diff --git a/globals.nix b/globals.nix
index 55f930f..1bbfb29 100644
--- a/globals.nix
+++ b/globals.nix
@@ -14,6 +14,7 @@
     cdav = "cdav.${wiro-world}";
     goatcounter = "stats.${wiro-world}";
     headscale = "headscale.${wiro-world}";
+    hedgedoc = "hedgedoc.${wiro-world}";
     matrix = "matrix.${wiro-world}";
     miniflux = "news.${wiro-world}";
     pds = "pds.${wiro-world}";
diff --git a/hosts/weird-row-server/authelia.nix b/hosts/weird-row-server/authelia.nix
index d0f6c48..dd55570 100644
--- a/hosts/weird-row-server/authelia.nix
+++ b/hosts/weird-row-server/authelia.nix
@@ -94,10 +94,11 @@
             {
               headscale = mkStrictPolicy "two_factor" [ "group:service:headscale" ];
               tailscale = mkStrictPolicy "two_factor" [ "group:service:headscale" ];
-              grafana = mkStrictPolicy "one_factor" [ "group:service:grafana" ];
-              miniflux = mkStrictPolicy "one_factor" [ "group:service:miniflux" ];
+              grafana = mkStrictPolicy "two_factor" [ "group:service:grafana" ];
+              miniflux = mkStrictPolicy "two_factor" [ "group:service:miniflux" ];
               rustical = mkStrictPolicy "two_factor" [ "group:service:rustical" ];
               vaultwarden = mkStrictPolicy "two_factor" [ "group:service:vaultwarden" ];
+              hedgedoc = mkStrictPolicy "two_factor" [ "group:service:hedgedoc" ];
             };
 
           claims_policies = {
@@ -167,6 +168,16 @@
               authorization_policy = "vaultwarden";
               consent_mode = "implicit";
             }
+            {
+              client_name = "Hedgedoc";
+              client_id = "hedgedoc";
+              client_secret = "$pbkdf2-sha256$310000$rN2opyCE0Lp3L2xO26sLMg$Z3Wf3KKODpb7l6FNhAfInyxn49nSXHfXhfxJH31EStc";
+              redirect_uris = [ "https://${globals.domains.hedgedoc}/auth/oauth2/callback" ];
+              authorization_policy = "hedgedoc";
+              consent_mode = "implicit";
+
+              token_endpoint_auth_method = "client_secret_post";
+            }
           ];
         };
 
diff --git a/hosts/weird-row-server/default.nix b/hosts/weird-row-server/default.nix
index a7245c6..d8dbdf9 100644
--- a/hosts/weird-row-server/default.nix
+++ b/hosts/weird-row-server/default.nix
@@ -21,6 +21,7 @@ in
     ./goatcounter.nix
     ./grafana.nix
     ./headscale.nix
+    ./hedgedoc.nix
     ./hypixel-bank-tracker.nix
     ./lldap.nix
     ./miniflux.nix
diff --git a/hosts/weird-row-server/hedgedoc.nix b/hosts/weird-row-server/hedgedoc.nix
new file mode 100644
index 0000000..6b67fa3
--- /dev/null
+++ b/hosts/weird-row-server/hedgedoc.nix
@@ -0,0 +1,57 @@
+{
+  config,
+  globals,
+  ...
+}:
+
+{
+  config = {
+    local.ports.hedgedoc = 3021;
+
+    age.secrets.hedgedoc-env.file = secrets/hedgedoc-env.age;
+
+    services.hedgedoc = {
+      enable = true;
+
+      environmentFile = config.age.secrets.hedgedoc-env.path;
+
+      settings = {
+        domain = "hedgedoc.wiro.world";
+        port = config.local.ports.hedgedoc.number;
+
+        protocolUseSSL = true;
+        allowOrigin = [
+          "localhost"
+          "hedgedoc.example.com"
+        ];
+
+        email = false;
+        allowAnonymous = false;
+        allowFreeURL = true;
+        defaultPermission = "private";
+
+        oauth2 = {
+          # sessionSecret = ...; # defined in the env
+
+          providerName = "Authelia";
+          authorizationURL = "https://${globals.domains.authelia}/api/oidc/authorization";
+          tokenURL = "https://${globals.domains.authelia}/api/oidc/token";
+          userProfileURL = "https://${globals.domains.authelia}/api/oidc/userinfo";
+
+          clientID = "hedgedoc";
+          # clientSecret = ...; # defined in `CMD_OAUTH2_CLIENT_SECRET`
+          pkce = true;
+
+          scope = "openid email profile groups";
+          userProfileUsernameAttr = "preferred_username";
+          userProfileDisplayNameAttr = "name";
+          userProfileEmailAttr = "email";
+        };
+      };
+    };
+
+    services.caddy.virtualHosts.${globals.domains.hedgedoc}.extraConfig = ''
+      reverse_proxy http://localhost:${toString config.services.hedgedoc.settings.port}
+    '';
+  };
+}
diff --git a/hosts/weird-row-server/secrets/default.nix b/hosts/weird-row-server/secrets/default.nix
index b1ef61a..af95b62 100644
--- a/hosts/weird-row-server/secrets/default.nix
+++ b/hosts/weird-row-server/secrets/default.nix
@@ -17,6 +17,8 @@ in
   "grafana-oidc-secret.age".publicKeys = deploy;
   "grafana-smtp-password.age".publicKeys = deploy;
   "headscale-oidc-secret.age".publicKeys = deploy;
+  # Defines `CMD_SESSION_SECRET`, `CMD_OAUTH2_CLIENT_SECRET`
+  "hedgedoc-env.age".publicKeys = deploy;
   # Defines `HYPIXEL_API_KEY`, `PROFILE_UUID`
   "hypixel-bank-tracker-main.age".publicKeys = deploy;
   "hypixel-bank-tracker-banana.age".publicKeys = deploy;
diff --git a/hosts/weird-row-server/secrets/hedgedoc-env.age b/hosts/weird-row-server/secrets/hedgedoc-env.age
new file mode 100644
index 0000000..202826f
--- /dev/null
+++ b/hosts/weird-row-server/secrets/hedgedoc-env.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 sMF1bg i3QqRptMtz+7YI2N+udNWZuPm96gGaA2qw7luHyidDk
+0cPN+n53niK5XUVF69ySBQ27bP/izxG3Xg/deJGRw2k
+-> ssh-ed25519 SmMcWg NofAgg8TfPWeODUDOKOF/DOI4rRpiE0SgB4F8dvKS18
+n66MlCV9Wy8Tnw/FeKSqwQwrKRqX+/9Rl8elp4BmyzA
+-> ssh-ed25519 Q8rMFA bn+OBvFRgMWmDjDaiMlJMnSmx0VIFrxozOPUlnnUNwY
+QxnkcW0ihgNTOeag7f7IPtElVDjIHd0agiSUBcsd5II
+--- LUXaXWKNw1MdZoff3jt7ZG76qW5n/GhA4jx9e6iyj2s
+����_�w�K���W�A��ZI�U�u��*2��C�X�[�x��X��'9��J표V?�`�{/�ha����6�H��X���̧2�#���v9�Po�`�M�ΪF�������%�'����T}�9�����⹮��Ԇ�L�,U�I��u$_���/��ab��s)i5�"H�7�N����O
+_�S�ed%o=ČS��
\ No newline at end of file