diff --git a/services/media.hcl b/services/media.hcl
new file mode 100644
index 0000000..366f408
--- /dev/null
+++ b/services/media.hcl
@@ -0,0 +1,214 @@
+job "media" {
+  datacenters = ["alo"]
+
+  meta {
+    uuid = uuidv4()
+  }
+
+  group "servers" {
+    network {
+      port "radarr" { to = 7878 }
+      port "sonarr" { to = 8989 }
+      port "bazarr" { to = 6767 }
+      port "pms" { static = 32400 }
+      port "qbt_ui" { to = 8080 }
+      port "qbt_torrent" { static = 51413 }
+    }
+
+    task "radarr" {
+      driver = "docker"
+
+      config {
+        image = "ghcr.io/hotio/radarr:latest"
+        ports = [ "radarr" ]
+        volumes = [
+          "/data/compute/appdata/radarr:/config",
+          "/data/media:/data",
+        ]
+      }
+
+      env {
+        PUID = 1000
+        PGID = 1000
+        TZ = "Europe/Lisbon"
+      }
+
+      resources {
+        cpu = 200
+      }
+
+      service {
+        name = "radarr"
+        port = "radarr"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.radarr.entryPoints=websecure",
+          "traefik.http.routers.radarr.middlewares=authentik@file",
+        ]
+      }
+    }
+
+    task "sonarr" {
+      driver = "docker"
+
+      config {
+        image = "ghcr.io/hotio/sonarr:latest"
+        ports = [ "sonarr" ]
+        volumes = [
+          "/data/compute/appdata/sonarr:/config",
+          "/data/media:/data",
+        ]
+      }
+
+      env {
+        PUID = 1000
+        PGID = 1000
+        TZ = "Europe/Lisbon"
+      }
+
+      resources {
+        cpu = 200
+      }
+
+      service {
+        name = "sonarr"
+        port = "sonarr"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.sonarr.entryPoints=websecure",
+          "traefik.http.routers.sonarr.middlewares=authentik@file",
+        ]
+      }
+    }
+
+    task "bazarr" {
+      driver = "docker"
+
+      config {
+        image = "ghcr.io/hotio/bazarr:latest"
+        ports = [ "bazarr" ]
+        volumes = [
+          "/data/compute/appdata/bazarr:/config",
+          "/data/media/media:/data",
+        ]
+      }
+
+      env {
+        PUID = 1000
+        PGID = 1000
+        TZ = "Europe/Lisbon"
+      }
+
+      resources {
+        cpu = 200
+      }
+
+      service {
+        name = "bazarr"
+        port = "bazarr"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.bazarr.entryPoints=websecure",
+          "traefik.http.routers.bazarr.middlewares=authentik@file",
+        ]
+      }
+    }
+
+    task "plex" {
+      driver = "docker"
+
+      config {
+        image = "plexinc/pms-docker:latest"
+        ports = [ "pms" ]
+        network_mode = "host"
+        volumes = [
+          "/data/compute/appdata/plex:/config",
+          "/data/media/media:/data",
+        ]
+      }
+
+      env {
+        PLEX_UID = 1000
+        PLEX_GID = 1000
+        TZ = "Europe/Lisbon"
+      }
+
+      resources {
+        cpu = 2000
+        memory = 1000
+      }
+
+      service {
+        name = "plex"
+        port = "pms"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.plex.entryPoints=websecure",
+          "traefik.http.routers.plex.middlewares=authentik@file",
+        ]
+      }
+    }
+
+    task "qbittorrent" {
+      driver = "docker"
+
+      config {
+        image = "lscr.io/linuxserver/qbittorrent:latest"
+        ports = [
+          "qbt_ui",
+          "qbt_torrent",
+        ]
+        volumes = [
+          "/data/compute/appdata/qbittorrent:/config",
+          "/data/media/torrents:/data",
+        ]
+      }
+
+      env {
+        PUID = 1000
+        PGID = 1000
+        TZ = "Europe/Lisbon"
+        TORRENTING_PORT = 51413
+      }
+
+      resources {
+        cpu = 2000
+        memory = 1000
+      }
+
+      service {
+        name = "torrent"
+        port = "qbt_ui"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.torrent.entryPoints=websecure",
+          "traefik.http.routers.torrent.middlewares=authentik@file",
+        ]
+      }
+    }
+
+    task "keepalived" {
+      driver = "docker"
+      env {
+        KEEPALIVED_INTERFACE = "eno1"
+        KEEPALIVED_VIRTUAL_IPS = "192.168.1.102/24"
+        KEEPALIVED_ROUTER_ID = "54" # defaults to 51
+        KEEPALIVED_UNICAST_PEERS = ""
+        KEEPALIVED_STATE       = "MASTER"
+        KEEPALIVED_VIRTUAL_ROUTES = ""
+      }
+      config {
+        # 2.2.8 wasn't starting, reason unknown
+        image        = "visibilityspots/keepalived:2.2.7"
+        network_mode = "host"
+        privileged   = true
+        cap_add      = ["NET_ADMIN", "NET_BROADCAST", "NET_RAW"]
+      }
+    }
+  }
+}