diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 42764e48c..4f8f964f8 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -163,10 +163,11 @@ with lib;
       dc = "makefu"; #dc = "cac";
       extraZones = {
         "krebsco.de" = ''
-          wry            IN A ${head nets.internet.addrs4}
-          io             IN NS     wry.krebsco.de.
-          graphs         IN A ${head nets.internet.addrs4}
-          tinc           IN A ${head nets.internet.addrs4}
+          wry            IN A  ${head nets.internet.addrs4}
+          io             IN NS wry.krebsco.de.
+          graphs         IN A  ${head nets.internet.addrs4}
+          paste       60 IN A  ${head nets.internet.addrs4}
+          tinc           IN A  ${head nets.internet.addrs4}
           '';
       };
       nets = rec {
@@ -174,6 +175,7 @@ with lib;
           addrs4 = ["104.233.87.86"];
           aliases = [
             "wry.internet"
+            "paste.internet"
           ];
         };
         retiolum = {
@@ -182,6 +184,8 @@ with lib;
           addrs6 = ["42:6e1e:cc8a:7cef:827:f938:8c64:baad"];
           aliases = [
             "graphs.wry.retiolum"
+            "paste.wry.retiolum"
+            "paste.retiolum"
             "wry.retiolum"
           ];
           tinc.pubkey = ''
@@ -210,8 +214,7 @@ with lib;
         "krebsco.de" = ''
           omo               IN A      ${head nets.internet.addrs4}
           euer              IN A      ${head nets.internet.addrs4}
-          gum               IN A      ${head nets.internet.addrs4}
-          paste             IN A      ${head nets.internet.addrs4}'';
+          gum               IN A      ${head nets.internet.addrs4} '';
       };
       nets = {
         internet = {
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 0530921a0..921771033 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -36,7 +36,7 @@ let
           type = with types; listOf (attrsOf str);
         };
         extraConfig = mkOption {
-          type = with types; str;
+          type = with types; string;
           default = "";
         };
       };
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index eed11642f..65bb51193 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -16,6 +16,14 @@ let
         description = "hostname which serves tinc boot";
         default = "tinc.krebsco.de" ;
     };
+    listen = mkOption {
+        type = with types; listOf str;
+        description = ''Addresses to listen on (nginx-syntax).
+        ssl will be configured, http will be redirected to ssl.
+        Make sure to have at least 1 ssl port configured.
+        '';
+        default = [ "80" "443 ssl" ] ;
+    };
     ssl_certificate_key = mkOption {
         type = types.str;
         description = "Certificate key to use for ssl";
@@ -33,19 +41,17 @@ let
 
   imp = {
     krebs.nginx.servers = assert config.krebs.nginx.enable; {
-      retiolum-boot-redir = {
-        server-names = singleton cfg.hostname;
-        extraConfig = ''
-          return 301 https://$server_name$request_uri;
-        '';
-        locations = [];
-      };
       retiolum-boot-ssl = {
         server-names = singleton cfg.hostname;
-        listen = "443 ssl";
+        listen = cfg.listen;
         extraConfig = ''
           ssl_certificate ${cfg.ssl_certificate};
           ssl_certificate_key ${cfg.ssl_certificate_key};
+
+          if ($scheme = http){
+            return 301 https://$server_name$request_uri;
+          }
+
           root ${pkgs.retiolum-bootstrap};
           try_files $uri $uri/retiolum.sh;
         '';
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index a7ed93c43..63b1f47f7 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -1,59 +1,72 @@
 { config, lib, pkgs, ... }:
 
+with lib;
 let
 
-  ip = (lib.head config.krebs.build.host.nets.internet.addrs4);
+  external-ip = head config.krebs.build.host.nets.internet.addrs4;
+  internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
       # TODO: copy this config or move to krebs
       ../../tv/2configs/CAC-CentOS-7-64bit.nix
       ../2configs/base.nix
-      ../2configs/base-sources.nix
+      ../2configs/unstable-sources.nix
       ../2configs/tinc-basic-retiolum.nix
 
+      ../2configs/bepasty-dual.nix
+
       ../2configs/iodined.nix
 
       # Reaktor
       ../2configs/Reaktor/simpleExtend.nix
   ];
 
-  krebs.Reaktor.enable = true;
-
-  networking.firewall.allowPing = true;
-  networking.interfaces.enp2s1.ip4 = [
-  {
-    address = ip;
-    prefixLength = 24;
-  }
-  ];
-  networking.defaultGateway = "104.233.87.1";
-  networking.nameservers = [
-    "8.8.8.8"
-  ];
-
-  # based on ../../tv/2configs/CAC-Developer-2.nix
-  sound.enable = false;
-
-  # prepare graphs
-  nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
-
-  krebs.nginx.enable = true;
-  krebs.retiolum-bootstrap.enable = true;
-  makefu.tinc_graphs.enable = true;
-
-  makefu.tinc_graphs.krebsNginx = {
-    enable = true;
-    # TODO: remove hard-coded hostname
-    hostnames_complete  = [ "graphs.wry" ];
-    hostnames_anonymous = [ "graphs.krebsco.de" ];
-  };
-
-  networking.firewall.allowedTCPPorts = [ 53 80 443 ];
-
   krebs.build = {
     user = config.krebs.users.makefu;
-    target = "root@${ip}";
+    target = "root@wry";
     host = config.krebs.hosts.wry;
   };
 
+
+
+  krebs.Reaktor.enable = true;
+
+  # bepasty to listen only on the correct interfaces
+  krebs.bepasty.servers.internal.nginx.listen  = [ "${internal-ip}:80" ];
+  krebs.bepasty.servers.external.nginx.listen  = [ "${external-ip}:80" "${external-ip}:443 ssl" ];
+
+  # prepare graphs
+  krebs.nginx.enable = true;
+  krebs.retiolum-bootstrap.enable = true;
+
+  nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+  makefu.tinc_graphs = {
+    enable = true;
+    nginx = {
+      enable = true;
+      # TODO: remove hard-coded hostname
+      complete = {
+        listen = [ "${internal-ip}:80" ];
+        server-names = [ "graphs.wry" ];
+      };
+      anonymous = {
+        listen = [ "${external-ip}:80" ] ;
+        server-names = [ "graphs.krebsco.de" ];
+      };
+    };
+  };
+  networking = {
+    firewall.allowPing = true;
+    firewall.allowedTCPPorts = [ 53 80 443 ];
+    interfaces.enp2s1.ip4 = [{
+      address = external-ip;
+      prefixLength = 24;
+    }];
+    defaultGateway = "104.233.87.1";
+    nameservers = [ "8.8.8.8" ];
+  };
+
+
+  # based on ../../tv/2configs/CAC-Developer-2.nix
+  sound.enable = false;
 }
diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
new file mode 100644
index 000000000..fb170957a
--- /dev/null
+++ b/makefu/2configs/bepasty-dual.nix
@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+# 1systems should configure itself:
+#   krebs.bepasty.servers.internal.nginx.listen  = [ "80" ]
+#   krebs.bepasty.servers.external.nginx.listen  = [ "80" "443 ssl" ]
+#     80 is redirected to 443 ssl
+
+# secrets used:
+#   wildcard.krebsco.de.crt
+#   wildcard.krebsco.de.key
+#   bepasty-secret.nix     <- contains single string
+
+with lib;
+{
+
+  krebs.nginx.enable = mkDefault true;
+  krebs.bepasty = {
+    enable = true;
+    serveNginx= true;
+
+    servers = {
+      internal = {
+        nginx = {
+          server-names = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
+        };
+        defaultPermissions = "admin,list,create,read,delete";
+        secretKey = import <secrets/bepasty-secret.nix>;
+      };
+
+      external = {
+        nginx = {
+          server-names = [ "paste.krebsco.de" ];
+          extraConfig = ''
+          ssl_session_cache    shared:SSL:1m;
+          ssl_session_timeout  10m;
+          ssl_certificate     /root/secrets/wildcard.krebsco.de.crt;
+          ssl_certificate_key /root/secrets/wildcard.krebsco.de.key;
+          ssl_verify_client off;
+          proxy_ssl_session_reuse off;
+          ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
+          ssl_ciphers RC4:HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+          if ($scheme = http){
+            return 301 https://$server_name$request_uri;
+          }'';
+        };
+        defaultPermissions = "read";
+        secretKey = import <secrets/bepasty-secret.nix>;
+      };
+    };
+  };
+}
diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix
index cebfd7cea..b8c5c5236 100644
--- a/makefu/2configs/exim-retiolum.nix
+++ b/makefu/2configs/exim-retiolum.nix
@@ -5,10 +5,6 @@ with lib;
   krebs.exim-retiolum.enable = true;
   environment.systemPackages = with pkgs; [
     msmtp
-    mutt-kz
-    notmuch
-    # TODO: put this somewhere else
-    offlineimap
   ];
 
 }
diff --git a/makefu/2configs/unstable-sources.nix b/makefu/2configs/unstable-sources.nix
new file mode 100644
index 000000000..f2d28dcaf
--- /dev/null
+++ b/makefu/2configs/unstable-sources.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+{
+  krebs.build.source = {
+    git.nixpkgs = {
+      url = https://github.com/makefu/nixpkgs;
+      rev = "984d33884d63d404ff2da76920b8bc8b15471552";
+    };
+
+    dir.secrets = {
+      host = config.krebs.hosts.pornocauster;
+      path = "/home/makefu/secrets/${config.krebs.build.host.name}/";
+    };
+    dir.stockholm = {
+      host = config.krebs.hosts.pornocauster;
+      path = toString ../.. ;
+    };
+  };
+}
diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix
index d970652a4..ff32eea60 100644
--- a/makefu/3modules/bepasty-server.nix
+++ b/makefu/3modules/bepasty-server.nix
@@ -6,10 +6,10 @@ let
   bepasty = pkgs.pythonPackages.bepasty-server;
   gevent = pkgs.pythonPackages.gevent;
   python = pkgs.pythonPackages.python;
-  cfg = config.makefu.bepasty-server;
+  cfg = config.krebs.bepasty;
 
   out = {
-    options.makefu.bepasty-server = api;
+    options.krebs.bepasty = api;
     config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
   };
 
@@ -20,27 +20,20 @@ let
     servers = mkOption {
       type = with types; attrsOf optionSet;
       options = singleton {
-        nginxCfg = mkOption {
+        nginx = mkOption {
           # TODO use the correct type
           type = with types; attrsOf unspecified;
           description = ''
             additional nginx configuration. see krebs.nginx for all options
           '' ;
         };
-        debug = mkOption {
-          type = types.bool;
-          description = ''
-            run server in debug mode
-          '';
-          default = false;
-        };
 
-        # TODO: assert secretKey
         secretKey = mkOption {
           type = types.str;
           description = ''
             server secret for safe session cookies, must be set.
           '';
+          default = "";
         };
 
         # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
@@ -66,6 +59,7 @@ let
         extraConfig = mkOption {
           type = types.str;
           default = "";
+          # TODO configure permissions in separate
           example = ''
             PERMISSIONS = {
               'myadminsecret': 'admin,list,create,read,delete',
@@ -75,8 +69,13 @@ let
         };
 
         defaultPermissions = mkOption {
+          # TODO: listOf str
           type = types.str;
-          default = "list";
+          description = ''
+          default permissions for all unauthenticated users.
+          '';
+          example = "read,create,delete";
+          default = "read";
         };
 
       };
@@ -102,21 +101,22 @@ let
           serviceConfig = {
             Type = "simple";
             PrivateTmp = true;
-            ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" ''
+
+            ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" ''
               #!/bin/sh
-              chmod 755 ${server.workDir}
-              mkdir -p ${server.dataDir}
-              cat > ${server.workDir}/bepasty-${name}.conf <<EOF
+              mkdir -p "${server.dataDir}" "${server.workDir}"
+              chown bepasty:bepasty "${server.workDir}" "${server.dataDir}"
+              cat > "${server.workDir}/bepasty-${name}.conf" <<EOF
               SITENAME="${name}"
               STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
-              SECRET_KEY="${escapeShellArg server.secretKey}"
+              SECRET_KEY="${server.secretKey}"
               DEFAULT_PERMISSIONS="${server.defaultPermissions}"
               ${server.extraConfig}
               EOF
             '';
-            Directory = "${bepasty}/lib/${python.libPrefix}/site-packages";
-            # we use Gunicorn to start a wsgi server
             ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
+              -u bepasty \
+              -g bepasty \
               --workers 3 --log-level=info \
               --bind=unix:${server.workDir}/gunicorn-${name}.sock \
               --pid ${server.workDir}/gunicorn-${name}.pid \
@@ -128,17 +128,21 @@ let
 
     users.extraUsers.bepasty = {
       uid = 2796546855; #genid bepasty
+      group = "bepasty";
       home = "/var/lib/bepasty-server";
-      createHome = true;
+    };
+    users.extraGroups.bepasty = {
+      gid = 2796546855; #genid bepasty
     };
   };
+
   nginx-imp = {
     assertions = [ { assertion = config.krebs.nginx.enable;
                       message = "krebs.nginx.enable must be true"; }];
 
     krebs.nginx.servers = mapAttrs' (name: server:
       nameValuePair("bepasty-server-${name}")
-      (server.nginxCfg // {
+      (mkMerge [ server.nginx  {
         extraConfig = ''
           client_max_body_size 32M;
           '';
@@ -153,7 +157,7 @@ let
             alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
           ''))
           ];
-      })
+      }])
     ) cfg.servers ;
   };
 in
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 598365c39..3ac325b29 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -3,6 +3,7 @@ _:
 {
   imports = [
     ./tinc_graphs.nix
+    ./bepasty-server.nix
   ];
 }
 
diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
index ff2f55873..1f87f00cc 100644
--- a/makefu/3modules/tinc_graphs.nix
+++ b/makefu/3modules/tinc_graphs.nix
@@ -20,26 +20,38 @@ let
       default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
     };
 
-    krebsNginx = {
-      # configure krebs nginx to serve the new graphs
-      enable = mkEnableOption "tinc_graphs nginx";
+    nginx = {
+      enable = mkEnableOption "enable tinc_graphs to be served with nginx";
 
-      hostnames_complete = mkOption {
-        #TODO: this is not a secure way to serve these graphs,better listen to
-        #      the correct interface, krebs.nginx does not support this yet
+      anonymous = {
+        server-names = mkOption {
+          type = with types; listOf str;
+          description = "hostnames which serve anonymous graphs";
+          default = [ "graphs.${config.krebs.build.host.name}" ];
+        };
+
+        listen = mkOption {
+          # use the type of the nginx listen option
+          type = with types; listOf str;
+          description = "listen address for anonymous graphs";
+          default = [ "80" ];
+        };
 
-        type = with types; listOf str;
-        description = "hostname which serves complete graphs";
-        default = [ "graphs.${config.krebs.build.host.name}" ];
       };
 
-      hostnames_anonymous = mkOption {
-        type = with types; listOf str;
-        description = ''
-          hostname which serves anonymous graphs
-          must be different from hostname_complete
-        '';
-        default = [ "anongraphs.${config.krebs.build.host.name}" ];
+      complete = {
+        server-names = mkOption {
+          type = with types; listOf str;
+          description = "hostname which serves complete graphs";
+          default = [ "graphs.${config.krebs.build.host.name}" ];
+        };
+
+        listen = mkOption {
+          type = with types; listOf str;
+          description = "listen address for complete graphs";
+          default = [ "127.0.0.1:80" ];
+        };
+
       };
     };
 
@@ -109,25 +121,23 @@ let
       createHome = true;
     };
 
-    krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
-      tinc_graphs_complete = {
-        server-names = cfg.krebsNginx.hostnames_complete;
+    krebs.nginx.servers = mkIf cfg.nginx.enable {
+      tinc_graphs_complete = mkMerge [ cfg.nginx.complete  {
         locations = [
           (nameValuePair "/" ''
             autoindex on;
             root ${internal_dir};
           '')
         ];
-      };
-      tinc_graphs_anonymous = {
-        server-names = cfg.krebsNginx.hostnames_anonymous;
+      }] ;
+      tinc_graphs_anonymous = mkMerge [ cfg.nginx.anonymous {
         locations = [
           (nameValuePair "/" ''
             autoindex on;
             root ${external_dir};
           '')
         ];
-      };
+      }];
     };
   };