diff --git a/lib/data/services.toml b/lib/data/services.toml
index e0b57cae..2d7cd84a 100644
--- a/lib/data/services.toml
+++ b/lib/data/services.toml
@@ -92,6 +92,15 @@ anubis = 8408
 host = "marvin"
 extUrl = "xmpp.pyrox.dev"
 
+[pocket-id]
+port = 6932
+host = "marvin"
+extUrl = "auth.pyrox.dev"
+anubis = 8401
+be-port = 30101
+be-anubis = 30102
+
+
 [redlib]
 port = 6901
 host = "marvin"
diff --git a/packages/anubis-files/src/policies/authentik.yaml b/packages/anubis-files/src/policies/pocket-id.yaml
similarity index 69%
rename from packages/anubis-files/src/policies/authentik.yaml
rename to packages/anubis-files/src/policies/pocket-id.yaml
index 040e3cba..fdea871b 100644
--- a/packages/anubis-files/src/policies/authentik.yaml
+++ b/packages/anubis-files/src/policies/pocket-id.yaml
@@ -2,9 +2,6 @@ bots:
   - import: (data)/bots/ai-robots-txt.yaml
   - import: CUSTOM/block/alibaba-cloud.yaml
   - import: (data)/common/keep-internet-working.yaml
-  - name: allow-authentik-applications
-    path_regex: ^/application/o/.*$
-    action: ALLOW
   - import: CUSTOM/challenge/generic-browser.yaml
 
 dnsbl: false
diff --git a/systems/x86_64-linux/marvin/default.nix b/systems/x86_64-linux/marvin/default.nix
index 5f48dd76..848fe227 100644
--- a/systems/x86_64-linux/marvin/default.nix
+++ b/systems/x86_64-linux/marvin/default.nix
@@ -9,7 +9,7 @@
 
     # Running Services
     ./services/anubis.nix
-    ./services/authentik.nix
+    # ./services/authentik.nix
     ./services/avahi.nix
     ./services/bots.nix
     ./services/deemix.nix
@@ -24,6 +24,7 @@
     ./services/nextcloud
     ./services/pinchflat.nix
     ./services/planka.nix
+    ./services/pocket-id.nix
     ./services/podman.nix
     ./services/postgres.nix
     ./services/prometheus.nix
diff --git a/systems/x86_64-linux/marvin/services/authentik.nix b/systems/x86_64-linux/marvin/services/authentik.nix
index f089e76c..de2f70cc 100644
--- a/systems/x86_64-linux/marvin/services/authentik.nix
+++ b/systems/x86_64-linux/marvin/services/authentik.nix
@@ -90,11 +90,4 @@ in
     owner = "thehedgehog";
     group = "misc";
   };
-  services.anubis.instances.authentik = {
-    settings = {
-      BIND = ":${toString d.anubis}";
-      POLICY_FNAME = "${pkgs.py.anubis-files}/policies/authentik.yaml";
-      TARGET = "http://localhost:${toString d.port}";
-    };
-  };
 }
diff --git a/systems/x86_64-linux/marvin/services/planka.nix b/systems/x86_64-linux/marvin/services/planka.nix
index 74a37256..1bd98a0b 100644
--- a/systems/x86_64-linux/marvin/services/planka.nix
+++ b/systems/x86_64-linux/marvin/services/planka.nix
@@ -51,5 +51,4 @@ in
       TARGET = "http://localhost:${toString d.port}";
     };
   };
-
 }
diff --git a/systems/x86_64-linux/marvin/services/pocket-id.nix b/systems/x86_64-linux/marvin/services/pocket-id.nix
new file mode 100644
index 00000000..a2e4cfab
--- /dev/null
+++ b/systems/x86_64-linux/marvin/services/pocket-id.nix
@@ -0,0 +1,60 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  d = lib.py.data.services.pocket-id;
+in
+{
+  services.pocket-id = {
+    enable = true;
+    environmentFile = config.age.secrets.pocket-id-secrets.path;
+    settings = {
+      PUBLIC_APP_URL = "https://auth.pyrox.dev";
+      TRUST_PROXY = true;
+      UPDATE_CHECK_DISABLED = true;
+      BACKEND_PORT = 30101;
+      PORT = d.port;
+      INTERNAL_BACKEND_URL = "http://localhost:30101";
+
+      # Frontend Config
+      PUBLIC_UI_CONFIG_DISABLED = true;
+      APP_NAME = "dishNet Auth";
+      SESSION_DURATION = 120;
+      EMAILS_VERIFIED = true;
+      ALLOW_OWN_ACCOUNT_EDIT = true;
+      DISABLE_ANIMATIONS = true;
+      SMTP_HOST = "mail.pyrox.dev";
+      SMTP_PORT = 465;
+      SMTP_FROM = "auth@pyrox.dev";
+      SMTP_USER = "auth@pyrox.dev";
+      SMTP_TLS = "tls";
+      SMTP_SKIP_CERT_VERIFY = false;
+      LDAP_ENABLED = false;
+    };
+  };
+
+  age.secrets.pocket-id-secrets = {
+    file = ./secrets/pocket-id-secrets.age;
+    owner = "pocket-id";
+    group = "pocket-id";
+  };
+  services.anubis.instances = {
+    pocket-id-fe = {
+      settings = {
+        BIND = ":${toString d.anubis}";
+        POLICY_FNAME = "${pkgs.py.anubis-files}/policies/pocket-id.yaml";
+        TARGET = "http://localhost:${toString d.port}";
+      };
+    };
+    pocket-id-be = {
+      settings = {
+        BIND = ":${toString d.be-anubis}";
+        POLICY_FNAME = "${pkgs.py.anubis-files}/policies/pocket-id.yaml";
+        TARGET = "http://localhost:${toString d.be-port}";
+      };
+    };
+  };
+}
diff --git a/systems/x86_64-linux/marvin/services/secrets/pocket-id-secrets.age b/systems/x86_64-linux/marvin/services/secrets/pocket-id-secrets.age
new file mode 100644
index 0000000000000000000000000000000000000000..8c470ff560e0eabe562f749107a80645a9c12bf4
GIT binary patch
literal 1150
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7EOe^ybX3q!(>8aB
zG&l0f^L7p|&Pw*r@+`@7wJdQoNsTfo&vFR~^3C)rFAb^6FyRVyFG>y1E{%wY@O3t?
zbPjdZFE0$MayKa|(zYx#%W=*3(2g_@&2cu*%ZJ%kRGg@g=9ZWl;>Z<dnpNPQSg2hR
zYE%?es$bz0nrdOHo#~WVq+OVolaf_Y=v<H*8CBwy;_jLem|hm@nIDzr7@QPT<{4!i
z;Tz7C?vmr`q@Qb?o}2HIlTw)CY?Pm8=9?8-Rgx5L8Q`YxTN;q&RveP+o0uLP<XCCp
zoR{vBSMC<zo|om8mLA~D<!@dZ7~ve?mR%8IVVYWDnp5VHlIfOeoT=^aogD0(neSSv
z?OI;t?Gu(_7UJqvp65|o5mXxKsO{_#U=ZR~%9USb;TjfU8s!+^R^{QB=~H0o?{Ah=
zsBMu_>QUj5oS*CAmz^6Co)+MpTA7+3lv8GAkeFK*WMG~jUTRvIk;dg4<)4}nnHlV!
zUf`eanH-!L5Rhh?7i{E|?~+lRRBoQ_=Vs>N@1q|SZt3Bio8uDZW}zQZWoY1Tm{;Os
z5uVOvS`radl;o~&R+4V)@0n>)QQ_ek?h@hQl^C33o?GIWrk@vCSZ<i*m84y1=9QkB
z8IoEO=ILXZW?Y`;8D;9tW$c<~6p&FB<QPyI5ai|?W)P8_o|ozt;-Md5nI4vC?iuE1
zR_Gs+V^HK#QRwXC;+Sfj=$z`|9~Eet>R}oc%H?93l4_J@kP%wsZ02cHWTx+4=#!tE
zXXa?^VN{eJm6&Cc84~E>5fR~CRvA(nW#MlgT5eHU8R(ko66u$&UCL#i7m=D0Tu>0?
zXPj0LQl9Hrq3w~F;$)!hYU%6i<y@W=?40G3<dhy(Xd3ESlHnO;XcTUcooW>BTU=i0
zQlQV3Y98e5QIVS*R!|(6?_U{YS(sJinpcz-WNupMY+96&?UCt}S6)(KP-YpC<&ou_
zm*rtlZW<hw8s=RZ<mI2kl^y1qZ62DRZINB<pQZ2V=8;|C6=9ee;Fe!tQj+D8k!PBi
z<5`ho;bRU@$FN*eUXYvO;i#bP>133hTUu0}Y3S`1=;Y^-l~k0M6B6p-VOg4%Szs7d
zRcaoVT~r=g70DGDW*DB7nVM`I;9FX$uW#(078va0lI2{PWRx6`TxA&Km0RIuXkru^
z?#iXBtE*t)8DbJ{njM}IY~*g3Y*LcyobPE_RP5{J@1I-f=316mo|TcPU+h(BWWu$!
zdb7mW-|Q~4u1D=Cc$o7(Kj3uD^*TwON9NaWTx&T#{Y+Ehq1B#wnG-kv4?22LXt8B}
z&$nZ&`@7eu+*r|LlQPRcVYcianF~4JoZsmE-qp=)!SCI*Sntrb_d&U7hM{8DBr26R
zzMQ%`J>$gv7R}>c*0vs5yRPaU`OkUF_!^Ixmgk=x-V6%*Y!7%RFa$I$-kPBD#X=PT
DDoT>9

literal 0
HcmV?d00001

diff --git a/systems/x86_64-linux/marvin/services/secrets/secrets.nix b/systems/x86_64-linux/marvin/services/secrets/secrets.nix
index 242660d8..1c3f7d48 100644
--- a/systems/x86_64-linux/marvin/services/secrets/secrets.nix
+++ b/systems/x86_64-linux/marvin/services/secrets/secrets.nix
@@ -35,6 +35,7 @@ in
   "nix-serve-priv.age".publicKeys = marvinDefault;
   "pinchflat-secrets.age".publicKeys = marvinDefault;
   "planka-env.age".publicKeys = marvinDefault;
+  "pocket-id-secrets.age".publicKeys = marvinDefault;
   "vaultwarden-vars.age".publicKeys = marvinDefault;
   "vaultwarden-pgpass.age".publicKeys = marvinDefault;
   "webmentiond-env.age".publicKeys = marvinDefault;
diff --git a/systems/x86_64-linux/marvin/services/vaultwarden.nix b/systems/x86_64-linux/marvin/services/vaultwarden.nix
index 3d0d32cf..b95c8b5d 100644
--- a/systems/x86_64-linux/marvin/services/vaultwarden.nix
+++ b/systems/x86_64-linux/marvin/services/vaultwarden.nix
@@ -115,4 +115,11 @@ in
   age.secrets.vaultwarden-pgpass = vaultwardenSecret // {
     file = ./secrets/vaultwarden-pgpass.age;
   };
+  services.anubis.instances.vaultwarden = {
+    settings = {
+      BIND = ":${toString d.anubis}";
+      POLICY_FNAME = "${pkgs.py.anubis-files}/policies/vaultwarden.yaml";
+      TARGET = "http://localhost:${toString d.port}";
+    };
+  };
 }
diff --git a/systems/x86_64-linux/prefect/services/caddy.nix b/systems/x86_64-linux/prefect/services/caddy.nix
index 767512f5..7701e555 100644
--- a/systems/x86_64-linux/prefect/services/caddy.nix
+++ b/systems/x86_64-linux/prefect/services/caddy.nix
@@ -1,14 +1,8 @@
 { pkgs, lib, ... }:
 let
   pns = lib.py.data.services;
-  marvin = lib.py.data.hosts.marvin.ts.ip4;
+  marvin = "http://${lib.py.data.hosts.marvin.ts.ip4}";
   tsNet = lib.py.data.tsNet;
-  reverseProxyToMarvin = port: ts: {
-    extraConfig = ''
-      reverse_proxy http://${marvin}:${toString port}
-      ${if ts then "tailscale_auth" else ""}
-    '';
-  };
 in
 {
   services.caddy = {
@@ -68,17 +62,22 @@ in
       };
 
       # Authentik
-      "${pns.authentik.extUrl}:443" = {
-        serverAliases = [ "${pns.authentik.extUrl}:80" ];
+      ${pns.pocket-id.extUrl} = {
         extraConfig = ''
-            reverse_proxy http://${marvin}:${toString pns.authentik.anubis} {
-          		header_up X-Real-Ip {remote_host}
-              header_up X-Http-Version {http.request.proto}
-            }
+          reverse_proxy /api/* ${marvin}:${toString pns.pocket-id.be-port} {
+            header_up X-Real-IP {remote_host}
+            header_up X-Http-Version {http.request.proto}
+          }
+          reverse_proxy /.well-known/* ${marvin}:${toString pns.pocket-id.be-port} {
+            header_up X-Real-IP {remote_host}
+            header_up X-Http-Version {http.request.proto}
+          }
+          reverse_proxy /* ${marvin}:${toString pns.pocket-id.port} {
+            header_up X-Real-IP {remote_host}
+            header_up X-Http-Version {http.request.proto}
+          }
         '';
       };
-      "http://${pns.authentik.extUrl}:389" = reverseProxyToMarvin 389 false;
-      "${pns.authentik.extUrl}:636" = reverseProxyToMarvin 636 false;
 
       # Vaultwarden
       ${pns.vaultwarden.extUrl} = {
@@ -104,7 +103,7 @@ in
       ${pns.matrix-server.extUrl} = {
         extraConfig = ''
           handle /_matrix/* {
-            reverse_proxy http://${marvin}:${toString pns.matrix-server.port}
+            reverse_proxy ${marvin}:${toString pns.matrix-server.port}
           }
           handle {
             root * /var/www/cinny/dist/
@@ -117,7 +116,7 @@ in
       ${pns.jellyfin.extUrl} = {
         extraConfig = ''
           @blocked not remote_ip 100.64.0.0/10 private_ranges
-          reverse_proxy http://${marvin}:${toString pns.jellyfin.port}
+          reverse_proxy ${marvin}:${toString pns.jellyfin.port}
           handle /metrics* {
             respond @blocked "Access Denied" 403
           }
@@ -177,7 +176,7 @@ in
       # Forgejo
       ${pns.git.extUrl} = {
         extraConfig = ''
-          reverse_proxy http://${marvin}:${toString pns.git.anubis} {
+          reverse_proxy ${marvin}:${toString pns.git.anubis} {
             header_up X-Real-Ip {remote_host}
             header_up X-Http-Version {http.request.proto}
           }
@@ -187,7 +186,7 @@ in
       # Grafana
       ${pns.grafana.extUrl} = {
         extraConfig = ''
-          reverse_proxy http://${marvin}:${toString pns.grafana.anubis} {
+          reverse_proxy ${marvin}:${toString pns.grafana.anubis} {
             header_up X-Real-Ip {remote_host}
             header_up X-Http-Version {http.request.proto}
           }
@@ -197,7 +196,7 @@ in
       # Miniflux
       ${pns.miniflux.extUrl} = {
         extraConfig = ''
-          reverse_proxy http://${marvin}:${toString pns.miniflux.anubis} {
+          reverse_proxy ${marvin}:${toString pns.miniflux.anubis} {
             header_up X-Real-Ip {remote_host}
             header_up X-Http-Version {http.request.proto}
           }
@@ -207,7 +206,7 @@ in
       # Nextcloud
       ${pns.nextcloud.extUrl} = {
         extraConfig = ''
-          reverse_proxy http://${marvin}:${toString pns.nextcloud.anubis} {
+          reverse_proxy ${marvin}:${toString pns.nextcloud.anubis} {
             header_up X-Real-Ip {remote_host}
             header_up X-Http-Version {http.request.proto}
           }
@@ -217,7 +216,7 @@ in
       # Nextcloud-Office(Collabora)
       ${pns.nextcloud-office.extUrl} = {
         extraConfig = ''
-          reverse_proxy http://${marvin}:${toString pns.nextcloud-office.anubis} {
+          reverse_proxy ${marvin}:${toString pns.nextcloud-office.anubis} {
             header_up X-Real-Ip {remote_host}
             header_up X-Http-Version {http.request.proto}
           }
@@ -227,7 +226,7 @@ in
       # Planka
       ${pns.planka.extUrl} = {
         extraConfig = ''
-          reverse_proxy http://${marvin}:${toString pns.planka.anubis} {
+          reverse_proxy ${marvin}:${toString pns.planka.anubis} {
             header_up X-Real-Ip {remote_host}
             header_up X-Http-Version {http.request.proto}
           }
@@ -241,7 +240,7 @@ in
         extraConfig = ''
           bind tailscale/${pns.deemix.tsHost}
           tailscale_auth
-          reverse_proxy http://${marvin}:${toString pns.deemix.port}
+          reverse_proxy ${marvin}:${toString pns.deemix.port}
         '';
       };
       # Pinchflat
@@ -249,7 +248,7 @@ in
         extraConfig = ''
           bind tailscale/${pns.pinchflat.tsHost}
           tailscale_auth
-          reverse_proxy http://${marvin}:${toString pns.pinchflat.port}
+          reverse_proxy ${marvin}:${toString pns.pinchflat.port}
         '';
       };