = ./secrets/tsnsrv-auth-key.age;
+    owner = "tsnsrv";
+    group = "tsnsrv";
+  };
+}
diff --git a/hosts/prefect/services/caddy.nix b/hosts/prefect/services/caddy.nix
index 68d184c6..3b2a1548 100644
--- a/hosts/prefect/services/caddy.nix
+++ b/hosts/prefect/services/caddy.nix
@@ -16,7 +16,6 @@ let
 
   tsHosts = self.lib.caddy.mkTsSites [
     # keep-sorted start
-    "pinchflat"
     "shelfmark"
     # keep-sorted end
   ];