diff --git a/flake.lock b/flake.lock
index 25ecc01..0eb145c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -65,11 +65,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757508292,
-        "narHash": "sha256-7lVWL5bC6xBIMWWDal41LlGAG+9u2zUorqo3QCUL4p4=",
+        "lastModified": 1758287904,
+        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "146f45bee02b8bd88812cfce6ffc0f933788875a",
+        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
         "type": "github"
       },
       "original": {
@@ -263,11 +263,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757808926,
-        "narHash": "sha256-K6PEI5PYY94TVMH0mX3MbZNYFme7oNRKml/85BpRRAo=",
+        "lastModified": 1758463745,
+        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f21d9167782c086a33ad53e2311854a8f13c281e",
+        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
         "type": "github"
       },
       "original": {
@@ -386,11 +386,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757588530,
-        "narHash": "sha256-tJ7A8mID3ct69n9WCvZ3PzIIl3rXTdptn/lZmqSS95U=",
+        "lastModified": 1758108966,
+        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "b084b2c2b6bc23e83bbfe583b03664eb0b18c411",
+        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1757891025,
-        "narHash": "sha256-NfiTk59huy/YK9H4W4wVwRYyiP2u86QqROM5KK4f5F4=",
+        "lastModified": 1757943327,
+        "narHash": "sha256-w6cDExPBqbq7fTLo4dZ1ozDGeq3yV6dSN4n/sAaS6OM=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "4c38a024fa32e61db2be8573e5282b15d9733a79",
+        "rev": "67a709cfe5d0643dafd798b0b613ed579de8be05",
         "type": "github"
       },
       "original": {
@@ -418,11 +418,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757810152,
-        "narHash": "sha256-Vp9K5ol6h0J90jG7Rm4RWZsCB3x7v5VPx588TQ1dkfs=",
+        "lastModified": 1758346548,
+        "narHash": "sha256-afXE7AJ7MY6wY1pg/Y6UPHNYPy5GtUKeBkrZZ/gC71E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9a094440e02a699be5c57453a092a8baf569bdad",
+        "rev": "b2a3852bd078e68dd2b3dfa8c00c67af1f0a7d20",
         "type": "github"
       },
       "original": {
@@ -450,11 +450,11 @@
     },
     "nixpkgsMaster": {
       "locked": {
-        "lastModified": 1757932657,
-        "narHash": "sha256-D44RIPMw71krFXsk9af22YbwBhHpLWCDbncFokHWs5c=",
+        "lastModified": 1758531531,
+        "narHash": "sha256-OL0/5FQQc06oiF/l90H0/lVz7wvC7QR3Yptpizckr3Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "434ed09bd161bb1058612038479dc34863c3f106",
+        "rev": "5ae8f56b82f8abd42c13b5f11de89f5346afec5e",
         "type": "github"
       },
       "original": {
@@ -482,11 +482,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1757745802,
-        "narHash": "sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820=",
+        "lastModified": 1758277210,
+        "narHash": "sha256-iCGWf/LTy+aY0zFu8q12lK8KuZp7yvdhStehhyX1v8w=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c23193b943c6c689d70ee98ce3128239ed9e32d1",
+        "rev": "8eaee110344796db060382e15d3af0a9fc396e0e",
         "type": "github"
       },
       "original": {
@@ -518,11 +518,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1757931984,
-        "narHash": "sha256-hYGtHXTQ6eQPZWXKGxZWNrraP0j2p69B9EFIKNRC65E=",
+        "lastModified": 1758531197,
+        "narHash": "sha256-L6Bl4No41Ohag4/Ty0IMDE5EP56TPOfU2YaDLt59iFY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "0f5e4ecbdfd50a2deb75f344a03e5cfa22b97bcb",
+        "rev": "79e546908e49b0a824a7ac4827f8563452b002e7",
         "type": "github"
       },
       "original": {
@@ -634,11 +634,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757847158,
-        "narHash": "sha256-TumOaykhZO8SOs/faz6GQhqkOcFLoQvESLSF1cJ4mZc=",
+        "lastModified": 1758425756,
+        "narHash": "sha256-L3N8zV6wsViXiD8i3WFyrvjDdz76g3tXKEdZ4FkgQ+Y=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "ee6f91c1c11acf7957d94a130de77561ec24b8ab",
+        "rev": "e0fdaea3c31646e252a60b42d0ed8eafdb289762",
         "type": "github"
       },
       "original": {
@@ -729,11 +729,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1757831065,
-        "narHash": "sha256-xXBzVuKmkre9bHB/0f3c9ZvX41P1qWqap0Q+WHh1cqQ=",
+        "lastModified": 1758279410,
+        "narHash": "sha256-VtvAfGNKgBuxnxdatFt6LMXu682NensmioggVl+JmRY=",
         "owner": "vedderb",
         "repo": "vesc_tool",
-        "rev": "467e44ede9bd89fd87a075b00156455eba96fb19",
+        "rev": "9dab0663d4d47067c30ec4ca6aee074e6e69060b",
         "type": "github"
       },
       "original": {
diff --git a/hosts/iron/ports.nix b/hosts/iron/ports.nix
index 317909d..2b2b495 100644
--- a/hosts/iron/ports.nix
+++ b/hosts/iron/ports.nix
@@ -17,6 +17,7 @@
     photoprism.tcp = 2342;
     postfix-relay.tcp = 25;
     postfix-submission.tcp = 465;
+    prometheus-vodafone-station-exporter.tcp = 9420;
     qbittorrent-torrent.tcp = 59832;
     qbittorrent-webui.tcp = 8099;
     radicale.tcp = 5232;
@@ -24,10 +25,10 @@
     snapserver.tcp = 1704;
     snapserverHttp.tcp = 1780;
     snapserverTcp.tcp = 1705;
+    tvproxy.tcp = 64321;
     unifi-http.tcp = 8080;
     unifi-https.tcp = 8443;
-    wireguard-public-ip-tunnel.udp = 51000;
     wireguard-esphome.udp = 51001;
-    prometheus-vodafone-station-exporter.tcp = 9420;
+    wireguard-public-ip-tunnel.udp = 51000;
   };
 }
diff --git a/hosts/iron/secrets.yaml b/hosts/iron/secrets.yaml
index a866030..583c361 100644
--- a/hosts/iron/secrets.yaml
+++ b/hosts/iron/secrets.yaml
@@ -22,6 +22,7 @@ prometheus:
     exporters:
         vodafone-station: ENC[AES256_GCM,data:eaFqYEuK3UU=,iv:BauymCkvj33TmZLyii367uVEc4Iq4GGcik4nbyT9Fpk=,tag:poB+qh5tAdv/dEt3WN6yVw==,type:str]
         unpoller: ENC[AES256_GCM,data:WI1oUKHW4ef4pBk+mGM=,iv:C1LykPf1/ypUmy3ZCQzjfSjkpxhUukDNnfJnZLp2CJg=,tag:mSnZJKl9IHcx7I7GpFherw==,type:str]
+tvproxy: ENC[AES256_GCM,data:MbXEmgerpUiwDgcUKF2y1+Cc+d43sKPfGGTEkvNoZFFS4rzDWw4Udg==,iv:ZDsfSb3HK008e7/J/61iqVRafIzKbtPEdhH7ixo9lSY=,tag:3JbJ+2DJKQ9G2ui6VuWbOw==,type:str]
 sops:
     age:
         - recipient: age1hx7fdu4mcha7kkxe7yevtvs6xgzgaafgenm3drhvr609wlj94sgqm497je
@@ -33,8 +34,8 @@ sops:
             SU1USkxFUUY2NVhmUHBhZkdrNDR1Q0kKiXIicInELRjDR3tuyA+lnXeCcd9lYvbV
             GnBRGPM7BNO/6AA7HhAei48Kt+XE6+jQX66yTXyviKhK7Lpjrlb2YQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-15T15:29:31Z"
-    mac: ENC[AES256_GCM,data:7clDIKf/lRxXaYpiJS8+j8MzUvPTZmf20M4xM2sto+DSh2h/rJTvQanbg4/2yNVmLCX6FZ6USJb7bqg7aBw7Yv7RMoEio/HO6BtKNcHiLLiCW0dXkIROO4s5rc1S/nwtSFpifhgN2KrjXyBq+PVFk61on7K861zimsHev/KmDKk=,iv:9S1KONQWBMJBQElvAQ+NAOn15BrN0IkIyjedwSUm7oY=,tag:Kc8N8F5rz0EVIHseT1x0Kw==,type:str]
+    lastmodified: "2025-09-22T14:14:39Z"
+    mac: ENC[AES256_GCM,data:e0GijBvhWBIRXjm1lghrF4uHrE3+45ZfgQ/l2xrUv2lx6OC4xp+vjdlzJEDEAmWyRhIDvUYZ2lXrFKu/uwH4X/6vphNvSCJdr0F5/7Rrh84CCF++xrMG/hDztAoMKlhmkYpjmhvMt6sjVRxXo/ij2q3NlC7HN+ZEVkqMwVuFTyk=,iv:4Aske7FpYG5XJweeggTJvjy9SdfPYJ0h/a+rOxHL4jY=,tag:rBC4A0ZWn4JBw+3R7VB8wQ==,type:str]
     pgp:
         - created_at: "2024-01-31T01:20:30Z"
           enc: |-
diff --git a/hosts/iron/services/default.nix b/hosts/iron/services/default.nix
index 4a10130..331bfd0 100644
--- a/hosts/iron/services/default.nix
+++ b/hosts/iron/services/default.nix
@@ -20,6 +20,7 @@
     ./snapcast
     ./sturzbach.nix
     ./tts.nix
+    ./tvproxy.nix
     ./unifi-controller
     ./whatsapp.nix
     ./wireguard-esphome.nix
diff --git a/hosts/iron/services/tvproxy.nix b/hosts/iron/services/tvproxy.nix
new file mode 100644
index 0000000..ac8a293
Binary files /dev/null and b/hosts/iron/services/tvproxy.nix differ