diff --git a/flake.lock b/flake.lock
index c187503..05a380e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -590,11 +590,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1722813957,
-        "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=",
+        "lastModified": 1723637854,
+        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "cb9a96f23c491c081b38eab96d22fa958043c9fa",
+        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
         "type": "github"
       },
       "original": {
diff --git a/modules/nixos/clicks/services/silverbullet/default.nix b/modules/nixos/clicks/services/silverbullet/default.nix
new file mode 100644
index 0000000..992186f
--- /dev/null
+++ b/modules/nixos/clicks/services/silverbullet/default.nix
@@ -0,0 +1,71 @@
+# SPDX-FileCopyrightText: 2024 Clicks Codes
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  system,
+  ...
+}:
+let
+  cfg = config.clicks.services.silverbullet;
+in
+{
+  options.clicks.services.silverbullet = {
+    enable = lib.mkEnableOption "The silverbullet notes server";
+    tailscaleAuth = lib.mkEnableOption "Lock silverbullet to only be accessible on your tailnet";
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "The domain to host your silverbullet server on";
+    };
+    addr = lib.mkOption {
+      type = lib.types.str;
+      description = "Where to host silverbullet";
+      default = "127.0.0.1";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      description = "Port to host silverbullet on";
+      default = 1026;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    clicks = {
+      services.nginx.enable = true;
+      services.nginx.hosts.${cfg.domain} = {
+        routes = {
+          "/" = lib.clicks.nginx.http.reverseProxy cfg.addr cfg.port; # Only this gets locked behind tailscaleAuth - annoying normally but in this case handy
+          "~ /.client/manifest.json$" = lib.clicks.nginx.http.reverseProxy cfg.addr cfg.port;
+          "~ /.client/[a-zA-Z0-9_-]+.png$" = lib.clicks.nginx.http.reverseProxy cfg.addr cfg.port;
+          "~ /service_worker.js$" = lib.clicks.nginx.http.reverseProxy cfg.addr cfg.port;
+        };
+        www = false;
+        authWith = null; # We will set up tailscale auth manually, as we need to exclude some paths from it
+      };
+      services.tailscaleAuth = {
+        enable = true;
+        hosts = [ cfg.domain ];
+      };
+
+      networking.tailscale.enable = lib.mkIf cfg.tailscaleAuth true;
+
+      storage.impermanence.persist.directories = [
+        { directory = config.services.silverbullet.spaceDir; mode = "0700"; defaultPerms.mode = "0700"; }
+      ];
+    };
+
+    services.silverbullet = {
+      enable = true;
+      listenPort = cfg.port;
+      listenAddress = cfg.addr;
+      package = inputs.unstable.legacyPackages.${system}.silverbullet; # Silverbullet moves fast, the version currently in stable is unacceptably out-of-date
+    };
+
+    systemd.services.silverbullet.requires = (if config.clicks.services.nginx.enable then [ "nginx.service" ] else []);
+    systemd.services.silverbullet.after = (if config.clicks.services.nginx.enable then [ "nginx.service" ] else []);
+  };
+}
diff --git a/systems/x86_64-linux/teal/default.nix b/systems/x86_64-linux/teal/default.nix
index 4cceeca..9af45f5 100644
--- a/systems/x86_64-linux/teal/default.nix
+++ b/systems/x86_64-linux/teal/default.nix
@@ -231,6 +231,11 @@
         };
         domain = "fava.clicks.codes";
       };
+      silverbullet = {
+        enable = true;
+        domain = "silverbullet.clicks.codes";
+        tailscaleAuth = true;
+      };
     };
 
     networking.tailscale = {