diff --git a/core.tf b/core.tf
index ec1f25d..77b19d0 100644
--- a/core.tf
+++ b/core.tf
@@ -78,6 +78,14 @@ resource "nomad_job" "syslog-ng" {
   jobspec = file("${path.module}/syslogng.nomad")
 }
 
+resource "nomad_job" "ddclient" {
+  hcl2 {
+    enabled = true
+  }
+
+  jobspec = file("${path.module}/ddclient.nomad")
+}
+
 resource "consul_config_entry" "syslogng_promtail_intent" {
   name = "syslogng-promtail"
   kind = "service-intentions"
diff --git a/ddclient.nomad b/ddclient.nomad
new file mode 100644
index 0000000..13a6261
--- /dev/null
+++ b/ddclient.nomad
@@ -0,0 +1,51 @@
+job "ddclient" {
+  datacenters = ["dc1"]
+  type = "service"
+
+  group "ddclient" {
+
+    task "ddclient" {
+      driver = "docker"
+      config {
+        image = "linuxserver/ddclient:3.9.1"
+
+        mount {
+          type = "bind"
+          source = "local/ddclient.conf"
+          target = "/config/ddclient.conf"
+        }
+      }
+
+      vault {
+        policies = [
+          "access-tables",
+          "nomad-task",
+        ]
+      }
+
+      template {
+        data = <<EOH
+daemon=900
+ssl=yes
+use=web
+
+protocol=cloudflare,
+ttl=1,
+{{ with secret "kv/data/cloudflare" -}}
+password={{ .Data.data.api_token_dns_edit_all }}
+{{ end -}}
+zone={{ key "ddclient/zone" }}
+
+{{ key "ddclient/domain" }}
+        EOH
+        destination = "local/ddclient.conf"
+        change_mode = "restart"
+      }
+
+      resources {
+        cpu = 50
+        memory = 20
+      }
+    }
+  }
+}