diff --git a/services/kodi.nix b/services/kodi.nix
new file mode 100644
index 0000000..b1d2f1b
--- /dev/null
+++ b/services/kodi.nix
@@ -0,0 +1,33 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+mkIf (elem "kodi" config.machine.services) {
+  users.extraUsers.kodi.isNormalUser = true;
+  services.cage = {
+    enable = true;
+    user = "kodi";
+    program =
+      let
+        kodi = pkgs.kodi-wayland.withPackages (
+          kodiPackages: with kodiPackages; [
+            netflix
+            sponsorblock
+            vfs-libarchive
+            vfs-rar
+            vfs-sftp
+            youtube
+          ]
+        );
+      in
+      "${kodi}/bin/kodi-standalone";
+  };
+  # allow remote control
+  networking.firewall = {
+    allowedTCPPorts = [ 8080 ];
+    allowedUDPPorts = [ 8080 ];
+  };
+}