diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index c683d406c..a6b5a1906 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -712,6 +712,31 @@ let
         };
         secure = true;
       };
+      xu = {
+        cores = 4;
+        # TODO xu is mobile, so dc means "home data center"
+        dc = "tv"; #dc = "gg23";
+        nets = {
+          retiolum = {
+            addrs4 = ["10.243.13.38"];
+            addrs6 = ["42:0:0:0:0:0:0:1338"];
+            aliases = [
+              "xu.retiolum"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIIBCgKCAQEAl3l7IWbfbkVgaJFM3s9g2UCh2rmqoTba16Of7NNWMj05L/hIkUsQ
+              uc43/QzidWh/4gEaq5MQ7JpLyzVBQYRJkNlPRF/Z07KdLBskAZCjDYdYue9BrziX
+              8s2Irs2+FNbCK2LqtrPhbcXQJvixsk6vjl2OBpWTDUcDEsk+D1YQilxdtyUzCUkw
+              mmRo/mzNsLZsYlSgZ6El/ZLkRdtexAzGxJ0DrukpDR0uqXXkp7jUaxRCZ+Cwanvj
+              4I1Hu5aHzWB7KJ1SIvpX3a4f+mun1gh3TPqWP5PUqJok1PSuScz6P2UGaLZZyH63
+              4o+9nGJPuzb9bpMVRaVGtKXd39jwY7mbqwIDAQAB
+              -----END RSA PUBLIC KEY-----
+            '';
+          };
+        };
+        secure = true;
+      };
     };
     users = addNames {
       mv = {
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 4e123e723..f6b4bd8b1 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -67,7 +67,7 @@ types // rec {
           options = {
             config = mkOption {
               type = str;
-              apply = _: ''
+              default = ''
                 ${optionalString (net-config.via != null)
                   (concatMapStringsSep "\n" (a: "Address = ${a}") net-config.via.addrs)}
                 ${concatMapStringsSep "\n" (a: "Subnet = ${a}") net-config.addrs}
diff --git a/krebs/Zhosts/xu b/krebs/Zhosts/xu
new file mode 100644
index 000000000..688e4a340
--- /dev/null
+++ b/krebs/Zhosts/xu
@@ -0,0 +1,13 @@
+
+Subnet = 10.243.13.38
+Subnet = 42:0:0:0:0:0:0:1338
+-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEAl3l7IWbfbkVgaJFM3s9g2UCh2rmqoTba16Of7NNWMj05L/hIkUsQ
+uc43/QzidWh/4gEaq5MQ7JpLyzVBQYRJkNlPRF/Z07KdLBskAZCjDYdYue9BrziX
+8s2Irs2+FNbCK2LqtrPhbcXQJvixsk6vjl2OBpWTDUcDEsk+D1YQilxdtyUzCUkw
+mmRo/mzNsLZsYlSgZ6El/ZLkRdtexAzGxJ0DrukpDR0uqXXkp7jUaxRCZ+Cwanvj
+4I1Hu5aHzWB7KJ1SIvpX3a4f+mun1gh3TPqWP5PUqJok1PSuScz6P2UGaLZZyH63
+4o+9nGJPuzb9bpMVRaVGtKXd39jwY7mbqwIDAQAB
+-----END RSA PUBLIC KEY-----
+
+