diff --git a/hosts/server/natsu/default.nix b/hosts/server/natsu/default.nix
index dd6dd4b..90ba444 100644
--- a/hosts/server/natsu/default.nix
+++ b/hosts/server/natsu/default.nix
@@ -12,7 +12,7 @@ nixpkgs.lib.nixosSystem {
     # ./services/attic.nix
     ./services/caddy.nix
     ./services/forgejo-runner.nix
-    ./services/rtmps.nix
+    ./services/stream.nix
     # ./services/harmonia.nix
     ./configuration.nix
     ./hardware-configuration.nix
diff --git a/hosts/server/natsu/services/caddy.nix b/hosts/server/natsu/services/caddy.nix
index 39a46f0..45bccff 100644
--- a/hosts/server/natsu/services/caddy.nix
+++ b/hosts/server/natsu/services/caddy.nix
@@ -1,5 +1,8 @@
 { pkgs, ... }:
 
+let
+  streamPlayer = pkgs.writeTextDir "index.html" (builtins.readFile ./stream.html);
+in
 {
   services.caddy = {
     enable = true;
@@ -92,8 +95,23 @@
       reverse_proxy 127.0.0.1:4321
     '';
 
-    virtualHosts."rtmps.mizuki.guru".extraConfig = ''
-      respond 204
+    virtualHosts."stream.mizuki.guru".extraConfig = ''
+      handle_path /hls/* {
+        root * /var/lib/nginx-rtmp/hls
+        header Cache-Control "no-store"
+        file_server
+      }
+
+      handle /live/* {
+        root * ${streamPlayer}
+        rewrite * /index.html
+        file_server
+      }
+
+      handle {
+        root * ${streamPlayer}
+        file_server
+      }
     '';
 
     virtualHosts."netbird.mizuki.guru".extraConfig = ''
diff --git a/hosts/server/natsu/services/stream.html b/hosts/server/natsu/services/stream.html
new file mode 100644
index 0000000..b57a55b
--- /dev/null
+++ b/hosts/server/natsu/services/stream.html
@@ -0,0 +1,85 @@
+<!doctype html>
+<html lang="ko">
+    <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>stream.mizuki.guru</title>
+        <style>
+            :root {
+                color-scheme: dark;
+            }
+            body {
+                margin: 0;
+                min-height: 100vh;
+                display: grid;
+                place-items: center;
+                background: #0f0f14;
+                color: #f4f4f5;
+                font-family: system-ui, sans-serif;
+            }
+            main {
+                width: min(100vw - 2rem, 960px);
+            }
+            video {
+                width: 100%;
+                aspect-ratio: 16 / 9;
+                background: #000;
+                border-radius: 12px;
+            }
+            p {
+                color: #a1a1aa;
+            }
+            code {
+                color: #f9a8d4;
+            }
+        </style>
+    </head>
+    <body>
+        <main>
+            <video id="player" controls autoplay playsinline></video>
+            <p id="publish"></p>
+        </main>
+
+        <script src="https://cdn.jsdelivr.net/npm/hls.js@1"></script>
+        <script>
+            const video = document.getElementById("player");
+            const publish = document.getElementById("publish");
+
+            const streamName =
+                decodeURIComponent(
+                    location.pathname
+                        .replace(/^\/live\/?/, "")
+                        .replace(/^\/+|\/+$/g, ""),
+                ) || "stream";
+            const source = `/hls/${encodeURIComponent(streamName)}.m3u8`;
+
+            document.title = `${streamName} - stream.mizuki.guru`;
+            publish.innerHTML = `Publish: <code>rtmps://stream.mizuki.guru/live/${escapeHtml(streamName)}</code>`;
+
+            if (video.canPlayType("application/vnd.apple.mpegurl")) {
+                video.src = source;
+            } else if (Hls.isSupported()) {
+                const hls = new Hls({ liveDurationInfinity: true });
+                hls.loadSource(source);
+                hls.attachMedia(video);
+            } else {
+                video.outerHTML =
+                    "<p>이</p> 브라우저는 HLS 재생을 지원하지 않습니다.</p>";
+            }
+
+            function escapeHtml(value) {
+                return value.replace(
+                    /[&<>"']/g,
+                    (ch) =>
+                        ({
+                            "&": "&amp;",
+                            "<": "&lt;",
+                            ">": "&gt;",
+                            '"': "&quot;",
+                            "'": "&#39;",
+                        })[ch],
+                );
+            }
+        </script>
+    </body>
+</html>
diff --git a/hosts/server/natsu/services/rtmps.nix b/hosts/server/natsu/services/stream.nix
similarity index 70%
rename from hosts/server/natsu/services/rtmps.nix
rename to hosts/server/natsu/services/stream.nix
index 6e1e5da..7e8dc6f 100644
--- a/hosts/server/natsu/services/rtmps.nix
+++ b/hosts/server/natsu/services/stream.nix
@@ -1,7 +1,8 @@
 { pkgs, ... }:
 
 let
-  domain = "rtmps.mizuki.guru";
+  domain = "stream.mizuki.guru";
+  hlsDir = "/var/lib/nginx-rtmp/hls";
   caddyCertDir = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${domain}";
 in
 {
@@ -20,14 +21,25 @@ in
           application live {
             live on;
             record off;
+
+            hls on;
+            hls_path ${hlsDir};
+            hls_fragment 2s;
+            hls_playlist_length 10s;
+            hls_cleanup on;
           }
         }
       }
     '';
   };
 
-  systemd.services.rtmps-stunnel = {
-    description = "RTMPS TLS terminator for nginx-rtmp";
+  systemd.tmpfiles.rules = [
+    "d /var/lib/nginx-rtmp 0755 nginx nginx - -"
+    "d ${hlsDir} 0755 nginx nginx - -"
+  ];
+
+  systemd.services.stream-stunnel = {
+    description = "RTMPS TLS terminator for stream.mizuki.guru";
     after = [
       "network-online.target"
       "caddy.service"
@@ -41,11 +53,11 @@ in
       Type = "simple";
       User = "caddy";
       Group = "caddy";
-      ExecStart = "${pkgs.stunnel}/bin/stunnel ${pkgs.writeText "rtmps-stunnel.conf" ''
+      ExecStart = "${pkgs.stunnel}/bin/stunnel ${pkgs.writeText "stream-stunnel.conf" ''
         foreground = yes
         pid =
 
-        [rtmps]
+        [stream]
         accept = 0.0.0.0:1935
         connect = 127.0.0.1:19350
         cert = ${caddyCertDir}/${domain}.crt
