diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7be176e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+defguard/*.rpm
diff --git a/defguard/core.conf b/defguard/core.conf
new file mode 100644
index 0000000..da23115
--- /dev/null
+++ b/defguard/core.conf
@@ -0,0 +1,37 @@
+### Core configuration ###
+DEFGUARD_AUTH_SECRET=hJMvPDLA7YHCNVOqAr8qQWyq8EyMKGVT4U2kjF1UZ1TueWsPRmTWIxdab1FYDnHi
+DEFGUARD_GATEWAY_SECRET=NteTH8yjMxa5DSYqbiOAOHjOQigtSK4HMSUnxLUMbkh44t2pJG6hJ8yxoAbkeM9f
+DEFGUARD_YUBIBRIDGE_SECRET=BkMAPxgWNcBxfeEI9sfOKvkjSQxRepd1tDnV9JAt3MTctY0XaHtp545dCfnGmH92
+DEFGUARD_SECRET_KEY=LEmaPaVzXRydUpJ4ZkdrlOvcJhr3GFmdVsmby1hD9p8ZJieiVkSqfixDyQUM4JqO
+DEFGUARD_URL=https://core.lab.ngtech.home
+# For localhost only:
+DEFGUARD_COOKIE_INSECURE=false
+# How long auth session lives in seconds
+DEFGUARD_AUTH_SESSION_LIFETIME=604800
+# Optional. Generated based on DEFGUARD_URL if not provided.
+# DEFGUARD_WEBAUTHN_RP_ID=localhost
+DEFGUARD_ADMIN_GROUPNAME=admin
+DEFGUARD_DEFAULT_ADMIN_PASSWORD=pass123
+
+### Logging ###
+DEFGUARD_LOG_LEVEL=info
+
+### Proxy configuration ###
+# Optional. URL of proxy gRPC server
+DEFGUARD_PROXY_URL=http://localhost:50051
+
+### LDAP configuration ###
+#DEFGUARD_LDAP_URL=ldap://localhost:389
+#DEFGUARD_LDAP_SERVICE_PASSWORD=adminpassword
+#DEFGUARD_LDAP_USER_SEARCH_BASE="ou=users,dc=example,dc=org"
+#DEFGUARD_LDAP_GROUP_SEARCH_BASE="ou=groups,dc=example,dc=org"
+#DEFGUARD_LDAP_DEVICE_SEARCH_BASE="ou=devices,dc=example,dc=org"
+
+### DB configuration ###
+DEFGUARD_DB_HOST="localhost"
+DEFGUARD_DB_PORT=5432
+DEFGUARD_DB_NAME="defguard"
+DEFGUARD_DB_USER="defguard"
+DEFGUARD_DB_PASSWORD="defguard"
+# for SQLX CLI
+DATABASE_URL="postgresql://defguard:defguard@localhost/defguard"
diff --git a/defguard/gen-secret.sh b/defguard/gen-secret.sh
new file mode 100755
index 0000000..0b4830b
--- /dev/null
+++ b/defguard/gen-secret.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+openssl rand -base64 128 | tr -d "=+/" | tr -d '\n' | cut -c1-64
diff --git a/defguard/install-defguard-core.sh b/defguard/install-defguard-core.sh
new file mode 100755
index 0000000..a4d6296
--- /dev/null
+++ b/defguard/install-defguard-core.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+dnf install epel-release -y
+
+# install postresql
+dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm
+
+dnf install -y postgresql16-contrib postgresql16-server --nobest
+
+
+/usr/pgsql-16/bin/postgresql-16-setup initdb
+
+systemctl enable postgresql-16
+systemctl start postgresql-16
+
+echo "Enter defguard user password (defguard)"
+sudo -u postgres createuser -P defguard 
+sudo -u postgres createdb -O defguard defguard
+
+
+cp -vf  pg_hba.conf /var/lib/pgsql/16/data/pg_hba.conf
+
+systemctl restart postgresql-16
+
+
+
+# install nginx
+
+dnf install -y nginx
+
+# install nginx config files
+
+systemctl enable nginx
+systemctl start nginx
+
+# install defgauard core componenets
+
+wget "https://github.com/DefGuard/defguard/releases/download/v1.5.2/defguard-1.5.2-x86_64-unknown-linux-gnu.rpm" \
+		-O "defguard-unknown-linux-gnu.rpm"
+
+wget "https://github.com/DefGuard/proxy/releases/download/v1.5.1/defguard-proxy-1.5.1-x86_64-unknown-linux-gnu.rpm" \
+		-O "defguard-proxy-unknown-linux-gnu.rpm"
+
+dnf localinstall -y ./defguard-unknown-linux-gnu.rpm ./defguard-proxy-unknown-linux-gnu.rpm
+
+
+# install config files
+
+
+# enable and start services
+
+
diff --git a/defguard/install-defguard-gateway.sh b/defguard/install-defguard-gateway.sh
new file mode 100755
index 0000000..998cc85
--- /dev/null
+++ b/defguard/install-defguard-gateway.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+wget "https://github.com/DefGuard/gateway/releases/download/v1.5.1/defguard-gateway_1.5.1_x86_64-unknown-linux-gnu.rpm" \
+	-O "defguard-gatway-unknown-linux-gnu.rpm"
+
+dnf localinstall -y ./defguard-gatway-unknown-linux-gnu.rpm
diff --git a/defguard/nginx-defguard.conf b/defguard/nginx-defguard.conf
new file mode 100644
index 0000000..1c19a5f
--- /dev/null
+++ b/defguard/nginx-defguard.conf
@@ -0,0 +1,29 @@
+server {
+    listen 443 ssl http2;
+    server_name core.lab.ngtech.home;
+
+    ssl_certificate /etc/defguard/certs/core.crt;
+    ssl_certificate_key /etc/defguard/certs/core.key;
+    ssl_trusted_certificate /etc/defguard/certs/ca.crt;
+
+    location / {
+        proxy_pass http://localhost:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name enroll.lab.ngtech.home;
+
+    ssl_certificate /etc/defguard/certs/core.crt;  # Reuse for simplicity
+    ssl_certificate_key /etc/defguard/certs/core.key;
+    ssl_trusted_certificate /etc/defguard/certs/ca.crt;
+
+    location / {
+        proxy_pass http://localhost:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
diff --git a/defguard/pg_hba.conf b/defguard/pg_hba.conf
new file mode 100644
index 0000000..26a56f3
--- /dev/null
+++ b/defguard/pg_hba.conf
@@ -0,0 +1,126 @@
+# PostgreSQL Client Authentication Configuration File
+# ===================================================
+#
+# Refer to the "Client Authentication" section in the PostgreSQL
+# documentation for a complete description of this file.  A short
+# synopsis follows.
+#
+# ----------------------
+# Authentication Records
+# ----------------------
+#
+# This file controls: which hosts are allowed to connect, how clients
+# are authenticated, which PostgreSQL user names they can use, which
+# databases they can access.  Records take one of these forms:
+#
+# local         DATABASE  USER  METHOD  [OPTIONS]
+# host          DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostssl       DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostnossl     DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostgssenc    DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostnogssenc  DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+#
+# (The uppercase items must be replaced by actual values.)
+#
+# The first field is the connection type:
+# - "local" is a Unix-domain socket
+# - "host" is a TCP/IP socket (encrypted or not)
+# - "hostssl" is a TCP/IP socket that is SSL-encrypted
+# - "hostnossl" is a TCP/IP socket that is not SSL-encrypted
+# - "hostgssenc" is a TCP/IP socket that is GSSAPI-encrypted
+# - "hostnogssenc" is a TCP/IP socket that is not GSSAPI-encrypted
+#
+# DATABASE can be "all", "sameuser", "samerole", "replication", a
+# database name, a regular expression (if it starts with a slash (/))
+# or a comma-separated list thereof.  The "all" keyword does not match
+# "replication".  Access to replication must be enabled in a separate
+# record (see example below).
+#
+# USER can be "all", a user name, a group name prefixed with "+", a
+# regular expression (if it starts with a slash (/)) or a comma-separated
+# list thereof.  In both the DATABASE and USER fields you can also write
+# a file name prefixed with "@" to include names from a separate file.
+#
+# ADDRESS specifies the set of hosts the record matches.  It can be a
+# host name, or it is made up of an IP address and a CIDR mask that is
+# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
+# specifies the number of significant bits in the mask.  A host name
+# that starts with a dot (.) matches a suffix of the actual host name.
+# Alternatively, you can write an IP address and netmask in separate
+# columns to specify the set of hosts.  Instead of a CIDR-address, you
+# can write "samehost" to match any of the server's own IP addresses,
+# or "samenet" to match any address in any subnet that the server is
+# directly connected to.
+#
+# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
+# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
+# Note that "password" sends passwords in clear text; "md5" or
+# "scram-sha-256" are preferred since they send encrypted passwords.
+#
+# OPTIONS are a set of options for the authentication in the format
+# NAME=VALUE.  The available options depend on the different
+# authentication methods -- refer to the "Client Authentication"
+# section in the documentation for a list of which options are
+# available for which authentication methods.
+#
+# Database and user names containing spaces, commas, quotes and other
+# special characters must be quoted.  Quoting one of the keywords
+# "all", "sameuser", "samerole" or "replication" makes the name lose
+# its special character, and just match a database or username with
+# that name.
+#
+# ---------------
+# Include Records
+# ---------------
+#
+# This file allows the inclusion of external files or directories holding
+# more records, using the following keywords:
+#
+# include           FILE
+# include_if_exists FILE
+# include_dir       DIRECTORY
+#
+# FILE is the file name to include, and DIR is the directory name containing
+# the file(s) to include.  Any file in a directory will be loaded if suffixed
+# with ".conf".  The files of a directory are ordered by name.
+# include_if_exists ignores missing files.  FILE and DIRECTORY can be
+# specified as a relative or an absolute path, and can be double-quoted if
+# they contain spaces.
+#
+# -------------
+# Miscellaneous
+# -------------
+#
+# This file is read on server startup and when the server receives a
+# SIGHUP signal.  If you edit the file on a running system, you have to
+# SIGHUP the server for the changes to take effect, run "pg_ctl reload",
+# or execute "SELECT pg_reload_conf()".
+#
+# ----------------------------------
+# Put your actual configuration here
+# ----------------------------------
+#
+# If you want to allow non-local connections, you need to add more
+# "host" records.  In that case you will also need to make PostgreSQL
+# listen on a non-local interface via the listen_addresses
+# configuration parameter, or via the -i or -h command line switches.
+
+
+
+# TYPE  DATABASE        USER            ADDRESS                 METHOD
+
+# "local" is for Unix domain socket connections only
+local   all             all                                     peer
+# IPv4 local connections:
+host    all             all             127.0.0.1/32            scram-sha-256
+# IPv6 local connections:
+host    all             all             ::1/128                 scram-sha-256
+# Allow replication connections from localhost, by a user with the
+# replication privilege.
+local   replication     all                                     peer
+host    replication     all             127.0.0.1/32            scram-sha-256
+host    replication     all             ::1/128                 scram-sha-256
+
+
+local   defguard    defguard    md5
+host    defguard    defguard    127.0.0.1/32    md5
diff --git a/defguard/proxy.toml b/defguard/proxy.toml
new file mode 100644
index 0000000..b6dc4d3
--- /dev/null
+++ b/defguard/proxy.toml
@@ -0,0 +1,19 @@
+# This is an example config file for defguard proxy
+# To use it fill in actual values for your deployment below
+
+# port the API server will listen on
+http_port = 8080
+# port the gRPC server will listen on
+grpc_port = 50051
+
+# gRPC SSL configuration
+# provide certificate and key to connect to gRPC server with HTTPS
+# https://defguard.gitbook.io/defguard/features/setting-up-your-instance/docker-compose#grpc-ssl-setup
+# Optional: path to cert file
+# grpc_cert: proxy.crt
+# Optional: path to key file
+# grpc_key: proxy.key
+log_level = "info"
+rate_limit_per_second = 0
+rate_limit_burst = 0
+url = "http://localhost:8080"