diff --git a/flake.lock b/flake.lock
index 3914a22..758d100 100644
--- a/flake.lock
+++ b/flake.lock
@@ -78,6 +78,29 @@
         "type": "github"
       }
     },
+    "gatekeeper": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1786138873,
+        "narHash": "sha256-+G/hTquaK4AjYxNSJTpcZXUEKxFDv9lOn3x+lHHTWJw=",
+        "ref": "refs/heads/master",
+        "rev": "c5934d05c6f01c94c36221deb7ed4de03aa91ca1",
+        "revCount": 127,
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -255,11 +278,62 @@
         "type": "github"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "gatekeeper",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776659114,
+        "narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778901413,
+        "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "disko": "disko",
         "dns": "dns",
         "ep3-bs": "ep3-bs",
+        "gatekeeper": "gatekeeper",
         "home-manager": "home-manager",
         "mfsync": "mfsync",
         "microvm": "microvm",
@@ -461,6 +535,31 @@
         "type": "github"
       }
     },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779269674,
+        "narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "69aec536f6d1acc415ed2e20299312802aba98c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
     "zineshop": {
       "inputs": {
         "nixpkgs": [
diff --git a/flake.nix b/flake.nix
index decbc2c..20c41a9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -37,6 +37,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    gatekeeper = {
+      url = "git+https://git.dynamicdiscord.de/malobeo/gatekeeper";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix
new file mode 100644
index 0000000..6c46059
--- /dev/null
+++ b/machines/goldman/configuration.nix
@@ -0,0 +1,93 @@
+{ config, pkgs, inputs, modulesPath, ... }:
+
+let
+  sshKeys = import ../ssh_keys.nix;
+in
+{
+  networking.hostName = "goldman"; # Define your hostname.
+  nixpkgs.hostPlatform = { system = "aarch64-linux"; };
+  
+  imports =
+    [ 
+      inputs.gatekeeper.nixosModules.gatekeeper
+      ../modules/malobeo_user.nix
+      #inputs.nixos-hardware.nixosModules.raspberry-pi-3
+      (modulesPath + "/profiles/minimal.nix")
+      #(modulesPath + "/installer/sd-card/sd-image.nix")
+    ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+
+  #Try to reduce size
+  documentation.man.enable = false;
+  documentation.nixos.enable = false;
+
+  services.openssh.enable = true;
+  services.openssh.ports = [ 22 ];
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  networking.dhcpcd.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  services.mosquitto = {
+    enable = true;
+    listeners = [{
+      acl = [ "pattern readwrite #" ];
+      omitPasswordAuth = true;
+      settings.allow_anonymous = true;
+    }];
+  };
+
+  services = {
+    gatekeeper = {
+      enable = true;
+      envFile = pkgs.writeText "env" ''
+        MIFARE_APP_MASTER_KEY="7b195adb892073c9e34ebe7e0ca28b2b"
+        MIFARE_ACL_READ_BASE_KEY="741a50f2b189cc9f151e0600f50a6e1a"
+        MIFARE_ACL_WRITE_BASE_KEY="f1aa99f81cca268de98d422ee0ccb65c"
+        SECRET_KEY="8b14d0b447bff7efa24d5019cc59a999786e31f6f865173bbd642bf18de5ad85"
+        MQTT_HOST = "localhost"
+        MQTT_PORT = "1883"
+      '';
+      mock = "False";
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    htop
+    wget
+    git
+    pciutils
+    gpio-utils
+    nix-tree
+    lgpio
+  ];
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      addresses = true;
+      userServices = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 1883];
+
+  system.stateVersion = "23.05";
+}
+
diff --git a/machines/hosts.nix b/machines/hosts.nix
index e194ed1..4482706 100644
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -58,6 +58,15 @@ in
           address = "192.168.1.105";
         };
       };
+
+      goldman = {
+        type = "rpi";
+        network = {
+          local = true;
+          hostId = "16";
+          address = "192.168.1.106";
+        };
+      };
   
       durruti = {
         type = "microvm";