diff --git a/nixos/module/hectic/service/attic.nix b/nixos/module/hectic/service/attic.nix
new file mode 100644
index 00000000..702fd4d0
--- /dev/null
+++ b/nixos/module/hectic/service/attic.nix
@@ -0,0 +1,67 @@
+{ ... }: {
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.hectic.services.attic;
+  environmentFile = "/var/lib/atticd/credentials.env";
+in {
+  options.hectic.services.attic = {
+    enable = lib.mkEnableOption "Attic binary cache server";
+
+    hostName = lib.mkOption {
+      type = lib.types.str;
+      description = "Public hostname used by clients to reach this Attic server.";
+    };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Local address atticd binds to behind the reverse proxy.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8080;
+      description = "Local port atticd binds to behind the reverse proxy.";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.atticd-credentials = {
+      description = "Generate persistent atticd credentials";
+      before      = [ "atticd.service" ];
+      wantedBy    = [ "atticd.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        StateDirectory = "atticd";
+        UMask = "0077";
+      };
+      script = ''
+        if [ -s ${environmentFile} ]; then
+          exit 0
+        fi
+
+        install -m 0700 -d /var/lib/atticd
+        secret="$(${lib.getExe pkgs.openssl} genrsa -traditional 4096 | ${pkgs.coreutils}/bin/base64 -w0)"
+        cat > ${environmentFile} <<EOF
+        ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="$secret"
+        EOF
+        chmod 0600 ${environmentFile}
+      '';
+    };
+
+    services.atticd = {
+      enable          = true;
+      environmentFile = environmentFile;
+      settings = {
+        listen = "${cfg.listenAddress}:${toString cfg.port}";
+        allowed-hosts = [ cfg.hostName ];
+        api-endpoint = "https://${cfg.hostName}/";
+        compression.type = "zstd";
+      };
+    };
+  };
+}
diff --git a/nixos/system/hectic-lab/attic.nix b/nixos/system/hectic-lab/attic.nix
new file mode 100644
index 00000000..de7955d4
--- /dev/null
+++ b/nixos/system/hectic-lab/attic.nix
@@ -0,0 +1,17 @@
+{
+  domain,
+  ...
+}: { ... }: {
+  hectic.services.attic = {
+    enable   = true;
+    hostName = "cache.${domain}";
+  };
+
+  services.nginx.virtualHosts."cache.${domain}" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8080";
+    };
+  };
+}
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index 04f29628..a8546bcf 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -52,9 +52,10 @@ in {
 
     inputs.hectic-landing.nixosModules.hectic-landing
 
+    (import ./attic.nix              { inherit flake self inputs domain; })
     (import ./containers.nix          { inherit flake self inputs; })
-    (import ./mechabellum.nix         { inherit flake self inputs domain sslOpts; })
-    (import (./. + "/sentinèlla.nix") { inherit flake self inputs domain sslOpts; })
+    (import ./mechabellum.nix         { inherit flake self inputs domain; })
+    (import (./. + "/sentinèlla.nix") { inherit flake self inputs domain; })
   ];
 
   services.hectic-landing = {
@@ -205,8 +206,8 @@ in {
   services.nginx = {
     enable = true;
     # NOTE(yukkop): virtualHosts.${domain} is owned by the hectic-landing module
-    # (ACME-managed). See services.hectic-landing above.
-    virtualHosts."store.${domain}" = sslOpts // {
+    virtualHosts."store.${domain}" = {
+      enableACME = true;
       forceSSL = true;
       root = "/var/www/store";
       locations."/" = {
@@ -215,7 +216,8 @@ in {
         '';
       };
     };
-    virtualHosts."snuff.${domain}" = sslOpts // {
+    virtualHosts."snuff.${domain}" = {
+      enableACME = true;
       forceSSL = true;
       locations."/" = {
         extraConfig = ''
@@ -224,7 +226,8 @@ in {
         '';
       };
     };
-    virtualHosts."nrv.${domain}" = sslOpts // {
+    virtualHosts."nrv.${domain}" = {
+      enableACME = true;
       forceSSL = true;
       locations."/" = {
         extraConfig = ''
@@ -233,7 +236,8 @@ in {
         '';
       };
     };
-    virtualHosts."yukkop.${domain}" = sslOpts // {
+    virtualHosts."yukkop.${domain}" = {
+      enableACME = true;
       forceSSL = true;
       locations."/" = {
         extraConfig = ''
diff --git a/nixos/system/hectic-lab/mechabellum.nix b/nixos/system/hectic-lab/mechabellum.nix
index 40bc3711..3b36ebd1 100644
--- a/nixos/system/hectic-lab/mechabellum.nix
+++ b/nixos/system/hectic-lab/mechabellum.nix
@@ -1,7 +1,6 @@
 {
   inputs,
   domain,
-  sslOpts,
   ...
 }: {
   pkgs,
diff --git a/nixos/system/hectic-lab/sentinèlla.nix b/nixos/system/hectic-lab/sentinèlla.nix
index a599a135..b3338f3f 100644
--- a/nixos/system/hectic-lab/sentinèlla.nix
+++ b/nixos/system/hectic-lab/sentinèlla.nix
@@ -3,7 +3,6 @@
   flake,
   self,
   domain,
-  sslOpts,
   ...
 }: { ... }: {
   hectic.services."sentinèlla" = {
@@ -17,7 +16,8 @@
   };
 
   services.nginx = {
-    virtualHosts."probe.${domain}" = sslOpts // {
+    virtualHosts."probe.${domain}" = {
+      enableACME = true;
       forceSSL = true;
       locations."/" = {
         proxyPass = "http://127.0.0.1:5988";