18 files changed, 288 insertions, 374 deletions

diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
index a6be04876..936aaf004 100644
--- a/makefu/2configs/bepasty-dual.nix
+++ b/makefu/2configs/bepasty-dual.nix
@@ -20,54 +20,29 @@ let
   ext-dom = "paste.krebsco.de" ;
 in {
 
-  krebs.nginx.enable = mkDefault true;
+  services.nginx.enable = mkDefault true;
   krebs.bepasty = {
     enable = true;
     serveNginx= true;
 
     servers = {
-      internal = {
+      "paste.r" = {
         nginx = {
-          server-names = [ "paste.retiolum" "paste.r" "paste.${config.krebs.build.host.name}" ];
+          serverAliases = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
         };
         defaultPermissions = "admin,list,create,read,delete";
         secretKey = secKey;
       };
 
-      external = {
+      "${ext-dom}" = {
         nginx = {
-          server-names = [ ext-dom ];
-          ssl = {
-            enable = true;
-            certificate = "${acmepath}/${ext-dom}/fullchain.pem";
-            certificate_key = "${acmepath}/${ext-dom}/key.pem";
-            # these certs will be needed if acme has not yet created certificates:
-            #certificate =   "${sec}/wildcard.krebsco.de.crt";
-            #certificate_key = "${sec}/wildcard.krebsco.de.key";
-            ciphers = "RC4:HIGH:!aNULL:!MD5" ;
-            force_encryption = true;
-          };
-          locations = singleton ( nameValuePair  "/.well-known/acme-challenge" ''
-            root ${acmechall}/${ext-dom}/;
-          '');
-          extraConfig = ''
-          ssl_session_cache    shared:SSL:1m;
-          ssl_session_timeout  10m;
-          ssl_verify_client off;
-          proxy_ssl_session_reuse off;
-          '';
+          enableSSL = true;
+          forceSSL = true;
+          enableACME = true;
         };
         defaultPermissions = "read";
         secretKey = secKey;
       };
     };
   };
-  security.acme.certs."${ext-dom}" = {
-    email = "acme@syntax-fehler.de";
-    webroot = "${acmechall}/${ext-dom}/";
-    group = "nginx";
-    allowKeysForGroup = true;
-    postRun = "systemctl reload nginx.service";
-    extraDomains."${ext-dom}" = null ;
-  };
 }
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 9a2adbc3e..9e3f3eb61 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -22,7 +22,7 @@ with import <stockholm/lib>;
       user = config.krebs.users.makefu;
       source = let
           inherit (config.krebs.build) host user;
-          ref = "f52eaf4"; # stable @ 2016-12-12
+          ref = "ee13b9af"; # stable @ 2016-12-12
       in {
         nixpkgs = if config.makefu.full-populate || (getEnv "dummy_secrets" == "true") then
           {
diff --git a/makefu/2configs/deployment/mycube.connector.one.nix b/makefu/2configs/deployment/mycube.connector.one.nix
index 091b7f21b..379176f78 100644
--- a/makefu/2configs/deployment/mycube.connector.one.nix
+++ b/makefu/2configs/deployment/mycube.connector.one.nix
@@ -27,23 +27,18 @@ in {
     };
   };
 
-  krebs.nginx = {
+  services.nginx = {
     enable = mkDefault true;
-    servers = {
-      mybox-connector-one = {
-        listen = [ "${external-ip}:80" ];
-        server-names = [
-          "mycube.connector.one"
-          "mybox.connector.one"
-        ];
-        locations = singleton (nameValuePair "/" ''
+    virtualHosts."mybox.connector.one" = {
+        locations = {
+          "/".extraConfig = ''
           uwsgi_pass unix://${wsgi-sock};
           uwsgi_param         UWSGI_CHDIR     ${pkgs.mycube-flask}/${pkgs.python.sitePackages};
           uwsgi_param         UWSGI_MODULE    mycube.websrv;
           uwsgi_param         UWSGI_CALLABLE  app;
 
           include ${pkgs.nginx}/conf/uwsgi_params;
-        '');
+        '';
       };
     };
   };
diff --git a/makefu/2configs/disable_v6.nix b/makefu/2configs/disable_v6.nix
index 37db172ef..0a8c8d53d 100644
--- a/makefu/2configs/disable_v6.nix
+++ b/makefu/2configs/disable_v6.nix
@@ -1,4 +1,3 @@
 {
   networking.enableIPv6 = false;
-  boot.kernelParams = [ "ipv6.disable=1" ];
 }
diff --git a/makefu/2configs/elchos/irc-token.nix b/makefu/2configs/elchos/irc-token.nix
new file mode 100644
index 000000000..3f3c4ffc3
--- /dev/null
+++ b/makefu/2configs/elchos/irc-token.nix
@@ -0,0 +1,62 @@
+{pkgs, ...}:
+with import <stockholm/lib>;
+let
+  secret = (import <secrets/elchos-token.nix>);
+in {
+  systemd.services.elchos-irctoken = {
+    startAt = "*:0/30";
+    serviceConfig = {
+      RuntimeMaxSec = "20";
+    };
+    script = ''
+      set -euf
+      now=$(date -u +%Y-%m-%dT%H:%M)
+      sec=$(echo -n "${secret}$now" | md5sum | cut -d\  -f1)
+      message="The secret valid for 30 minutes is $sec"
+      echo "token for $now (UTC) is $sec"
+      LOGNAME=sec-announcer
+      HOSTNAME=$(${pkgs.systemd}/bin/hostnamectl --static)
+      IRC_SERVER=irc.freenode.net
+      IRC_PORT=6667
+      IRC_NICK=$HOSTNAME-$$
+      IRC_CHANNEL='#eloop'
+
+      export IRC_CHANNEL # for privmsg_cat
+
+      echo2() { echo "$*"; echo "$*" >&2; }
+
+      privmsg_cat() { ${pkgs.gawk}/bin/awk '{ print "PRIVMSG "ENVIRON["IRC_CHANNEL"]" :"$0 }'; }
+
+      tmpdir="$(mktemp -d irc-announce_XXXXXXXX)"
+      cd "$tmpdir"
+      mkfifo ircin
+      trap "
+        rm ircin
+        cd '$OLDPWD'
+        rmdir '$tmpdir'
+        trap - EXIT INT QUIT
+      " EXIT INT QUIT
+
+      {
+        echo2 "USER $LOGNAME 0 * :$LOGNAME@$HOSTNAME"
+        echo2 "NICK $IRC_NICK"
+
+        # wait for MODE message
+        ${pkgs.gnused}/bin/sed -un '/^:[^ ]* MODE /q'
+
+        echo2 "JOIN $IRC_CHANNEL"
+
+        printf '%s' "$message" \
+          | privmsg_cat
+
+        echo2 "PART $IRC_CHANNEL"
+
+        # wait for PART confirmation
+        sed -un '/:'"$IRC_NICK"'![^ ]* PART /q'
+
+        echo2 'QUIT :Gone to have lunch'
+      } < ircin \
+        | ${pkgs.netcat}/bin/netcat "$IRC_SERVER" "$IRC_PORT" |tee -a ircin
+    '';
+  };
+}
diff --git a/makefu/2configs/elchos/log.nix b/makefu/2configs/elchos/log.nix
new file mode 100644
index 000000000..3facd1ceb
--- /dev/null
+++ b/makefu/2configs/elchos/log.nix
@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+let
+in {
+  networking.firewall.allowedTCPPorts = [ 80 443 514 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 514 ];
+	services.logstash = {
+			enable = true;
+			enableWeb = true;
+      inputConfig = ''
+				syslog {
+          timezone => "Etc/UTC"
+        }
+      '';
+      filterConfig = ''
+        if ( [program] == "proftpd") {
+          kv {
+            field_split => "	"
+          }
+        }
+      '';
+      outputConfig = ''
+        stdout {
+          codec => rubydebug
+        }
+        elasticsearch { }
+        '';
+	};
+	services.elasticsearch = {
+			enable = true;
+	};
+	services.kibana = {
+			enable = true;
+      port = 9332;
+	};
+  services.nginx = {
+    virtualHosts = {
+      "log.nsupdate.info" = {
+        enableACME = true;
+        forceSSL = true;
+        basicAuth = import <secrets/kibana-auth.nix>;
+        locations = {
+          "/" = {
+            proxyPass = "http://localhost:9332";
+            extraConfig = ''
+              proxy_set_header   Host             $host;
+              proxy_set_header   X-Real-IP        $remote_addr;
+              proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
+            '';
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/makefu/2configs/elchos/search.nix b/makefu/2configs/elchos/search.nix
index 5adaa0c6f..5777be373 100644
--- a/makefu/2configs/elchos/search.nix
+++ b/makefu/2configs/elchos/search.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-# graphite-web on port 8080
-# carbon cache on port 2003 (tcp/udp)
+# search also generates ddclient entries for all other logs
+
 with import <stockholm/lib>;
 let
   #primary-itf = "eth0";
-  primary-itf = "wlp2s0";
+  #primary-itf = "wlp2s0";
+  primary-itf = config.makefu.server.primary-itf;
   elch-sock = "${config.services.uwsgi.runDir}/uwsgi-elch.sock";
   ddclientUser = "ddclient";
   sec = toString <secrets>;
@@ -14,15 +15,7 @@ let
   cfg = "${stateDir}/cfg";
   ddclientPIDFile = "${stateDir}/ddclient.pid";
 
-  acmepath = "/var/lib/acme/";
-  acmechall = acmepath + "/challenges/";
   # TODO: correct cert generation requires a `real` internet ip address
-  stats-dom = "stats.nsupdate.info";
-  search-dom = "search.nsupdate.info";
-  search_ssl_cert = "${acmepath}/${search-dom}/fullchain.pem";
-  search_ssl_key = "${acmepath}/${search-dom}/key.pem";
-  stats_ssl_cert = "${acmepath}/${stats-dom}/fullchain.pem";
-  stats_ssl_key = "${acmepath}/${stats-dom}/key.pem";
 
   gen-cfg = dict: ''
     ssl=yes
@@ -64,75 +57,22 @@ in {
     };
   };
 
-  security.acme.certs = {
-    "${stats-dom}" = {
-      email = "acme@syntax-fehler.de";
-      webroot = "${acmechall}/${stats-dom}/";
-      group = "nginx";
-      allowKeysForGroup = true;
-      postRun = "systemctl reload nginx.service";
-      extraDomains = {
-        "${stats-dom}" = null ;
-      };
-    };
-    "${search-dom}" = {
-      email = "acme@syntax-fehler.de";
-      webroot = "${acmechall}/${search-dom}/";
-      group = "nginx";
-      allowKeysForGroup = true;
-      postRun = "systemctl reload nginx.service";
-      extraDomains = {
-        "${stats-dom}" = null ;
-      };
-    };
-  };
-
-  krebs.nginx = {
+  services.nginx = {
     enable = mkDefault true;
-    servers = {
-      elch-stats = {
-        server-names = [ stats-dom ];
-        # listen = [ "80" "443 ssl" ];
-        ssl = {
-            enable = true;
-            certificate =   stats_ssl_cert;
-            certificate_key = stats_ssl_key;
-            force_encryption = true;
+    virtualHosts = {
+      "search.nsupdate.info" = {
+        enableACME = true;
+        forceSSL = true;
+        locations = {
+          "/".extraConfig = ''
+            uwsgi_pass unix://${elch-sock};
+            uwsgi_param         UWSGI_CHDIR     ${pkgs.elchhub}/${pkgs.python3.sitePackages};
+            uwsgi_param         UWSGI_MODULE    elchhub.wsgi;
+            uwsgi_param         UWSGI_CALLABLE  app;
+
+            include ${pkgs.nginx}/conf/uwsgi_params;
+          '';
         };
-
-        locations = [
-            (nameValuePair "/" ''
-              proxy_set_header   Host $host;
-              proxy_set_header   X-Real-IP          $remote_addr;
-              proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-              proxy_pass http://localhost:3000/;
-            '')
-            (nameValuePair  "/.well-known/acme-challenge" ''
-             root ${acmechall}/${search-dom}/;
-            '')
-        ];
-      };
-      elchhub = {
-        server-names = [ "search.nsupdate.info" ];
-        # listen = [ "80" "443 ssl" ];
-        ssl = {
-            enable = true;
-            certificate =   search_ssl_cert;
-            certificate_key = search_ssl_key;
-            force_encryption = true;
-        };
-        locations = [ (nameValuePair "/" ''
-          uwsgi_pass unix://${elch-sock};
-          uwsgi_param         UWSGI_CHDIR     ${pkgs.elchhub}/${pkgs.python3.sitePackages};
-          uwsgi_param         UWSGI_MODULE    elchhub.wsgi;
-          uwsgi_param         UWSGI_CALLABLE  app;
-
-          include ${pkgs.nginx}/conf/uwsgi_params;
-        '')
-        (nameValuePair  "/.well-known/acme-challenge" ''
-          root ${acmechall}/${search-dom}/;
-        '')
-        ];
       };
     };
   };
@@ -147,7 +87,7 @@ in {
         ExecStart = "${pkgs.elchhub}/bin/elch-manager";
       };
     };
-    register-elchos-nsupdate = {
+    ddclient-nsupdate-elchos = {
       wantedBy = [ "multi-user.target" ];
       after = [ "ip-up.target" ];
       serviceConfig = {
@@ -163,49 +103,8 @@ in {
     };
   };
 
-  services.grafana = {
-    enable = true;
-    addr = "127.0.0.1";
-    users.allowSignUp = false;
-    users.allowOrgCreate = false;
-    users.autoAssignOrg = false;
-    auth.anonymous.enable = true;
-    security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""}
-  };
-
-  services.graphite = {
-    api = {
-      enable = true;
-      listenAddress = "127.0.0.1";
-      port = 8080;
-    };
-    carbon = {
-      enableCache = true;
-      # save disk usage by restricting to 1 bulk update per second
-      config = ''
-        [cache]
-        MAX_CACHE_SIZE = inf
-        MAX_UPDATES_PER_SECOND = 1
-        MAX_CREATES_PER_MINUTE = 500
-        '';
-      storageSchemas = ''
-        [carbon]
-        pattern = ^carbon\.
-        retentions = 60:90d
-
-        [elchos]
-        patterhn = ^elchos\.
-        retentions = 10s:30d,60s:3y
-
-        [default]
-        pattern = .*
-        retentions = 30s:30d,300s:1y
-        '';
-    };
-  };
-
   networking.firewall = {
-    allowedTCPPorts = [ 2003 80 443 ];
-    allowedUDPPorts = [ 2003 ];
+    allowedTCPPorts = [ 80 443 ];
+    allowedUDPPorts = [ ];
   };
 }
diff --git a/makefu/2configs/elchos/stats.nix b/makefu/2configs/elchos/stats.nix
index 9f27b6647..b6133205f 100644
--- a/makefu/2configs/elchos/stats.nix
+++ b/makefu/2configs/elchos/stats.nix
@@ -1,73 +1,48 @@
 { config, lib, pkgs, ... }:
 
+# requires nsupdate to get correct hostname (from ./search.nix)
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
+
 with import <stockholm/lib>;
-let
-  sec = toString <secrets>;
-  acmepath = "/var/lib/acme/";
-  acmechall = acmepath + "/challenges/";
-  ext-dom = "stats.nsupdate.info";
-  #ssl_cert = "${sec}/wildcard.krebsco.de.crt";
-  #ssl_key  = "${sec}/wildcard.krebsco.de.key";
-  ssl_cert = "${acmepath}/${ext-dom}/fullchain.pem";
-  ssl_key = "${acmepath}/${ext-dom}/key.pem";
-in {
-  networking.firewall = {
-    allowedTCPPorts = [ 2003 80 443 ];
-    allowedUDPPorts = [ 2003 ];
+{
+
+  services.nginx = {
+    enable = mkDefault true;
+    virtualHosts = {
+      "stats.nsupdate.info" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations = {
+          "/"  = {
+            proxyPass  = "http://localhost:3000/";
+            extraConfig = ''
+              proxy_set_header   Host             $host;
+              proxy_set_header   X-Real-IP        $remote_addr;
+              proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
+            '';
+          };
+        };
+      };
+    };
   };
 
   services.grafana = {
     enable = true;
     addr = "127.0.0.1";
-    extraOptions = { "AUTH_ANONYMOUS_ENABLED" = "true"; };
     users.allowSignUp = false;
     users.allowOrgCreate = false;
     users.autoAssignOrg = false;
+    auth.anonymous.enable = true;
     security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""}
   };
-  krebs.nginx = {
-    enable = true;
-    servers.elch-stats = {
-      server-names = [ ext-dom ];
-      listen = [ "80" "443 ssl" ];
-      ssl = {
-          enable = true;
-          # these certs will be needed if acme has not yet created certificates:
-          certificate =   ssl_cert;
-          certificate_key = ssl_key;
-          force_encryption = true;
-      };
-
-      locations = [
-          (nameValuePair "/" ''
-            proxy_set_header   Host $host;
-            proxy_set_header   X-Real-IP          $remote_addr;
-            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass http://localhost:3000/;
-          '')
-          (nameValuePair  "/.well-known/acme-challenge" ''
-            root ${acmechall}/${ext-dom}/;
-          '')
-      ];
-    };
-  };
-
-  security.acme.certs."${ext-dom}" = {
-    email = "acme@syntax-fehler.de";
-    webroot = "${acmechall}/${ext-dom}/";
-    group = "nginx";
-    allowKeysForGroup = true;
-    postRun = "systemctl reload nginx.service";
-    extraDomains."${ext-dom}" = null ;
-  };
 
   services.graphite = {
-    web = {
+    api = {
       enable = true;
-      host = "127.0.0.1";
-      port = 8080;
+      listenAddress = "127.0.0.1";
+      port = 18080;
     };
     carbon = {
       enableCache = true;
@@ -85,7 +60,7 @@ in {
 
         [elchos]
         patterhn = ^elchos\.
-        retention = 10s:30d,60s:1y
+        retentions = 10s:30d,60s:3y
 
         [default]
         pattern = .*
@@ -93,4 +68,9 @@ in {
         '';
     };
   };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 2003 80 443 ];
+    allowedUDPPorts = [ 2003 ];
+  };
 }
diff --git a/makefu/2configs/elchos/test/ftpservers.nix b/makefu/2configs/elchos/test/ftpservers.nix
new file mode 100644
index 000000000..bc7517209
--- /dev/null
+++ b/makefu/2configs/elchos/test/ftpservers.nix
@@ -0,0 +1,7 @@
+{...}:
+{
+  services.vsftpd.anonymousUser = true;
+  services.vsftpd.enable = true;
+  services.vsftpd.chrootlocalUser = true;
+  networking.firewall.allowedTCPPorts = [ 21 ];
+}
diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix
index ef8a3b88f..e1c3d20ff 100644
--- a/makefu/2configs/main-laptop.nix
+++ b/makefu/2configs/main-laptop.nix
@@ -71,5 +71,15 @@ in {
     latitude = "48.7";
     longitude = "9.1";
   };
-
+  systemd.services.look-up = {
+    startAt = "*:30";
+    serviceConfig = {
+      ExecStart= pkgs.writeDash "look-up" ''
+        set -x
+        eval "export '$(egrep -z DBUS_SESSION_BUS_ADDRESS /proc/$(${pkgs.procps}/bin/pgrep -u ${user} ${window-manager})/environ)'"
+        ${pkgs.libnotify}/bin/notify-send -u critical -t 9999999 'look up once in a while'
+      '';
+      User = user;
+    };
+  };
 }
diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix
index b2a965de6..3fb629394 100644
--- a/makefu/2configs/nginx/euer.blog.nix
+++ b/makefu/2configs/nginx/euer.blog.nix
@@ -3,13 +3,9 @@
 with import <stockholm/lib>;
 let
   sec = toString <secrets>;
-  ssl_cert = "${sec}/wildcard.krebsco.de.crt";
-  ssl_key  = "${sec}/wildcard.krebsco.de.key";
   hostname = config.krebs.build.host.name;
   user = config.services.nginx.user;
   group = config.services.nginx.group;
-  external-ip = config.krebs.build.host.nets.internet.ip4.addr;
-  internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
   base-dir = "/var/www/blog.euer";
 in {
   # Prepare Blog directory
@@ -32,24 +28,15 @@ in {
     };
   };
 
-  krebs.nginx = {
+  services.nginx = {
     enable = mkDefault true;
-    servers = {
-      euer-blog = {
-        listen = [ "${external-ip}:80" "${external-ip}:443 ssl"
-                   "${internal-ip}:80" "${internal-ip}:443 ssl" ];
-        server-names = [ "euer.krebsco.de" "blog.euer.krebsco.de" "blog.${hostname}" ];
-        extraConfig = ''
-          gzip on;
-          gzip_buffers 4 32k;
-          gzip_types  text/plain application/x-javascript text/css;
-          ssl_certificate ${ssl_cert};
-          ssl_certificate_key ${ssl_key};
-          default_type text/plain;
-        '';
-        locations = singleton (nameValuePair "/" ''
-          root ${base-dir};
-        '');
+    virtualHosts = {
+      "euer.krebsco.de" = {
+        #serverAliases = [ "blog.euer.krebsco.de" "blog.${hostname}" ];
+        enableSSL = true;
+        enableACME = true;
+        forceSSL = true;
+        root = base-dir;
       };
     };
   };
diff --git a/makefu/2configs/nginx/euer.test.nix b/makefu/2configs/nginx/euer.test.nix
index bff652daf..40c376130 100644
--- a/makefu/2configs/nginx/euer.test.nix
+++ b/makefu/2configs/nginx/euer.test.nix
@@ -8,18 +8,16 @@ let
   external-ip = config.krebs.build.host.nets.internet.ip4.addr;
   internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
 in {
-  krebs.nginx = {
+  services.nginx = {
     enable = mkDefault true;
-    servers = {
-      euer-share = {
-        listen = [ ];
-        server-names = [ "share.euer.krebsco.de" ];
-        locations = singleton (nameValuePair "/" ''
+    virtualHosts."share.euer.krebsco.de" = {
+      locations."/" =  {
+        proxyPass = "http://localhost:8000/";
+        extraConfig = ''
           proxy_set_header   Host $host;
           proxy_set_header   X-Real-IP          $remote_addr;
           proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_pass http://localhost:8000/;
-        '');
+        '';
       };
     };
   };
diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix
index 9d0b74871..fefdd6dc7 100644
--- a/makefu/2configs/nginx/euer.wiki.nix
+++ b/makefu/2configs/nginx/euer.wiki.nix
@@ -4,13 +4,6 @@ with import <stockholm/lib>;
 let
   sec = toString <secrets>;
   ext-dom = "wiki.euer.krebsco.de";
-  acmepath = "/var/lib/acme/";
-  acmechall = acmepath + "/challenges/";
-
-  #ssl_cert = "${sec}/wildcard.krebsco.de.crt";
-  #ssl_key  = "${sec}/wildcard.krebsco.de.key";
-  ssl_cert = "${acmepath}/${ext-dom}/fullchain.pem";
-  ssl_key = "${acmepath}/${ext-dom}/key.pem";
 
   user = config.services.nginx.user;
   group = config.services.nginx.group;
@@ -25,8 +18,7 @@ let
   #  user1 = pass1
   #  userN = passN
   tw-pass-file = "${sec}/tw-pass.ini";
-  external-ip = config.krebs.build.host.nets.internet.ip4.addr;
-  internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
+
 in {
   services.phpfpm = {
     # phpfpm does not have an enable option
@@ -79,24 +71,18 @@ in {
     };
   };
 
-  krebs.nginx = {
+  services.nginx = {
     enable = mkDefault true;
-    servers = {
-      euer-wiki = {
-        listen = [ "${external-ip}:80" "${external-ip}:443 ssl"
-                   "${internal-ip}:80" "${internal-ip}:443 ssl" ];
-        server-names = [
-          ext-dom
-          "wiki.makefu.retiolum"
-          "wiki.makefu"
-        ];
-        ssl = {
-          enable = true;
-          # these certs will be needed if acme has not yet created certificates:
-          certificate =   ssl_cert;
-          certificate_key = ssl_key;
-          force_encryption = true;
-        };
+    virtualHosts = {
+      "${ext-dom}" = {
+        #serverAliases = [
+        #  "wiki.makefu.retiolum"
+        #  "wiki.makefu"
+        #];
+        enableSSL = true;
+        forceSSL = true;
+        enableACME = true;
+        # recommendedGzipSettings = true;
         extraConfig = ''
           gzip on;
           gzip_buffers 4 32k;
@@ -104,34 +90,26 @@ in {
           default_type text/plain;
 
         '';
-        locations = [
-          (nameValuePair "/" ''
-            root ${wiki-dir};
-            expires -1;
-            autoindex on;
-          '')
-          (nameValuePair "/store.php" ''
-            root ${tw-upload};
-            client_max_body_size 200M;
-            fastcgi_split_path_info ^(.+\.php)(/.+)$;
-            fastcgi_pass unix:${fpm-socket};
-            include ${pkgs.nginx}/conf/fastcgi_params;
-            include ${pkgs.nginx}/conf/fastcgi.conf;
-          '')
-          (nameValuePair  "/.well-known/acme-challenge" ''
-            root ${acmechall}/${ext-dom}/;
-          '')
-
-        ];
+        locations = {
+          "/" = {
+            root = wiki-dir;
+            extraConfig = ''
+              expires -1;
+              autoindex on;
+            '';
+          };
+          "/store.php" = {
+            root = tw-upload;
+            extraConfig = ''
+              client_max_body_size 200M;
+              fastcgi_split_path_info ^(.+\.php)(/.+)$;
+              fastcgi_pass unix:${fpm-socket};
+              include ${pkgs.nginx}/conf/fastcgi_params;
+              include ${pkgs.nginx}/conf/fastcgi.conf;
+            '';
+          };
+        };
       };
     };
   };
-  security.acme.certs."${ext-dom}" = {
-    email = "acme@syntax-fehler.de";
-    webroot = "${acmechall}/${ext-dom}/";
-    group = "nginx";
-    allowKeysForGroup = true;
-    postRun = "systemctl reload nginx.service";
-    extraDomains."${ext-dom}" = null ;
-  };
 }
diff --git a/makefu/2configs/nginx/icecult.nix b/makefu/2configs/nginx/icecult.nix
index ce4f62e55..e817e55d8 100644
--- a/makefu/2configs/nginx/icecult.nix
+++ b/makefu/2configs/nginx/icecult.nix
@@ -10,19 +10,17 @@ let
     sha256 = "0l8q7kw3w1kpvmy8hza9vr5liiycivbljkmwpacaifbay5y98z58";
   };
 in{
-  krebs.nginx = {
+  services.nginx = {
     enable = true;
-    servers.default = {
-        extraConfig = ''
-          root ${icecult}/app;
+    virtualHosts.default = {
+      root = "${icecult}/app";
+      locations = {
+        "/rpc".proxyPass = "http://10.42.22.163:3121";
+        "/rpc".extraConfig = ''
+          rewrite /rpc/(.*) /$1 break;
+          proxy_http_version 1.1;
         '';
-        locations = [
-          (nameValuePair "/rpc" ''
-        rewrite /rpc/(.*) /$1 break;
-        proxy_http_version 1.1;
-        proxy_pass http://10.42.22.163:3121;
-          '')
-      ];
+      };
     };
   };
 }
diff --git a/makefu/2configs/nginx/public_html.nix b/makefu/2configs/nginx/public_html.nix
index 9545e98f4..676d1f110 100644
--- a/makefu/2configs/nginx/public_html.nix
+++ b/makefu/2configs/nginx/public_html.nix
@@ -3,13 +3,16 @@
 with import <stockholm/lib>;
 
 {
-  krebs.nginx = {
+  services.nginx = {
     enable = true;
-    servers.default.locations = [
-      (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-        alias /home/$1/public_html$2;
-        autoindex on;
-      '')
-    ];
+    virtualHosts.default = {
+      default = true;
+      locations = {
+        "~ ^/~(.+?)(/.*)?\$".extraConfig = ''
+          alias /home/$1/public_html$2;
+          autoindex on;
+        '';
+      };
+    };
   };
 }
diff --git a/makefu/2configs/nginx/update.connector.one.nix b/makefu/2configs/nginx/update.connector.one.nix
index 593f23199..44345dcd8 100644
--- a/makefu/2configs/nginx/update.connector.one.nix
+++ b/makefu/2configs/nginx/update.connector.one.nix
@@ -1,25 +1,19 @@
 { config, lib, pkgs, ... }:
 
 with import <stockholm/lib>;
-let
-  hostname = config.krebs.build.host.name;
-  external-ip = config.krebs.build.host.nets.internet.ip4.addr;
-in {
-  krebs.nginx = {
+{
+  services.nginx = {
     enable = mkDefault true;
-    servers = {
-      update-connector-one = {
-        listen = [ "${external-ip}:80" ];
-        server-names = [
-          "update.connector.one"
-          "firmware.connector.one"