diff --git a/nixos/modules/nixos/services/traefik/secrets.sops.tmp.yaml b/nixos/modules/nixos/services/traefik/secrets.sops.tmp.yaml
new file mode 100644
index 0000000..16756eb
--- /dev/null
+++ b/nixos/modules/nixos/services/traefik/secrets.sops.tmp.yaml
@@ -0,0 +1,8 @@
+---
+system:
+    services:
+        # apiTokenFile is just env vars for the service, hijack this to hide domains
+        traefik:
+            apiTokenFile: |
+                CLOUDFLARE_API_KEY=b7e89056905c569e0f38c3ae37c9125dfdbce
+                CLOUDFLARE_EMAIL=admin@voltaicforge.com