diff --git a/modules/common/taiga.nix b/modules/common/taiga.nix
new file mode 100644
index 0000000..0f64fb3
--- /dev/null
+++ b/modules/common/taiga.nix
@@ -0,0 +1,169 @@
+{ config, pkgs, ... }: let
+  openid_environment = {
+    ENABLE_OPENID = "True";
+    OPENID_USER_URL = "https://login.clicks.codes/realms/master/protocol/openid-connect/userinfo";
+    OPENID_TOKEN_URL = "https://login.clicks.codes/realms/master/protocol/openid-connect/token";
+    OPENID_CLIENT_ID = "taiga";
+    OPENID_NAME = "Clicks Keycloak";
+
+    # PUBLIC_REGISTER_ENABLED = "True";
+
+    OPENID_ID_FIELD = "sub";
+    OPENID_USERNAME_FIELD = "preferred_username";
+    OPENID_FULLNAME_FIELD = "name";
+    OPENID_EMAIL_FIELD = "email";
+    OPENID_SCOPE="openid email";
+
+    OPENID_FILTER = "enabled";
+    OPENID_FILTER_FIELD = "taiga_access";
+  };
+  backend_environment = openid_environment // {
+    POSTGRES_DB = "taiga";
+    POSTGRES_USER = "taiga";
+    POSTGRES_HOST = "172.20.0.1";
+
+    TAIGA_SCHEME = "https";
+    TAIGA_DOMAIN = "taiga.clicks.codes";
+    TAIGA_SUBPATH = "";
+
+    EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend";
+    DEFAULT_FROM_EMAIL = "taiga@clicks.codes";
+    EMAIL_USE_TLS = "True";
+    EMAIL_USE_SSL = "False"; # not needed when using TLS
+    EMAIL_HOST = "mail.clicks.codes";
+    EMAIL_PORT = "587";
+    EMAIL_HOST_USER = "taiga@clicks.codes";
+
+    RABBITMQ_USER = "taiga";
+
+    ENABLE_TELEMETRY = "False";
+  };
+  credential_environment_files = [
+    config.sops.secrets.taiga_credentials_env.path
+    # TODO: OPENID_CLIENT_SECRET
+  ];
+
+  backend_volumes = [
+    "/var/taiga/back/static:/taiga-back/static"
+    "/var/taiga/back/media:/taiga-back/media"
+  ];
+
+  taiga_version = "latest";
+  taiga_base_version = "latest";  # events, etc. only have X.X.0 versions
+in {
+  sops.secrets.taiga_credentials_env = {
+    mode = "0660";
+    owner = config.users.users.root.name;
+    group = config.users.users.root.group;
+    sopsFile = ../../secrets/taiga.env.bin;
+    format = "binary";
+  };
+
+  networking.firewall.interfaces.taiga.allowedTCPPorts = [ 5432 ];
+
+  systemd.services = {
+    "docker-network-taiga" = {
+      serviceConfig.Type = "oneshot";
+      wantedBy = [
+        "docker-taiga-back.service"
+        "docker-taiga-async.service"
+        "docker-taiga-async-rabbitmq.service"
+        "docker-taiga-front.service"
+        "docker-taiga-events.service"
+        "docker-taiga-events-rabbitmq.service"
+        "docker-taiga-protected.service"
+        "docker-taiga-gateway.service"
+      ];
+      script = ''
+        ${pkgs.docker}/bin/docker network inspect taiga > /dev/null 2>&1 || ${pkgs.docker}/bin/docker network create taiga --gateway 172.20.0.1 --subnet 172.20.0.0/16 --opt com.docker.network.bridge.name=taiga
+      '';
+    };
+    docker-taiga-back.requires = [
+      "docker-taiga-events-rabbitmq.service"
+      "docker-taiga-async-rabbitmq.service"
+      "postgresql.service"
+    ];
+    docker-taiga-async.requires = [
+      "docker-taiga-events-rabbitmq.service"
+      "docker-taiga-async-rabbitmq.service"
+      "postgresql.service"
+    ];
+    docker-taiga-gateway.requires = [
+      "docker-taiga-front.service"
+      "docker-taiga-back.service"
+      "docker-taiga-events.service"
+    ];
+    docker-taiga-events.requires = [
+      "docker-taiga-events-rabbitmq.service"
+    ];
+  };
+  virtualisation.oci-containers.containers = {
+    taiga-back = {
+      image = "taigaio/taiga-back:${taiga_version}";
+      environment = backend_environment;
+      environmentFiles = credential_environment_files;
+      volumes = backend_volumes;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-async = {
+      image = "taigaio/taiga-back:${taiga_version}";
+      environment = backend_environment;
+      environmentFiles = credential_environment_files;
+      volumes = backend_volumes;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-async-rabbitmq = {
+      image = "rabbitmq:3.8-management-alpine";
+      environment = {
+        RABBITMQ_DEFAULT_USER = "taiga";
+        RABBITMQ_DEFAULT_VHOST = "taiga";
+      };
+      environmentFiles = credential_environment_files;
+      volumes = [ "/var/taiga/rabbitmq/async:/var/lib/rabbitmq" ];
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-front = {
+      image = "taigaio/taiga-front:${taiga_version}";
+      environment = openid_environment // {
+        TAIGA_URL = "https://taiga.clicks.codes";
+        TAIGA_WEBSOCKETS_URL = "wss://taiga.clicks.codes";
+        TAIGA_SUBPATH = "";
+      };
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-events = {
+      image = "taigaio/taiga-events:${taiga_base_version}";
+      environment = {
+        RABBITMQ_USER = "taiga";
+      };
+      environmentFiles = credential_environment_files;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-events-rabbitmq = {
+      image = "rabbitmq:3.8-management-alpine";
+      environment = {
+        RABBITMQ_DEFAULT_USER = "taiga";
+        RABBITMQ_DEFAULT_VHOST = "taiga";
+      };
+      environmentFiles = credential_environment_files;
+      volumes = [ "/var/taiga/rabbitmq/events:/var/lib/rabbitmq" ];
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-protected = {
+      image = "taigaio/taiga-protected:${taiga_base_version}";
+      environment = {
+        MAX_AGE = "600";
+      };
+      environmentFiles = credential_environment_files;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-gateway = {
+      image = "nginx:1.19-alpine";
+      ports = [ "127.0.0.255:1029:80/tcp" ];
+      volumes = [
+        "${./taiga/taiga-gateway.conf}:/etc/nginx/conf.d/default.conf"
+      ] ++ backend_volumes;
+      extraOptions = [ "--network=taiga" ];
+    };
+  };
+}