diff --git a/fake_flake.nix b/fake_flake.nix
index 7220149..d3a243a 100644
--- a/fake_flake.nix
+++ b/fake_flake.nix
@@ -41,7 +41,7 @@ in
 {
   imports = [
     "${nivSources.agenix}/modules/age.nix"
-    # "${nivSources.nixos-mailserver}/default.nix"
+    "${nivSources.nixos-mailserver}/default.nix"
     "${nivSources.nixos-matrix-modules}/module.nix"
 
     # fixme: ideally we'd not rely on the flake syntax to load the module
diff --git a/modules/default.nix b/modules/default.nix
index 412ad99..e707c43 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -18,6 +18,7 @@ in
     ./mastodon.nix
     ./nix_cache.nix
     ./auth.nix
+    ./hedgedoc.nix
   ];
 
   options.serverConfig =
@@ -147,6 +148,11 @@ in
           host = "puffer.${domain}";
           accessType = "proxy";
         };
+        hedgedoc_host = {
+          port = 8048;
+          host = "hedgedoc.${domain}";
+          accessType = "proxy";
+        };
         tlemap_host = {
           port = 8100;
           host = "tlemap.${domain}";
diff --git a/modules/email.nix b/modules/email.nix
index 9889fd7..b3835a8 100644
--- a/modules/email.nix
+++ b/modules/email.nix
@@ -7,7 +7,7 @@ in
   #  services.dovecot2.sieve.extensions = [ "fileinto" ]; # sives break without this for some reason
   mailserver = {
     enable = true;
-    # fqdn = vhosts.mail_host.host;
+    fqdn = vhosts.mail_host.host;
     domains = [ domain ];
 
     # A list of all login accounts. To create the password hashes, use
diff --git a/modules/hedgedoc.nix b/modules/hedgedoc.nix
new file mode 100644
index 0000000..cd1423c
--- /dev/null
+++ b/modules/hedgedoc.nix
@@ -0,0 +1,17 @@
+{ config, ... }:
+let
+  inherit (config.serverConfig) vhosts;
+in {
+    services.hedgedoc = {
+    enable = true;
+    settings = {
+      domain = vhosts.hedgedoc_host.host;
+      inherit (vhosts.hedgedoc_host) port;
+      host = "127.0.0.1";
+      protocolUseSSL = true;
+      allowEmailRegister = false; # no registrations for now
+      allowAnonymousEdits = true; # anonymous can edit select files
+      allowAnonymous = false; # anonymous can't actually create notes
+    };
+  };
+}