diff --git a/hosts/mups/configuration.nix b/hosts/mups/configuration.nix
index 24fe51b..1fb24b5 100644
--- a/hosts/mups/configuration.nix
+++ b/hosts/mups/configuration.nix
@@ -1,15 +1,20 @@
-{ config, lib, pkgs, inputs, system, ... }:
-let
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  system,
+  ...
+}: let
   cfg = config.mods;
   keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILmAOd9VbhyJeibt6Vrb101MNTk5W8+rh94Djv/C+pyu muon@muho"
   ];
-
 in {
   # Hardware
-  imports = [ ./hardware-configuration.nix ../ports.nix ];
+  imports = [./hardware-configuration.nix ../ports.nix];
 
   # System
   mods.user.name = "muon";
@@ -46,29 +51,82 @@ in {
     enable = true;
     listen = "[::]:8008";
     root = "/var/www";
-    configuration = { general = { directory-listing = true; }; };
+    configuration = {general = {directory-listing = true;};};
   };
   services.nginx.virtualHosts = {
     "muon.host" = {
       enableACME = true;
       forceSSL = true;
       default = true;
-      locations."/" = { proxyPass = "http://localhost:8008"; };
+      locations."/" = {proxyPass = "http://localhost:8008";};
     };
     "nvr.muon.host" = {
       enableACME = true;
       forceSSL = true;
-      locations."/" = { proxyPass = "http://10.0.0.2:8095"; };
+      locations."/" = {proxyPass = "http://10.0.0.2:8095";};
     };
     "tetterodesportcomplex.nl" = {
       enableACME = true;
       forceSSL = true;
-      locations."/" = { proxyPass = "http://10.0.0.3:5001"; };
+      locations."/" = {proxyPass = "http://10.0.0.3:5001";};
     };
     "www.tetterodesportcomplex.nl" = {
       enableACME = true;
       forceSSL = true;
-      locations."/" = { proxyPass = "http://10.0.0.3:5001"; };
+      locations."/" = {proxyPass = "http://10.0.0.3:5001";};
+    };
+    "seedbox.muon.host" = {
+      forceSSL = true;
+      enableACME = true;
+      locations = {
+        "/" = {
+          proxyPass = "http://10.0.0.3:3013";
+        };
+        "/api" = {
+          proxyPass = "http://10.0.0.3:3014";
+          extraConfig =
+            #sh
+            ''
+              limit_req zone=api burst=20 nodelay;
+
+              # CORS headers
+              add_header Access-Control-Allow-Origin "*" always;
+              add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+              add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+              add_header Access-Control-Expose-Headers "Content-Length,Content-Range" always;
+
+              # Handle preflight requests
+              if ($request_method = 'OPTIONS') {
+                  add_header Access-Control-Allow-Origin "*";
+                  add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
+                  add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization";
+                  add_header Content-Type text/plain;
+                  add_header Content-Length 0;
+                  return 204;
+              }
+            '';
+        };
+        "/api/stream" = {
+          proxyPass = "http://10.0.0.3:3014";
+          extraConfig =
+            #sh
+            ''
+              limit_req zone=download burst=10 nodelay;
+              proxy_set_header Range $http_range;
+
+              # Streaming optimizations
+              proxy_buffering off;
+              proxy_cache off;
+              proxy_read_timeout 300s;
+              proxy_connect_timeout 30s;
+              proxy_send_timeout 300s;
+
+              # Allow large file streaming
+              client_max_body_size 0;
+              proxy_max_temp_file_size 0;
+            '';
+        };
+      };
     };
   };
 
@@ -79,9 +137,8 @@ in {
 
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [ 80 8080 ];
+    allowedTCPPorts = [80 8080];
   };
 
   system.stateVersion = "24.05"; # Did you read the comment?
 }
-
diff --git a/hosts/ports.nix b/hosts/ports.nix
index 04f26c8..b9da945 100644
--- a/hosts/ports.nix
+++ b/hosts/ports.nix
@@ -24,7 +24,8 @@
       ntfy = 3010;
       audio = 3011;
       atuin = 3012;
-      stream = 3013;
+      # stream = 3013; # seedbox-frontend
+      # seedbox = 3014; # seedbox-backend
 
       search = 8081;
       videos = 8082;
@@ -39,7 +40,6 @@
       prowlarr = 5006;
       flaresolverr = 5007;
       torrent = 5008;
-      seedbox = 5009;
     };
   };
 }
diff --git a/modules/nixos/server/containers/seedbox.nix b/modules/nixos/server/containers/seedbox.nix
index ef4b61b..7cf5dc1 100644
--- a/modules/nixos/server/containers/seedbox.nix
+++ b/modules/nixos/server/containers/seedbox.nix
@@ -6,8 +6,8 @@
   ...
 }: let
   cfg = config.mods.server.seedbox;
-  port = config.mods.server.nginx.ports.stream;
-  backend-port = config.mods.server.local.ports.seedbox;
+  port = 3013;
+  bport = 3014;
 in
   with lib; {
     options.mods.server.seedbox = {
@@ -17,172 +17,181 @@ in
       };
     };
 
-    config = mkIf cfg.enable {
-      # Runtime
-      virtualisation.podman = {
-        enable = true;
-        autoPrune.enable = true;
-        dockerCompat = true;
-      };
+    config =
+      mkIf config.mods.server.nginx.enable {
+      }
+      // mkIf cfg.enable {
+        networking.firewall = {
+          allowedTCPPorts = [port bport];
+          allowedUDPPorts = [port bport];
+        };
 
-      # Enable container name DNS for all Podman networks.
-      networking.firewall.interfaces = let
-        matchAll =
-          if !config.networking.nftables.enable
-          then "podman+"
-          else "podman*";
-      in {
-        "${matchAll}".allowedUDPPorts = [53];
-      };
+        # Runtime
+        virtualisation.docker = {
+          enable = true;
+          autoPrune.enable = true;
+        };
+        virtualisation.oci-containers.backend = "docker";
 
-      virtualisation.oci-containers.backend = "podman";
+        # Containers
+        virtualisation.oci-containers.containers."seedbox-backend" = {
+          image = "compose2nix/seedbox-backend";
+          volumes = [
+            "seedbox-lite_seedbox_cache:/app/cache:rw"
+            "seedbox-lite_seedbox_data:/app/data:rw"
+          ];
+          ports = [
+            "${toString bport}:3001/tcp"
+          ];
+          log-driver = "journald";
+          extraOptions = [
+            "--network-alias=seedbox-backend"
+            "--network=seedbox-lite_seedbox-network"
+          ];
+          environment = {
+            NODE_ENV = "production";
+            ACCESS_PASSWORD = "temp_pass";
+            FRONTEND_URL = "http://localhost:${toString port}";
+          };
+        };
+        systemd.services."docker-seedbox-backend" = {
+          serviceConfig = {
+            Restart = lib.mkOverride 90 "always";
+            RestartMaxDelaySec = lib.mkOverride 90 "1m";
+            RestartSec = lib.mkOverride 90 "100ms";
+            RestartSteps = lib.mkOverride 90 9;
+          };
+          after = [
+            "docker-network-seedbox-lite_seedbox-network.service"
+            "docker-volume-seedbox-lite_seedbox_cache.service"
+            "docker-volume-seedbox-lite_seedbox_data.service"
+          ];
+          requires = [
+            "docker-network-seedbox-lite_seedbox-network.service"
+            "docker-volume-seedbox-lite_seedbox_cache.service"
+            "docker-volume-seedbox-lite_seedbox_data.service"
+          ];
+          partOf = [
+            "docker-compose-seedbox-lite-root.target"
+          ];
+          wantedBy = [
+            "docker-compose-seedbox-lite-root.target"
+          ];
+        };
+        virtualisation.oci-containers.containers."seedbox-frontend" = {
+          image = "compose2nix/seedbox-frontend";
+          ports = [
+            "${toString port}:8080/tcp"
+          ];
+          dependsOn = [
+            "seedbox-backend"
+          ];
+          log-driver = "journald";
+          extraOptions = [
+            "--network-alias=seedbox-frontend"
+            "--network=seedbox-lite_seedbox-network"
+          ];
+          environment = {
+            NODE_ENV = "production";
+            ACCESS_PASSWORD = "temp_pass";
+          };
+        };
+        systemd.services."docker-seedbox-frontend" = {
+          serviceConfig = {
+            Restart = lib.mkOverride 90 "always";
+            RestartMaxDelaySec = lib.mkOverride 90 "1m";
+            RestartSec = lib.mkOverride 90 "100ms";
+            RestartSteps = lib.mkOverride 90 9;
+          };
+          after = [
+            "docker-network-seedbox-lite_seedbox-network.service"
+          ];
+          requires = [
+            "docker-network-seedbox-lite_seedbox-network.service"
+          ];
+          partOf = [
+            "docker-compose-seedbox-lite-root.target"
+          ];
+          wantedBy = [
+            "docker-compose-seedbox-lite-root.target"
+          ];
+        };
 
-      # Containers
-      virtualisation.oci-containers.containers."seedbox-backend" = {
-        image = "localhost/compose2nix/seedbox-backend";
-        volumes = [
-          "seedbox-lite_seedbox_cache:/app/cache:rw"
-          "seedbox-lite_seedbox_data:/app/data:rw"
-        ];
-        ports = [
-          "${backend-port}:3001/tcp"
-        ];
-        log-driver = "journald";
-        extraOptions = [
-          "--network-alias=seedbox-backend"
-          "--network=seedbox-lite_seedbox-network"
-        ];
-      };
-      systemd.services."podman-seedbox-backend" = {
-        serviceConfig = {
-          Restart = lib.mkOverride 90 "always";
+        # Networks
+        systemd.services."docker-network-seedbox-lite_seedbox-network" = {
+          path = [pkgs.docker];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStop = "docker network rm -f seedbox-lite_seedbox-network";
+          };
+          script = ''
+            docker network inspect seedbox-lite_seedbox-network || docker network create seedbox-lite_seedbox-network --driver=bridge
+          '';
+          partOf = ["docker-compose-seedbox-lite-root.target"];
+          wantedBy = ["docker-compose-seedbox-lite-root.target"];
         };
-        after = [
-          "podman-network-seedbox-lite_seedbox-network.service"
-          "podman-volume-seedbox-lite_seedbox_cache.service"
-          "podman-volume-seedbox-lite_seedbox_data.service"
-        ];
-        requires = [
-          "podman-network-seedbox-lite_seedbox-network.service"
-          "podman-volume-seedbox-lite_seedbox_cache.service"
-          "podman-volume-seedbox-lite_seedbox_data.service"
-        ];
-        partOf = [
-          "podman-compose-seedbox-lite-root.target"
-        ];
-        wantedBy = [
-          "podman-compose-seedbox-lite-root.target"
-        ];
-      };
-      virtualisation.oci-containers.containers."seedbox-frontend" = {
-        image = "localhost/compose2nix/seedbox-frontend";
-        ports = [
-          "${port}:80/tcp"
-        ];
-        dependsOn = [
-          "seedbox-backend"
-        ];
-        log-driver = "journald";
-        extraOptions = [
-          "--network-alias=seedbox-frontend"
-          "--network=seedbox-lite_seedbox-network"
-        ];
-      };
-      systemd.services."podman-seedbox-frontend" = {
-        serviceConfig = {
-          Restart = lib.mkOverride 90 "always";
-        };
-        after = [
-          "podman-network-seedbox-lite_seedbox-network.service"
-        ];
-        requires = [
-          "podman-network-seedbox-lite_seedbox-network.service"
-        ];
-        partOf = [
-          "podman-compose-seedbox-lite-root.target"
-        ];
-        wantedBy = [
-          "podman-compose-seedbox-lite-root.target"
-        ];
-      };
 
-      # Networks
-      systemd.services."podman-network-seedbox-lite_seedbox-network" = {
-        path = [pkgs.podman];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStop = "podman network rm -f seedbox-lite_seedbox-network";
+        # Volumes
+        systemd.services."docker-volume-seedbox-lite_seedbox_cache" = {
+          path = [pkgs.docker];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          script = ''
+            docker volume inspect seedbox-lite_seedbox_cache || docker volume create seedbox-lite_seedbox_cache --driver=local
+          '';
+          partOf = ["docker-compose-seedbox-lite-root.target"];
+          wantedBy = ["docker-compose-seedbox-lite-root.target"];
+        };
+        systemd.services."docker-volume-seedbox-lite_seedbox_data" = {
+          path = [pkgs.docker];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          script = ''
+            docker volume inspect seedbox-lite_seedbox_data || docker volume create seedbox-lite_seedbox_data --driver=local
+          '';
+          partOf = ["docker-compose-seedbox-lite-root.target"];
+          wantedBy = ["docker-compose-seedbox-lite-root.target"];
         };
-        script = ''
-          podman network inspect seedbox-lite_seedbox-network || podman network create seedbox-lite_seedbox-network --driver=bridge
-        '';
-        partOf = ["podman-compose-seedbox-lite-root.target"];
-        wantedBy = ["podman-compose-seedbox-lite-root.target"];
-      };
 
-      # Volumes
-      systemd.services."podman-volume-seedbox-lite_seedbox_cache" = {
-        path = [pkgs.podman];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
+        # Builds
+        systemd.services."docker-build-seedbox-backend" = {
+          path = [pkgs.docker pkgs.git];
+          serviceConfig = {
+            Type = "oneshot";
+            TimeoutSec = 300;
+          };
+          script = ''
+            cd /tmp
+            git clone https://github.com/hotheadhacker/seedbox-lite.git && cd seedbox-lite/server || cd seedbox-lite/server
+            podman build -t compose2nix/seedbox-backend .
+          '';
         };
-        script = ''
-          podman volume inspect seedbox-lite_seedbox_cache || podman volume create seedbox-lite_seedbox_cache --driver=local
-        '';
-        partOf = ["podman-compose-seedbox-lite-root.target"];
-        wantedBy = ["podman-compose-seedbox-lite-root.target"];
-      };
-      systemd.services."podman-volume-seedbox-lite_seedbox_data" = {
-        path = [pkgs.podman];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
+        systemd.services."docker-build-seedbox-frontend" = {
+          path = [pkgs.docker pkgs.git];
+          serviceConfig = {
+            Type = "oneshot";
+            TimeoutSec = 300;
+          };
+          script = ''
+            cd /tmp
+            git clone https://github.com/hotheadhacker/seedbox-lite.git && cd seedbox-lite/client || cd seedbox-lite/client
+            podman build -t compose2nix/seedbox-frontend --build-arg VITE_API_BASE_URL=http://localhost:${toString bport} .
+          '';
         };
-        script = ''
-          podman volume inspect seedbox-lite_seedbox_data || podman volume create seedbox-lite_seedbox_data --driver=local
-        '';
-        partOf = ["podman-compose-seedbox-lite-root.target"];
-        wantedBy = ["podman-compose-seedbox-lite-root.target"];
-      };
 
-      # Builds
-      systemd.services."podman-build-seedbox-backend" = {
-        path = [pkgs.podman pkgs.git];
-        serviceConfig = {
-          Type = "oneshot";
-          TimeoutSec = 300;
+        # Root service
+        # When started, this will automatically create all resources and start
+        # the containers. When stopped, this will teardown all resources.
+        systemd.targets."docker-compose-seedbox-lite-root" = {
+          unitConfig = {
+            Description = "Root target generated by compose2nix.";
+          };
+          wantedBy = ["multi-user.target"];
         };
-        script = ''
-          cd /tmp
-          git clone https://github.com/hotheadhacker/seedbox-lite.git
-          cd seedbox-lite/server
-          podman build -t compose2nix/seedbox-backend .
-        '';
       };
-      systemd.services."podman-build-seedbox-frontend" = {
-        path = [pkgs.podman pkgs.git];
-        serviceConfig = {
-          Type = "oneshot";
-          TimeoutSec = 300;
-        };
-        script = ''
-          cd /tmp
-          git clone https://github.com/hotheadhacker/seedbox-lite.git
-          cd seedbox-lite/client
-          podman build -t compose2nix/seedbox-frontend --build-arg VITE_API_BASE_URL=http://localhost:${backend-port} .
-        '';
-      };
-
-      # Root service
-      # When started, this will automatically create all resources and start
-      # the containers. When stopped, this will teardown all resources.
-      systemd.targets."podman-compose-seedbox-lite-root" = {
-        unitConfig = {
-          Description = "Root target generated by compose2nix.";
-        };
-        wantedBy = ["multi-user.target"];
-      };
-    };
   }