diff --git a/hosts/common/packages.nix b/hosts/common/packages.nix
index d2dc093..631b6e1 100644
--- a/hosts/common/packages.nix
+++ b/hosts/common/packages.nix
@@ -4,6 +4,7 @@
   nixpkgs.config.allowUnfree = true;
 
   environment.systemPackages = with pkgs; [
+    agenix
     bind
     btop
     comma
diff --git a/hosts/desktops/common/services.nix b/hosts/desktops/common/services.nix
index 1be581b..885d315 100644
--- a/hosts/desktops/common/services.nix
+++ b/hosts/desktops/common/services.nix
@@ -8,6 +8,7 @@ let
 in {
   services = {
     printing.enable = true;
+    flatpak.enable = true;
     pipewire = {
       enable = true;
       alsa.enable = true;
@@ -38,4 +39,8 @@ in {
       };
     };
   };
+  xdg.portal = {
+    enable = true;
+    xdgOpenUsePortal = true;
+  };
 }
diff --git a/hosts/servers/alexandria/chatbot-ui.nix b/hosts/servers/alexandria/chatbot-ui.nix
new file mode 100644
index 0000000..0400bc4
--- /dev/null
+++ b/hosts/servers/alexandria/chatbot-ui.nix
@@ -0,0 +1,23 @@
+{ inputs, config, pkgs, lib, ... }:
+
+{
+  virtualisation.oci-containers.containers."chatbot-ui" = {
+    image = "ghcr.io/mckaywrigley/chatbot-ui:main";
+    ports = [ "${config.ports.chatbot-ui}:5006" ];
+    environmentFiles = [ config.age.secrets.chatbot-ui-keys.path ];
+    extraOptions = [ "--pull=always" ];
+  };
+
+  services.nginx.virtualHosts."chat.baduhai.me" = {
+    useACMEHost = "baduhai.me";
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://127.0.0.1:${config.ports.chatbot-ui}";
+  };
+
+  age.secrets.chatbot-ui-keys = {
+    file = ../../../secrets/chatbot-ui-keys.age;
+    owner = "root";
+    group = "root";
+  };
+}
diff --git a/hosts/servers/alexandria/variables.nix b/hosts/servers/alexandria/variables.nix
index 635ff33..d1c1f60 100644
--- a/hosts/servers/alexandria/variables.nix
+++ b/hosts/servers/alexandria/variables.nix
@@ -22,6 +22,7 @@ in {
     whoogle = mkStringOption "8007";
     qbittorrent = mkStringOption "8008";
     actual = mkStringOption "8009";
+    chatbot-ui = mkStringOption "8010";
     jellyfin = mkStringOption "8096";
     sonarr = mkStringOption "8989";
     jackett = mkStringOption "9117";
diff --git a/secrets/chatbot-ui-keys.age b/secrets/chatbot-ui-keys.age
new file mode 100644
index 0000000..996cfc5
Binary files /dev/null and b/secrets/chatbot-ui-keys.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index d9a98e2..3276999 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -13,4 +13,5 @@ let
 in {
   "cloudflare-creds.age".publicKeys = all-hosts;
   "paperless-pass.age".publicKeys = all-hosts;
+  "chatbot-ui-keys.age".publicKeys = all-hosts;
 }