diff --git a/hosts/thegeneralist-central/cert.pem.age b/hosts/thegeneralist-central/cert.pem.age
new file mode 100644
index 0000000..ee2225e
--- /dev/null
+++ b/hosts/thegeneralist-central/cert.pem.age
@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 pp9qdQ 2WgjmfKlFjtkMRuA1pHNaGDoGKUozBBjYosmfSNL8EA
+dbFwrLcgWUaxKkHPGsGF7OaOXb3xf5nsCdGhnkbkzPU
+--- yCk7ScptYN12uv1aCqyqfqRHvxl8QiAaFRXd3KgJbdE
+èn­gDÊÎ~ÿ·GÛ÷¦¢èþ‚âât%ó­uá÷÷©¦—1ãg� UÖ¥zL�ÖY|ÓŸ¾añr¹o\©èBs8@kê~Ar†To£þ÷%zžÀ²—yƒ¨ë|"ÿ™‡`CÁjw·ºõŠ¨ñ5±>‡lû¼ÂeèºFœy�ÃfEìÁ·éZÉó½
ÃªUÃÅ:|H �Š“¸=è¨u¥ñˆÂÑ© þ(ÈÀ^qÙ‡Œoï˜ô=‰�ûï�q3Œ×b�I­	äìA¹ð›ýn¹`�HÓksGj
+:…ÐM¨¥˜X·`ßolÄçéÙ‡etddÁoÊÉö¬ÍÑóPíüFï§~‡ôƒÕ¥Úÿ#9*M,hþÑ­Zjo›”Øo|ª"­Ïe$©ÏÙ0ºV
\ No newline at end of file
diff --git a/hosts/thegeneralist-central/cftoken.age b/hosts/thegeneralist-central/cftoken.age
new file mode 100644
index 0000000..1c43e7e
--- /dev/null
+++ b/hosts/thegeneralist-central/cftoken.age
@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 pp9qdQ OrqCuVIzHaavNZxpOXYlIcnrHJe5GOjtcIhmaw+8wHI
+TQCYrhgm4O52QPodgSmFMvyw0Ln7n/+vFlGnONctPKk
+--- jOnFOfG4YRnpvtmmoEVfbh3mAXtfcJiTjzja46xTKMk
+Ï÷r_z'Dx�’y2Ô—ÿƒG½8¹hë}=è‡EàK«[wÀßÆìöaðÿBÞ
+÷þH Ä§ÿHîÆbE–ÿì9{´YS‚ÑÎ–JÞL>²ö¨êPÈÒ“m£ÿDšn¤BQ
Qšš2êÕ¸·çW&uÒ‡X…¼òf»FUoj6Q3e4¡X¸*‚Ý*ó*xÚÓÖ½©ç Cî±ÏýpÇ’}”ÛVµ9~
=û`ô ½¦�’AÓI<.÷’GEÀ¨2­L1BM‡x›ÿW…½IlŸ–†Ü}2&±âïÖ
\ No newline at end of file
diff --git a/hosts/thegeneralist-central/configuration.nix b/hosts/thegeneralist-central/configuration.nix
index 17f1256..714ccc3 100644
--- a/hosts/thegeneralist-central/configuration.nix
+++ b/hosts/thegeneralist-central/configuration.nix
@@ -5,7 +5,7 @@
 { self, config, pkgs, lib, inputs, ... }:
 
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [ ./hardware-configuration.nix ./site.nix ];
 
   users.users.thegeneralist = {
     isNormalUser = true;
@@ -18,7 +18,6 @@
     in [ thegeneralist ];
   };
 
-  programs.home-manager.enable = true;
   home-manager = {
     backupFileExtension = "home.bak";
     extraSpecialArgs = { inherit inputs; };
diff --git a/hosts/thegeneralist-central/credentials.age b/hosts/thegeneralist-central/credentials.age
new file mode 100644
index 0000000..857de19
Binary files /dev/null and b/hosts/thegeneralist-central/credentials.age differ
diff --git a/hosts/thegeneralist-central/site.nix b/hosts/thegeneralist-central/site.nix
new file mode 100644
index 0000000..89d16d1
--- /dev/null
+++ b/hosts/thegeneralist-central/site.nix
@@ -0,0 +1,33 @@
+{ config, pkgs, ... }: let
+  domain = "thegeneralist01.com";
+in {
+  environment.systemPackages = [ pkgs.cloudflared ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts = {
+      "${domain}" = {
+        root = "/var/www/${domain}";
+        locations."/".tryFiles = "$uri $uri/ $uri/index.html";
+      };
+    };
+  };
+
+  age.secrets.cftcert.file = ./cert.pem.age;
+  age.secrets.cftcredentials.file = ./credentials.age;
+
+  services.cloudflared = {
+    enable = true;
+    certificateFile = config.age.secrets.cftcert.path;
+    tunnels."site" = {
+      ingress = {
+        "thegeneralist01.com" = "http://localhost:80";
+        "www.thegeneralist01.com" = "http://localhost:80";
+      };
+      default = "http_status:404";
+      credentialsFile = config.age.secrets.cftcredentials.path;
+      certificateFile = config.age.secrets.cftcert.path;
+    };
+  };
+}
diff --git a/modules/common/home-manager.nix b/modules/common/home-manager.nix
index 3eca196..76b3871 100644
--- a/modules/common/home-manager.nix
+++ b/modules/common/home-manager.nix
@@ -3,4 +3,8 @@
     useGlobalPkgs   = true;
     useUserPackages = true;
   };
+
+  home-manager.sharedModules = [{
+    programs.home-manager.enable = true;
+  }];
 }
diff --git a/secrets.nix b/secrets.nix
index d5e0c37..3bd4512 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -4,5 +4,8 @@ in {
   "hosts/thegeneralist/hostkey.age".publicKeys = [ thegeneralist ];
   "hosts/thegeneralist-central/hostkey.age".publicKeys = [ thegeneralist ];
 
+  "hosts/thegeneralist-central/cert.pem.age".publicKeys = [ thegeneralist ];
+  "hosts/thegeneralist-central/credentials.age".publicKeys = [ thegeneralist ];
+
   "modules/linux/tailscale-marshall.age".publicKeys = [ thegeneralist ];
 }
