diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 4628b2acc..659e71458 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -130,7 +130,6 @@ with import ../../4lib { inherit lib; };
           io                IN NS     pigstarter.krebsco.de.
           pigstarter        IN A      ${head nets.internet.addrs4}
           gold              IN A      ${head nets.internet.addrs4}
-          tinc              IN A      ${head nets.internet.addrs4}
           boot              IN A      ${head nets.internet.addrs4}'';
       };
       nets = {
@@ -167,6 +166,7 @@ with import ../../4lib { inherit lib; };
         "krebsco.de" = ''
           wry            IN A ${head nets.internet.addrs4}
           graphs         IN A ${head nets.internet.addrs4}
+          tinc           IN A ${head nets.internet.addrs4}
           '';
       };
       nets = rec {
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index d8c8d6fa1..03b19d1c7 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -34,15 +34,19 @@ in {
 
   # prepare graphs
   nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+
   krebs.nginx.enable = true;
+  krebs.retiolum-bootstrap.enable = true;
   makefu.tinc_graphs.enable = true;
+
   makefu.tinc_graphs.krebsNginx = {
     enable = true;
     # TODO: remove hard-coded hostname
     hostnames_complete  = [ "graphs.wry" ];
     hostnames_anonymous = [ "graphs.krebsco.de" ];
   };
-  networking.firewall.allowedTCPPorts = [80];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 
   krebs.build = {
     user = config.krebs.users.makefu;