diff --git a/config/services/nextcloud.nix b/config/services/nextcloud.nix
index 0967ef4..89ddf45 100644
--- a/config/services/nextcloud.nix
+++ b/config/services/nextcloud.nix
@@ -1 +1,37 @@
-{}
+{
+  config,
+  pkgs,
+  ...
+}: {
+  age.secrets."services/nextcloud/admin-password".owner = "nextcloud";
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud29;
+
+    hostName = "cloud.winston.sh";
+    https = true;
+
+    phpOptions = {
+      "opcache.interned_strings_buffer" = "23";
+    };
+
+    extraApps = {
+      inherit
+        (config.services.nextcloud.package.packages.apps)
+        end_to_end_encryption
+        previewgenerator
+        twofactor_webauthn
+        ;
+    };
+    extraAppsEnable = true;
+
+    config.adminpassFile = config.age.secrets."services/nextcloud/admin-password".path;
+  };
+
+  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+    forceSSL = true;
+    enableACME = false;
+    useACMEHost = "winston.sh";
+  };
+}