diff --git a/modules/cloudflare-ddns.nix b/modules/cloudflare-ddns.nix
new file mode 100644
index 0000000..3abd8a2
--- /dev/null
+++ b/modules/cloudflare-ddns.nix
@@ -0,0 +1,18 @@
+{ config, ... }: {
+  services.cloudflare-dyndns = {
+    enable = true;
+    proxied = false;
+    ipv4 = true;
+    ipv6 = false;
+    domains = [ "d1.a1.crawling.us" ];
+    apiTokenFile = config.sops.secrets.cloudflare_ddns__api_token.path;
+  };
+
+  sops.secrets.cloudflare_ddns__api_token = {
+    mode = "0600";
+    owner = config.users.users.root.name;
+    group = config.users.users.root.group;
+    sopsFile = ../secrets/cloudflare.env.bin;
+    format = "binary";
+  };
+}