diff --git a/.gitattributes b/.gitattributes
index bd72c2c..eea1737 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,5 @@
 **/secrets/** filter=git-crypt diff=git-crypt
 **/secrets.yaml diff=sops
 *.wav filter=lfs diff=lfs merge=lfs -text
+
+hosts/iron/services/tvproxy.nix filter=git-crypt diff=git-crypt
diff --git a/hosts/iron/ports.nix b/hosts/iron/ports.nix
index 317909d..2b2b495 100644
--- a/hosts/iron/ports.nix
+++ b/hosts/iron/ports.nix
@@ -17,6 +17,7 @@
     photoprism.tcp = 2342;
     postfix-relay.tcp = 25;
     postfix-submission.tcp = 465;
+    prometheus-vodafone-station-exporter.tcp = 9420;
     qbittorrent-torrent.tcp = 59832;
     qbittorrent-webui.tcp = 8099;
     radicale.tcp = 5232;
@@ -24,10 +25,10 @@
     snapserver.tcp = 1704;
     snapserverHttp.tcp = 1780;
     snapserverTcp.tcp = 1705;
+    tvproxy.tcp = 64321;
     unifi-http.tcp = 8080;
     unifi-https.tcp = 8443;
-    wireguard-public-ip-tunnel.udp = 51000;
     wireguard-esphome.udp = 51001;
-    prometheus-vodafone-station-exporter.tcp = 9420;
+    wireguard-public-ip-tunnel.udp = 51000;
   };
 }
diff --git a/hosts/iron/secrets.yaml b/hosts/iron/secrets.yaml
index a866030..583c361 100644
--- a/hosts/iron/secrets.yaml
+++ b/hosts/iron/secrets.yaml
@@ -22,6 +22,7 @@ prometheus:
     exporters:
         vodafone-station: ENC[AES256_GCM,data:eaFqYEuK3UU=,iv:BauymCkvj33TmZLyii367uVEc4Iq4GGcik4nbyT9Fpk=,tag:poB+qh5tAdv/dEt3WN6yVw==,type:str]
         unpoller: ENC[AES256_GCM,data:WI1oUKHW4ef4pBk+mGM=,iv:C1LykPf1/ypUmy3ZCQzjfSjkpxhUukDNnfJnZLp2CJg=,tag:mSnZJKl9IHcx7I7GpFherw==,type:str]
+tvproxy: ENC[AES256_GCM,data:MbXEmgerpUiwDgcUKF2y1+Cc+d43sKPfGGTEkvNoZFFS4rzDWw4Udg==,iv:ZDsfSb3HK008e7/J/61iqVRafIzKbtPEdhH7ixo9lSY=,tag:3JbJ+2DJKQ9G2ui6VuWbOw==,type:str]
 sops:
     age:
         - recipient: age1hx7fdu4mcha7kkxe7yevtvs6xgzgaafgenm3drhvr609wlj94sgqm497je
@@ -33,8 +34,8 @@ sops:
             SU1USkxFUUY2NVhmUHBhZkdrNDR1Q0kKiXIicInELRjDR3tuyA+lnXeCcd9lYvbV
             GnBRGPM7BNO/6AA7HhAei48Kt+XE6+jQX66yTXyviKhK7Lpjrlb2YQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-15T15:29:31Z"
-    mac: ENC[AES256_GCM,data:7clDIKf/lRxXaYpiJS8+j8MzUvPTZmf20M4xM2sto+DSh2h/rJTvQanbg4/2yNVmLCX6FZ6USJb7bqg7aBw7Yv7RMoEio/HO6BtKNcHiLLiCW0dXkIROO4s5rc1S/nwtSFpifhgN2KrjXyBq+PVFk61on7K861zimsHev/KmDKk=,iv:9S1KONQWBMJBQElvAQ+NAOn15BrN0IkIyjedwSUm7oY=,tag:Kc8N8F5rz0EVIHseT1x0Kw==,type:str]
+    lastmodified: "2025-09-22T14:14:39Z"
+    mac: ENC[AES256_GCM,data:e0GijBvhWBIRXjm1lghrF4uHrE3+45ZfgQ/l2xrUv2lx6OC4xp+vjdlzJEDEAmWyRhIDvUYZ2lXrFKu/uwH4X/6vphNvSCJdr0F5/7Rrh84CCF++xrMG/hDztAoMKlhmkYpjmhvMt6sjVRxXo/ij2q3NlC7HN+ZEVkqMwVuFTyk=,iv:4Aske7FpYG5XJweeggTJvjy9SdfPYJ0h/a+rOxHL4jY=,tag:rBC4A0ZWn4JBw+3R7VB8wQ==,type:str]
     pgp:
         - created_at: "2024-01-31T01:20:30Z"
           enc: |-
diff --git a/hosts/iron/services/default.nix b/hosts/iron/services/default.nix
index 4a10130..331bfd0 100644
--- a/hosts/iron/services/default.nix
+++ b/hosts/iron/services/default.nix
@@ -20,6 +20,7 @@
     ./snapcast
     ./sturzbach.nix
     ./tts.nix
+    ./tvproxy.nix
     ./unifi-controller
     ./whatsapp.nix
     ./wireguard-esphome.nix
diff --git a/hosts/iron/services/tvproxy.nix b/hosts/iron/services/tvproxy.nix
new file mode 100644
index 0000000..ac8a293
Binary files /dev/null and b/hosts/iron/services/tvproxy.nix differ