diff --git a/lib/data/services.toml b/lib/data/services.toml
index 2ef6f525..48426751 100644
--- a/lib/data/services.toml
+++ b/lib/data/services.toml
@@ -83,6 +83,14 @@ port = 6930
 host = "marvin"
 tsHost = "yt"
 
+[pingvin-share]
+port = 6933
+host = "marvin"
+extUrl = "share.pyrox.dev"
+anubis = 8410
+be-port = 30104
+be-anubis = 30105
+
 [planka]
 port = 6929
 host = "marvin"
diff --git a/packages/anubis-files/src/policies/pingvin-share.yaml b/packages/anubis-files/src/policies/pingvin-share.yaml
new file mode 100644
index 00000000..fdea871b
--- /dev/null
+++ b/packages/anubis-files/src/policies/pingvin-share.yaml
@@ -0,0 +1,7 @@
+bots:
+  - import: (data)/bots/ai-robots-txt.yaml
+  - import: CUSTOM/block/alibaba-cloud.yaml
+  - import: (data)/common/keep-internet-working.yaml
+  - import: CUSTOM/challenge/generic-browser.yaml
+
+dnsbl: false
diff --git a/packages/pingvin-share-config/default.nix b/packages/pingvin-share-config/default.nix
new file mode 100644
index 00000000..baba7454
--- /dev/null
+++ b/packages/pingvin-share-config/default.nix
@@ -0,0 +1,19 @@
+{
+  pkgs,
+  stdenv,
+  settings ? { },
+  ...
+}:
+let
+  format = pkgs.formats.yaml { };
+  file = format.generate "config.yaml" settings;
+in
+stdenv.mkDerivation {
+  pname = "pingvin-share-config";
+  version = "1.0.0";
+
+  installPhase = ''
+    mkdir $out
+    cp ${file} $out/config.yaml
+  '';
+}
diff --git a/systems/x86_64-linux/marvin/default.nix b/systems/x86_64-linux/marvin/default.nix
index 848fe227..6b7fdb46 100644
--- a/systems/x86_64-linux/marvin/default.nix
+++ b/systems/x86_64-linux/marvin/default.nix
@@ -23,6 +23,7 @@
     ./services/nginx.nix
     ./services/nextcloud
     ./services/pinchflat.nix
+    ./services/pingvin-share.nix
     ./services/planka.nix
     ./services/pocket-id.nix
     ./services/podman.nix
diff --git a/systems/x86_64-linux/marvin/services/pingvin-share.nix b/systems/x86_64-linux/marvin/services/pingvin-share.nix
new file mode 100644
index 00000000..a0529393
--- /dev/null
+++ b/systems/x86_64-linux/marvin/services/pingvin-share.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  d = lib.py.data.services.pingvin-share;
+  cfg = config.services.pingvin-share;
+  configFile = pkgs.py.pingvin-share-config.overrideAttrs {
+    settings = {
+      general = {
+        appName = "dishNet Files";
+        secureCookies = "true";
+      };
+      share = {
+        allowRegistration = "false";
+        allowUnauthenticatedShares = "false";
+      };
+      email.enableShareEmailRecipients = "true";
+      smtp = {
+        enabled = "true";
+        host = "mail.pyrox.dev";
+        port = "465";
+        email = "share@pyrox.dev";
+        username = "share@pyrox.dev";
+        password = "SMTP_PASSWORD";
+      };
+      ldap.enabled = "false";
+      legal.enabled = "false";
+      s3.enabled = "false";
+      initUser = {
+        enabled = true;
+        username = "dish";
+        email = "pyrox@pyrox.dev";
+        password = "ADMIN_PASSWORD";
+        isAdmin = true;
+      };
+    };
+  };
+in
+{
+  services = {
+    pingvin-share = {
+      enable = true;
+      backend.port = d.be-port;
+      frontend.port = d.port;
+      hostname = "share.pyrox.dev";
+      https = true;
+    };
+    anubis.instances = lib.mkIf cfg.enable {
+      pingvin-share-be = {
+        settings = {
+          BIND = ":${toString d.be-anubis}";
+          POLICY_FNAME = "${pkgs.py.anubis-files}/policies/pingvin-share.yaml";
+          TARGET = "http://localhost:${toString d.be-port}";
+        };
+      };
+      pingvin-share-fe = {
+        settings = {
+          BIND = ":${toString d.anubis}";
+          POLICY_FNAME = "${pkgs.py.anubis-files}/policies/pingvin-share.yaml";
+          TARGET = "http://localhost:${toString d.port}";
+        };
+      };
+    };
+  };
+  systemd.services.init-pingvin-config = {
+    enable = cfg.enable;
+    description = "Pingvin Share configuration setup";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "pingvin-share.service" ];
+    path = [ pkgs.gnused ];
+    script = ''
+      rm ${cfg.dataDir}/config.yaml
+      chmod o-rwx ${cfg.dataDir}/config.yaml
+      chmod ug-x ${cfg.dataDir}/config.yaml
+      cp ${configFile}/config.yaml ${cfg.dataDir}/config.yaml
+      sed -i "s/SMTP_PASSWORD/$SMTP_PASSWORD/" ${cfg.dataDir}/config.yaml
+      sed -i "s/ADMIN_PASSWORD/$ADMIN_PASSWORD/" ${cfg.dataDir}/config.yaml
+    '';
+    serviceConfig = {
+      EnvironmentFile = config.age.secrets.pingvin-secrets.path;
+      User = cfg.user;
+      Group = cfg.group;
+      ReadWritePaths = [ "${cfg.dataDir}/config.yaml" ];
+    };
+  };
+}
diff --git a/systems/x86_64-linux/marvin/services/secrets/pingvin-secrets.age b/systems/x86_64-linux/marvin/services/secrets/pingvin-secrets.age
new file mode 100644
index 0000000000000000000000000000000000000000..76b1fe952cc68114d75206800fd4135fc493504e
GIT binary patch
literal 1145
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7EOe^ybW|uPH#9N}
z4-4~mPtA0-%&v?mO7tkrtST&Vs*Lb+EvhQZE(z2&3~)*bcjc-I$|_AUFDx{!H1ZCs
za52_*3okIS$jmfN^e{}+PYbBb%1?>NiqdyZDTdirRGg@g=9ZWl;>hJ*6&{pj8E#l%
zZef<}?w@LrYhhSqUQ!aO?UPlMn3rvmQdH%cqn+cMscl&1nwe7)?qz0}<ricgmJ#I>
z?w!MB7!Z{lS(%km6y$8`mzk4aZ0722n&TK6Q4#J@5p3j<XqjH-Y7ppE;b!jUmt~&m
zm0l2T8t9d5>24U}8yRWNWl>QOky{vEnPyPvW>l2nWSL@?<PxRrm{=98U0I%?Z)6y3
zU{so!735qHT9pzNqV1IE=Mh+vpJA!*mlNU_z?JCgAC#R^nqM5@p6RKtU*wtWU1AVe
z73Ln96=CXT5|)u=;OOG+<&+kb9FXc2?3(UeWuRRWQQ%SHljsrP6VBytXpmK9YFQ8x
zl~|eKn^9t%kz!Glmz$sBRN$1KrtjllZXV(l;aiep=v|_3=w{-bl2(zDU0hI+8d8y1
zmXg6$Xi#ZvlpT~-;8kJjmFFB)sPARuXck<atnHQO<5-kj<*M(M9bxWd7--?_7?A5+
zmXwy0WD;iPW#O!!7-$yBm1f{nknNXa>gH5ZT54ok;G7o_7F8S^V&<FY7nM`xR&1P`
zADWe1<mHy*lam^r92Deb<d@-Pn3&;e7!n?o#bp_llW$z)7ZsFb?C5M3X=It2m!j|L
zmz?VDte+g>QxW2m6dYKYZJZeqkmQkU=I0n(85EhTZ{nwKkz5&=>c(a48<1*N91xY2
z?dBK}WaQ?XmgOFlXlRjZnrL34UF7QHk(=o5>*14CVs7YDXzpHKQs5n7>X`2vP#%(&
z9308z9PSiWk?vQP;u~QZ?3W*Dq@5P-8J3z7VpwF7S?J@VZ&u_RWtb7+p5__q?VpsK
zW)bC@7Mki_9FbF%Wt3>h<(?Xzl3NfGUTIe5UsV<u<WpFh>SkzQT3qNKTo`GTY^d*5
zk?iZ@mtK($OUJNWQ(lmp;^C-ZVd+&G6j<Ws;$#_7m0XsUt(|FMoS#{e85r!Qom-Ob
zR8mkJWLReD5}eNEQWa29TH;b3;T0Ze6c(6N<mzr}8C6k|9^jSdUYYEZ<Xe^G;+<`(
zU*^fBtE;OJ8tCVnlvkCOnp>Vx=;oakmJ;gjlo#Rdo8*@0Z=92798nqOn3V64Zf?NE
zaqNrg@9JZ^vor3`tV-7X*cUVJO~}FiBfA3MU-jy6N$TRuym8SYu~8_1_sG$X=tpz+
z>F321NBrD*uBug{GbCB{(@cgE%{fPFJfBSc>{6?Io839|_M&-}%l<7jd3nZ7?DC1C
zBY8g8cBh6-5T2J}^l?i2zbQ%oAI$1GE_(JvQ`dz@IwcJ^7HI{%y%W<h(e@7jnE;gx

literal 0
HcmV?d00001

diff --git a/systems/x86_64-linux/marvin/services/secrets/secrets.nix b/systems/x86_64-linux/marvin/services/secrets/secrets.nix
index aa99acad..780b210b 100644
--- a/systems/x86_64-linux/marvin/services/secrets/secrets.nix
+++ b/systems/x86_64-linux/marvin/services/secrets/secrets.nix
@@ -35,6 +35,7 @@ in
   "../nextcloud/nextcloud-admin-pw.age".publicKeys = marvinDefault;
   "nix-serve-priv.age".publicKeys = marvinDefault;
   "pinchflat-secrets.age".publicKeys = marvinDefault;
+  "pingvin-secrets.age".publicKeys = marvinDefault;
   "planka-env.age".publicKeys = marvinDefault;
   "pocket-id-secrets.age".publicKeys = marvinDefault;
   "vaultwarden-vars.age".publicKeys = marvinDefault;
diff --git a/systems/x86_64-linux/prefect/services/mailserver/logins.nix b/systems/x86_64-linux/prefect/services/mailserver/logins.nix
index 5b9acaf5..ff0d9d36 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/logins.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/logins.nix
@@ -33,5 +33,9 @@
       hashedPassword = "$2b$05$uZoLVdCo48rLVBFdG0.UXua8a.84w1PzmLYOpJ1qTNo25KCdQlflm";
       sendOnly = true;
     };
+    "share@pyrox.dev" = {
+      hashedPassword = "$2b$05$GTK7WRECM2FKlpqUWhsE1e9QaXX5fQ41id.W/PV2TZnOwNtrKJZHe";
+      sendOnly = true;
+    };
   };
 }