diff --git a/services/beancount.hcl b/services/beancount.hcl
new file mode 100644
index 0000000..2103c81
--- /dev/null
+++ b/services/beancount.hcl
@@ -0,0 +1,44 @@
+job "beancount" {
+  datacenters = ["alo"]
+
+  # force each evaluation to be different, so that the jobspec changes, so that the latest image is pulled
+  # otherwise, nomad run ends up not doing anything even if the latest image is different
+  meta {
+    uuid = uuidv4()
+  }
+
+  group "web" {
+    network {
+      port "http" {
+        to = 5000
+      }
+    }
+
+    task "fava" {
+      driver = "docker"
+
+      config {
+        image = "gitea.v.paler.net/ppetru/fava:latest"
+        ports = ["http"]
+        volumes = [
+          "/data/compute/appdata/beancount:/beancount",
+        ]
+      }
+
+      env {
+        BEANCOUNT_FILE = "/beancount/pi.beancount"
+      }
+
+      service {
+        name = "finances"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.finances.entryPoints=websecure",
+          "traefik.http.routers.finances.middlewares=authentik@file",
+        ]
+      }
+    }
+  }
+}