diff --git a/hosts/workstation/configuration.nix b/hosts/workstation/configuration.nix
index e6bb934..5d6637c 100644
--- a/hosts/workstation/configuration.nix
+++ b/hosts/workstation/configuration.nix
@@ -124,16 +124,9 @@ in
     ../../secrets/ssh/root-private-ca.pem
   ];
   services = {
+    minio.enable = true;
     flatpak.enable = true;
     open-webui.enable = true;
-    tailscale = {
-      enable = true;
-      useRoutingFeatures = "client";
-      extraUpFlags = [
-        "--accept-routes"
-        "--shields-up"
-      ];
-    };
     scx = {
       enable = true;
       scheduler = "scx_lavd";
@@ -169,4 +162,30 @@ in
       ];
     };
   };
+  programs.virt-manager.enable = true;
+  users.groups.libvirtd.members = [ "jawz" ];
+  virtualisation.libvirtd.enable = true;
+  systemd.services.minio-init = {
+    description = "Initialize MinIO buckets";
+    after = [ "minio.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      # Wait for MinIO to be ready
+      until ${pkgs.curl}/bin/curl -sf http://localhost:9000/minio/health/live > /dev/null 2>&1; do
+        echo "Waiting for MinIO..."
+        sleep 1
+      done
+
+      # Configure mc alias and create bucket
+      ${pkgs.minio-client}/bin/mc alias set local http://localhost:9000 minioadmin minioadmin || true
+      ${pkgs.minio-client}/bin/mc mb local/webref || true
+      ${pkgs.minio-client}/bin/mc anonymous set public local/webref || true
+
+      echo "MinIO initialized with webref bucket"
+    '';
+  };
 }