diff --git a/terraform/gandi.nix b/terraform/gandi.nix
index 82f7ffd..c089943 100644
--- a/terraform/gandi.nix
+++ b/terraform/gandi.nix
@@ -29,6 +29,18 @@ in
         inherit name ttl type values;
       };
 
+      proxyRecords = name: ttl: type: values: [
+        # kurisu.lahfa.xyz running a sniproxy:
+        (record name ttl "A" ["163.172.69.160"])
+        (record name ttl type values)
+      ];
+
+      # Creates a extra *.p record pointing to the sniproxy
+      dualProxyRecords = name: ttl: type: values: lib.flatten [
+        (record name ttl type values)
+        (proxyRecords "${name}.p" ttl type values)
+      ];
+
       # TODO: make less fragile and have actual unique and stable names
       canonicalName = record: let
         name = builtins.replaceStrings ["." "@"] ["_" "_root_"] record.name;
@@ -41,32 +53,29 @@ in
           value = record // {
             zone = tf.ref "resource.gandi_livedns_domain.forkos_org.id";
           };
-        }) records);
+        }) (lib.flatten records));
 
     in forkosRecords ([
       # (record "@" 3600 "A" ["163.172.69.160"])
       (record "@" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
 
-      (record "cl" 3600 "A" ["163.172.69.160"])
-      (record "cl" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
+      (proxyRecords "cl" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
 
-      (record "fodwatch" 3600 "A" ["163.172.69.160"])
-      (record "fodwatch" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
+      (proxyRecords "fodwatch" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
 
-      (record "netbox" 3600 "A" ["163.172.69.160"])
-      (record "netbox" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
+      (proxyRecords "netbox" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
 
-      (record "bagel-box.infra" 3600 "AAAA" ["2001:bc8:38ee:100:100::1"])
-      (record "gerrit01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
-      (record "fodwatch.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
-      (record "meta01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
+      (dualProxyRecords "bagel-box.infra" 3600 "AAAA" ["2001:bc8:38ee:100:100::1"])
+      (dualProxyRecords "gerrit01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
+      (dualProxyRecords "fodwatch.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
+      (dualProxyRecords "meta01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
 
-      (record "amqp" 3600 "CNAME" ["bagel-box.infra"])
-      (record "grafana" 3600 "CNAME" ["meta01.infra"])
-      (record "hydra" 3600 "CNAME" ["bagel-box.infra"])
-      (record "loki" 3600 "CNAME" ["meta01.infra"])
-      (record "mimir" 3600 "CNAME" ["meta01.infra"])
-      (record "matrix" 3600 "CNAME" ["meta01.infra"])
+      (record "amqp" 3600 "CNAME" ["bagel-box.infra.p"])
+      (record "grafana" 3600 "CNAME" ["meta01.infra.p"])
+      (record "hydra" 3600 "CNAME" ["bagel-box.infra.p"])
+      (record "loki" 3600 "CNAME" ["meta01.infra.p"])
+      (record "mimir" 3600 "CNAME" ["meta01.infra.p"])
+      (record "matrix" 3600 "CNAME" ["meta01.infra.p"])
 
       (record "vpn-gw.wob01.infra" 3600 "AAAA" [ "2a01:584:11::2" ])
       # TODO: do not hardcode, just reuse the Colmena hive module outputs to generate all the required details.