diff --git a/machine/empyrean/default.nix b/machine/empyrean/default.nix
index 8f0da52..1369a23 100644
--- a/machine/empyrean/default.nix
+++ b/machine/empyrean/default.nix
@@ -136,6 +136,16 @@
           ssl_client_certificate /etc/nginx/client-ca.crt;
         '';
       };
+      "icecast.secure.ktvb.site" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/".proxyPass = "http://10.22.20.1:8688";
+        extraConfig = ''
+          # enable mTLS
+          ssl_verify_client on;
+          ssl_client_certificate /etc/nginx/client-ca.crt;
+        '';
+      };
       # mirror revproxy
       "mirror.alogoulogoi.com" = {
         enableACME = true;