diff --git a/hosts/common/configs/system/cloudflared/default.nix b/hosts/common/configs/system/cloudflared/default.nix
new file mode 100644
index 0000000..68f6320
--- /dev/null
+++ b/hosts/common/configs/system/cloudflared/default.nix
@@ -0,0 +1,5 @@
+{ ... }:
+{
+  # https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-local-tunnel/
+  services.cloudflared.enable = true;
+}
diff --git a/hosts/elara/default.nix b/hosts/elara/default.nix
index 08752eb..b504c8c 100644
--- a/hosts/elara/default.nix
+++ b/hosts/elara/default.nix
@@ -15,6 +15,7 @@
     ../common/configs/system/brightnessctl
     ../common/configs/system/btop
     ../common/configs/system/btrfs
+    ../common/configs/system/cloudflared
     ../common/configs/system/cpu
     ../common/configs/system/docker
     ../common/configs/system/fastfetch
@@ -46,6 +47,7 @@
     ../common/configs/system/users
     ../common/configs/system/wget
     ../common/configs/system/zsh
+    ./configs/system/globalprotect-remote-connect
     ./users/nikara
   ];
 
diff --git a/hosts/elara/users/nikara/default.nix b/hosts/elara/users/nikara/default.nix
index f16b482..5e09a61 100644
--- a/hosts/elara/users/nikara/default.nix
+++ b/hosts/elara/users/nikara/default.nix
@@ -61,7 +61,6 @@ in
     (import ../../../common/configs/user/gui/wev { inherit user home; })
     (import ../../../common/configs/user/gui/x11 { inherit user home; })
     (import ../../../common/configs/user/gui/xdg { inherit user home; })
-    (import ../../configs/user/console/globalprotect-remote-connect { inherit user home; })
   ];
 
   # echo "password" | mkpasswd -s
@@ -112,16 +111,14 @@ in
       "gpg/personal/pass".sopsFile = ../../../../secrets/personal/secrets.yaml;
 
       # SAS
-      "globalprotect/server".sopsFile = ../../../../secrets/sas/secrets.yaml;
-      "globalprotect/email".sopsFile = ../../../../secrets/sas/secrets.yaml;
-      "globalprotect/password".sopsFile = ../../../../secrets/sas/secrets.yaml;
-      "globalprotect/gateway".sopsFile = ../../../../secrets/sas/secrets.yaml;
-
       "ssh/sas/git/key" = {
         sopsFile = ../../../../secrets/sas/secrets.yaml;
         path = "${home}/.ssh/ssh_git_sas_ed25519_key";
       };
       "ssh/sas/git/pass".sopsFile = ../../../../secrets/sas/secrets.yaml;
+
+      "gpg/sas/key".sopsFile = ../../../../secrets/sas/secrets.yaml;
+      "gpg/sas/pass".sopsFile = ../../../../secrets/sas/secrets.yaml;
     };
 
     programs.ssh.matchBlocks = {