diff --git a/btc-ssh-key.pub b/btc-ssh-key.pub
new file mode 100644
index 0000000..5e4654b
--- /dev/null
+++ b/btc-ssh-key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINOIWWGUGM+5GjypoSNe0nKMLnu+5/McFHQhY7HXtpbS btcpay-server key
diff --git a/flake.nix b/flake.nix
index b4d7e68..13074c3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,72 +1,99 @@
 {
-  description = "BTCPay Server NixOS module";
-  
+  description = "BTCPayServer NixOS flake with dotfile-based pg_hba.conf and sops-nix secrets";
+
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
     nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
+    sops-nix.url = "github:Mic92/sops-nix";
   };
 
-  outputs = { self, nixpkgs, nix-bitcoin, ... }: {
-    # Export a module for others to use
+  outputs = { self, nixpkgs, nix-bitcoin, sops-nix, ... }: {
     nixosModules.btcpay-server = { config, lib, pkgs, ... }: {
-      imports = [ nix-bitcoin.nixosModules.default ];
-      
+      imports = [ nix-bitcoin.nixosModules.default sops-nix.nixosModules.sops ];
+
       options.services.btcpay-full = {
         enable = lib.mkEnableOption "BTCPay Server with Bitcoin node";
       };
-      # Disable debugfs mount in LXC containers
+
       config = lib.mkIf config.services.btcpay-full.enable {
         nix-bitcoin.generateSecrets = true;
         nix-bitcoin.operator = {
           enable = true;
           name = "btcpay";
         };
-        
+
+        # sops secret for Postgres password
+        sops.secrets.nbxplorer-pg-password = {
+          sopsFile = ./secrets.yaml;
+          owner = "postgres";
+        };
+
+        # Use tracked dotfile for Postgres auth rules
+        services.postgresql = {
+          enable = true;
+          package = pkgs.postgresql_14;
+          initialDatabases = [{ name = "nbxplorer"; }];
+          ensureUsers = [{
+            name = "nbxplorer";
+            passwordFile = config.sops.secrets.nbxplorer-pg-password.path;
+            ensureDBOwnership = true;
+          }];
+          authentication = builtins.readFile ./pg_hba.conf;
+        };
+
         services.bitcoind = {
           enable = true;
           prune = 100000;
           dbCache = 8000;
           rpc.port = 8332;
         };
-        
-        # Enable BTCPay Server with network binding
+
         services.btcpayserver = {
           enable = true;
-          # Configure BTCPay Server to listen on all interfaces
           address = "0.0.0.0";
           port = 23000;
+          environment = {
+            NBXPLORER_CHAINS__BTC__POSTGRES = "User ID=nbxplorer;Host=localhost;Port=5432;Database=nbxplorer;Password=${
+              builtins.readFile config.sops.secrets.nbxplorer-pg-password.path
+            }";
+          };
         };
 
-        
         networking.firewall.allowedTCPPorts = [
           config.services.btcpayserver.port
           config.services.bitcoind.port
+          5432
         ];
+
+        # (SSH added below)
       };
     };
 
-    # System configuration for deployment - REMOVED duplicate nix-bitcoin import
     nixosConfigurations.btcpay = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       modules = [
-        ({ ... }: {
-          # Minimal system configuration for containers
+        ({ config, ... }: {
           boot.isContainer = true;
           system.stateVersion = "25.05";
-          
-          # Enable our BTCPay service
           services.btcpay-full.enable = true;
-          
-          # Basic SSH access
+
+          # SSH best practices: use a public key from secrets, fallback to password auth only if needed
+          sops.secrets.btcpay-ssh-pubkey = {
+            sopsFile = ./secrets.yaml;
+            owner = "root";
+          };
+          users.users.root.openssh.authorizedKeys.keys = [
+            (builtins.readFile config.sops.secrets.btcpay-ssh-pubkey.path)
+          ];
+
           services.openssh = {
             enable = true;
             settings = {
-              PermitRootLogin = "yes";
-              PasswordAuthentication = true;
+              PermitRootLogin = "prohibit-password"; # disables password logins
+              PasswordAuthentication = false;
             };
           };
         })
-        # This module already imports nix-bitcoin.nixosModules.default
         self.nixosModules.btcpay-server
       ];
     };
diff --git a/justfile b/justfile
index 4928753..21d4563 100644
--- a/justfile
+++ b/justfile
@@ -1,20 +1,22 @@
-# Variables
 REMOTE_HOST := "root@10.1.1.163"
 
-# Default command
-default:
-    @echo "BTCPay Server deployment commands:"
-    @echo "  just build     - Build configuration"
-    @echo "  just deploy    - Deploy to remote server"
-
-# Build the configuration
 build:
-    NIX_CONFIG="experimental-features = nix-command flakes" nix build .#nixosConfigurations.btcpay.config.system.build.toplevel
+    nix build .#nixosConfigurations.btcpay.config.system.build.toplevel
 
-# Deploy to remote server
 deploy:
-    NIX_CONFIG="experimental-features = nix-command flakes" nixos-rebuild switch --flake .#btcpay --target-host {{REMOTE_HOST}} --option experimental-features "nix-command flakes"
+    nixos-rebuild switch --flake .#btcpay --target-host {{REMOTE_HOST}} --option experimental-features "nix-command flakes"
 
-# Check services status
 status:
     ssh {{REMOTE_HOST}} "systemctl status bitcoind btcpayserver"
+
+encrypt-secrets:
+    sops -e -i secrets.yaml
+
+edit-secrets:
+    sops secrets.yaml
+
+shell:
+    nix develop
+
+psql:
+    psql -h localhost -U nbxplorer -d nbxplorer
diff --git a/pg_hba.conf b/pg_hba.conf
new file mode 100644
index 0000000..b70a5d2
--- /dev/null
+++ b/pg_hba.conf
@@ -0,0 +1,4 @@
+# TYPE  DATABASE        USER            ADDRESS                 METHOD
+local   all             all                                     md5
+host    all             all             127.0.0.1/32            md5
+host    all             all             ::1/128                 md5
diff --git a/secrets.yaml b/secrets.yaml
new file mode 100644
index 0000000..33f6670
--- /dev/null
+++ b/secrets.yaml
@@ -0,0 +1,2 @@
+nbxplorer-pg-password: >-
+  f%Rn^g!o*d0U3UjXNN&1dG&H
\ No newline at end of file
diff --git a/shell.nix b/shell.nix
index 1f60faf..1f784b5 100644
--- a/shell.nix
+++ b/shell.nix
@@ -2,6 +2,20 @@
 
 pkgs.mkShell {
   buildInputs = with pkgs; [
-    just
+    just           # task runner
+    sops           # secrets management
+    postgresql     # includes psql client utility[6][9]
+    bitcoin        # Bitcoin Core CLI tools (bitcoind, bitcoin-cli)
+    curl           # For HTTP API testing
+    jq             # For manipulating test output
+    # dotnet-sdk   # IF you develop/plugins for NBXplorer, uncomment this
   ];
+
+  shellHook = ''
+    export SSH_CONFIG_FILE="$PWD/ssh-config-dev"
+    alias ssh="ssh -F $SSH_CONFIG_FILE"
+    alias scp="scp -F $SSH_CONFIG_FILE"
+    echo "Repo-local SSH config active: using $SSH_CONFIG_FILE for ssh/scp."
+  '';
 }
+