@@ -0,0 +1,69 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  domain = config.networking.domain;
+  ts-domain = "fin-marlin.ts.net";
+in
+{
+  age.secrets.readeck.file = ../../secrets/readeck.age;
+
+  services.readeck = {
+    enable = true;
+    package = pkgs.readeck.overrideAttrs (attrs: rec {
+      version = "0.22.0-pre1";
+      src = pkgs.fetchFromCodeberg {
+        owner = "readeck";
+        repo = "readeck";
+        rev = "12e39b6fe20d3949b249b1410b83ea8ea5043046";
+        hash = "sha256-QOnxTUlC+TaU/MSDSIg8T3cc7dScojVGVyM7kltljbA=";
+      };
+
+      vendorHash = "sha256-2MB7v5oG/LcEKtgbFNxPXSI8TljpbqYUrI7pvu7m+e8=";
+
+      npmDeps = pkgs.fetchNpmDeps {
+        src = "${src}/web";
+        hash = "sha256-znUKRaUdx6GXD2YL6hs0iveaAAHQ8H9n4NHZFi331+g=";
+      };
+    });
+    environmentFile = config.age.secrets.readeck.path;
+    settings = {
+      server = {
+        host = "unix:/run/web/readeck.sock?mode=0660";
+        base_url = "https://read.${ts-domain}";
+      };
+      email = {
+        host = "localhost";
+        port = 587;
+        from = "readeck@${domain}";
+        from_noreply = "noreply+readeck@${domain}";
+      };
+      auth.forwarded = {
+        enabled = true;
+        provisioning = false;
+        header_user = "X-Webauth-User";
+        header_email = "X-Webauth-Email";
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "read.${ts-domain}" = {
+      extraConfig = ''
+        bind tailscale/read
+        tailscale_auth
+        reverse_proxy {
+          to unix//run/web/readeck.sock
+          header_up X-Webauth-User {http.auth.user.tailscale_login}
+          header_up X-Webauth-Email {http.auth.user.tailscale_user}
+        }
+      '';
+    };
+  };
+
+  systemd.services.readeck.serviceConfig = {
+    SupplementaryGroups = [ "webservice" ];
+  };
+}