diff --git a/inventories/z9/host_vars/dooris.sops.yaml b/inventories/z9/host_vars/dooris.sops.yaml
index 73c8726..5222bc8 100644
--- a/inventories/z9/host_vars/dooris.sops.yaml
+++ b/inventories/z9/host_vars/dooris.sops.yaml
@@ -1,11 +1,11 @@
+dooris_static_api_token: ENC[AES256_GCM,data:JbmbaXKxBouw/mFqZGcH8pi9Cb3Vyl4i0zV5ZqUwBkGmMuylj3ocLpZZ0Ur+gGGG0MIuFwOvfnctJFLTcVylNQ==,iv:tYpWo2rANvCJidaZ2L+e3dnEJByy0Y9PYbAvQDEZL7Q=,tag:NGqnEftvqAVRZOuJqkyCVQ==,type:str]
 secret__dooris_client_secret: ENC[AES256_GCM,data:v85gIBNH4s4j36crJ+Pb2lu2cdZpwz0xndHzBKZNGKg=,iv:Rlt6R7JMcHTAAVPiTtFaxqsWD8G5B9Ab3yqItYdFR+E=,tag:dlMHaxTMx3LgOzCsTLUdzw==,type:str]
 secret__dooris_ccujack_password: ENC[AES256_GCM,data:bHeftSA7eC1cSydBRumksRgw2v0=,iv:X/pfsvQPZREifGjHDGx8mVk2TDrlrRVb6MiAr01wI9o=,tag:ti//x7eDbheMG6Hsn2KBlg==,type:str]
 ansible_pull__age_private_key: ENC[AES256_GCM,data:Yi4ST1zDVN4dLDs9i6aajUvEzTSYvwfYIRZUC278rgdO0bGk4y6saevmqK4mUnpIpz8M+ze//1OTDTgU6K4AE1TsX8vWB7fboGE=,iv:srZYtxDXXkCu5h7HwYbMtPr7PYhhgJ8rZQ3H4TOJmTk=,tag:iq6YEEyzYd6rNoAIgdk5Sw==,type:str]
 secret__acme_dns_api_key_dooris_ccchh_net: ENC[AES256_GCM,data:1qDNE8CeXo6SA5vaZYQ/2yNUE9Y1nUkL976Qsq6D9QYCc3fIrkKMXg==,iv:clOa/vwup2QS0Yvq8JTFGhCkuviWWBPNzp0tht8WZXY=,tag:WwN035cE5AxVSpJqRqkGqw==,type:str]
 sops:
   age:
-    - recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax
-      enc: |
+    - enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
         YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrYW9aYzMxeFYxemp5MUlR
         NGJOaDRCc2E5bGdjSnFkcm5YMTdaSldKSFVVCmJmNERQbDF0Y2NDZGNnWVE5UlIy
@@ -13,8 +13,9 @@ sops:
         YVc5c281N0Fod2hib29wOEJXZkZKOXMKx2g337TvrUk5hXZNbxlPlrWOydYbSBoW
         aHvFML6xynRtBrMsp9IebicBxZKSWLi7uHi+LuAzkIcqpAlJUUBAbg==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-04-19T21:46:01Z"
-  mac: ENC[AES256_GCM,data:5VlEYqo7ez4EgdMqGGnelc02EoT/bCLYVbPGHth4kd+DhOaJ1EXhmVB5eiX3AwyRl2nr79z/idCDJ6R1QdfQ5v8rYnnWcqehtiIIz0RBXhbED/hN2oz48yRhIX9vCB0gjsK6cacDzTCHP0tPEsQF+Ax4uWdXNHKnZVYS70qxbEI=,iv:noc3LJdiZ10w9O6JfwTxzLUNKT74rfdTX/Gb94fP3JI=,tag:WgFpYsFO3WjrjCs/7R634w==,type:str]
+      recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax
+  lastmodified: "2026-07-19T14:13:08Z"
+  mac: ENC[AES256_GCM,data:ZjgYzR6w5Vw0yomgqFQyqfqeHlFExyh26K1cpt6dHSuokpmOBVZ2yMdKBpPbhzxtqTWW+7dTFFdRK0ksIan4Niq1Rvh+W+Gi0UfG0nD3541oODuceqWv8Itr6ke4C+x/VlfBoG0eiUfqVPuEE27vpGF5YM5xZ4lH0SIhexWbLU4=,iv:Zor5Kgpm3B9Z61BF2knDJn5woNx/QVNYbhdpPgwqQn0=,tag:cE2xBmvD+qDxyzXh2Md0TQ==,type:str]
   pgp:
     - created_at: "2026-05-20T02:08:48Z"
       enc: |-
@@ -187,4 +188,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
   unencrypted_suffix: _unencrypted
-  version: 3.12.2
+  version: 3.13.2
diff --git a/inventories/z9/host_vars/dooris.yaml b/inventories/z9/host_vars/dooris.yaml
index 3792153..65c949d 100644
--- a/inventories/z9/host_vars/dooris.yaml
+++ b/inventories/z9/host_vars/dooris.yaml
@@ -1,3 +1,5 @@
+dooris_url: "https://dooris.ccchh.net"
+
 docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'resources/z9/dooris/docker_compose/compose.yaml.j2') }}"
 docker_compose__configuration_files: [ ]
 
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index 7a14440..59fe15a 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -170,3 +170,10 @@
     - transmission
   tags:
     - transmission
+
+- name: Setup dooris
+  hosts: dooris
+  roles:
+    - dooris
+  tags:
+    - dooris
diff --git a/resources/z9/dooris/docker_compose/compose.yaml.j2 b/resources/z9/dooris/docker_compose/compose.yaml.j2
index e81b233..86784cb 100644
--- a/resources/z9/dooris/docker_compose/compose.yaml.j2
+++ b/resources/z9/dooris/docker_compose/compose.yaml.j2
@@ -11,6 +11,7 @@ services:
       DOORIS_CCUJACK_USER: "dooris"
       DOORIS_CCUJACK_PASSWORD: "{{ secret__dooris_ccujack_password }}"
       DOORIS_AUTHORIZED_KEYS_FILE: "/srv/state/dooris_authorized_keys"
+      DOORIS_STATIC_API_TOKENS: "{{ dooris_static_api_token }}"
     network_mode: host
     restart: unless-stopped
     volumes:
diff --git a/roles/dooris/handlers/main.yml b/roles/dooris/handlers/main.yml
new file mode 100644
index 0000000..0e3528f
--- /dev/null
+++ b/roles/dooris/handlers/main.yml
@@ -0,0 +1,5 @@
+- name: "reload sshd"
+  become: true
+  ansible.builtin.systemd_service:
+      name: "ssh.service"
+      state: "reloaded"
diff --git a/roles/dooris/meta/argument_specs.yml b/roles/dooris/meta/argument_specs.yml
new file mode 100644
index 0000000..db2c23c
--- /dev/null
+++ b/roles/dooris/meta/argument_specs.yml
@@ -0,0 +1,13 @@
+argument_specs:
+    main:
+        options:
+
+            dooris_static_api_token:
+                description: "A static token that is valid on the servers API and can operate locks"
+                required: true
+                type: str
+
+            dooris_url:
+                description: "The URL on which the dooris server is reachable"
+                required: true
+                type: str
diff --git a/roles/dooris/meta/main.yml b/roles/dooris/meta/main.yml
new file mode 100644
index 0000000..feb396f
--- /dev/null
+++ b/roles/dooris/meta/main.yml
@@ -0,0 +1,2 @@
+dependencies:
+    - docker_compose
diff --git a/roles/dooris/tasks/main.yml b/roles/dooris/tasks/main.yml
new file mode 100644
index 0000000..659dccd
--- /dev/null
+++ b/roles/dooris/tasks/main.yml
@@ -0,0 +1,34 @@
+- name: Create local dooris group
+  become: true
+  ansible.builtin.group:
+      name: "dooris"
+      gid: 10000
+
+- name: Create local dooris user
+  become: true
+  ansible.builtin.user:
+      name: "dooris"
+      uid: 10000
+      group: "dooris"
+      system: true
+      password: "!"
+      home: "/ansible_docker_compose/state/"
+      shell: "/ansible_docker_compose/state/ssh-cli"
+
+- name: Ensure dooris state directory exists and has correct permissions
+  become: true
+  ansible.builtin.file:
+      path: "/ansible_docker_compose/state/"
+      owner: "dooris"
+      group: "dooris"
+      mode: "u=rwx,g=rx,o="
+
+- name: Create ssh server config for dooris user
+  become: true
+  notify: "reload sshd"
+  ansible.builtin.template:
+      src: sshd_config
+      dest: /etc/ssh/sshd_config.d/dooris.conf
+      owner: root
+      group: root
+      mode: u=rw,g=r,o=r
diff --git a/roles/dooris/templates/sshd_config b/roles/dooris/templates/sshd_config
new file mode 100644
index 0000000..4647f9e
--- /dev/null
+++ b/roles/dooris/templates/sshd_config
@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+
+Match User dooris
+  AuthorizedKeysFile /ansible_docker_compose/state/dooris_authorized_keys
+  ForceCommand /ansible_docker_compose/state/ssh-cli
+  SetEnv DOORIS_SERVER_URL={{ dooris_url }} DOORIS_API_TOKEN={{ dooris_static_api_token }}