diff --git a/1systems/tv/mkdir.nix b/1systems/tv/mkdir.nix
index 2e90c8acd..e0e057d63 100644
--- a/1systems/tv/mkdir.nix
+++ b/1systems/tv/mkdir.nix
@@ -46,7 +46,7 @@ with lib;
   networking.hostName = "mkdir";
   networking.interfaces.enp2s1.ip4 = [
     {
-      address = "162.248.167.241";
+      address = "162.248.167.241"; # TODO
       prefixLength = 24;
     }
   ];
diff --git a/2configs/tv/identity.nix b/2configs/tv/identity.nix
index 1a02876f8..de99f507f 100644
--- a/2configs/tv/identity.nix
+++ b/2configs/tv/identity.nix
@@ -9,7 +9,7 @@
       cd = {
         cores = 2;
         dc = "tv"; #dc = "cac";
-        nets = {
+        nets = rec {
           internet = {
             addrs4 = ["162.219.7.216"];
             aliases = [
@@ -20,13 +20,14 @@
             ];
           };
           retiolum = {
+            via = internet;
             addrs4 = ["10.243.113.222"];
             addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af3"];
             aliases = [
               "cd.retiolum"
               "cgit.cd.retiolum"
             ];
-            tinc-key = ''
+            tinc.pubkey = ''
               -----BEGIN RSA PUBLIC KEY-----
               MIICCgKCAgEAvmCBVNKT/Su4v9nl/Nm3STPo5QxWPg7xEkzIs3Oh39BS8+r6/7UQ
               rebib7mczb+ebZd+Rg2yFoGrWO8cmM0VcLy5bYRMK7in8XroLEjWecNNM4TRfNR4
@@ -47,15 +48,19 @@
       mkdir = {
         cores = 1;
         dc = "tv"; #dc = "cac";
-        nets = {
+        nets = rec {
+          internet = {
+            addrs4 = ["162.248.167.241"];
+          };
           retiolum = {
+            via = internet;
             addrs4 = ["10.243.113.223"];
             addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af4"];
             aliases = [
               "mkdir.retiolum"
               "cgit.mkdir.retiolum"
             ];
-            tinc-key = ''
+            tinc.pubkey = ''
               -----BEGIN RSA PUBLIC KEY-----
               MIIBCgKCAQEAuyfM+3od75zOYXqnqRMAt+yp/4z/vC3vSWdjUvEmCuM23c5BOBw+
               dKqbWoSPTzOuaQ0szdL7a6YxT+poSUXd/i3pPz59KgCl192rd1pZoJKgvoluITev
@@ -71,7 +76,7 @@
       nomic = {
         cores = 2;
         dc = "tv"; #dc = "gg23";
-        nets = {
+        nets = rec {
           retiolum = {
             addrs4 = ["10.243.0.110"];
             addrs6 = ["42:02d5:733f:d6da:c0f5:2bb7:2b18:09ec"];
@@ -79,7 +84,7 @@
               "nomic.retiolum"
               "cgit.nomic.retiolum"
             ];
-            tinc-key = ''
+            tinc.pubkey = ''
               -----BEGIN RSA PUBLIC KEY-----
               MIIBCgKCAQEAwb8Yk/YRc17g2J9n960p6j4W/l559OPyuMPdGJ4DmCm3WNQtxoa+
               qTFUiDiI85BcmfqnSeddLG8zTC2XnSlIvCRMJ9oKzppFM4PX4OTAaJZVE5WyCQhw
@@ -95,15 +100,19 @@
       rmdir = {
         cores = 1;
         dc = "tv"; #dc = "cac";
-        nets = {
+        nets = rec {
+          internet = {
+            addrs4 = ["167.88.44.94"];
+          };
           retiolum = {
+            via = internet;
             addrs4 = ["10.243.113.224"];
             addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af5"];
             aliases = [
               "rmdir.retiolum"
               "cgit.rmdir.retiolum"
             ];
-            tinc-key = ''
+            tinc.pubkey = ''
               -----BEGIN RSA PUBLIC KEY-----
               MIIBCgKCAQEA+twy4obSbJdmZLfBoe9YYeyoDnXkO/WPa2D6Eh6jXrWk5fbhBjRf
               i3EAQfLiXXFJX3E8V8YvJyazXklI19jJtCLDiu/F5kgJJfyAkWHH+a/hcg7qllDM
@@ -127,7 +136,7 @@
             aliases = [
               "wu.retiolum"
             ];
-            tinc-key = ''
+            tinc.pubkey = ''
               -----BEGIN RSA PUBLIC KEY-----
               MIIBCgKCAQEArDvU0cuBsVqTjCX2TlWL4XHSy4qSjUhjrDvUPZSKTVN7x6OENCUn
               M27g9H7j4/Jw/8IHoJLiKnXHavOoc9UJM+P9Fla/4TTVADr69UDSnLgH+wGiHcEg
diff --git a/4lib/tv/default.nix b/4lib/tv/default.nix
index ec46d8ea8..5eb9ac45f 100644
--- a/4lib/tv/default.nix
+++ b/4lib/tv/default.nix
@@ -76,6 +76,10 @@ builtins // lib // rec {
 
     net = submodule ({ config, ... }: {
       options = {
+        via = mkOption {
+          type = nullOr net;
+          default = null;
+        };
         addrs = mkOption {
           type = listOf addr;
           apply = _: config.addrs4 ++ config.addrs6;
@@ -92,8 +96,23 @@ builtins // lib // rec {
           # TODO nonEmptyListOf hostname
           type = listOf hostname;
         };
-        tinc-key = mkOption {
-          type = str;
+        tinc = mkOption {
+          type = submodule {
+            options = {
+              config = mkOption {
+                type = str;
+                apply = _: ''
+                  ${optionalString (config.via != null)
+                    (concatMapStringsSep "\n" (a: "Address = ${a}") config.via.addrs)}
+                  ${concatMapStringsSep "\n" (a: "Subnet = ${a}") config.addrs}
+                  ${config.tinc.pubkey}
+                '';
+              };
+              pubkey = mkOption {
+                type = str;
+              };
+            };
+          };
         };
       };
     });