diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..f2e530b
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,13 @@
+keys:
+  - &admin_bates64 age1h08rnd0jeddf55l6l3rf6dlwwh7mngcxy92tyz0hfysjqx4wvgrq6vmah2
+  - &server_kuribo age1dhxleu7puseq4fz5gprzdssprdd452kjry2n47xaqfh22p5eyqfs68zysl
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *admin_bates64
+  - path_regex: secrets/kuribo/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *admin_bates64
+          - *server_kuribo
diff --git a/flake.lock b/flake.lock
index a7457cc..b2721c1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,7 +18,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index e0e562e..f90090f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,10 +1,11 @@
 {
-  description = "bates64";
-
+  description = "starhaven.dev infrastructure";
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-  };
 
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+  };
   outputs =
     inputs@{ nixpkgs, ... }:
     {
@@ -13,6 +14,7 @@
           system = "aarch64-linux";
           modules = [
             ./servers/kuribo/configuration.nix
+            inputs.sops-nix.nixosModules.sops
           ];
         };
       };
diff --git a/secrets/kuribo/pds.env b/secrets/kuribo/pds.env
new file mode 100644
index 0000000..c77cd26
--- /dev/null
+++ b/secrets/kuribo/pds.env
@@ -0,0 +1,13 @@
+PDS_JWT_SECRET=ENC[AES256_GCM,data:SwmU7j+3kfoCCQlZk/LAzytRoVSb7tgKI6tGdZKJThg=,iv:1WCvMVlPR4L7rO/YUmkobjHcXlSGlyIo80ir+GymdeQ=,tag:WbGeolX/pzSZ+LA8ueUygA==,type:str]
+PDS_ADMIN_PASSWORD=ENC[AES256_GCM,data:+U1Tw+rRcb9rPjZTsOZ9ZYdVeTRFjv8yhuSCCFIe+wQ=,iv:TLJ+HJ8hDXcaZ/9qtSonnOE1oz4JngxuXJLjXpqdDwU=,tag:W7Hi9XMXUMUZAimnAc6uJQ==,type:str]
+PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=ENC[AES256_GCM,data:thNijhgsq106+SJVnoseWu1S8SU2AB8Z5EqjKUzMBm+29FB146dmqPOphXL5yBPDuj0gjzFvfu4W7BOAKcx7fA==,iv:zcmhJopT8WHN2GfhDGO1oYp/NeyPpXeNrg6AVmDYMGk=,tag:JLcO4aVuKMVgRU6pirks+A==,type:str]
+PDS_EMAIL_SMTP_URL=ENC[AES256_GCM,data:ltLt4Q7CaIL4swhDA2pBcMRR2gaMGcYw/7E7JtU4bMotEXrEO19V5ySomjbdFs3ImFzMtVVNY0am9R5Q40TZq85r6zDsoGv6,iv:Kh10CNUhkzqj5PROyFgGme0KUspZL/epxiQf2Ej0G6Y=,tag:noT7j38nip6OLbnwr8AWDQ==,type:str]
+PDS_EMAIL_FROM_ADDRESS=ENC[AES256_GCM,data:VxEX3on/7jQ/SXmr53bvFzd3O/xu,iv:yehoA4hxkJ6UOjv625834otS1Es4uKtarjZjKFk2sJI=,tag:XaplSBikfq97mLTq+XyOrQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkenRnNWFlMzBIOTJsclYw\nSkw3ZW9pa0NRejRQd1FmOENTaE54UU4rcHkwCjFBSXljeTdQeGhXZDZrWS9JUkx0\nUXpxWUVKZTdGWjVLT1FRUmloMXhNdWcKLS0tIEhERVFJNU5pSU00b3MxUHB1Y280\nWTFiaTh0YXJyUXFKNGNrOE84elRONVUK20OPeWSZW2A9mTnEDfQmDc7n3jvUQhxb\nBatl6b0ismrkTWcRJK8nxImcvxBtMMCLfzK5Wt/9gBLJ6VDT6UPYFg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1h08rnd0jeddf55l6l3rf6dlwwh7mngcxy92tyz0hfysjqx4wvgrq6vmah2
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4OVBaMzZ3UGd1R25SczNN\nd3R6bzVGTkN0SWpjb05wankvb2tpNTJvZlR3CjhwYUdHaTJ6Y1VPSTltOHhNbWdL\ncGs3OEJqaFljUFRhUVNncm13RFdETTgKLS0tIG1Mb1ZXQ3BpejdteWFkWUFyOGJu\ndFpyWkNiK2hoNlROd09xTzVueFdSUmcKDrIcoDDH2O/c9dyS/oLL0rudsrsmtOhJ\n55QagSzYouGlJbpl2xtBeUplg1WcEBX7FSW3UWFbz+Gc0/Rv76jRCA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1dhxleu7puseq4fz5gprzdssprdd452kjry2n47xaqfh22p5eyqfs68zysl
+sops_lastmodified=2025-12-01T18:49:36Z
+sops_mac=ENC[AES256_GCM,data:tSPG0g8XpTu0IJ8GQKIUczVlreLbZ/VFncomwSVzFEIXloJ6QQsX2hobyFCW4RwovQoZnVfO4uL8Ku/SIjsLIMCejLiGXAa4r0VDDZtxhnaX7tPBecG7gE3Ke15V4bT6B9uxB7TGhJYTsTlq/tb8D7UZG2+yWudFry8ArJRFxp0=,iv:9vxvakrxx8EmNBPSY1wnoV5cHx2/8GqGhNLYHyDj74w=,tag:5NeNRKenYykPj6b13bHFOg==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.11.0
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
new file mode 100644
index 0000000..6ad385e
--- /dev/null
+++ b/secrets/secrets.yaml
@@ -0,0 +1,16 @@
+hello: ENC[AES256_GCM,data:Qu9O3bH7MKpraW17zQaBAw==,iv:aYX8MM/yFbyVQHqoUTn98fFDb78lywuQNvOaJoTlpMg=,tag:UTHsJ5KdogR8c9bW3m50/Q==,type:str]
+sops:
+    age:
+        - recipient: age1h08rnd0jeddf55l6l3rf6dlwwh7mngcxy92tyz0hfysjqx4wvgrq6vmah2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBldFJveWZZeUh5Qytibkkv
+            MTBqNnJTYnl2aVlzbHpnZUJIQ0xWZzBFNmhVCitoM3MyRXBBVUc2WHY4TUpmNmdn
+            YmtiVkpJUVhNWXNRdDRJNFJtdkkwYWcKLS0tIHJpV3habGJxdStCc0MwcVFhSmxa
+            cmFVYTN0bUlXQ29rOUZVaHRBblpJUE0KHLXin6XsfzIvqYMDRt+GW444X43Eh5Fe
+            rMppR22DHSVdZ8+rJj+pKnYH9DSNc7QbUJwMoeiKBknFh/uXhPCXgg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-01T19:41:23Z"
+    mac: ENC[AES256_GCM,data:DUVrnfELB9bpFlkpA1AajIsVYv1K7r0ur0hH1J3HwWLt4ezgHC6uCoFRlXzC/ysYGlVfn1Hu6WgFEZ75UJ3TzRsluCthZqcwHSGF4cgpD5b5YP2KsF/GoYDPdWhXT+eQ6bLnLCMzxtjstFVWRpkeD0eD9eHNk6Hg270pnS8c9S4=,iv:1FuAy0IT/bgRfUw7/TkPCypnfZNC5aM5qTv10hETBrw=,tag:VL0ema4HZaMvnld+YMNwXA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
diff --git a/servers/kuribo/configuration.nix b/servers/kuribo/configuration.nix
index 215cda0..97ede2a 100644
--- a/servers/kuribo/configuration.nix
+++ b/servers/kuribo/configuration.nix
@@ -4,6 +4,7 @@
     ../../modules/auto-upgrade.nix
     ../../modules/gc.nix
     ../../users/users.nix
+    ./pds.nix
   ];
 
   networking.hostName = "kuribo";
@@ -21,6 +22,9 @@
   };
   services.fail2ban.enable = true;
 
+  sops.defaultSopsFile = ./secrets/secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
   programs.neovim = {
     enable = true;
     defaultEditor = true;
diff --git a/servers/kuribo/pds.nix b/servers/kuribo/pds.nix
new file mode 100644
index 0000000..083d73e
--- /dev/null
+++ b/servers/kuribo/pds.nix
@@ -0,0 +1,54 @@
+{ config, ... }:
+let
+  pdsSettings = config.services.bluesky-pds.settings;
+in
+{
+  sops.secrets.pds = {
+    sopsFile = ../../secrets/kuribo/pds.env;
+    format = "dotenv";
+    owner = "pds";
+    group = "pds";
+  };
+
+  services.bluesky-pds = {
+    enable = true;
+    environmentFiles = [ config.sops.secrets.pds.path ];
+    settings = {
+      PDS_PORT = 3000;
+      PDS_HOSTNAME = "pds.starhaven.dev";
+      PDS_ADMIN_EMAIL = "admin@starhaven.dev";
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+    email = pdsSettings.PDS_ADMIN_EMAIL;
+    globalConfig = ''
+      on_demand_tls {
+        ask http://127.0.0.1:${toString pdsSettings.PDS_PORT}/tls-check
+      }
+    '';
+    virtualHosts.${pdsSettings.PDS_HOSTNAME} = {
+      serverAliases = [ "*.${pdsSettings.PDS_HOSTNAME}" ];
+      extraConfig = ''
+        tls {
+          on_demand
+        }
+
+        reverse_proxy http://127.0.0.1:${toString pdsSettings.PDS_PORT}
+
+        handle /xrpc/app.bsky.unspecced.getAgeAssuranceState {
+          header content-type "application/json"
+          header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
+          header access-control-allow-origin "*"
+          respond `{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}` 200
+        }
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+}