diff --git a/docker/tandoor/docker-compose.yml b/docker/tandoor/docker-compose.yml
new file mode 100644
index 0000000..8133b76
--- /dev/null
+++ b/docker/tandoor/docker-compose.yml
@@ -0,0 +1,21 @@
+---
+services:
+  web_recipes:
+    restart: always
+    image: vabene1111/recipes:2.3.6
+    volumes:
+      - ${TANDOOR_STATICFILES:-/mnt/nas1/shared/tandoor/staticfiles}:/opt/recipes/staticfiles
+      - ${TANDOOR_MEDIAFILES:-/mnt/nas1/shared/tandoor/mediafiles}:/opt/recipes/mediafiles
+    environment:
+      SECRET_KEY: ${TANDOOR_SECRET_KEY}
+      TZ: ${TANDOOR_TZ:-Europe/Madrid}
+      ALLOWED_HOSTS: ${TANDOOR_ALLOWED_HOSTS:-recipes.roboces.dev}
+      SOCIAL_PROVIDERS: ${TANDOOR_SOCIAL_PROVIDERS:-allauth.socialaccount.providers.openid_connect}
+      SOCIALACCOUNT_PROVIDERS: ${TANDOOR_SOCIALACCOUNT_PROVIDERS}
+      POSTGRES_HOST: ${TANDOOR_POSTGRES_HOST:-192.168.1.3}
+      POSTGRES_DB: ${TANDOOR_POSTGRES_DB:-tandoor}
+      POSTGRES_PORT: ${TANDOOR_POSTGRES_PORT:-5432}
+      POSTGRES_USER: ${TANDOOR_POSTGRES_USER}
+      POSTGRES_PASSWORD: ${TANDOOR_POSTGRES_PASSWORD}
+    ports:
+      - "8081:80"
diff --git a/docker/tandoor/sample.env b/docker/tandoor/sample.env
new file mode 100644
index 0000000..e5029ad
--- /dev/null
+++ b/docker/tandoor/sample.env
@@ -0,0 +1,11 @@
+TANDOOR_STATICFILES=
+TANDOOR_MEDIAFILES=
+TANDOOR_SECRET_KEY=
+TANDOOR_TZ=Europe/Madrid
+TANDOOR_ALLOWED_HOSTS=
+TANDOOR_SOCIALACCOUNT_PROVIDERS=
+TANDOOR_POSTGRES_HOST=
+TANDOOR_POSTGRES_DB=
+TANDOOR_POSTGRES_PORT=
+TANDOOR_POSTGRES_USER=
+TANDOOR_POSTGRES_PASSWORD=
diff --git a/tofu/authentik/main.tf b/tofu/authentik/main.tf
index 7b27b0c..87ebc58 100644
--- a/tofu/authentik/main.tf
+++ b/tofu/authentik/main.tf
@@ -199,36 +199,6 @@ module "sftpgo" {
   sub_mode              = "user_username"
 }
 
-module "netbird" {
-  source              = "../modules/authentik-oidc"
-  app_name            = "netbird"
-  app_slug            = "netbird"
-  client_id           = var.netbird_client_id
-  client_type         = "public"
-  app_access_group_id = authentik_group.vpn.id
-  redirect_uris = [
-    {
-      matching_mode = "strict",
-      url           = "https://vpn.fukurokuju.dev",
-    },
-    {
-      matching_mode = "regex",
-      url           = "https://vpn.fukurokuju.dev.*",
-    },
-    {
-      matching_mode = "strict",
-      url           = "http://localhost:53000"
-    },
-
-  ]
-  sub_mode = "user_id"
-  extra_property_mappings = [
-    "goauthentik.io/providers/oauth2/scope-authentik_api"
-  ]
-  app_icon              = "https://vpn.fukurokuju.dev/apple-icon.png"
-  access_token_validity = "days=10"
-  client_secret         = ""
-}
 
 module "rustical" {
   source              = "../modules/authentik-oidc"
@@ -248,3 +218,13 @@ module "jellyfin" {
   name                = "jellyfin"
   app_access_group_id = authentik_group.arrs.id
 }
+
+module "tandoor" {
+  source              = "../modules/authentik-oidc"
+  app_name            = "Tandoor"
+  app_slug            = "tandoor"
+  app_access_group_id = ""
+  redirect_uris       = [{ matching_mode = "strict", url = "https://recipes.roboces.dev/accounts/oidc/authentik/login/callback/" }]
+  client_id           = var.tandoor_client_id
+  client_secret       = var.tandoor_client_secret
+}
diff --git a/tofu/authentik/sample.env b/tofu/authentik/sample.env
index a784c41..3887146 100644
--- a/tofu/authentik/sample.env
+++ b/tofu/authentik/sample.env
@@ -10,6 +10,7 @@ TF_VAR_paperless_client_id=
 TF_VAR_paperless_client_secret=
 TF_VAR_sftpgo_client_id=
 TF_VAR_sftpgo_client_secret=
-TF_VAR_netbird_client_id=
 TF_VAR_rustical_client_id=
 TF_VAR_rustical_client_secret=
+TF_VAR_tandoor_client_id=
+TF_VAR_tandoor_client_secret=
diff --git a/tofu/authentik/vars.tf b/tofu/authentik/vars.tf
index 4a1c5dd..30ec835 100644
--- a/tofu/authentik/vars.tf
+++ b/tofu/authentik/vars.tf
@@ -39,12 +39,6 @@ variable "paperless_client_secret" {
   type        = string
 }
 
-variable "netbird_client_id" {
-  description = "Netbird client ID"
-  type        = string
-}
-
-
 variable "sftpgo_client_id" {
   description = "SFTPGo client ID"
   type        = string
@@ -61,16 +55,16 @@ variable "rustical_client_id" {
 }
 
 variable "rustical_client_secret" {
-  description = "Rustical client secret"
+  description = "Tandoor client secret"
   type        = string
 }
 
-variable "mediamanager_client_id" {
-  description = "MediaManager client ID"
+variable "tandoor_client_id" {
+  description = "Tandoor client ID"
   type        = string
 }
 
-variable "mediamanager_client_secret" {
-  description = "MediaManager client secret"
+variable "tandoor_client_secret" {
+  description = "Tandoor client secret"
   type        = string
 }