diff --git a/flake.lock b/flake.lock
index d92446f..ff54adc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,50 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -23,7 +68,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -40,6 +85,27 @@
       }
     },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -127,7 +193,7 @@
           "nixpkgs"
         ],
         "nuschtosSearch": "nuschtosSearch",
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1767448089,
@@ -169,7 +235,8 @@
     },
     "root": {
       "inputs": {
-        "home-manager": "home-manager",
+        "agenix": "agenix",
+        "home-manager": "home-manager_2",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim"
@@ -204,6 +271,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 2d1c88b..86763ad 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,6 +8,9 @@
 
     nixvim.url = "github:nix-community/nixvim/nixos-25.11";
     nixvim.inputs.nixpkgs.follows = "nixpkgs";
+
+    agenix.url = "github:ryantm/agenix";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =
diff --git a/nixos/server/default.nix b/nixos/server/default.nix
index b1b06c1..9b4e13d 100644
--- a/nixos/server/default.nix
+++ b/nixos/server/default.nix
@@ -1,22 +1,53 @@
 {
   inputs,
   outputs,
+  config,
+  pkgs,
   ...
 }:
+let
+  dyndnsScript = pkgs.writeScript "dyndns.py" (builtins.readFile ./dyndns.py);
+in
 {
   imports = [
     (import ../base.nix { inherit inputs outputs; })
     ./hardware-configuration.nix
+    ./secrets
+    inputs.agenix.nixosModules.default
   ];
 
+  users.groups.dyndns = { };
   users.users = {
     leonhard = {
       initialPassword = "leonhard";
       isNormalUser = true;
       extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keys = [
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPegeAIABaY9DyWumihNZBlzfdduycvurwYYqoZrdkov2pRVJt8eFhXe+5tdLTKiAq58yzkJ6Zj3CuYb3XuQxX/aDvY4covDXjn1tGKf32xkhTuLd9eDGbFishiC+qROp2/3eZ01DwuttHWo3n/jwOwL3M9mw9Now2i2qaTGuq8wfG5XJ9Cp2+3Ly+mChhtff7Us65dWihNbR3k2WLLvdPJ2HMjeZder0u/IsTTGJj/sytEGt0LPqFOJMl0QuqemkzbeoSAEpVl4huXp5LVT7be2UUmRuekg0p2+EopHunMhUaf7dekiupbKFFNY8aU/eOEZmnakJpOEhcZWaFot825O8jViC9I0NTLazgwttqnZxnuFIp/0Ljf0j7SR/tJa55T0yMH5pyEjw/yvYLplJKbBlPyl2LpsN37l5HKXFtunOsiK/NLL6rLUoTjO5QGCg750c2UKqL8A1g11sW82kscePQTFKbIRmr271ruFWaxnNNh2W5LuJNcUlLf/t/6ps= leonhard"
-      ];
+      openssh.authorizedKeys.keys = config.kekleo.publicKeys;
+    };
+    dyndns = {
+      isSystemUser = true;
+      group = "dyndns";
+      packages = [ pkgs.python313Packages.nc-dnsapi ];
+    };
+  };
+
+  systemd.timers."dyndns" = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "5m";
+      OnUnitActiveSec = "5m";
+      Unit = "dyndns.service";
+    };
+  };
+
+  systemd.services."dyndns" = {
+    script = ''
+      set -eu
+      ${pkgs.python313}/bin/python3 ${dyndnsScript}
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      User = "dyndns";
     };
   };
 
@@ -52,4 +83,7 @@
   };
 
   kekleo.graphical = false;
+  kekleo.publicKeys = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPegeAIABaY9DyWumihNZBlzfdduycvurwYYqoZrdkov2pRVJt8eFhXe+5tdLTKiAq58yzkJ6Zj3CuYb3XuQxX/aDvY4covDXjn1tGKf32xkhTuLd9eDGbFishiC+qROp2/3eZ01DwuttHWo3n/jwOwL3M9mw9Now2i2qaTGuq8wfG5XJ9Cp2+3Ly+mChhtff7Us65dWihNbR3k2WLLvdPJ2HMjeZder0u/IsTTGJj/sytEGt0LPqFOJMl0QuqemkzbeoSAEpVl4huXp5LVT7be2UUmRuekg0p2+EopHunMhUaf7dekiupbKFFNY8aU/eOEZmnakJpOEhcZWaFot825O8jViC9I0NTLazgwttqnZxnuFIp/0Ljf0j7SR/tJa55T0yMH5pyEjw/yvYLplJKbBlPyl2LpsN37l5HKXFtunOsiK/NLL6rLUoTjO5QGCg750c2UKqL8A1g11sW82kscePQTFKbIRmr271ruFWaxnNNh2W5LuJNcUlLf/t/6ps= leonhard@LeonhardsPC"
+  ];
 }
diff --git a/nixos/server/dyndns.py b/nixos/server/dyndns.py
new file mode 100644
index 0000000..f6cbdc3
--- /dev/null
+++ b/nixos/server/dyndns.py
@@ -0,0 +1,3 @@
+from nc_dnsapi import Client, DNSRecord
+
+pass
diff --git a/nixos/server/secrets/default.nix b/nixos/server/secrets/default.nix
new file mode 100644
index 0000000..fc3879e
--- /dev/null
+++ b/nixos/server/secrets/default.nix
@@ -0,0 +1,25 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  keys = builtins.map (
+    key: builtins.toString (pkgs.writeText "agenix-key" key)
+  ) config.kekleo.publicKeys;
+in
+{
+  age.identityPaths = keys;
+  age.secrets.nc_customer = {
+    file = ./nc_customer.age;
+    owner = "dyndns";
+  };
+  age.secrets.nc_api_password = {
+    file = ./nc_api_password.age;
+    owner = "dyndns";
+  };
+  age.secrets.nc_api_key = {
+    file = ./nc_api_key.age;
+    owner = "dyndns";
+  };
+}
diff --git a/nixos/server/secrets/nc_api_key.age b/nixos/server/secrets/nc_api_key.age
new file mode 100644
index 0000000..c56e35f
--- /dev/null
+++ b/nixos/server/secrets/nc_api_key.age
@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-rsa 0VNryQ
+YH11o9QzKg5u12VpNWVth66TStPbNM1A5LEc2iERk6pt3mh3gMFZ4dY0xCi8unaY
+C1xeNd0dmxJwbeCVmEy7zj8IQ9ROAhobv0uFGDJHuqr96HoMxk3iw2/M5up3KCFc
+w6cdJWVJzG0UP20Jiu3f3Yw5dCt7bGGr4MWL9XNmzOzXZEfBcnPiXgdhwurRfOR/
+ZR/r06uNzJNb9nyZeAewU4B1WtkfGdzw6T44IheTmXjTSP2woFl64vddnayl64lw
+xnoG85jz23ayiB8IDIkE+o5cb/2kfPCQNG3JVd+XGT3SJvJRYHwFl6hfX63G504A
+6UzCHMrKG8WeNg0WwR4ViyoEg3Q0ZsExCxBx7itB0/7i/Q4v3bcif1jFFIC2HepC
+5M9UcYlHr06qkfITHATnq3pCd+0piolT7k3YwFzeojp/zUUtfnMOFauVNpeEfqy4
+B5deqnbKYt8z0BZsZ377RUbsP7q+Xho6dZmVOEqG3LzzW3aJSbhigduh51vCbimD
+
+--- yMIQCO5AwTLnXoHXjYHBvXfOIf5vRe/cmNv4mzqlU6s
+E½b�ü¥°<ÕQXHO0q†w¿üç®Ô³‡w$lyg]¿ÇõñâÒŠ›Άþ´gÇÑH
Z
�"ÉÇn³Q
&-U_2
ÎõN.–ärg»·™ö3€
\ No newline at end of file
diff --git a/nixos/server/secrets/nc_api_password.age b/nixos/server/secrets/nc_api_password.age
new file mode 100644
index 0000000..f6a14a7
Binary files /dev/null and b/nixos/server/secrets/nc_api_password.age differ
diff --git a/nixos/server/secrets/nc_customer.age b/nixos/server/secrets/nc_customer.age
new file mode 100644
index 0000000..0b8ba9b
Binary files /dev/null and b/nixos/server/secrets/nc_customer.age differ