diff --git a/machines/Marid/configuration.nix b/machines/Marid/configuration.nix
index 22a41f0..c1cdd60 100644
--- a/machines/Marid/configuration.nix
+++ b/machines/Marid/configuration.nix
@@ -2,6 +2,9 @@
 
 {
   services.cron.enable = false;
+  security.pki.certificateFiles = [
+    config.sops.secrets."certs/proxy".path
+  ];
   networking.dhcpcd.extraConfig = "noarp";
   system.stateVersion = "21.05";
 }
diff --git a/machines/Marid/secrets.yaml b/machines/Marid/secrets.yaml
new file mode 100644
index 0000000..1e01a74
--- /dev/null
+++ b/machines/Marid/secrets.yaml
@@ -0,0 +1,37 @@
+users:
+    derped:
+        password: ENC[AES256_GCM,data:bSkIZ3CrpnYPzmOZSp/J6y2IUXOe2kszqRYH1ffv7UQgE0sbbbRD/Re5b/p2RfJMhF7vRGH7QfSX6rcTMktyf4cnq14L655OHrah4/+J9YgRRYtGKNeVxr6DJAFPcoW3nc99,iv:NI9lm0SeNN0keDxeLoa+tU6LCfDkICJNCMm90+kKd5c=,tag:edoH4DVqjnu4233DXk5GIg==,type:str]
+certs:
+    proxy: ENC[AES256_GCM,data:T68c6HOxit4pJwWhRcYfFFXi3F8c5j0auiIAlafoexaJvOgnarjmyDnikRB4+gobV0ZytVYIRosb2JuqtH159B05310dJDmUBnGPpOyKSKtPjIaKV0BFCnMI04sosTqh0dNKhqPCuA/95QNJeXvJ3zHkpWuriZhuej45EGJLROWG3fQCpibdDvYaeHhWj2SdtJB9o/eRRbyI7g/AuqJfuvHXoKJmTKbsEXZHu8M0qAiABoR/fuMwF8/FrCgzJ9FZPLPBqQLfGzLMyRULYay8JYegmbvw/YKGk2Y6OMp2zgQOz2xbIAPfGFrPVhoaeyJMRq6aaVa1zupHKFLd8R+cxIfYuViRwMQGOQWZ/hy6gEOCasBzZQVP1SXpCYmHLZPK1Q9jsRxO3ja61EBwNg2dFEe9ONBfSftmj71Ipzrjo/jm3VBPabI3OYbp6LaDIShn/lJxVoyTYJiSe2rn1jix/LE2mwJYg//g2ckkCDSJCVr991MHpsYKeGc7Aocxy/UAWUFPWtCdLGfkJ5T/Z1jYqvGE0MbcifUO2KBvOdZJSu4ptYWxgq1hg0q+f/KQu7WPGcDXpiE2AOfA04coaF+NxCOwHq46py7Ez36wt4y3a2/5xBYnvsdQCb2kKf253IuSF1hMB+yj0Fbw2+HU4FK5V8zuVjfhvC9zncq8WSWojiyodWritbzBKBj/FDqOSKH4UdFfsC4oSzY8y0vDsW5Ied2iE5gPlDeXqwmkfEQuqtBLekc8063ny+iX8TD+5WbEUxn+6++lXiQZWPcaGffGSWcGFaE+EhKV67ul6uARYSuB328WO/mA9cKlv1xPH4HwEXcqPBOdtw==,iv:vyUBk+7VryI+u1yIkPYLYV13gZVE2P9q4T/pmz92OqY=,tag:htempltVO7hkJI0Wfkgm/A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age10vw4q40dq0tk9xzexeyn7cl6qka0hz7mfkmhv9g322k0u4dacd5sq8gg67
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Rnd5UndnWlVUd3RQdEs1
+            S2c3OTFMbmwwdE1WWE5wSEhVQ1NIenJDMG5vCm0xMk1jTGJqTzVtVGwrMVBKNlF5
+            bGxHaURhSzRkdndZalRpT2VLOXhDbEkKLS0tIEd0T1AyR3RsT3NCaGhiZ3BtQUFi
+            MHl3cFVaa0pnbTR3NGhuTXp0dk5ob2cKh2aFZqv1C/m3rZvEKSl9sCYJ8lC/mofq
+            oaigG2BXkgVkcT9xhZufWkMDhS+mOZW7oL0m2DDM3M8cnSMx55ONFg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-06-17T17:35:37Z"
+    mac: ENC[AES256_GCM,data:r4VXy06lvBAtGMexX3zDg9VI67WYeWLS7g9zg9HIv9rZUfwF2/2ZAXDu4PC9Ree8navCb1JhRYpopkZqlm04ky/6XI8RgFfGHXrdtvJAMJeS3houHuL7xLHlEarPvlLfE53g0zZa/GJqBiPzv+VTFEibv6kRKhhQ3FyRgsqUrO4=,iv:cpX1FIhCivvzM6dN4e+z6A2Lo/crHxRffRDweIViehA=,tag:FHRX14G/ke8MgJMyge+eiQ==,type:str]
+    pgp:
+        - created_at: "2023-06-17T16:07:20Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DVbZwA9DOvl8SAQdAcdYIYiBbPSGSTJBzT5ZTV+4fJr8AdZcE5IpSEno7pVIw
+            k6f2fPf2VuXdfnHOFtSMvPfDCsWIqO9JLuue5Bgjd6yxyq7Ss7QqZpFFWjlW6V1A
+            1GgBCQIQI8f3q64+P9CSec9gjmIhAv/ohOsMfBI3CozxHJhQO4B+N4CyZsCYvHrF
+            6qUXpvXEMm6xkTvmXnMc6EEKEuIRMTm+pHEf8Uoz9NCGsWSBbNRFtL6fUZVKLQ09
+            lglDc2ZHhC6XJg==
+            =uWvi
+            -----END PGP MESSAGE-----
+          fp: 1F2EA6D9A57A9BE5A7F3AA035BEBEE4EE57DC7E2
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/machines/Marid/sops.nix b/machines/Marid/sops.nix
new file mode 100644
index 0000000..e9cde21
--- /dev/null
+++ b/machines/Marid/sops.nix
@@ -0,0 +1,14 @@
+{ config, lib, ... }:
+
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    age = {
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+    # TODO: auto loop over users
+    secrets."users/derped/password".neededForUsers = true;
+    secrets."certs/proxy".mode = "0440";
+  };
+}