diff --git a/flake.lock b/flake.lock
index db1d831..7d63d69 100644
--- a/flake.lock
+++ b/flake.lock
@@ -99,6 +99,27 @@
         "type": "github"
       }
     },
+    "naersk": {
+      "inputs": {
+        "nixpkgs": [
+          "password-hash-self-service",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1655042882,
+        "narHash": "sha256-9BX8Fuez5YJlN7cdPO63InoyBy7dm3VlJkkmTt6fS1A=",
+        "owner": "nmattia",
+        "repo": "naersk",
+        "rev": "cddffb5aa211f50c4b8750adbec0bbbdfb26bb9f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nmattia",
+        "repo": "naersk",
+        "type": "github"
+      }
+    },
     "nix-pre-commit-hooks": {
       "inputs": {
         "flake-utils": [
@@ -213,6 +234,45 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1657802959,
+        "narHash": "sha256-9+JWARSdlL8KiH3ymnKDXltE1vM+/WEJ78F5B1kjXys=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4a01ca36d6bfc133bc617e661916a81327c9bbc8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "password-hash-self-service": {
+      "inputs": {
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "naersk": "naersk",
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1657992602,
+        "narHash": "sha256-bFAR4Rvi/MWlvdtYZhCtRY6zDFjThA0QCthUqbaHjsE=",
+        "ref": "master",
+        "rev": "1b3435ec8615300fd81e96045ca7596e0f5a23f0",
+        "revCount": 14,
+        "type": "git",
+        "url": "https://git.sbruder.de/simon/password-hash-self-service"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.sbruder.de/simon/password-hash-self-service"
+      }
+    },
     "root": {
       "inputs": {
         "bang-evaluator": "bang-evaluator",
@@ -225,9 +285,35 @@
         "nixpkgs": "nixpkgs",
         "nixpkgs-overlay": "nixpkgs-overlay",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "password-hash-self-service": "password-hash-self-service",
         "sops-nix": "sops-nix"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "password-hash-self-service",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "password-hash-self-service",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1657939629,
+        "narHash": "sha256-8lX/pZNetbLCN2cW/O+vUz1rG8ig4RaVX5PWe5m4VLA=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "2cd36d4aef875867ee1d7963541ccb3ae50b358c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
diff --git a/flake.nix b/flake.nix
index 11d69b2..27f0b0a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -34,6 +34,9 @@
     bang-evaluator.url = "git+https://git.sbruder.de/simon/bangs";
     bang-evaluator.inputs.flake-utils.follows = "flake-utils";
     bang-evaluator.inputs.nixpkgs.follows = "nixpkgs";
+
+    password-hash-self-service.url = "git+https://git.sbruder.de/simon/password-hash-self-service";
+    password-hash-self-service.inputs.flake-utils.follows = "flake-utils";
   };
 
   outputs =
diff --git a/machines/renge/configuration.nix b/machines/renge/configuration.nix
index 2347824..89d6208 100644
--- a/machines/renge/configuration.nix
+++ b/machines/renge/configuration.nix
@@ -19,6 +19,7 @@
     ./services/murmur.nix
     ./services/nitter.nix
     ./services/onlypain.icu
+    ./services/password-hash-self-service.nix
     ./services/prometheus.nix
     ./services/sbruder.xyz
     ./services/schabernack.nix
diff --git a/machines/renge/services/password-hash-self-service.nix b/machines/renge/services/password-hash-self-service.nix
new file mode 100644
index 0000000..72acdbd
--- /dev/null
+++ b/machines/renge/services/password-hash-self-service.nix
@@ -0,0 +1,10 @@
+{ inputs, pkgs, ... }:
+
+{
+  services.nginx.virtualHosts."phss.sbruder.de" = {
+    enableACME = true;
+    forceSSL = true;
+
+    root = "${inputs.password-hash-self-service.packages.${pkgs.system}.default}";
+  };
+}