diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 827f984d6..3357964ef 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -7,12 +7,18 @@
     <stockholm/krebs/2configs/secret-passwords.nix>
     <stockholm/krebs/2configs/hw/x220.nix>
 
+
+    ## initrd unlocking
+    # (brain hosts/puyak/luks-ssd;echo)  | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+    <stockholm/krebs/2configs/tor/initrd.nix>
+
     <stockholm/krebs/2configs/binary-cache/nixos.nix>
     <stockholm/krebs/2configs/binary-cache/prism.nix>
     <stockholm/krebs/2configs/go.nix>
     <stockholm/krebs/2configs/ircd.nix>
     <stockholm/krebs/2configs/news.nix>
     <stockholm/krebs/2configs/news-spam.nix>
+
     ###   shackspace
     # handle the worlddomination map via coap
     <stockholm/krebs/2configs/shack/worlddomination.nix>
diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix
new file mode 100644
index 000000000..cb6008f73
--- /dev/null
+++ b/krebs/2configs/tor/initrd.nix
@@ -0,0 +1,50 @@
+{config, pkgs, ... }:
+## unlock command:
+# (brain hosts/puyak/luks-ssd;echo)  | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+{
+  boot.initrd.network.enable = true;
+  boot.initrd.network.ssh = {
+    enable = true;
+    port = 22;
+    authorizedKeys = [
+      config.krebs.users.jeschli-brauerei.pubkey
+      config.krebs.users.lass.pubkey
+      config.krebs.users.lass-mors.pubkey
+      config.krebs.users.makefu.pubkey
+      config.krebs.users.tv.pubkey
+    ];
+    hostECDSAKey = <secrets/initrd/host_ecdsa_key>;
+  };
+  boot.initrd.availableKernelModules = [ "e1000e" ];
+
+  boot.initrd.secrets = {
+    "/etc/tor/onion/bootup" = <secrets/initrd>;
+  };
+
+  boot.initrd.extraUtilsCommands = ''
+    copy_bin_and_libs ${pkgs.tor}/bin/tor
+  '';
+
+  # start tor during boot process
+  boot.initrd.network.postCommands = let
+    torRc = (pkgs.writeText "tor.rc" ''
+      DataDirectory /etc/tor
+      SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+      SOCKSPort 127.0.0.1:9063
+      HiddenServiceDir /etc/tor/onion/bootup
+      HiddenServicePort 22 127.0.0.1:22
+    '');
+  in ''
+    echo "tor: preparing onion folder"
+    # have to do this otherwise tor does not want to start
+    chmod -R 700 /etc/tor
+
+    echo "make sure localhost is up"
+    ip a a 127.0.0.1/8 dev lo
+    ip link set lo up
+
+    echo "tor: starting tor"
+    tor -f ${torRc} --verify-config
+    tor -f ${torRc} &
+  '';
+}