diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index c78ec4a..8c31786 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -114,6 +114,12 @@
             };
           };
 
+          enableOmada = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = "TP-Link Omada SDN controller (podman container)";
+          };
+
           vlans = lib.mkOption {
             type = lib.types.attrsOf (lib.types.submodule vlanModule);
             description = "VLANs setup for this router";
diff --git a/modules/clan/gw-router/omada.nix b/modules/clan/gw-router/omada.nix
new file mode 100644
index 0000000..673fa33
--- /dev/null
+++ b/modules/clan/gw-router/omada.nix
@@ -0,0 +1,43 @@
+{
+  roles.default.perInstance = { settings, ... }: {
+    nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      let
+        dir = config.clan.core.settings.directory;
+        instance = "zerotier";
+
+        networkId = builtins.readFile "${dir}/vars/shared/zerotier-network-${instance}/network-id/value";
+        full = "fd" + networkId + "9993";
+        hextet = i: builtins.substring (i * 4) 4 full;
+        subnetZtier = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
+      in
+      {
+        config = lib.mkIf (settings.enableOmada) {
+          virtualisation.podman.enable = true;
+          virtualisation.oci-containers = {
+            backend = "podman";
+            containers.omada = {
+              image = "docker.io/mbentley/omada-controller:5.15";
+              extraOptions = [ "--network=host" ];
+              environment.TZ = config.time.timeZone;
+              volumes = [
+                "/var/lib/omada/data:/opt/tplink/EAPController/data"
+                "/var/lib/omada/logs:/opt/tplink/EAPController/logs"
+              ];
+            };
+          };
+
+          networking.firewall.extraInputRules = ''
+            ip6 saddr ${subnetZtier} tcp dport 8043 accept comment "omada ui over the mesh"
+          '';
+
+          clan.core.state.omada.folders = [ "/var/lib/omada" ];
+
+        };
+      };
+  };
+}