diff --git a/hosts/samhain/nixos/default.nix b/hosts/samhain/nixos/default.nix
index 6936d6ea..7a0a4700 100644
--- a/hosts/samhain/nixos/default.nix
+++ b/hosts/samhain/nixos/default.nix
@@ -14,6 +14,35 @@
   deploy.groups = [ "gui" ];
   deploy.ssh.host = "192.168.1.135";
 
+  secrets.files.kat-glauca-dns = {
+    text = pkgs.lib.deployEmbedFuckery ''
+      user="$(${pkgs.rbw-bitw}/bin/bitw -p gpg://${../../../private/files/bitw/master.gpg} get infra/hexdns-dynamic -f username)"
+      pass="$(${pkgs.rbw-bitw}/bin/bitw -p gpg://${../../../private/files/bitw/master.gpg} get infra/hexdns-dynamic -f password)"
+      hostname="$(${pkgs.rbw-bitw}/bin/bitw -p gpg://${../../../private/files/bitw/master.gpg} get infra/hexdns-dynamic -f hostname)"
+    '';
+    owner = "kat";
+    group = "users";
+  };
+
+  systemd.services.kat-glauca-dns = {
+    serviceConfig = {
+      ExecStart = "${pkgs.kat-glauca-dns}/bin/kat-glauca-dns";
+    };
+    environment = {
+      passFile = config.secrets.files.kat-glauca-dns.path;
+    };
+    wantedBy = [ "default.target"];
+  };
+
+  systemd.timers.kat-glauca-dns = {
+    timerConfig = {
+      Unit = "kat-glauca-dns.service";
+      OnBootSec = "5m";
+      OnUnitActiveSec = "30m";
+    };
+    wantedBy = [ "default.target" ];
+  };
+
   # graphics tablet
   services.xserver.wacom.enable = true;
 
diff --git a/modules/nixos/deploy/default.nix b/modules/nixos/deploy/default.nix
index 3aa40418..7f0eed2e 100644
--- a/modules/nixos/deploy/default.nix
+++ b/modules/nixos/deploy/default.nix
@@ -17,7 +17,8 @@ let
     '' else ''
       <<${if hasPrefix "__FUCKERY__" file.text then "EOF" else "'EOF'"}
       ${removePrefix "__FUCKERY__" file.text}
-      EOF'')) (attrValues config.secrets.files);
+      EOF
+'')) (attrValues config.secrets.files);
 in {
   options = {
     deploy = {
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 1c24368a..0852229d 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -17,8 +17,6 @@ let
       clockSupport = true;
     };
 
-    kat-website = super.callPackage ./kat-website { };
-
     waybar = super.waybar.override { pulseSupport = true; };
 
     notmuch = super.callPackage ./notmuch { inherit (super) notmuch; };
@@ -35,6 +33,10 @@ let
 
     screenstub = unstable.callPackage ./screenstub { };
 
+    kat-glauca-dns = unstable.callPackage ./kat-glauca-dns { inherit sources; };
+
+    kat-website = super.callPackage ./kat-website { };
+
     kat-weather = super.callPackage ./kat-weather { };
 
     kat-gpg-status = super.callPackage ./kat-gpg-status { };
diff --git a/pkgs/kat-glauca-dns/default.nix b/pkgs/kat-glauca-dns/default.nix
new file mode 100644
index 00000000..2fc74396
--- /dev/null
+++ b/pkgs/kat-glauca-dns/default.nix
@@ -0,0 +1,16 @@
+{ sources, pkgs, curl, coreutils, writeShellScriptBin }: 
+
+let 
+  rbw-bitw = (import sources.arc-nixexprs { inherit pkgs; }).pkgs.rbw-bitw; 
+in writeShellScriptBin "kat-glauca-dns" ''
+#!/usr/bin/env bash
+set -eu
+
+ip4=$(${curl}/bin/curl -s --ipv4 https://dns.glauca.digital/checkip)
+ip6=$(${curl}/bin/curl -s --ipv6 https://dns.glauca.digital/checkip)
+source $passFile
+echo "$ip4, $ip6"
+  ${curl}/bin/curl -u ''${user}:''${pass} --data-urlencode "hostname=''${hostname}" --data-urlencode "myip=''${ip4}" "https://dns.glauca.digital/nic/update"
+echo ""
+  ${curl}/bin/curl -u ''${user}:''${pass} --data-urlencode "hostname=''${hostname}" --data-urlencode "myip=''${ip6}" "https://dns.glauca.digital/nic/update"
+''