diff --git a/caddy.nix b/caddy.nix
index 0b69523..964951a 100755
--- a/caddy.nix
+++ b/caddy.nix
@@ -21,5 +21,13 @@
       }
       reverse_proxy 192.168.100.11:80
     '';
+
+    virtualHosts."panel.srazka.com".extraConfig = ''
+      forward_auth 127.0.0.1:9091 {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+      }
+      reverse_proxy 127.0.0.1:9911
+    '';
   };
 }
diff --git a/configuration.nix b/configuration.nix
index 867ba85..81ab3b2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -9,7 +9,9 @@
     pkgs.vim
     pkgs.git
     pkgs.agenix
+    pkgs.python3
     pkgs.podman-compose
+    (pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh))
   ];
 
   virtualisation.podman = {
@@ -46,6 +48,29 @@
     "f /home/reudy/containers/routes/_placeholder.caddy 0640 reudy panelroutes -"
   ];
 
+  systemd.services.panel-api = {
+    description = "Minimal panel API service";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "reudy";
+      Group = "panelroutes";
+      Restart = "always";
+      RestartSec = 3;
+      WorkingDirectory = "/home/reudy";
+      ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}";
+    };
+
+    environment = {
+      PANEL_API_BIND = "127.0.0.1";
+      PANEL_API_PORT = "9911";
+      PANEL_BASE_DIR = "/home/reudy/containers";
+      PANELCTL_PATH = "/run/current-system/sw/bin/panelctl";
+    };
+  };
+
   security.sudo.wheelNeedsPassword = true;