diff --git a/hosts/common/server.nix b/hosts/common/server.nix
new file mode 100644
index 0000000..7997f2c
--- /dev/null
+++ b/hosts/common/server.nix
@@ -0,0 +1,137 @@
+# Server stack shared by dogma-nixos and dogma-nixos-rtx (not WSL)
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.bridge.bridge-nf-call-iptables" = 1;
+    "net.ipv4.conf.all.forwarding" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+    "net.ipv4.conf.all.proxy_arp" = 1;
+    "net.ipv4.conf.ens2.proxy_arp" = 1;
+  };
+
+  networking.firewall.trustedInterfaces = ["br0"];
+
+  # Bridge networking - host-specific NIC may be overridden per-host
+  networking.interfaces.enp6s0.useDHCP = false;
+  networking.interfaces.br0.useDHCP = true;
+  networking.bridges.br0.interfaces = ["enp6s0"];
+
+  services.caddy = {
+    enable = true;
+    environmentFile = config.sops.templates."caddy.env".path;
+    virtualHosts."centraldogma.site:".extraConfig = ''
+
+      root * /srv/root/
+      file_server
+      encode zstd gzip
+
+      redir /jellyfin /jellyfin/
+      reverse_proxy /jellyfin/* 127.0.0.1:8096
+
+      redir /sonarr /sonarr/
+      reverse_proxy /sonarr/* 127.0.0.1:8989
+
+      redir /radarr /radarr/
+      reverse_proxy /radarr/* 127.0.0.1:7878
+
+    '';
+    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:8096
+    '';
+    virtualHosts."jellyfin2.centraldogma.site:".extraConfig = ''
+      redir /jellyfin /jellyfin/
+      reverse_proxy /jellyfin/* 127.0.0.1:8096
+    '';
+    virtualHosts."git.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 127.0.0.1:3000
+    '';
+    virtualHosts."spy.centraldogma.site:".extraConfig = ''
+      reverse_proxy /* 192.168.1.78:4444
+    '';
+  };
+
+  services.flaresolverr.enable = true;
+
+  services.mongodb = {
+    enable = true;
+    package = pkgs.mongodb-ce;
+    initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
+  };
+
+  services.jackett.enable = true;
+
+  services.factorio = {
+    enable = true;
+    public = true;
+    requireUserVerification = true;
+    username = "TheMaskedMan95";
+    admins = ["TheMaskedMan95"];
+    game-name = "Realm of the Masked Men";
+    description = "No Dogs allowed";
+    extraSettingsFile = config.sops.templates."factorio.json".path;
+    saveName = "SPACExxxx";
+    openFirewall = true;
+  };
+
+  services.radarr.enable = true;
+
+  services.ddclient = {
+    enable = true;
+    protocol = "namecheap";
+    server = "dynamicdns.park-your-domain.com";
+    ssl = true;
+    username = "centraldogma.site";
+    domains = [
+      "@"
+      "www"
+    ];
+    usev4 = "webv4, webv4=ipify-ipv4";
+    passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
+    interval = "5mins";
+  };
+
+  services.sonarr.enable = true;
+
+  services.transmission = {
+    enable = true;
+    openRPCPort = true;
+    settings = {
+      rpc-bind-address = "0.0.0.0";
+      rpc-whitelist = "127.0.0.1,192.168.1.86";
+      download-dir = "/mnt/media/Downloads";
+    };
+  };
+
+  services.adguardhome = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 3003;
+    settings = {
+      allowDHCP = true;
+      dns = {
+        upstream_dns = [
+          "9.9.9.9#dns.quad9.net"
+          "149.112.112.112#dns.quad9.net"
+        ];
+      };
+      filtering = {
+        protection_enabled = true;
+        filtering_enabled = true;
+        parental_enabled = true;
+        safe_search.enabled = false;
+      };
+      filters = map (url: {
+        enabled = true;
+        url = url;
+      }) [
+        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt"
+        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt"
+      ];
+    };
+  };
+}