diff --git a/flake.lock b/flake.lock
index 18daa0da..159393ff 100644
--- a/flake.lock
+++ b/flake.lock
@@ -625,6 +625,28 @@
         "type": "github"
       }
     },
+    "iana-angl": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1789498292,
+        "narHash": "sha256-bsrT7MWTXL+tpwDZmI5xWLPZZPYAzU1WjcGlNmqpePw=",
+        "ref": "refs/heads/master",
+        "rev": "2937d257d601b40de2437a51ebc3c7b61b40f679",
+        "revCount": 37,
+        "type": "git",
+        "url": "https://gitea.hectic-lab.com/yukkop/learning.git"
+      },
+      "original": {
+        "rev": "2937d257d601b40de2437a51ebc3c7b61b40f679",
+        "type": "git",
+        "url": "https://gitea.hectic-lab.com/yukkop/learning.git"
+      }
+    },
     "impermanence": {
       "locked": {
         "lastModified": 1737831083,
@@ -986,6 +1008,7 @@
         "hectic-landing": "hectic-landing",
         "home-manager": "home-manager",
         "hyprland": "hyprland",
+        "iana-angl": "iana-angl",
         "impermanence": "impermanence",
         "mechabellum-replay-analysis": "mechabellum-replay-analysis",
         "nix-darwin": "nix-darwin",
@@ -996,11 +1019,32 @@
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
         "nixvim": "nixvim",
-        "rust-overlay": "rust-overlay",
+        "rust-overlay": "rust-overlay_2",
         "sops-nix": "sops-nix"
       }
     },
     "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "iana-angl",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789457514,
+        "narHash": "sha256-Aggle++fTyAifBy+QBPxjM+obO5iepKW/8MDxQtgGvI=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "89e99bf0778a8f2cd18c9360c3f19c1ee47fc739",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
diff --git a/flake.nix b/flake.nix
index 6ee5c595..80cc4eab 100644
--- a/flake.nix
+++ b/flake.nix
@@ -72,6 +72,10 @@
       url = "git+ssh://git@github.com/liquizz/hectic-landing.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    iana-angl = {
+      url = "git+https://gitea.hectic-lab.com/yukkop/learning.git?rev=2937d257d601b40de2437a51ebc3c7b61b40f679";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     mechabellum-replay-analysis = {
       # NOTE(yukkop): private repo - SSH access required.
       # Only evaluated when nixosConfigurations."hectic-lab|x86_64-linux" is built.
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index c58b4ce0..5476ea6e 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -58,6 +58,7 @@ in {
     self.nixosModules."shadowsocks"      # NOTE(nrv): usage/instance
 
     inputs.hectic-landing.nixosModules.hectic-landing
+    inputs.iana-angl.nixosModules.iana-angl
 
     (import ./attic.nix              { inherit flake self inputs domain; })
     (import ./containers.nix          { inherit flake self inputs; })
@@ -76,6 +77,12 @@ in {
     host    = "127.0.0.1";
   };
 
+  services.iana-angl = {
+    enable  = true;
+    package = inputs.iana-angl.packages.${pkgs.stdenv.hostPlatform.system}.iana-angl;
+    domain  = "lessons.${domain}";
+  };
+
   # NOTE(yukkop): both nixos-mailserver and hectic-landing module set
   # security.acme.defaults.email. Force the mailserver-aligned address.
   security.acme.defaults.email = lib.mkForce "security@${domain}";
@@ -102,6 +109,7 @@ in {
         Public = true;
         AntiCheatPermission = 3;
         AntiCheatSpeed = 3;
+        AntiCheatHit = 3;
       };
       sandboxProperties = {
         StartMonth = 12;
@@ -378,6 +386,10 @@ in {
         '';
       };
     };
+    virtualHosts."lessons.${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+    };
     virtualHosts."snuff.${domain}" = {
       enableACME = true;
       forceSSL = true;