diff --git a/ansible/plays/services/filestash/.env b/ansible/plays/services/filestash/.env
new file mode 100644
index 0000000..72bef9d
--- /dev/null
+++ b/ansible/plays/services/filestash/.env
@@ -0,0 +1 @@
+COMPOSE_PROJECT_NAME=filestash
diff --git a/ansible/plays/services/filestash/docker-compose.yaml b/ansible/plays/services/filestash/docker-compose.yaml
new file mode 100644
index 0000000..beddb28
--- /dev/null
+++ b/ansible/plays/services/filestash/docker-compose.yaml
@@ -0,0 +1,21 @@
+version: "3.4"
+services:
+  filestash:
+    container_name: filestash
+    image: machines/filestash:latest
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.filestash.rule=Host(`stash.unruhig.eu`)"
+      - "traefik.http.routers.filestash.entryPoints=websecure"
+      - "traefik.http.services.filestash.loadbalancer.server.port=8334"
+    environment:
+      - "APPLICATION_URL=https://stash.unruhig.eu"
+    volumes:
+    - data:/app/data/state/
+    networks:
+      - default
+
+volumes:
+  data:
diff --git a/ansible/plays/services/paperless-proxy/.env b/ansible/plays/services/paperless-proxy/.env
new file mode 100644
index 0000000..a658d1f
--- /dev/null
+++ b/ansible/plays/services/paperless-proxy/.env
@@ -0,0 +1 @@
+COMPOSE_PROJECT_NAME=paperless-proxy
diff --git a/ansible/plays/services/paperless-proxy/Caddyfile b/ansible/plays/services/paperless-proxy/Caddyfile
new file mode 100644
index 0000000..ad76f6c
--- /dev/null
+++ b/ansible/plays/services/paperless-proxy/Caddyfile
@@ -0,0 +1,7 @@
+{
+    auto_https off
+}
+
+http://paperless.tobiasmanske.de {
+    reverse_proxy {{ hostvars['thonkpad.ka.chaoswg.org']['wg_addr'] }}:8000
+}
diff --git a/ansible/plays/services/paperless-proxy/docker-compose.yaml b/ansible/plays/services/paperless-proxy/docker-compose.yaml
new file mode 100644
index 0000000..6a114d8
--- /dev/null
+++ b/ansible/plays/services/paperless-proxy/docker-compose.yaml
@@ -0,0 +1,16 @@
+---
+version: "3.4"
+
+services:
+  proxy:
+    image: caddy:2
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro,z
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=${COMPOSE_PROJECT_NAME}_default"
+      - "traefik.http.routers.paperlessproxy.rule=Host(`paperless.tobiasmanske.de`)"
+      - "traefik.http.routers.paperlessproxy.entryPoints=websecure"
+      - "traefik.http.services.paperlessproxy.loadbalancer.server.port=80"
+    restart: always
+...
diff --git a/ansible/plays/vps.yaml b/ansible/plays/vps.yaml
index 23106bc..36e91a3 100644
--- a/ansible/plays/vps.yaml
+++ b/ansible/plays/vps.yaml
@@ -39,11 +39,13 @@
     - {role: compose_project, service: blog}
     - {role: compose_project, service: linktree}
     - {role: compose_project, service: caddy}
+    - {role: compose_project, service: paperless-proxy}
     - {role: compose_project, service: diun}
     - {role: compose_project, service: seafile}
     - {role: compose_project, service: watchtower}
     - {role: compose_project, service: wkd}
     - {role: compose_project, service: wallabag}
     - {role: compose_project, service: gotosocial}
+    - {role: compose_project, service: filestash}
 
 # vim: ft=yaml.ansible