diff --git a/modules/config/instances/config/kanboard.nix b/modules/config/instances/config/kanboard.nix
new file mode 100644
index 0000000..542380b
--- /dev/null
+++ b/modules/config/instances/config/kanboard.nix
@@ -0,0 +1,34 @@
+{ instancesFunctions }:
+let
+  inherit (instancesFunctions)
+    domain0
+    servicePath
+    sslPath
+    sopsPath
+    ;
+
+  kanboardLabel = "Kanboard";
+  kanboardName = "kanboard";
+  kanboardSubdomain = "todo";
+in
+{
+  label = kanboardLabel;
+  name = kanboardName;
+  email = {
+    address0 = "noreply@${domain0}";
+  };
+  sops = {
+    path0 = "${sopsPath}/${kanboardName}";
+  };
+  subdomain = kanboardSubdomain;
+  paths = {
+    path0 = "${servicePath}/${kanboardLabel}";
+  };
+  ports = {
+    port0 = 3434;
+  };
+  ssl = {
+    cert = "${sslPath}/${kanboardSubdomain}.${domain0}/fullchain.pem";
+    key = "${sslPath}/${kanboardSubdomain}.${domain0}/key.pem";
+  };
+}
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index e171e44..ec84c5a 100755
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -89,6 +89,7 @@ in
           vaultwarden
           forgejo
           xserver
+          kanboard
           ;
       };
     };
diff --git a/modules/nixos/services/acme/default.nix b/modules/nixos/services/acme/default.nix
index 0c23a31..abc2775 100755
--- a/modules/nixos/services/acme/default.nix
+++ b/modules/nixos/services/acme/default.nix
@@ -38,6 +38,7 @@ in
           "syncthing"
           "searx"
           "vaultwarden"
+          "kanboard"
           "audiobookshelf"
         ]
       )
diff --git a/modules/nixos/services/kanboard/default.nix b/modules/nixos/services/kanboard/default.nix
new file mode 100644
index 0000000..1275b4c
--- /dev/null
+++ b/modules/nixos/services/kanboard/default.nix
@@ -0,0 +1,93 @@
+{
+  flake,
+  config,
+  ...
+}:
+let
+  inherit (flake.config.machines.devices)
+    ceres
+    ;
+  inherit (flake.config.services.instances) smtp kanboard web;
+  service = kanboard;
+  localhost = web.localhost.address0;
+  host = "${service.subdomain}.${web.domains.url0}";
+in
+{
+  services = {
+    kanboard = {
+      enable = true;
+      dataDir = "/var/lib/${service.name}";
+      settings = {
+        HTTP_PROXY_HOSTNAME = host;
+        HTTP_PROXY_PORT = service.ports.port0;
+        MAIL_SMTP_HOSTNAME = smtp.hostname;
+        MAIL_TRANSPORT = "smtp";
+        MAIL_SMTP_PORT = smtp.ports.port0;
+        MAIL_SMTP_USERNAME = service.email.address0;
+        MAIL_FROM = service.email.address0;
+        MAIL_SMTP_PASSWORD = config.sops.secrets."${service.name}-smtp".path;
+        MAIL_SMTP_ENCRYPTION = "tls";
+      };
+    };
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            reverse_proxy ${localhost}:${toString service.ports.port0}
+
+            tls ${service.ssl.cert} ${service.ssl.key}
+          '';
+        };
+      };
+    };
+  };
+  sops =
+    let
+      sopsPath = secret: {
+        path = "${service.sops.path0}/${service.name}-${secret}";
+        owner = service.name;
+        mode = "600";
+      };
+    in
+    {
+      secrets = builtins.listToAttrs (
+        map
+          (secret: {
+            name = "${service.name}-${secret}";
+            value = sopsPath secret;
+          })
+          [
+            "smtp"
+          ]
+      );
+    };
+
+  fileSystems."/var/lib/${service.name}" = {
+    device = service.paths.path0;
+    fsType = "none";
+    options = [
+      "bind"
+    ];
+    depends = [
+      ceres.storage0.mount
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service.paths.path0} 755 ${service.name} ${service.name} -"
+    "Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
+  ];
+
+  users.users.${service.name}.extraGroups = [
+    "caddy"
+    "postgres"
+  ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [
+        service.ports.port0
+      ];
+    };
+  };
+}
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 72f872c..ea48b5b 100755
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -35,6 +35,7 @@ wireguard-CA220: ENC[AES256_GCM,data:rNy/IMKqAOsgMUu5r8BZsjTCu0L5fDDDV3/g+pkhW1y
 wireguard-CA358: ENC[AES256_GCM,data:/VewmiNfRc9/wSE7TT+z1F9LLIvr/5wPsQZ/zBwAh3dEi9yswOGyde2b/XQ=,iv:7U5dmqFiwhCoL1moGSfHprv85o5TdMr6T2sNk5gH82I=,tag:T1hqh8CiO2iBa+ksaiKCtA==,type:str]
 wireguard-CA627: ENC[AES256_GCM,data:chmDsH2nE0nagjFRZWuxX08/Ykt+rIgCHYkMHd+7nIqihK5SebF7MJlrp84=,iv:NVOlGE7W70nQ0UM/i5WixJvDULO3Y4cLf8h+OAGHhQQ=,tag:L123ShCnr9+kIg1itIoqBA==,type:str]
 glance-jellyfin: ENC[AES256_GCM,data:ozdDKgAWkA88J2j8RtiOP/aQPAt/neUOSlAZF20g510=,iv:x+VhYlnA9F/VPrzVcma4/oPelCc8kjWoTZvOs4L9Uqo=,tag:crdSDjr8Y5GH/JAF6t8Yeg==,type:str]
+kanboard-smtp: ENC[AES256_GCM,data:FmmLEGr5Q8RHtie11Y88XQ==,iv:KtY/Bl2vpkXim7KrkK7cc5n0M0RDlxerbXu9jczj/hI=,tag:ZlbV6d1wH6KmbvHJR3Fq/w==,type:str]
 sops:
     age:
         - recipient: age19dpncsdphdt2tmknjs99eghk527pvdrw0m29qjn2z2gg3et5tdtqycqhl0
@@ -46,7 +47,7 @@ sops:
             bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD
             aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-26T17:10:37Z"
-    mac: ENC[AES256_GCM,data:h4jgFynRh4zercRoj1N38Anh4PIb9dspx22qDrndjxJ57oGAOh8p6JyFBlN6YbKYOc+dvdcVHMJUgG4swP7N7SR9ZTNipMgoLOpVQ4NpuWZrNOa7YHs+kRyXu+Y1r4agV890tmogrbyRNKXFtGwLigMtqKeG81VOVFNm9Po1Wgg=,iv:FLO5cwSdasoFKLFtpSxa9FT/Kav5R4qfxXFV8cS8QJk=,tag:G+p8MuM3qLht/m48wDmCVA==,type:str]
+    lastmodified: "2025-06-09T00:32:17Z"
+    mac: ENC[AES256_GCM,data:b4WMUmVOzgcz/ajxPl0OfQUGarUtnFIFS3DA9CjogPz6aVNDGWrVged5FB6UOotoqQ5RcgThewSu2HztEfCbhM0ZwZ0ak87XS8QHb++s97HhYeeh5mqgVnpsvF4Coa9aRpc2H4etuUNYFxoDojT/hTUKzg3a3QNSWzB06aKTd1A=,iv:YEJN5sakhN1rFytIDMIHpHAVYxvbt9iI2eXL2YBUYnY=,tag:SNBQWZIrXw4ptMLEqkR/xA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2