diff --git a/.harper-dictionary.txt b/.harper-dictionary.txt
index ee6758ab..04e44a82 100644
--- a/.harper-dictionary.txt
+++ b/.harper-dictionary.txt
@@ -1,6 +1,7 @@
 DN42
 Jellyfin
+PQ
 Vaultwarden
+customPolicy
 nixd
-PQ
 zaphod
diff --git a/hosts/marvin/services/git.nix b/hosts/marvin/services/git.nix
index 7094edf0..318f111f 100644
--- a/hosts/marvin/services/git.nix
+++ b/hosts/marvin/services/git.nix
@@ -7,7 +7,7 @@
   ...
 }:
 let
-  cfg = config.services.forgejo.settings;
+  cfg = config.services.forgejo;
   sec = config.age.secrets;
   d = self.lib.data.services.git;
 in
@@ -71,7 +71,7 @@ in
         DISABLE_SSH = true;
         DOMAIN = d.extUrl;
         HTTP_PORT = d.port;
-        ROOT_URL = "https://${cfg.server.DOMAIN}";
+        ROOT_URL = "https://${cfg.settings.server.DOMAIN}";
         LFS_START_SERVER = true;
       };
       #
diff --git a/lib/default.nix b/lib/default.nix
index 32d2b073..a5077b7d 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -1,7 +1,13 @@
-{ lib, self, ... }:
+{
+  lib,
+  self,
+  pkgs,
+  ...
+}:
 let
   inherit (self) data;
   strings = import ./strings.nix { inherit lib; };
+  misc = import ./misc.nix { inherit self pkgs; };
 in
 {
   flake = {
@@ -9,8 +15,10 @@ in
       caddy = import ./caddy.nix { inherit data lib; };
       secrets = import ./secrets.nix;
       inherit data;
+      inherit misc;
       inherit strings;
       inherit (strings) toPascalCase toUpperSnakeCase;
+      inherit (misc) mkAnubisInstance;
     };
   };
 }
diff --git a/lib/misc.nix b/lib/misc.nix
new file mode 100644
index 00000000..96bff7ae
--- /dev/null
+++ b/lib/misc.nix
@@ -0,0 +1,36 @@
+{ self, pkgs, ... }:
+let
+  system = pkgs.stdenv.hostPlatform.system;
+in
+{
+  /**
+    Creates an Anubis instance for this service
+
+    # Example
+    ```nix
+    mkAnubisInstance "service-a" false
+    ```
+
+    # Type
+    ```
+    mkAnubisInstance :: String -> Bool -> AttrSet
+    ```
+
+    # Arguments
+    - [service] The service name that this instance will be proxying
+    - [customPolicy] Whether the service uses a custom `${service}.yaml` policy file. If false, uses `default.yaml`
+  */
+  mkAnubisInstance =
+    service: customPolicy:
+    let
+      serviceData = self.data.services.${service};
+      policyFile = if customPolicy then "${service}.yaml" else "default.yaml";
+    in
+    {
+      settings = {
+        BIND = ":${toString serviceData.anubis}";
+        POLICY_FNAME = "${self.packages.${system}.anubis-files}/policies/${policyFile}";
+        TARGET = "http://localhost:${toString serviceData.port}";
+      };
+    };
+}