diff --git a/host/configuration.nix b/host/configuration.nix
index be62bf5..02f8213 100644
--- a/host/configuration.nix
+++ b/host/configuration.nix
@@ -9,6 +9,7 @@
     ./../nixosModules/actual-budget.nix
     ./../nixosModules/gitea.nix
     ./../nixosModules/syncthing.nix
+    ./../nixosModules/nextcloud.nix
   ];
 
   boot.loader.grub = {
@@ -38,7 +39,8 @@
   website.enable = true;
   actualBudget.enable = true;
   gitea.enable = true;
-  syncthing.enable = true;
+  syncthing.enable = false;
+  nextcloud.enable = true;
 
   # Automatically pull this config from git
   autoUpdate.enable = true;
diff --git a/nixosModules/nextcloud.nix b/nixosModules/nextcloud.nix
new file mode 100644
index 0000000..83637fb
--- /dev/null
+++ b/nixosModules/nextcloud.nix
@@ -0,0 +1,39 @@
+{ pkgs, lib, config, ... }: {
+
+  imports = [
+    ./acme.nix
+  ];
+
+  options = {
+    nextcloud.enable = lib.mkEnableOption "enables nextcloud";
+  };
+
+  config = lib.mkIf config.nextcloud.enable {
+
+    # Open http and https ports to the public
+    networking.firewall.allowedTCPPorts = [ 443 80 ];
+
+    # Make sure acme module is active for the "kyren.codes" ssl cert
+    acme.enable = true;
+
+    services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+      forceSSL = true;
+      useACMEHost = "kyren.codes";
+    };
+
+    # Define the password and disable php from caching the path to it
+    sops.secrets.nextcloud-admin-password = { };
+    services.nextcloud.phpOptions."realpath_cache_size" = "0";
+
+    services.nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud30;
+      hostName = "nextcloud.kyren.codes";
+      database.createLocally = true;
+      config = {
+        dbtype = "pgsql";
+        adminpassFile = config.sops.secrets.nextcloud-admin-password.path;
+      };
+    };
+  };
+}
diff --git a/nixosModules/secrets.yaml b/nixosModules/secrets.yaml
index 467edd4..476f7fe 100644
--- a/nixosModules/secrets.yaml
+++ b/nixosModules/secrets.yaml
@@ -2,6 +2,7 @@ github-access-token: ENC[AES256_GCM,data:VXzObn7doHiMzHzzLaBp8Awe3lO256zUoC8u06A
 cloudflare-dns-api-token: ENC[AES256_GCM,data:NtHjCIgY3O3hMdscGeBHLTzgxnW3uvIdf4Pin/v41ZV1YdsPtz2rXA==,iv:r5jOfkYFUgadCePCTCGeoRtmnrSfRCPytxwUBdLX290=,tag:Fq69nnShzj7QcGT4cPGftA==,type:str]
 gitea-db-password: ENC[AES256_GCM,data:LHru7hpuT9dmEsfEfcsejfcyoNo2JHITmDzxcqHsj+XCBgQOroi9t+I57QN/Qs6+0Eq4wkSq3o2E,iv:mM9xzbXZK9JUMh078TvsNoMtb4g6dffQmRnYqC7UFf4=,tag:k3v1lKhdYSejoFgs3HTk2g==,type:str]
 syncthing-gui-password: ENC[AES256_GCM,data:CSQuswlhnCX1ChRTffWvIFodQ3vU4PmlDj8H7MjtQ7aWEok330V2Cqs/4EV0PnVtFd3uBCQ=,iv:TqNYonoB7ygN3PT67MFjythf8a+gNPEwDNdtNadMHQk=,tag:hnGs0Z59EGOUKtit9wGD+A==,type:str]
+nextcloud-admin-password: ENC[AES256_GCM,data:qLpqlcZtXt5q1U0okGplawLP/9xK0M8rM7uMdu6j1ld8G4rT8QhM8dyBTJWQPdopoCbjaOE=,iv:iMZqEOq/zDbCXwAr838SNAi0OyLOaN6RXC6XM4ttNF8=,tag:m7I2Lj0ykm5U9mWr4f/tXA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -17,8 +18,8 @@ sops:
             b254YjZLRm9odks2Y1Erdk1NSU1CVncKnhMnBLjSLfMO3A7gTUI9vIRQvaK07I7k
             mQdtsGZM+1FqlbxsFIoqji+xrqAvcBQENott5+tuFM+ePT5EjQUYGg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-31T15:08:41Z"
-    mac: ENC[AES256_GCM,data:XF+Fy4F6ApahM6t0r444Ib27WcXNmYpst9cPo8i8XwTDcjZF1bZHPHHLHQyLDqj7ZjZEBAPj5JuBcLp5RccKKuEDD8QzKRhiqCaMNjZqOrUIYPNOKnrgaMrh/UOwbLC832ets/WCE3j7wZB88aBqUw34vvClC4geBtCuX9AG3As=,iv:0wsf8xqIu5HOwEMd8Lryc3XxfmjFJFYlw+uW65NXiNY=,tag:YPWofxcWrQgm1Z8Aj5xVqg==,type:str]
+    lastmodified: "2024-12-31T18:25:32Z"
+    mac: ENC[AES256_GCM,data:G7k3q0R5dWq5pkZRsQugJwv65PCnBqrksPK2lI5KThmJXXvJgpRkkicjCKX4P4gvT22xvNyonYikNXNWbOQ8fCSgMD7xY+7XV/P1reSLeOj53QVgP9U5LIx8W/Un23nBJ6WXtjc4tEr9XMnHAoGU2XzCCiiTdUza9HHlz714qO0=,iv:rlAphyLK5W4pgSB8/vqZC75/XYavyNhvCve7J0kXTMo=,tag:9QRqJHKI/Gp8Vp8fqhU/IA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1