diff --git a/homelab-services/minio-service/flake.lock b/homelab-services/minio-service/flake.lock
new file mode 100644
index 0000000..e23651e
--- /dev/null
+++ b/homelab-services/minio-service/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1749727998,
+        "narHash": "sha256-mHv/yeUbmL91/TvV95p+mBVahm9mdQMJoqaTVTALaFw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fd487183437963a59ba763c0cc4f27e3447dd6dd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/homelab-services/minio-service/flake.nix b/homelab-services/minio-service/flake.nix
new file mode 100644
index 0000000..423aa22
--- /dev/null
+++ b/homelab-services/minio-service/flake.nix
@@ -0,0 +1,105 @@
+{
+  description = "minio service for storing images with api access";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+  };
+
+  outputs = { self, nixpkgs, ... }: {
+    nixosModules.minio-service = { config, lib, pkgs, ... }:
+      let
+        opts = config.services.minio-service;
+      in {
+        options.services.minio-service = {
+          enable = lib.mkEnableOption "MinIO object storage server";
+
+          dataDir = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/minio";
+            description = "Directory to store MinIO data.";
+          };
+
+          dataPort = lib.mkOption {
+            type = lib.types.port;
+            default = 9000;
+            description = "MinIO S3 API port.";
+          };
+
+          consolePort = lib.mkOption {
+            type = lib.types.port;
+            default = 9001;
+            description = "MinIO Admin Console port.";
+          };
+
+          rootUser = lib.mkOption {
+            type = lib.types.str;
+            default = "minioadmin";
+            description = "MinIO root username.";
+          };
+
+          rootPasswordFile = lib.mkOption {
+            type = lib.types.path;
+            description = "File containing MinIO root password.";
+          };
+
+          default-nginx = {
+            enable = lib.mkEnableOption "Enable nginx reverse proxy for MinIO";
+            hostname = lib.mkOption {
+              type = lib.types.str;
+              default = "localhost";
+              description = "Hostname for nginx reverse proxy.";
+            };
+          };
+        };
+
+        config = lib.mkIf opts.enable {
+          users.groups.minio = {};
+          users.users.minio = {
+            isSystemUser = true;
+            group = "minio";
+            home = opts.dataDir;
+          };
+
+          systemd.services.minio = {
+            description = "MinIO S3-compatible object storage";
+            after = [ "network.target" ];
+            wantedBy = [ "multi-user.target" ];
+
+            serviceConfig = {
+              ExecStart = ''
+                ${pkgs.minio}/bin/minio server ${opts.dataDir} \
+                  --address ":${toString opts.dataPort}" \
+                  --console-address ":${toString opts.consolePort}"
+              ''; 
+              User = "minio";
+              Group = "minio";
+              Environment = [
+                "MINIO_ROOT_USER=${opts.rootUser}"
+                "MINIO_ROOT_PASSWORD_FILE=${opts.rootPasswordFile}"
+              ];
+              Restart = "always";
+            };
+          };
+
+          services.nginx = lib.mkIf opts.default-nginx.enable {
+            enable = true;
+            virtualHosts.${opts.default-nginx.hostname} = {
+              forceSSL = true;
+              enableACME = true;
+              locations."/" = {
+                proxyPass = "http://localhost:${toString opts.dataPort}";
+              };
+              locations."/console" = {
+                proxyPass = "https://localhost:${toString opts.consolePort}";
+              };
+            };
+          };
+
+          networking.firewall.allowedTCPPorts = lib.mkMerge [
+            [ opts.dataPort opts.consolePort ]
+            (lib.mkIf opts.default-nginx.enable [ 80 443 ])
+          ];
+        };
+      };
+  };
+}