diff --git a/.sops.yaml b/.sops.yaml
index a57ed0d..b8e34d6 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -5,3 +5,7 @@ creation_rules:
     key_groups:
       - age:
           - *server
+  - path_regex: secrets/rabbi-gerzi\.env$
+    key_groups:
+      - age:
+          - *server
diff --git a/flake.nix b/flake.nix
index 71124a5..3921e65 100644
--- a/flake.nix
+++ b/flake.nix
@@ -20,6 +20,10 @@
       url = "git+https://git.yisroelbaum.com/yisroelbaum/MyResume";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    rabbi-gerzi = {
+      url = "git+https://git.yisroelbaum.com/yisroelbaum/Rabbi_Gerzi";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -30,20 +34,24 @@
       sops-nix,
       tide,
       resume,
+      rabbi-gerzi,
       ...
     }:
     let
       system = "x86_64-linux";
       domainName = "yisroelbaum.com";
-    in {
+    in
+    {
       nixosConfigurations.nixos = nixpkgs.lib.nixosSystem {
         modules = [
           ./configuration.nix
           ./discourse.nix
           ./tide.nix
+          ./rabbi-gerzi.nix
           home-manager.nixosModules.home-manager
           sops-nix.nixosModules.sops
           tide.nixosModules.tide
+          rabbi-gerzi.nixosModules.default
           {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
@@ -52,14 +60,16 @@
         ];
         specialArgs = { inherit domainName resume; };
       };
-      devShells."${system}".default = let
-        pkgs = import nixpkgs { inherit system; };
-      in pkgs.mkShell {
-        buildInputs = with pkgs; [
-          nixos-rebuild
-          sops
-          age
-        ];
-      };
+      devShells."${system}".default =
+        let
+          pkgs = import nixpkgs { inherit system; };
+        in
+        pkgs.mkShell {
+          buildInputs = with pkgs; [
+            nixos-rebuild
+            sops
+            age
+          ];
+        };
     };
 }
diff --git a/rabbi-gerzi.nix b/rabbi-gerzi.nix
new file mode 100644
index 0000000..ad5f676
--- /dev/null
+++ b/rabbi-gerzi.nix
@@ -0,0 +1,34 @@
+{
+  config,
+  domainName,
+  ...
+}:
+{
+  services.rabbi-gerzi = {
+    enable = true;
+    frontend = {
+      hostName = "rabbigerzi.${domainName}";
+      nginx = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+    backend = {
+      hostName = "rabbigerziapi.${domainName}";
+      environmentFile = config.sops.secrets."rabbi-gerzi-env".path;
+      nginx = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+  };
+
+  sops.secrets."rabbi-gerzi-env" = {
+    sopsFile = ./secrets/rabbi-gerzi.env;
+    format = "dotenv";
+    key = "";
+    mode = "0400";
+    owner = config.services.rabbi-gerzi.user;
+    group = config.services.rabbi-gerzi.group;
+  };
+}
diff --git a/secrets/README.md b/secrets/README.md
index d923746..5350e1a 100644
--- a/secrets/README.md
+++ b/secrets/README.md
@@ -21,3 +21,13 @@ host's age key.
 
 `tide.yaml` is encrypted and committed. `tide.yaml.example` is
 the plaintext template.
+
+## Rabbi Gerzi
+
+Create `rabbi-gerzi.env` as a SOPS-encrypted dotenv file with:
+
+```dotenv
+APP_KEY=base64:...
+RABBI_GERZI_INITIAL_ADMIN_EMAIL=...
+RABBI_GERZI_INITIAL_ADMIN_PASSWORD=...
+```