diff --git a/nixos/book-stack.nix b/nixos/book-stack.nix
index f50cb37..c1cdb5f 100644
--- a/nixos/book-stack.nix
+++ b/nixos/book-stack.nix
@@ -1,13 +1,14 @@
 { pkgs, ... }:
 
 {
+  age.secrets."bookstack-app-file-key".file = ../secrets/bookstack-app-file-key.age;
+  age.secrets."bookstack-app-file-key".owner = "bookstack";
   services.bookstack = {
     enable = true;
     hostname = "wiki.sincerity.network";
-    # appKeyFile = "/run/secrets/bookstack-app-key";
-    appKeyFile = "/home/infra/app-key-file"; # TODO use agenix
+    appKeyFile = "/run/agenix/bookstack-app-file-key";
     nginx = {
-      serverName = "wiki.mutualaid.work";
+      serverName = "wiki.sincerity.network";
       listenAddresses = [ "0.0.0.0" ];
       forceSSL = true;
       enableACME = true;
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index cd81df9..311029a 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -7,7 +7,7 @@
     # Import your generated (nixos-generate-config) hardware configuration
     ./hardware-configuration.nix
     ./vault-warden.nix
-    # ./book-stack.nix
+    ./book-stack.nix
     # ./bonfire.nix
     ./mumble.nix
   ];
diff --git a/secrets/bookstack-app-file-key.age b/secrets/bookstack-app-file-key.age
new file mode 100644
index 0000000..f5081a7
--- /dev/null
+++ b/secrets/bookstack-app-file-key.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 gm2l9w rbcxQCRvrPZ8fpkJVAYORMvcZDW3W+U4cTffMgF4Jkc
+GGq3QOlsKaZbSjlosCb3hDix2/BI6bLyriBTqZbAv6Y
+-> $d-FD:-grease E =s%
+UyDWgsHQwFtEQj4m7lBaHq9EH9LmZI8Z9/T5QUn9acYX9V0
+--- atlTfS4hkVQXzaWulmfSWdMuWgf4+ar7js2eFPz6V2g
+��rs{J��#��$����4n?a�tm
+ޓ�x&8v������1?�g�������&$1�A�0K���o�M���j
\ No newline at end of file