diff --git a/flake.lock b/flake.lock
index 0b4945c..1c1d638 100644
--- a/flake.lock
+++ b/flake.lock
@@ -476,11 +476,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1779441912,
-        "narHash": "sha256-Le50mFgpetFC8gyc1j3+oXEjRV3lZdeU2vqBtoWaAJo=",
+        "lastModified": 1781207988,
+        "narHash": "sha256-ZsPqHeeUXDR1fksT4EGlizv8RHPHp42kusVNhnenzxo=",
         "ref": "refs/heads/main",
-        "rev": "847ed2f52fd5ff0ead5958d6932b219b4254a2bf",
-        "revCount": 38,
+        "rev": "53c5bdca5f2ff22b4e950c38b4d8bb96ee03c80d",
+        "revCount": 40,
         "type": "git",
         "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
       },
diff --git a/flake.nix b/flake.nix
index 217baab..fe2e6da 100644
--- a/flake.nix
+++ b/flake.nix
@@ -136,6 +136,7 @@
         modules = [
           ./hosts/busch
           disko.nixosModules.disko
+          agenix.nixosModules.default
           proxmox-nixos.nixosModules.proxmox-ve
 
           ({...}: {
diff --git a/hosts/busch-gpu-docker/default.nix b/hosts/busch-gpu-docker/default.nix
index d7870cd..a31b2e3 100644
--- a/hosts/busch-gpu-docker/default.nix
+++ b/hosts/busch-gpu-docker/default.nix
@@ -56,6 +56,15 @@
     tokenSecretFile = config.age.secrets.hawser-token;
   };
 
+  services.beszel.agent = {
+    enable = true;
+    environment = {
+      HUB_URL = "https://beszel.jfreudenberger.de";
+      DISABLE_SSH = "true";
+    };
+    environmentFile = config.age.secrets.beszel.path;
+  };
+
   # This option defines the first version of NixOS you have installed on this particular machine,
   # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
   # Most users should NEVER change this value after the initial install, for any reason,
diff --git a/hosts/busch-gpu-docker/secrets.nix b/hosts/busch-gpu-docker/secrets.nix
index 093c7a0..82a4982 100644
--- a/hosts/busch-gpu-docker/secrets.nix
+++ b/hosts/busch-gpu-docker/secrets.nix
@@ -2,5 +2,6 @@
 {
   age.secrets = {
     hawser-token.file = "${inputs.secrets}/secrets/busch-gpu-docker/hawser-token";
+    beszel.file = "${inputs.secrets}/secrets/busch-gpu-docker/beszel";
   };
 }
diff --git a/hosts/busch-main-docker/default.nix b/hosts/busch-main-docker/default.nix
index ce7c502..6df1d21 100644
--- a/hosts/busch-main-docker/default.nix
+++ b/hosts/busch-main-docker/default.nix
@@ -44,6 +44,15 @@
     tokenSecretFile = config.age.secrets.hawser-token;
   };
 
+  services.beszel.agent = {
+    enable = true;
+    environment = {
+      HUB_URL = "https://beszel.jfreudenberger.de";
+      DISABLE_SSH = "true";
+    };
+    environmentFile = config.age.secrets.beszel.path;
+  };
+
   # This option defines the first version of NixOS you have installed on this particular machine,
   # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
   # Most users should NEVER change this value after the initial install, for any reason,
diff --git a/hosts/busch-main-docker/secrets.nix b/hosts/busch-main-docker/secrets.nix
index f06e116..f009a67 100644
--- a/hosts/busch-main-docker/secrets.nix
+++ b/hosts/busch-main-docker/secrets.nix
@@ -2,5 +2,6 @@
 {
   age.secrets = {
     hawser-token.file = "${inputs.secrets}/secrets/busch-main-docker/hawser-token";
+    beszel.file = "${inputs.secrets}/secrets/busch-main-docker/beszel";
   };
 }
diff --git a/hosts/busch/default.nix b/hosts/busch/default.nix
index 0d84c12..3c55b48 100644
--- a/hosts/busch/default.nix
+++ b/hosts/busch/default.nix
@@ -4,6 +4,7 @@
   imports =
     [
       ./disko.nix
+      ./secrets.nix
 
       ../../modules/nix.nix
       ../../modules/auto-upgrade.nix
@@ -29,21 +30,31 @@
 
   networking.hostName = "busch"; # Define your hostname.
 
-  services.netbird = {
-    package = pkgs-unstable.netbird;
-    useRoutingFeatures = "both";
-    clients.wt0 = {
-      hardened = false;
-      login = {
-        enable = true;
-        setupKeyFile = (pkgs.writeText "setupKey" ''
-          A99F5508-D543-40B7-A31A-A8931B1AE246
-        '').outPath;
+  services = {
+    netbird = {
+      package = pkgs-unstable.netbird;
+      useRoutingFeatures = "both";
+      clients.wt0 = {
+        hardened = false;
+        login = {
+          enable = true;
+          setupKeyFile = (pkgs.writeText "setupKey" ''
+            A99F5508-D543-40B7-A31A-A8931B1AE246
+          '').outPath;
+        };
+        port = 51820;
+        environment = {
+          NB_MANAGEMENT_URL = "https://netbird.jfreudenberger.de";
+        };
       };
-      port = 51820;
+    };
+    beszel.agent = {
+      enable = true;
       environment = {
-        NB_MANAGEMENT_URL = "https://netbird.jfreudenberger.de";
+        HUB_URL = "https://beszel.jfreudenberger.de";
+        DISABLE_SSH = "true";
       };
+      environmentFile = config.age.secrets.beszel.path;
     };
   };
   systemd.services.${config.services.netbird.clients.wt0.service.name}.path = [ pkgs.shadow ];
diff --git a/hosts/busch/secrets.nix b/hosts/busch/secrets.nix
new file mode 100644
index 0000000..b98512e
--- /dev/null
+++ b/hosts/busch/secrets.nix
@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  age.secrets = {
+    beszel.file = "${inputs.secrets}/secrets/busch/beszel";
+  };
+}
diff --git a/hosts/srv03/default.nix b/hosts/srv03/default.nix
index 78f2cfc..d53ba85 100644
--- a/hosts/srv03/default.nix
+++ b/hosts/srv03/default.nix
@@ -16,6 +16,7 @@
       ../../modules/docker.nix
       ../../modules/traefik.nix
       ../../modules/pocket-id.nix
+      ../../modules/beszel-hub.nix
       ../../modules/netbird-docker.nix
       ../../modules/netbird-client.nix
       ../../modules/dockhand.nix
@@ -51,6 +52,11 @@
       appUrl = "dockhand.jfreudenberger.de";
     };
 
+    beszel-docker = {
+      enable = true;
+      appUrl = "https://beszel.jfreudenberger.de";
+    };
+
     netbird-docker = {
       enable = true;
       secrets = config.age.secrets.netbird-server;
diff --git a/hosts/xcy/default.nix b/hosts/xcy/default.nix
index 0c62fef..8c87473 100644
--- a/hosts/xcy/default.nix
+++ b/hosts/xcy/default.nix
@@ -33,6 +33,15 @@
     tokenSecretFile = config.age.secrets.hawser-token;
   };
 
+  services.beszel.agent = {
+    enable = true;
+    environment = {
+      HUB_URL = "https://beszel.jfreudenberger.de";
+      DISABLE_SSH = "true";
+    };
+    environmentFile = config.age.secrets.beszel.path;
+  };
+
   networking.firewall = {
     checkReversePath = "loose";
     allowedTCPPorts = [
diff --git a/hosts/xcy/secrets.nix b/hosts/xcy/secrets.nix
index 4add6e7..6dfb2eb 100644
--- a/hosts/xcy/secrets.nix
+++ b/hosts/xcy/secrets.nix
@@ -2,5 +2,6 @@
 {
   age.secrets = {
     hawser-token.file = "${inputs.secrets}/secrets/xcy/hawser-token";
+    beszel.file = "${inputs.secrets}/secrets/xcy/beszel";
   };
 }
diff --git a/modules/beszel-hub.nix b/modules/beszel-hub.nix
new file mode 100644
index 0000000..7b2376a
--- /dev/null
+++ b/modules/beszel-hub.nix
@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+
+  cfg = config.services.beszel-docker;
+  version = "0.18.7";
+
+in {
+
+  options.services.beszel-docker = {
+    enable = lib.mkEnableOption "Beszel hub hosted as OCI container";
+    appUrl = lib.mkOption {
+      description = "URL of the beszel hub";
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.oci-containers.containers = {
+      beszel = {
+        image = "henrygd/beszel:${version}";
+        autoStart = true;
+        networks = [
+          "traefik"
+        ];
+        environment = {
+          APP_URL = cfg.appUrl;
+        };
+        extraOptions = [
+          ''--mount=type=volume,source=data,target=/beszel_data,volume-driver=local''
+          /*''--health-cmd=["/beszel" "health" "--url" "http://localhost:8090"]''
+          "--health-interval=120s"
+          "--health-timeout=5s"
+          "--health-retries=2"
+          "--health-start-period=10s"*/
+        ];
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.beszel.rule" = "Host(`${lib.removePrefix "https://" cfg.appUrl}`)";
+          "traefik.http.routers.beszel.entrypoints" = "websecure";
+        };
+      };
+    };
+
+    systemd.services."docker-beszel" = {
+      after = [
+        "docker-traefik.service"
+      ];
+      requires = [
+        "docker-traefik.service"
+      ];
+    };
+
+  };
+}
diff --git a/modules/i3.nix b/modules/i3.nix
index 80fcb57..9540221 100644
--- a/modules/i3.nix
+++ b/modules/i3.nix
@@ -41,6 +41,7 @@
 	pinentry-gnome3
 	xdotool
 	playerctl
+        networkmanager_dmenu
       ];
     };
 
diff --git a/modules/pocket-id.nix b/modules/pocket-id.nix
index ff62097..fd311c1 100644
--- a/modules/pocket-id.nix
+++ b/modules/pocket-id.nix
@@ -7,7 +7,7 @@ let
 
   cfg = config.services.pocket-id-docker;
   pocketidCfg = config.services.pocket-id;
-  version = "2.6.2";
+  version = "2.8.0";
 
 in {
 
diff --git a/modules/traefik.nix b/modules/traefik.nix
index 322c190..7e8e19c 100644
--- a/modules/traefik.nix
+++ b/modules/traefik.nix
@@ -7,7 +7,7 @@
 let
 
   cfg = config.services.traefik-docker;
-  version = "3.6.14";
+  version = "3.7.5";
 
 in {