diff --git a/modules/common/nginx-routes.nix b/modules/common/nginx-routes.nix
index 865a171..e94d30f 100644
--- a/modules/common/nginx-routes.nix
+++ b/modules/common/nginx-routes.nix
@@ -13,6 +13,7 @@
       (ReverseProxy "127.0.0.1:3000")
     ]))
     (Hosts [ "vaultwarden.clicks.codes" "passwords.clicks.codes" ] (ReverseProxy "generic:1028"))
+    (Hosts [ "taiga.clicks.codes" "projects.clicks.codes" "tasks.clicks.codes" "issues.clicks.codes" "kanban.clicks.codes" ] (ReverseProxy "generic:1029"))
     (Host "login.clicks.codes" (ReverseProxy "127.0.0.1:9083"))
     (Hosts [ "gerrit.clicks.codes" "git.clicks.codes" ]
       (ReverseProxy "generic:1024"))
diff --git a/modules/common/postgres.nix b/modules/common/postgres.nix
index f77346a..30103e8 100644
--- a/modules/common/postgres.nix
+++ b/modules/common/postgres.nix
@@ -4,7 +4,7 @@
 
     package = pkgs.postgresql;
     settings = {
-      listen_addresses = lib.mkForce "standard";
+      listen_addresses = lib.mkForce "standard, 172.20.0.1";
       log_connections = true;
       logging_collector = true;
       log_disconnections = true;
@@ -12,7 +12,7 @@
     };
 
     ensureDatabases =
-      [ "vaultwarden" "gerrit" "privatebin" "keycloak" "nextcloud" "synapse" ];
+      [ "vaultwarden" "gerrit" "privatebin" "keycloak" "nextcloud" "synapse" "taiga" ];
 
     ensureUsers = [
       {
@@ -42,11 +42,17 @@
         name = "nextcloud";
         ensurePermissions = { "DATABASE nextcloud" = "ALL PRIVILEGES"; };
       }
+      {
+        name = "taiga";
+        ensurePermissions = { "DATABASE taiga" = "ALL PRIVILEGES"; };
+      }
     ] ++ (map (name: ({
       inherit name;
       ensurePermissions = { "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES"; };
     })) [ "minion" "coded" "pineafan" ]);
 
+    #                 method database user address auth-method
+    authentication = "host   all      all  samenet scram-sha-256";
   };
 
   systemd.services.postgresql.postStart = lib.mkMerge [
@@ -85,6 +91,10 @@
         user = "nextcloud";
         passwordFile = config.sops.secrets.clicks_nextcloud_db_password.path;
       }
+      {
+        user = "taiga";
+        passwordFile = config.sops.secrets.clicks_taiga_db_password.path;
+      }
     ] [
       (map (userData: ''
         $PSQL -tAc "ALTER USER ${userData.user} PASSWORD '$(cat ${userData.passwordFile})';"
@@ -99,6 +109,7 @@
     "clicks_vaultwarden_db_password"
     "clicks_privatebin_db_password"
     "clicks_nextcloud_db_password"
+    "clicks_taiga_db_password"
   ] [
     (map (name: {
       inherit name;
diff --git a/modules/common/taiga.nix b/modules/common/taiga.nix
new file mode 100644
index 0000000..0f64fb3
--- /dev/null
+++ b/modules/common/taiga.nix
@@ -0,0 +1,169 @@
+{ config, pkgs, ... }: let
+  openid_environment = {
+    ENABLE_OPENID = "True";
+    OPENID_USER_URL = "https://login.clicks.codes/realms/master/protocol/openid-connect/userinfo";
+    OPENID_TOKEN_URL = "https://login.clicks.codes/realms/master/protocol/openid-connect/token";
+    OPENID_CLIENT_ID = "taiga";
+    OPENID_NAME = "Clicks Keycloak";
+
+    # PUBLIC_REGISTER_ENABLED = "True";
+
+    OPENID_ID_FIELD = "sub";
+    OPENID_USERNAME_FIELD = "preferred_username";
+    OPENID_FULLNAME_FIELD = "name";
+    OPENID_EMAIL_FIELD = "email";
+    OPENID_SCOPE="openid email";
+
+    OPENID_FILTER = "enabled";
+    OPENID_FILTER_FIELD = "taiga_access";
+  };
+  backend_environment = openid_environment // {
+    POSTGRES_DB = "taiga";
+    POSTGRES_USER = "taiga";
+    POSTGRES_HOST = "172.20.0.1";
+
+    TAIGA_SCHEME = "https";
+    TAIGA_DOMAIN = "taiga.clicks.codes";
+    TAIGA_SUBPATH = "";
+
+    EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend";
+    DEFAULT_FROM_EMAIL = "taiga@clicks.codes";
+    EMAIL_USE_TLS = "True";
+    EMAIL_USE_SSL = "False"; # not needed when using TLS
+    EMAIL_HOST = "mail.clicks.codes";
+    EMAIL_PORT = "587";
+    EMAIL_HOST_USER = "taiga@clicks.codes";
+
+    RABBITMQ_USER = "taiga";
+
+    ENABLE_TELEMETRY = "False";
+  };
+  credential_environment_files = [
+    config.sops.secrets.taiga_credentials_env.path
+    # TODO: OPENID_CLIENT_SECRET
+  ];
+
+  backend_volumes = [
+    "/var/taiga/back/static:/taiga-back/static"
+    "/var/taiga/back/media:/taiga-back/media"
+  ];
+
+  taiga_version = "latest";
+  taiga_base_version = "latest";  # events, etc. only have X.X.0 versions
+in {
+  sops.secrets.taiga_credentials_env = {
+    mode = "0660";
+    owner = config.users.users.root.name;
+    group = config.users.users.root.group;
+    sopsFile = ../../secrets/taiga.env.bin;
+    format = "binary";
+  };
+
+  networking.firewall.interfaces.taiga.allowedTCPPorts = [ 5432 ];
+
+  systemd.services = {
+    "docker-network-taiga" = {
+      serviceConfig.Type = "oneshot";
+      wantedBy = [
+        "docker-taiga-back.service"
+        "docker-taiga-async.service"
+        "docker-taiga-async-rabbitmq.service"
+        "docker-taiga-front.service"
+        "docker-taiga-events.service"
+        "docker-taiga-events-rabbitmq.service"
+        "docker-taiga-protected.service"
+        "docker-taiga-gateway.service"
+      ];
+      script = ''
+        ${pkgs.docker}/bin/docker network inspect taiga > /dev/null 2>&1 || ${pkgs.docker}/bin/docker network create taiga --gateway 172.20.0.1 --subnet 172.20.0.0/16 --opt com.docker.network.bridge.name=taiga
+      '';
+    };
+    docker-taiga-back.requires = [
+      "docker-taiga-events-rabbitmq.service"
+      "docker-taiga-async-rabbitmq.service"
+      "postgresql.service"
+    ];
+    docker-taiga-async.requires = [
+      "docker-taiga-events-rabbitmq.service"
+      "docker-taiga-async-rabbitmq.service"
+      "postgresql.service"
+    ];
+    docker-taiga-gateway.requires = [
+      "docker-taiga-front.service"
+      "docker-taiga-back.service"
+      "docker-taiga-events.service"
+    ];
+    docker-taiga-events.requires = [
+      "docker-taiga-events-rabbitmq.service"
+    ];
+  };
+  virtualisation.oci-containers.containers = {
+    taiga-back = {
+      image = "taigaio/taiga-back:${taiga_version}";
+      environment = backend_environment;
+      environmentFiles = credential_environment_files;
+      volumes = backend_volumes;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-async = {
+      image = "taigaio/taiga-back:${taiga_version}";
+      environment = backend_environment;
+      environmentFiles = credential_environment_files;
+      volumes = backend_volumes;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-async-rabbitmq = {
+      image = "rabbitmq:3.8-management-alpine";
+      environment = {
+        RABBITMQ_DEFAULT_USER = "taiga";
+        RABBITMQ_DEFAULT_VHOST = "taiga";
+      };
+      environmentFiles = credential_environment_files;
+      volumes = [ "/var/taiga/rabbitmq/async:/var/lib/rabbitmq" ];
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-front = {
+      image = "taigaio/taiga-front:${taiga_version}";
+      environment = openid_environment // {
+        TAIGA_URL = "https://taiga.clicks.codes";
+        TAIGA_WEBSOCKETS_URL = "wss://taiga.clicks.codes";
+        TAIGA_SUBPATH = "";
+      };
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-events = {
+      image = "taigaio/taiga-events:${taiga_base_version}";
+      environment = {
+        RABBITMQ_USER = "taiga";
+      };
+      environmentFiles = credential_environment_files;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-events-rabbitmq = {
+      image = "rabbitmq:3.8-management-alpine";
+      environment = {
+        RABBITMQ_DEFAULT_USER = "taiga";
+        RABBITMQ_DEFAULT_VHOST = "taiga";
+      };
+      environmentFiles = credential_environment_files;
+      volumes = [ "/var/taiga/rabbitmq/events:/var/lib/rabbitmq" ];
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-protected = {
+      image = "taigaio/taiga-protected:${taiga_base_version}";
+      environment = {
+        MAX_AGE = "600";
+      };
+      environmentFiles = credential_environment_files;
+      extraOptions = [ "--network=taiga" ];
+    };
+    taiga-gateway = {
+      image = "nginx:1.19-alpine";
+      ports = [ "127.0.0.255:1029:80/tcp" ];
+      volumes = [
+        "${./taiga/taiga-gateway.conf}:/etc/nginx/conf.d/default.conf"
+      ] ++ backend_volumes;
+      extraOptions = [ "--network=taiga" ];
+    };
+  };
+}
diff --git a/modules/common/taiga/taiga-gateway.conf b/modules/common/taiga/taiga-gateway.conf
new file mode 100644
index 0000000..ebaeb68
--- /dev/null
+++ b/modules/common/taiga/taiga-gateway.conf
@@ -0,0 +1,75 @@
+server {
+    listen 80 default_server;
+
+    client_max_body_size 100M;
+    charset utf-8;
+
+    # Frontend
+    location / {
+        proxy_pass http://taiga-front/;
+        proxy_pass_header Server;
+        proxy_set_header Host $http_host;
+        proxy_redirect off;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Scheme $scheme;
+    }
+
+    # API
+    location /api/ {
+        proxy_pass http://taiga-back:8000/api/;
+        proxy_pass_header Server;
+        proxy_set_header Host $http_host;
+        proxy_redirect off;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Scheme $scheme;
+    }
+
+    # Admin
+    location /admin/ {
+        proxy_pass http://taiga-back:8000/admin/;
+        proxy_pass_header Server;
+        proxy_set_header Host $http_host;
+        proxy_redirect off;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Scheme $scheme;
+    }
+
+    # Static
+    location /static/ {
+        alias /taiga/static/;
+    }
+
+    # Media
+    location /_protected/ {
+        internal;
+        alias /taiga/media/;
+        add_header Content-disposition "attachment";
+    }
+
+    # Unprotected section
+    location /media/exports/ {
+        alias /taiga/media/exports/;
+        add_header Content-disposition "attachment";
+    }
+
+    location /media/ {
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Scheme $scheme;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_pass http://taiga-protected:8003/;
+        proxy_redirect off;
+    }
+
+    # Events
+    location /events {
+        proxy_pass http://taiga-events:8888/events;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
+    }
+}