diff --git a/.sops.yaml b/.sops.yaml
index d598e74..f5e2e07 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -2,6 +2,7 @@ keys:
   # after updating this, you will need to `sops updatekeys secrets.file` for any files that need the new key(s)
   - &daniel age1stdue5q5teskee057ced6rh9pzzr93xsy66w4sc3zu49rgxl7cjshztt45 # pass age-key | rg '# pub'
   - &sshd-at-beefcake age1etv56f7kf78a55lxqtydrdd32dpmsjnxndf4u28qezxn6p7xt9esqvqdq7 # ssh beefcake "nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'"
+  - &sshd-at-router age1zd7c3g5d20shdftq8ghqm0r92488dg4pdp4gulur7ex3zx2yq35ssxawpn # ssh router "nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'"
 creation_rules:
   - path_regex: secrets/[^/]+\.(ya?ml|json|env|ini)$
     key_groups:
@@ -12,3 +13,8 @@ creation_rules:
     - age:
       - *daniel
       - *sshd-at-beefcake
+  - path_regex: secrets/router/[^/]+\.(ya?ml|json|env|ini)$
+    key_groups:
+    - age:
+      - *daniel
+      - *sshd-at-router
diff --git a/flake.nix b/flake.nix
index 99d4a61..1693b6c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -569,6 +569,17 @@
           linux
           troubleshooting-tools
 
+          outputs.nixosModules.deno-netlify-ddns-client
+
+          {
+            services.deno-netlify-ddns-client = {
+              enable = true;
+              username = "router.h";
+              # TODO: ipv6
+              ipv6 = false;
+            };
+          }
+
           /*
           NOTE: maybe use this someday, but I think I need more concrete
           networking knowledge before I know how to use it well. Additionally,
diff --git a/nixos/beefcake.nix b/nixos/beefcake.nix
index b3f2fd6..867c1c1 100644
--- a/nixos/beefcake.nix
+++ b/nixos/beefcake.nix
@@ -1645,7 +1645,37 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       };
     }
     {
-      # TODO: paperless-ngx
+      systemd.tmpfiles.settings = {
+        "10-paperless" = {
+          "/storage/paperless" = {
+            "d" = {
+              mode = "0750";
+              user = "paperless";
+              group = "paperless";
+            };
+          };
+        };
+      };
+      services.restic.commonPaths = [
+        "/storage/paperless"
+      ];
+
+      sops.secrets.paperless-superuser-password = {
+        owner = "paperless";
+        group = "paperless";
+        mode = "400";
+      };
+
+      services.paperless = {
+        enable = true;
+        package = pkgs.paperless-ngx;
+        dataDir = "/storage/paperless";
+        passwordFile = config.sops.secrets.paperless-superuser-password.path;
+      };
+
+      services.caddy.virtualHosts."paperless.h.lyte.dev" = {
+        extraConfig = ''reverse_proxy :${toString config.services.paperless.port}'';
+      };
     }
     {
       systemd.tmpfiles.settings = {
diff --git a/nixos/router.nix b/nixos/router.nix
index 0278bc8..ff8d685 100644
--- a/nixos/router.nix
+++ b/nixos/router.nix
@@ -1,7 +1,7 @@
 {
+  config,
   lib,
   # outputs,
-  # config,
   pkgs,
   ...
 }: let
@@ -51,6 +51,7 @@
         "idm.h.lyte.dev"
         "git.lyte.dev"
         "video.lyte.dev"
+        "paperless.h.lyte.dev"
         "audio.lyte.dev"
         "a.lyte.dev"
         "bw.lyte.dev"
@@ -107,6 +108,21 @@ in {
     iftop
   ];
 
+  sops = {
+    defaultSopsFile = ../secrets/router/secrets.yml;
+    age = {
+      sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+    secrets = {
+      netlify-ddns-password = {mode = "0400";};
+    };
+  };
+  services.deno-netlify-ddns-client = {
+    passwordFile = config.sops.secrets.netlify-ddns-password.path;
+  };
+
   boot.kernel.sysctl =
     sysctl-entries
     // {
diff --git a/secrets/beefcake/secrets.yml b/secrets/beefcake/secrets.yml
index 70c973c..dd41417 100644
--- a/secrets/beefcake/secrets.yml
+++ b/secrets/beefcake/secrets.yml
@@ -26,6 +26,7 @@ api.lyte.dev: ENC[AES256_GCM,data:14C5GQ41m/g7qHPzxlYoWjKWDOcm7MEDkuSofiuLfRNc/n
 restic-rascal-passphrase: ENC[AES256_GCM,data:yonKbBh4riGwxc/qcj8F/qrgAtA1sWhYejw9rdOTdCNW3a7zL/Ny1+XCI/P3bMOsY6UTmg/gxA2itp4cSbvqjg==,iv:5GwaEExn7b3dIkCVehLxaBXW+nUuSexY/bcqfCUwF5Q=,tag:dinyyw2XeVoSnw/IsYfK0w==,type:str]
 restic-rascal-ssh-private-key: ENC[AES256_GCM,data:ddsOs0XsayyQI9qc6LzwQpdDnfwNpbj8PbBJ5fyuqtlVNYndeLxaYcbZI2ULSUhgR1tN0FS+ggGTHQhVvjwksNvpskUGHNKkSLKH3D/mn5N9tsoeAblN4gZsloZdqXBVzEehumcQMdhh6iy6NkNbuinKrVKDhLV25PrFKuSBEYw9VHU7HAMW5Tfop3RzBXjZWETCDAR2OQa7d1dXsJ0Kw6b9RFmRe5MGQ0J7YhjdTg26JGMMVSeHvr5UbiUJkGA5RvOLEDM2Dfai7Lf8yRPZVxUl+rdRsNvNYEoYGu5rGLUFcuqIbQ+s40dP2uXwWauwkIvHUjEahkbP0httj4Kg3qIJBRPg7OuS+MOwAnLEAs3hl5zeBV396yA9qjWW8nhnbml58/uFFbfXbJWTM3r8cMpFbHKD+Ojo/99fm5Vy3pAMzNzEsHOaT+iyDYyNkV5OH1GyKK9n7kIRLdqmWe7GmaKXlwVvNUPi3RvLX9VXq83a4BuupFyTmaNfPGMs/17830aleV674+QVgKh3VyFtuJy6KBpMXDv16wFo,iv:S2I3h6pmKLxEc29E0zn2b8lscqA//5/ZMTV9q+/tdvs=,tag:ALeCT+nrVPDfS21xC555sA==,type:str]
 restic-ssh-priv-key-benland: ENC[AES256_GCM,data:G+uiYZTvqXhpJb66j6Q6S+otlXeRX0CdYeMHzSMjIbvbI0AVm0yCU7COO5/O8i47NpvrKKS1kVxVEK8ixLRUowkl3hgRXhxsBIPFnpkMD0ENmJttm4HOpi0qIWMwzPYTjkz/slY4HcTFnCfYy1ZpURQdWwZsr1EdAA05bUMTtM22R3uOMzjO8uf72PCWX7yffo8MxsLmWvNVAOhVlrb2H5KQNR/IquFK3TFoZitq5nVDG9tcEFkX+lgA3zsmCHU/2DvvodgeRoltaAFvgjVznNGf4e5p8owHUtSzX52HwGZRiUlMuhpre2gm1r73n8AyZe41II+LX/85fMfZDdyayIGv3AAMBib8H0/AoChexRcdLQEmzOgRrXsgucDJrWSWP6WMBVyamUm79m5ep0fvL1lJftuJqN0uuq9dBrispdso4x+6jk/pDf5pEM/FE6s1rY832BEb7q0PnjyvVogOez+cIihmMpDdnS0A/8TFzg29i3C+93x5vrt3k7atNzR/jN+/GqX2FKLzxWrrIw2d,iv:IP+N8JQu+XRvwTtBnxu54ujzU5UliltXG3mk9HfJaN8=,tag:4oinE9QMaSh8IfUd/ttM3Q==,type:str]
+paperless-superuser-password: ENC[AES256_GCM,data:lypWK73mOYI2hyQAW/4T3cDiVtsts3kKb7LZb9ES3n97Kn5l,iv:jBHUBFbb4GqQ3gnK0h5VCaGj3/kd3/eGa1QFiE7+B9I=,tag:UoQar+x1xVnCV2k+9hYjWA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -50,8 +51,8 @@ sops:
             bGpacHFRSkJYUUMwOEh4cVBXZ1NESmsKa5EhZ7148ojCqZldukLcPLr93HqnpNgq
             rMI0Nyz4Z4lkTVMRpA94zyNTkNwJ02/CYcKi8EJi6jGZnNPUTcnTwg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-11T20:26:42Z"
-    mac: ENC[AES256_GCM,data:a0gC3hbOoEkRWWv9o1wUbiuvTnp9+vSDTD+l1xxRnwApXW6oqoLpcChbfrHNKNpJKMOQ7KUEgR2Gc5oWQUk+sth4QY/P59QeTtXNAWdmyB8SsbaRdmms/EapUhH8qSy2v24JOaqIdCv/HrRF1MJnHjJ0qZX/bTC6JVmIrsM6LlQ=,iv:AkMwDNRPn+yUOWFcHCdPLerkztAi9/W0W87LQSD/aZo=,tag:+6fi773Qc5lTM60fIVHSnQ==,type:str]
+    lastmodified: "2024-09-13T05:09:18Z"
+    mac: ENC[AES256_GCM,data:rS12xfQ6FQwVa19rdfk6i1DThUOfsrw+IdKGYOMrX8a7sOKPkNxyxyZASfaKopg3BaM8qmoOFUW4B9VWwTh4d+MhruH3DhJO3UuZpOtDv7H8JFmzqg8rlYx0nm+8/+dB0zjgK7m2FP8wn0jfXraaaQ7/HobgLgGtl+NAsXQkrwQ=,iv:+JO3Yq6Kp2CHu20dSRDOJf0ivq5ASHYrKvlCgg1vGxQ=,tag:y6nIISSZFQwRoFNvqaQWbg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.0
diff --git a/secrets/router/secrets.yml b/secrets/router/secrets.yml
new file mode 100644
index 0000000..847ca77
--- /dev/null
+++ b/secrets/router/secrets.yml
@@ -0,0 +1,30 @@
+netlify-ddns-password: ENC[AES256_GCM,data:zp58uV2L+/n/9Cvp1BnQBhdfmNfuyH8C73R6JYrJ3pw0QbEpPpIWuzod9S28QxNq50Bj5/zGzE+D125dkYFX0A==,iv:kceEl04Nb6LWcyjl2fHYjsl0RSO8OulN3DKlDLwjIu4=,tag:nOi2H56dEX9K5okaiDaWOQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1stdue5q5teskee057ced6rh9pzzr93xsy66w4sc3zu49rgxl7cjshztt45
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiQlZqSzBaTUROMkp2K2xI
+            Z0ZIdllGNnlNYnFtVERPbVN6Y1FnWC9aeGlFCnZYci9CblA3VFZsOG5OOXE3cDZj
+            TlZkbU0yY0F1ZDA5amczRVFldU1ZWGcKLS0tIEFTdi9uRFdlQW1MbUdSdm9jRW5n
+            emxsSGN2b3JLZGNYQmVDYk96QUY5aVEK0w7Q/zEsIJKFcQjhgQovmRs4Iv6bhuaz
+            cKn8M/p8dG+p5G50ALsiIiuTFBUM7vmFVF000PxqsEFr0Yl6eDg+uA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zd7c3g5d20shdftq8ghqm0r92488dg4pdp4gulur7ex3zx2yq35ssxawpn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZK1lRTlRIc2ZxcllsRFRp
+            aEZIOC80TSt2Ly9MUEdiVGQ5akkrUUJwcDFJClIyMUl0SWY3TXFLcWl0TGw3K3VM
+            N0VWaGpCaVp6MXg4M2pwcnNhNkhPYjQKLS0tIEZOVGVTcUxaMmxBNEVJQ2VFSjRm
+            L2lpaExJM2FkUFdqa3JpalZmOFZYV0kKmXlu5CUIYnNEOlIco3JveS7KdiF2yWTn
+            r/KOKA9/v3zPbnsYc+HETxYNy1OWrQ/qDGIbR6jz8L5+v35FN+larw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-13T05:37:38Z"
+    mac: ENC[AES256_GCM,data:r1qpYSojCuN84FYX1c684XifKMKUPTOl7dvzuoYYuLf+mwbZrD4fUErDmZczzA4g2ttSNNv05bEq5D7XgfoXPcbhqtj/jggxvX4EGLltpo3Jy77EyKabr1c7KsYV3ciYT13sRGzFYrge06wVrUUPpozPfvAbp1qv0CwK4dUg4dc=,iv:Bpnrx8KcZnWkld4f3VRl39xMmaU388KQunig9xohUto=,tag:vKUupMf/dRb5bY8BMV4oVw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0