diff --git a/flake.nix b/flake.nix
index 005f861..2fec0e2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,6 +54,7 @@
         ./modules/wireguard.nix
         ./modules/cron.nix
         ./modules/paperless.nix
+        ./modules/kavita.nix
         #./modules/dyndns.nix i think ddclient is deprecated
         #./modules/home-assistant.nix idk dont like this
         home-manager.nixosModules.home-manager
diff --git a/modules/kavita.nix b/modules/kavita.nix
new file mode 100644
index 0000000..fa687f2
--- /dev/null
+++ b/modules/kavita.nix
@@ -0,0 +1,17 @@
+{ config, pkgs, lib, inputs, ... }:
+{
+
+  networking.firewall.allowedTCPPorts = [ 5000 ];
+  age.secrets.kavita = {
+    file = ../secrets/kavita.age;
+    owner = "kavita";
+    group = "kavita";
+  };
+  services.kavita = {
+    enable = true;
+    user = "kavita";
+    port = 5000;
+    dataDir = "/mnt/250ssd/kavita";
+    tokenKeyFile = config.age.secrets.kavita.path;
+  };
+}
diff --git a/secrets/kavita.age b/secrets/kavita.age
new file mode 100644
index 0000000..dd08100
Binary files /dev/null and b/secrets/kavita.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 5b356cd..b9e5acb 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -17,4 +17,5 @@ in
   "coturn-secret.age".publicKeys = [ nix-test-vm server ];
   "matrix-registration.age".publicKeys = [ nix-test-vm server ];
   "paperless.age".publicKeys = [ nix-test-vm server ];
+  "kavita.age".publicKeys = [ nix-test-vm server ];
 }