diff --git a/configuration.nix b/configuration.nix
index e1d7de5..0482b5e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -41,8 +41,7 @@
     defaultSopsFile = ./secrets.yaml;
     age.sshKeyPaths = [ "/root/id_ed25519" ];
     secrets.github-access-token = { };
-    secrets.namecheap-api-user = { mode = "0440"; group = "acme"; };
-    secrets.namecheap-api-key = { mode = "0440"; group = "acme"; };
+    secrets.cloudflare-dns-api-token = { mode = "0440"; group = "acme"; };
   };
   nix.extraOptions = "!include /run/secrets/github-access-token";
 
diff --git a/nginx.nix b/nginx.nix
index caaac97..3d954d5 100644
--- a/nginx.nix
+++ b/nginx.nix
@@ -2,9 +2,16 @@
   services.nginx = {
     enable = true;
     virtualHosts."kyren.codes" = {
+      # forceSSL = true;
+      # enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:3000";
+      };
+    }
+    virtualHosts."185.170.113.195" = {
       listen = [{
         addr = "0.0.0.0";
-        port = 80;
+        port = 3000;
       }];
 
       locations."/" = {
@@ -27,13 +34,12 @@
     defaults.email = "kyren223@proton.me";
     certs."kyren.codes" = {
       extraDomainNames = [ "*.kyren.codes" ];
-      dnsProvider = "namecheap";
-      environmentFile = "${pkgs.writeText "namecheap-creds" ''
-        NAMECHEAP_API_USER_FILE=/run/secrets/namecheap-api-user
-        NAMECHEAP_API_KEY_FILE=/run/secrets/namecheap-api-key
+      dnsProvider = "cloudflare";
+      environmentFile = "${pkgs.writeText "cf-creds" ''
+        CF_DNS_API_TOKEN_FILE=/run/secrets/cloudflare-dns-api-token
       ''}";
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 ];
+  networking.firewall.allowedTCPPorts = [ 80, 3000 ];
 }
diff --git a/secrets.yaml b/secrets.yaml
index 609d3bf..49ae088 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -1,6 +1,5 @@
 github-access-token: ENC[AES256_GCM,data:VXzObn7doHiMzHzzLaBp8Awe3lO256zUoC8u06APR2WQitvJZs1EIqJs92rA5aORny4J6EahBaKRlcrur8oxBfRSAYkzXrECNm6E8mDYFelKv3sjXlPC3KHvHWtNewkkOA8yDOjdvw7kQVWsqZcO73GxZtN6/LgNiZfW7HMC,iv:3jr6uz+3ZUmIXP9aeqzOtvrHZhbc7Wpbdi1ZA0L8r+I=,tag:4eaV7GsdGrP7sLZAPVIDyQ==,type:str]
-namecheap-api-user: ENC[AES256_GCM,data:noc2o4ID0v2uPQigksGIqpdWheo=,iv:aGcW2EsKSFRfTyf8QinWfZDpcPiM1RdLWvDEtkn672s=,tag:GeKNFYxKwSY/ET+cItyJAA==,type:str]
-namecheap-api-key: ENC[AES256_GCM,data:4cfLurohMYez7dPNNuubEH6IB9h6kcAiJIHoHpjvhy3ZYsZBVyjLxnRVgBMFp1WCynu45KIaY7f91z8xgGUcnw==,iv:txQooTDSGwVsQl1xx220XGw2o+sMoOGNBJnU3ssvW3s=,tag:4P2+h+Orqbb0qLx0HIUAig==,type:str]
+cloudflare-dns-api-token: ENC[AES256_GCM,data:NtHjCIgY3O3hMdscGeBHLTzgxnW3uvIdf4Pin/v41ZV1YdsPtz2rXA==,iv:r5jOfkYFUgadCePCTCGeoRtmnrSfRCPytxwUBdLX290=,tag:Fq69nnShzj7QcGT4cPGftA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -16,8 +15,8 @@ sops:
             b254YjZLRm9odks2Y1Erdk1NSU1CVncKnhMnBLjSLfMO3A7gTUI9vIRQvaK07I7k
             mQdtsGZM+1FqlbxsFIoqji+xrqAvcBQENott5+tuFM+ePT5EjQUYGg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-27T15:24:46Z"
-    mac: ENC[AES256_GCM,data:iSXS5uFI4YL1WIZZ7pT5JSWlrnVWc/5QdbrJ5CxFS9SEOKlgCbHToLymd2u8pHjvDVvckaSKvjf1KNV0nq8v+ccxlplzBhsRc/sZwestqqvn1JeAlPGOg6qxvWarLr2/T47XONM7bNtq6AjgE1s+pnrXeK0zZh7Y733i7+WG63I=,iv:CbEBXuiX/WSKnrTlqrg4TEzokKCT44K1Eq2TaC1JUM8=,tag:KVTRIejSatPQ2EyWUkTWNw==,type:str]
+    lastmodified: "2024-12-27T17:08:50Z"
+    mac: ENC[AES256_GCM,data:VC+m4Xa27AAIz3oe+SdonfcJpRRONA3EfoduxHQKsK3LohEd90tnwdQRMQ8TrZbghpxTUff2kAzr2TTyzbqw6wB0DK5+d1vlQmGgLEHiFxtFJtH/eA0F/0PLGmASOgQYGVhWC7taHHredaOsCVI1CwUyV0Uznkj48fWqoKHEfLU=,iv:L9npPtZdMkSnQ+Ha0rnuv6LDd6qIGcUoYULTZ2NtfKc=,tag:tQv5JukyN+ZCLvwZ90suFg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1