diff --git a/.git-age.yaml b/.git-age.yaml
index 9b0fe6bdd0fe13f422bf9b0f2972953795d1d4aa..36c769fd90e28f28c855e7abd135a5c3d27da87a 100644
--- a/.git-age.yaml
+++ b/.git-age.yaml
@@ -4,5 +4,7 @@ machines/common/cifs.nix:
     - age105cm5awxxegyrqthh4vhnxzr0tdy86q8uq52wkkjacfkutp2vprqwseak7
 machines/dragonwell/dex.nix:
     - age105cm5awxxegyrqthh4vhnxzr0tdy86q8uq52wkkjacfkutp2vprqwseak7
+machines/dragonwell/tandoor.nix:
+    - age105cm5awxxegyrqthh4vhnxzr0tdy86q8uq52wkkjacfkutp2vprqwseak7
 machines/dragonwell/vikunja.nix:
     - age105cm5awxxegyrqthh4vhnxzr0tdy86q8uq52wkkjacfkutp2vprqwseak7

diff --git a/.gitattributes b/.gitattributes
index 7fa6de1b9f3b5f9a6108d6fe6649e43d5588b5f6..ff02440df104657da34644e4225841b4b12904af 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -3,3 +3,4 @@ apps/gui/firefox/work.nix filter=git-age diff=git-age
 machines/common/cifs.nix filter=git-age diff=git-age
 machines/dragonwell/dex.nix filter=git-age diff=git-age
 machines/dragonwell/vikunja.nix filter=git-age diff=git-age
+machines/dragonwell/tandoor.nix filter=git-age diff=git-age

diff --git a/machines/dragonwell/caddy.nix b/machines/dragonwell/caddy.nix
index 51099aece410b9d49f480c7ce08205df6238ef0f..1d66c9c6e749290ef624fe993417c6ac36c38158 100644
--- a/machines/dragonwell/caddy.nix
+++ b/machines/dragonwell/caddy.nix
@@ -1,8 +1,5 @@
-{
-  pkgs,
-  config,
+}: {
   ...
-}: {
   services.caddy = {
     enable = true;
     virtualHosts = {
@@ -58,6 +55,9 @@         reverse_proxy localhost:2884
       '';
       "todo.jolheiser.com".extraConfig = ''
         reverse_proxy localhost:8636
+      '';
+      "recipes.jolheiser.com".extraConfig = ''
+        reverse_proxy localhost:3663
       '';
     };
   };

diff --git a/machines/dragonwell/default.nix b/machines/dragonwell/default.nix
index 7c2af48a8e5bfe7a2f29d8f37e2880ba42c9cd44..9ba27149e6cae14925606122bc2e41141cc05185 100644
--- a/machines/dragonwell/default.nix
+++ b/machines/dragonwell/default.nix
@@ -2,7 +2,7 @@ let
   username = "jolheiser";
   key = ''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfKqCWtDlS3tgvfT6hQN+ii8UtabIZ+ZNmYN+bLwIa8PHOEW5MbfaqXSlhKkSi4+7SfQDCHphw0SMfhsQ4qMEcoywZ+4niDgKlQEVkl+S/VGbLuPe92NRStkyreZBLPr3Rh7ScNlGHcmHmoV9v7725fMnsMmabGVhpGO84PwNHOfJyv2tx2h6LxFbAV8S44UQu2lc8YLWCK2UvKuRnBerBXLnDQThUUX8UuCFzb786gQzD5XDU0MENbByxiy0XdVGAC+tFXEiSIgFZlFbFYyShgdTP9MzX2MOglEi+ae+1UIFncraW7ptUey7qHFJylpHWWWvE+GTwsg2G50i0FvFj jolheiser@jolheiser'';
 in {
-  imports = [./caddy.nix ./dex.nix ./golink.nix ./gotosocial.nix ./restic.nix ./ugit.nix ./vikunja.nix ./hardware.nix];
+  imports = [./caddy.nix ./dex.nix ./golink.nix ./gotosocial.nix ./restic.nix ./tandoor.nix ./ugit.nix ./vikunja.nix ./hardware.nix];
 
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;

diff --git a/machines/dragonwell/dex.nix b/machines/dragonwell/dex.nix
index e81503c84cd01ecef1856b97165562e540d3da05..aa5a673bf95dc124dec800dd61b90b830434a4fc 100644
Binary files a/machines/dragonwell/dex.nix and b/machines/dragonwell/dex.nix differ

diff --git a/machines/dragonwell/tandoor.nix b/machines/dragonwell/tandoor.nix
new file mode 100644
index 0000000000000000000000000000000000000000..efc40612cf2e6e88cc44a601151a0b70b4bdcf5f
Binary files /dev/null and b/machines/dragonwell/tandoor.nix differ

diff --git a/secrets/personal/dex-tandoor.age b/secrets/personal/dex-tandoor.age
new file mode 100644
index 0000000000000000000000000000000000000000..f93a15f59ad8bb38cc61dd888f5b21a46f45af9c
--- /dev/null
+++ b/secrets/personal/dex-tandoor.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 E8j6/g KP8adYt7yepYjV1WCWB2k37H11nZS0syTPO6PVucDQ4
+nd9usbx1lF7W2NoRyBmdU+TkYw42yPc5+YLHPvFgf1U
+-> ssh-ed25519 f31uNA 7VqN325Bduh25YchTA9x4fTSRd41a2YaVvDdLpwLpDQ
+CqwaGdHTEgYBMAPu90iepQ49xYaWHG0FgstoW26nvx8
+-> =8c+@%-grease w_5b {U1m1b74 pok2 2(-Tc:-s
+rOOI5rguWr1j4qgZ2pU46+aeXkrO4nj98K5haK31Cxa8dpWpX9griaZZY2yK9t90
+gREWgA+FELyBNadX
+--- UsjsNVNstM008feyUFwjzDmO99vtJLO6V2/LjjErUX8
+��om����-`w�������*q��+�G�:�?{܄���
+�I��V�
Ne�~�+
\ No newline at end of file

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index de8302de02f7be589c7be107111c746761cd9564..1b7aeb09affd3550c190cdd41065157347b2d3ca 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -28,3 +28,5 @@   "personal/dex.age".publicKeys = [jolheiser dragonwell];
   "personal/dex-tailscale.age".publicKeys = [jolheiser dragonwell];
   "personal/dex-vikunja.age".publicKeys = [jolheiser dragonwell];
   matcha = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZxjkZLj/9xvmg1enK+B7k8qf6Px0j4kTZ2caQfYmB1";
+let
+  matcha = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZxjkZLj/9xvmg1enK+B7k8qf6Px0j4kTZ2caQfYmB1";