diff --git a/configuration.nix b/configuration.nix
index cba67f9..eadb95b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -2,6 +2,7 @@
   imports = [
 	(modulesPath + "/profiles/qemu-guest.nix")
 	./forgejo.nix
+	./web.nix
 ];
 
   boot.loader.grub = {
diff --git a/web.nix b/web.nix
new file mode 100644
index 0000000..6662dc1
--- /dev/null
+++ b/web.nix
@@ -0,0 +1,50 @@
+{ pkgs, ...}: {
+	users.users.web = { isSystemUser = true; group = "web"; };
+	users.groups.web = {};
+
+	systemd.tmpfiles.rules = [
+		"d /var/www/html 0755 web web -"
+	];
+
+	services.phpfpm.pools.www = {
+		user = "web";
+		group = "web";
+		phpPackage = pkgs.php84.buildEnv {
+			extensions = ({ enabled, all }: enabled ++ (with all; [ intl pdo_mysql opcache apcu ]));
+		};
+		settings = {
+			"listen.owner" = "nginx";
+			"listen.group" = "nginx";
+			"pm" = "dynamic";
+			"pm.max_children" = 10;
+			"pm.start_servers" = 2;
+			"pm.min_spare_servers" = 1;
+			"pm.max_spare_servers" = 3;
+		};
+	};
+
+	services.nginx = {
+		enable = true;
+		virtualHosts."default" = {
+			default = true;
+			root = "/var/www/html";
+			locations."/".index = "index.php index.html";
+			locations."~ \\.php$".extraConfig = ''
+				fastcgi_pass unix:/run/phpfpm/www.sock;
+			include ${pkgs.nginx}/conf/fastcgi_params;
+			fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+			'';
+		};
+	};
+
+	# database "app" and a MySQL user "web" that logs in via the local socket (no password)
+	services.mysql = {
+		ensureDatabases = [ "app" ];
+		ensureUsers = [{
+			name = "web";
+			ensurePermissions = { "app.*" = "ALL PRIVILEGES"; };
+		}];
+	};
+
+	networking.firewall.allowedTCPPorts = [ 80 ];
+}