diff --git a/hosts/server/toggles.nix b/hosts/server/toggles.nix
index 048320a..1c6a32e 100644
--- a/hosts/server/toggles.nix
+++ b/hosts/server/toggles.nix
@@ -82,5 +82,6 @@ in
     "vaultwarden"
     "readeck"
     "keycloak"
+    "oauth2-proxy"
   ];
 }
diff --git a/modules/servers/oauth2-proxy.nix b/modules/servers/oauth2-proxy.nix
new file mode 100644
index 0000000..c231bd0
--- /dev/null
+++ b/modules/servers/oauth2-proxy.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.oauth2-proxy;
+in
+{
+  options.my.servers.oauth2-proxy = setup.mkOptions "oauth2-proxy" "auth-proxy" 4180;
+  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+    sops.secrets.oauth2-proxy = {
+      sopsFile = ../../secrets/env.yaml;
+      restartUnits = [ "oauth2-proxy.service" ];
+    };
+    services.oauth2-proxy = {
+      inherit (cfg) enable;
+      provider = "keycloak-oidc";
+      clientID = "oauth2-proxy";
+      keyFile = config.sops.secrets.oauth2-proxy.path;
+      oidcIssuerUrl = "https://auth.lebubu.org/realms/homelab";
+      redirectURL = "https://auth-proxy.lebubu.org/oauth2/callback";
+      httpAddress = "${cfg.ip}:${toString cfg.port}";
+      email.domains = [ "*" ];
+      cookie = {
+        name = "_oauth2_proxy";
+        secure = true;
+        expire = "168h";
+        refresh = "1h";
+        domain = ".lebubu.org";
+      };
+      extraConfig = {
+        skip-auth-routes = [
+          "^/ping$"
+        ];
+        set-xauthrequest = true;
+        pass-access-token = true;
+        pass-user-headers = true;
+        request-logging = true;
+        auth-logging = true;
+        session-store-type = "cookie";
+        skip-provider-button = true;
+      };
+    };
+    systemd.services.oauth2-proxy = {
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}
diff --git a/secrets/env.yaml b/secrets/env.yaml
index 3467917..08558be 100644
--- a/secrets/env.yaml
+++ b/secrets/env.yaml
@@ -12,6 +12,7 @@ synapse: ENC[AES256_GCM,data:IR0pFwQBEM4O8mzzYXrPe2FjulSUGuitzLDLms2uovr6gEU82mC
 readeck: ENC[AES256_GCM,data:TsIkHLji37dDHQRt78SquBhoSREHDgvgbc6+M1k2MLrgMGJ/Ejfy5AZXCIp/Qj5sXDzKP4j6Y6xFvGLswCqe02XjqGCpX13gZVCFPuKr8Nq051Xg,iv:Rc/pjYP+Vd/DvLCYsfJjDrnAlAiUlZOcNeeYzE6O3UY=,tag:OvR+CXMmrUFbsrHvduhnjA==,type:str]
 lidarr-mb-gap: ENC[AES256_GCM,data:bNzD9Nf9BWAPkm0Yk0J4MJbmo908QX9VsD+40Rngnfec9nzH4vZ2DrelxRllgT1kgnXMQzvoSgNhBwkDN4fgX73hz1FjkytTwahlO0wcY6R+tw4aokh0QYy0TVx5pZ4u1FEQOAp3IMgBsP8HOqaL/NEsEo3yb0K9iC3AfFihkLDJmVh26Pg=,iv:go0qS7/BcfcAMPkAdGWCoL61gNqBG5lWDev++y9DJ/I=,tag:LgtEyTZH8NfhfrKTcAigZw==,type:str]
 keycloak: ENC[AES256_GCM,data:BmwZxuJaOB8F7zmBNAf42lkw36s5TepimtdyT2xjdGVyuHgRHbTZqeVen7/0II39qrJjko4agZJgToIZ1uhaC/gpGSoHZlib3rJozPCqmBc42nO6SOtpIO8=,iv:kPModK85937/liNk6iLIRiQ/G5yB7S7h24ZzPb8A1zo=,tag:lWvDQAHVRiBz8XZUoADKvw==,type:str]
+oauth2-proxy: ENC[AES256_GCM,data:IjHaomHQbt8PYWen6mcL9NWRlbTwv0ozk2ggiCsmWwT77U/D8n8JzlaBxJ5d50aqn4U0P+nNr6tQnBj/,iv:EbqmMUEZeprgCojN6h+uPWXsrUsd59HHsiOz8KwOIRU=,tag:3ke0SYGjvxKT1p7Na2pxvg==,type:str]
 sops:
     age:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
@@ -50,7 +51,7 @@ sops:
             QXRUYWtGcWZCVW11U3VYRktuUjlCbDgKsTK4WhUza/JuoDTU3uATa6fq/8eYzxtb
             9BUK1ddzx9Mghea9XBMS17YGtGmW800OsLBomb3SINnOFvejcnKf8Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-10T08:26:05Z"
-    mac: ENC[AES256_GCM,data:rUc4vtnyqK7U6Zvx+BCVMT6yqhCBBsKY/Cfp13XzPzKqa/8sRI7PSEUBY+RSH0t2ShCUep+dWu0ghgFq9L2olJkwuOQ3MHPyIRw3ldwbuYwoRiCtvTkyvtZMaJouy/QrD+mHBr8a6UZRIl/6gnIxcqktzXUeKbCtJcSFj5ScHIg=,iv:j/mtZ3RJwMilVF5AFFUjo4Jm5IDlRIzZx1MdjOE+4gc=,tag:w4Niu71q3Lutu32VdFruHw==,type:str]
+    lastmodified: "2025-12-10T10:02:01Z"
+    mac: ENC[AES256_GCM,data:AAxT/ujy2OoQhZfqS/Dv6YMOWE3uSE9m0zy6fxRSSsN1A9muzNkUVtUWUUdmTC0galwth62s07IU91fHGv+y75MZ76TQMFUXvhkaQp3I4p9I0eDalQfrDaEjqnSKgTJ9jdjzGPAdnG0ZNZQESIQllMUzD5JRGIEiN7gmZo5BGLQ=,iv:BHQOJyaGPp4Hu1EV4bgIJzhLlGOqfWrH6+GI0eZ4Vpc=,tag:yKP1JPAb/z/I9uIMeB0KvA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0