diff --git a/nixos/grocy.nix b/nixos/grocy.nix
new file mode 100644
index 00000000..78b50711
--- /dev/null
+++ b/nixos/grocy.nix
@@ -0,0 +1,23 @@
+{config, lib, ...}: let
+  inherit (lib.modules) mkDefault;
+in {
+  config = {
+    services.grocy = {
+      enable = mkDefault true;
+      hostName = "grocy";
+      nginx.enableSSL = false;
+      settings = {
+        currency = mkDefault "CAD";
+      };
+    };
+    services.nginx = let
+      name.shortServer = mkDefault "grocy";
+    in {
+      virtualHosts = {
+        grocy = {
+          inherit name;
+        };
+      };
+    };
+  };
+}
diff --git a/systems/tei/cloudflared.nix b/systems/tei/cloudflared.nix
index 2728260e..f98c2126 100644
--- a/systems/tei/cloudflared.nix
+++ b/systems/tei/cloudflared.nix
@@ -8,6 +8,7 @@
   inherit (lib.attrsets) listToAttrs nameValuePair;
   inherit (access) nixosFor;
   inherit (config.networking) hostName;
+  inherit (config.services) nginx;
   cfg = config.services.cloudflared;
   apartment = "5e85d878-c6b2-4b15-b803-9aeb63d63543";
   accessHostFor = {
@@ -49,11 +50,15 @@ in {
         default = "http_status:404";
         ingress = listToAttrs [
           (ingressForNginx {
-            host = config.services.zigbee2mqtt.domain;
+            host = nginx.virtualHosts.zigbee2mqtt.serverName;
             inherit hostName;
           })
           (ingressForNginx {
-            host = config.services.nginx.access.unifi.domain;
+            host = nginx.access.unifi.domain;
+            inherit hostName;
+          })
+          (ingressForNginx {
+            host = nginx.virtualHosts.grocy.serverName;
             inherit hostName;
           })
           (ingressForHass {inherit hostName;})
diff --git a/systems/tei/nixos.nix b/systems/tei/nixos.nix
index 0a1c334a..6b92783c 100644
--- a/systems/tei/nixos.nix
+++ b/systems/tei/nixos.nix
@@ -23,12 +23,14 @@ in {
     nixos.home-assistant
     nixos.zigbee2mqtt
     nixos.syncplay
+    nixos.grocy
     ./cloudflared.nix
   ];
 
   services.nginx = {
     virtualHosts = {
       zigbee2mqtt.proxied.enable = "cloudflared";
+      grocy.proxied.enable = "cloudflared";
     };
   };
 
diff --git a/tf/cloudflare_records.tf b/tf/cloudflare_records.tf
index 82ddc006..5878de58 100644
--- a/tf/cloudflare_records.tf
+++ b/tf/cloudflare_records.tf
@@ -27,6 +27,7 @@ module "hakurei_system_records" {
     "smb",
     "kitchen",
     "home",
+    "grocy",
     "yt",
   ]
   global_subdomains = [
diff --git a/tf/cloudflare_tunnels.tf b/tf/cloudflare_tunnels.tf
index c76feb20..a0b40596 100644
--- a/tf/cloudflare_tunnels.tf
+++ b/tf/cloudflare_tunnels.tf
@@ -74,6 +74,7 @@ module "tewi" {
     "id",
     "z2m",
     "unifi",
+    "grocy",
   ]
 }