diff --git a/flake.nix b/flake.nix
index 582fce6..e2e718f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,9 +9,14 @@
     };
 
     herdr.url = "github:ogulcancelik/herdr";
+
+    rssdownloader-src = {
+      url = "path:/home/ulve/code/rssdownloader";
+      flake = false;
+    };
   };
 
-  outputs = {self, home-manager, nixpkgs, herdr, ...}: {
+  outputs = {self, home-manager, nixpkgs, herdr, rssdownloader-src, ...}: {
     nixosConfigurations.nixos = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       modules = [
@@ -64,6 +69,7 @@
 
     nixosConfigurations.nixserve = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
+      specialArgs = { inherit rssdownloader-src; };
       modules = [
         ./hosts/nixserve
         home-manager.nixosModules.home-manager
diff --git a/hosts/nixserve/default.nix b/hosts/nixserve/default.nix
index 84f8215..c0bfc6b 100644
--- a/hosts/nixserve/default.nix
+++ b/hosts/nixserve/default.nix
@@ -49,6 +49,7 @@
 
   networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ ];
   networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ ];
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
   programs.zsh.enable = true;
   security.polkit.enable = true;
diff --git a/hosts/nixserve/health.nix b/hosts/nixserve/health.nix
index 5b9e889..55d490e 100644
--- a/hosts/nixserve/health.nix
+++ b/hosts/nixserve/health.nix
@@ -8,7 +8,7 @@ let
     bad()    { echo -e "  ''${R}✗''${N} $*"; }
     section(){ echo -e "\n''${W}''${B}$*''${N}"; }
 
-    echo -e "''${W}nixserve''${N} — $(date '+%Y-%m-%d %H:%M')  uptime: $(uptime -p | sed 's/up //')  load: $(cut -d' ' -f1-3 /proc/loadavg)"
+    echo -e "''${W}nixserve''${N} — $(date '+%Y-%m-%d %H:%M')  uptime: $(uptime | sed 's/.*up //; s/,.*//')  load: $(cut -d' ' -f1-3 /proc/loadavg)"
 
     # ── ZFS ────────────────────────────────────────────────────────────────────
     section "ZFS"
diff --git a/hosts/nixserve/rssdownloader.nix b/hosts/nixserve/rssdownloader.nix
new file mode 100644
index 0000000..6f2d5c9
--- /dev/null
+++ b/hosts/nixserve/rssdownloader.nix
@@ -0,0 +1,7 @@
+{ pkgs, src }:
+pkgs.buildGoModule {
+  pname = "rssdownloader";
+  version = "0.1.0";
+  inherit src;
+  vendorHash = null;
+}
diff --git a/hosts/nixserve/services.nix b/hosts/nixserve/services.nix
index bd413cf..21f670e 100644
--- a/hosts/nixserve/services.nix
+++ b/hosts/nixserve/services.nix
@@ -1,6 +1,8 @@
-{ pkgs, ... }:
+{ pkgs, rssdownloader-src, ... }:
 
 let
+  rssdownloader = pkgs.callPackage ./rssdownloader.nix { src = rssdownloader-src; };
+
   proxyVhost = { upstream, websockets ? true, maxBodySize ? "1g" }: {
     forceSSL = true;
     enableACME = true;
@@ -41,7 +43,8 @@ in
     lockdPort = 4001;
     mountdPort = 4002;
     exports = ''
-      /media  192.168.50.0/24(rw,sync,no_subtree_check,all_squash,anonuid=1000,anongid=1000,fsid=0)
+      /media  192.168.50.0/24(rw,sync,no_subtree_check,all_squash,anonuid=1000,anongid=1000,fsid=0,insecure)
+      /media  100.64.0.0/10(rw,sync,no_subtree_check,all_squash,anonuid=1000,anongid=1000,fsid=0,insecure)
     '';
   };
 
@@ -107,6 +110,19 @@ in
     };
   };
 
+  systemd.services.rssdownloader = {
+    description = "RSS Torrent Downloader";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.transmission_4 ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${rssdownloader}/bin/rssdownloader -config /home/ulve/code/rssdownloader/config.json";
+      Restart = "on-failure";
+      User = "ulve";
+    };
+  };
+
   systemd.services.transmission = dockerService {
     name = "transmission";
     description = "Transmission via Mullvad VPN";