diff --git a/README.md b/README.md
index 70a5454..b9c5b99 100644
--- a/README.md
+++ b/README.md
@@ -36,8 +36,39 @@ was chosen as it's IMO the first stepping stone to enable
 self-hosting. Tiny Tiny RSS was chosen because it is somewhat
 lightweight.
 
-- [ ] Vaultwarden
-- [ ] TTRSS
+- Haproxy
+  - [x] Systemd service
+- Keycloak
+  - [x] Provision using keycloak-cli-config
+  - [x] Behind haproxy
+  - [x] Integration tests
+  - [ ] Backup
+- Grafana/Alertmanager/Prometheus
+  - [ ] Systemd service
+  - [ ] Behind haproxy
+  - [ ] Behind keycloak with oauth2proxy
+  - [ ] Integration tests
+  - [ ] Backup
+- Vaultwarden
+  - [x] Systemd service
+  - [x] Behind haproxy
+  - [x] Behind keycloak with oauth2proxy
+  - [ ] Integration tests
+  - [ ] Backup
+  - [ ] Dashboard with Grafana
+  - [ ] Alerts with Alertmanager
+- TTRSS
+  - [x] Systemd service
+  - [x] Behind haproxy
+  - [x] Behind keycloak with oauth2proxy
+  - [ ] Integration tests
+  - [ ] Backup
+  - [ ] Dashboard with Grafana
+  - [ ] Alerts with Alertmanager
+- Misc
+  - [x] Function to generate haproxy config
+  - [ ] Documentation for setting up on Linode
+  - [ ] Documentation for getting started
 
 ## Getting Started
 
diff --git a/mycompany-agents/network.nix b/mycompany-agents/network.nix
new file mode 100644
index 0000000..f908e62
--- /dev/null
+++ b/mycompany-agents/network.nix
@@ -0,0 +1,18 @@
+let
+  hercules-ci-agent =
+      builtins.fetchTarball "https://github.com/hercules-ci/hercules-ci-agent/archive/stable.tar.gz";
+in
+{
+  network.description = "Hercules CI agents";
+
+  agent = {
+    imports = [
+      (hercules-ci-agent + "/module.nix")
+    ];
+
+    services.hercules-ci-agent.enable = true;
+    services.hercules-ci-agent.concurrentTasks = 4; # Number of jobs to run
+    deployment.keys."cluster-join-token.key".keyFile = ./cluster-join-token.key;
+    deployment.keys."binary-caches.json".keyFile = ./binary-caches.json;
+  };
+}