diff --git a/flake.lock b/flake.lock
index 2bf3b0e..1de6743 100644
--- a/flake.lock
+++ b/flake.lock
@@ -278,6 +278,27 @@
         "type": "github"
       }
     },
+    "portal": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils_3"
+      },
+      "locked": {
+        "lastModified": 1793962157,
+        "narHash": "sha256-syLIoDUWY5g2ubyNZNqgR+R6R5wLgSD8/XWnIazjhYc=",
+        "ref": "refs/heads/master",
+        "rev": "5a5b043354b88f024b53fce39b60a563fd895063",
+        "revCount": 33,
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/portal"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/portal"
+      }
+    },
     "pyproject-build-systems": {
       "inputs": {
         "nixpkgs": [
@@ -341,9 +362,10 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "portal": "portal",
         "sops-nix": "sops-nix",
         "tasklist": "tasklist",
-        "utils": "utils_3",
+        "utils": "utils_4",
         "zineshop": "zineshop"
       }
     },
@@ -443,6 +465,21 @@
         "type": "github"
       }
     },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tasklist": {
       "inputs": {
         "nixpkgs": [
@@ -503,6 +540,24 @@
       "inputs": {
         "systems": "systems_3"
       },
+      "locked": {
+        "lastModified": 1791914995,
+        "narHash": "sha256-Zf/xfQEAasnwnmEfHqW/4hjDE/s44yn2hD4RuVIZRjA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b7a79d3fea1e214f6d668d521cecec0c01e26544",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "utils_4": {
+      "inputs": {
+        "systems": "systems_4"
+      },
       "locked": {
         "lastModified": 1731533236,
         "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
@@ -517,9 +572,9 @@
         "type": "github"
       }
     },
-    "utils_4": {
+    "utils_5": {
       "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -565,7 +620,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "utils": "utils_4"
+        "utils": "utils_5"
       },
       "locked": {
         "lastModified": 1792488750,
diff --git a/flake.nix b/flake.nix
index e46e9c1..7e2223f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -32,6 +32,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    portal = {
+      url = "git+https://git.dynamicdiscord.de/malobeo/portal";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     ep3-bs = {
       url = "git+https://git.dynamicdiscord.de/kalipso/ep3-bs.nix";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/machines/fanny/configuration.nix b/machines/fanny/configuration.nix
index 317da99..2522887 100644
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -149,6 +149,7 @@ in
     "antamap" 
     "ns1"
     "wordpress"
+    "portal"
   ];
 
   networking = {
@@ -184,6 +185,22 @@ in
       };
     };
 
+    virtualHosts."portal.hq.malobeo.org" = {
+      forceSSL = true;
+      enableACME = true;
+      acmeRoot = null;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.portal.network.address}:8080";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
+          client_body_timeout 3600s;
+          send_timeout 3600s;
+          fastcgi_buffers 64 4K;
+        '';
+      };
+    };
+
     virtualHosts."cloud.hq.malobeo.org" = {
       forceSSL = true;
       enableACME = true;
diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix
index 6c46059..76d7ceb 100644
--- a/machines/goldman/configuration.nix
+++ b/machines/goldman/configuration.nix
@@ -86,7 +86,7 @@ in
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 1883];
+  networking.firewall.allowedTCPPorts = [ 80 443 1883 8000 ];
 
   system.stateVersion = "23.05";
 }
diff --git a/machines/hosts.nix b/machines/hosts.nix
index 4d35b6c..adc3cad 100644
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -146,10 +146,15 @@ in
 
       wordpress = {
         type = "microvm";
-        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F7";
       };
 
-      # last host id: 21
+      portal = {
+        type = "microvm";
+        network = createMaloNet "22" "52:DA:0D:F9:EF:F8";
+      };
+
+      # last host id: 22
     };
   };
 }
diff --git a/machines/overwatch/configuration.nix b/machines/overwatch/configuration.nix
index 28befbd..a0050a5 100644
--- a/machines/overwatch/configuration.nix
+++ b/machines/overwatch/configuration.nix
@@ -270,6 +270,12 @@ in
           targets = [ "${hosts.malobeo.hosts.wordpress.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "portal";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ];
+        }];
+      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };
diff --git a/machines/portal/configuration.nix b/machines/portal/configuration.nix
new file mode 100644
index 0000000..93c0710
--- /dev/null
+++ b/machines/portal/configuration.nix
@@ -0,0 +1,42 @@
+{ self, config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+let
+  hosts = import ../hosts.nix {};
+in
+{
+  networking = {
+    hostName = mkDefault "portal";
+    useDHCP = false;
+  };
+
+  imports = [
+    inputs.malobeo.nixosModules.malobeo.metrics
+    inputs.portal.nixosModules.portal
+    inputs.self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
+  malobeo.users = {
+    admin = true;
+  };
+
+  services.portal = {
+    enable = true;
+    #TODO: we should use FQDN like gatekeeper.hq.malobeo.org
+    gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}:8000";
+    gatekeeperScheme = "http";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8080 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+