diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
index 890652285..f63dbefd8 100644
--- a/makefu/2configs/bepasty-dual.nix
+++ b/makefu/2configs/bepasty-dual.nix
@@ -32,6 +32,11 @@ in {
             "paste.${config.krebs.build.host.name}"
             "paste.r"
           ];
+          extraConfig = ''
+            if ( $server_addr = "${external-ip}" ) {
+              return 403;
+            }
+          '';
         };
         defaultPermissions = "admin,list,create,read,delete";
         secretKeyFile = secKey;
diff --git a/makefu/2configs/deployment/graphs.nix b/makefu/2configs/deployment/graphs.nix
index bde9892cd..e7dc54dd0 100644
--- a/makefu/2configs/deployment/graphs.nix
+++ b/makefu/2configs/deployment/graphs.nix
@@ -6,11 +6,6 @@ let
   internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
   hn = config.krebs.build.host.name;
 in {
-  krebs.bepasty.servers."paste.r".nginx.extraConfig = ''
-    if ( $server_addr = "${external-ip}" ) {
-      return 403;
-    }
-  '';
   krebs.tinc_graphs = {
     enable = true;
     nginx = {