diff --git a/modules/services/guacamole-user-mapping.xml b/modules/services/guacamole-user-mapping.xml
new file mode 100644
index 0000000..2df1fd0
--- /dev/null
+++ b/modules/services/guacamole-user-mapping.xml
@@ -0,0 +1,8 @@
+<user-mapping>
+ <authorize username="marty" password="dingoVncTest">
+     <protocol>vnc</protocol>
+     <param name="hostname">localhost</param>
+     <param name="port">5901</param>
+     <param name="password">dingoVncTest</param>
+ </authorize>
+</user-mapping>
diff --git a/modules/services/guacamole.nix b/modules/services/guacamole.nix
new file mode 100644
index 0000000..372e2cf
--- /dev/null
+++ b/modules/services/guacamole.nix
@@ -0,0 +1,35 @@
+{ config, ... }:
+{
+  services = {
+    guacamole-server = {
+      enable = true;
+      host = "127.0.0.1";
+      port = 4822;
+      userMappingXml = ./guacamole-user-mapping.xml;
+    };
+    guacamole-client = {
+      enable = true;
+      enableWebserver = true;
+      settings = {
+        guacd-port = 4822;
+        guacd-hostname = "localhost";
+      };
+    };
+    anubis.instances.guacamole = {
+      settings = {
+        TARGET = "http://localhost:4822";
+        BIND = ":4883";
+        BIND_NETWORK = "tcp";
+      };
+    };
+    nginx.virtualHosts."remote.liv.town" = {
+      forceSSL = true;
+      sslCertificate = "/var/lib/acme/liv.town/cert.pem";
+      sslCertificateKey = "/var/lib/acme/liv.town/key.pem";
+      locations."/" = {
+        proxyPass = "http://localhost${toString config.services.anubis.instances.guacamole.settings.BIND}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}