diff --git a/nixos/arion/arion-compose.nix b/nixos/arion/arion-compose.nix
index a8d3df4..eb0d352 100644
--- a/nixos/arion/arion-compose.nix
+++ b/nixos/arion/arion-compose.nix
@@ -44,7 +44,7 @@
     service.command = [ config.nixos.build.run-nginx ];
     service.useHostStore = true;
     service.ports = [
-      "8000:80" # host:container
+      "8009:80" # host:container
     ];
   };
 }
diff --git a/nixos/firewall.nix b/nixos/firewall.nix
index 845d4cb..a2aec50 100644
--- a/nixos/firewall.nix
+++ b/nixos/firewall.nix
@@ -1,3 +1,3 @@
 {pkgs, ...}: {
-  networking.firewall.allowedTCPPorts = [80 22 443];
+  networking.firewall.allowedTCPPorts = [80 22 443 8009];
 }
diff --git a/nixos/linux.nix b/nixos/linux.nix
index 8c2c3a9..fe8a5e9 100644
--- a/nixos/linux.nix
+++ b/nixos/linux.nix
@@ -43,6 +43,17 @@ in {
   age.secrets.nearlyfreespeech.file = ./secrets/nearlyfreespeech.age;
   age.secrets.nearlyfreespeech.owner = "root";
 
+  writeShellScriptBinInRepoRoot = name: script: pkgs.writeShellScriptBin name ''
+    cd `${pkgs.git}/bin/git rev-parse --show-toplevel`
+    ${script}
+  '';
+
+  start-arion-run = writeShellScriptBinInRepoRoot "start-arion-run" ''
+    cd arion/
+    ${pkgs.arion}/bin/arion down
+    ${pkgs.arion}/bin/arion up
+  '';
+
   environment.systemPackages = [
     ddnsPkg
     pullomaticPkg
@@ -56,6 +67,7 @@ in {
 
     # For docker-compose like setups
     pkgs.arion
+    start-arion-run
   ];
 
   swapDevices = [