diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index a84da38db..a7e0b839d 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -54,6 +54,7 @@ with import <stockholm/lib>;
         jq
         mkpasswd
         netcat
+        netcup
         nix-repl
         nmap
         p7zip
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 39d0c4f6b..0854e53c2 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -112,13 +112,14 @@ with import <stockholm/lib>;
       };
     }
 
-    (let ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; in {
-      environment.variables = {
-        CURL_CA_BUNDLE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-        GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-        SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-      };
-    })
+    {
+      environment.variables =
+        flip genAttrs (_: "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt") [
+          "CURL_CA_BUNDLE"
+          "GIT_SSL_CAINFO"
+          "SSL_CERT_FILE"
+        ];
+    }
 
     {
       services.cron.enable = false;
diff --git a/tv/5pkgs/netcup/default.nix b/tv/5pkgs/netcup/default.nix
new file mode 100644
index 000000000..2443e9e73
--- /dev/null
+++ b/tv/5pkgs/netcup/default.nix
@@ -0,0 +1,32 @@
+{ coreutils, curl, fetchgit, gawk, gnugrep, gnused, jq, stdenv, w3m, ... }:
+with import <stockholm/lib>;
+let
+  readJSON = path: fromJSON (readFile path);
+  sed.escape = replaceChars ["/"] ["\\/"]; # close enough
+  PATH = makeBinPath [
+    coreutils
+    curl
+    gawk
+    gnugrep
+    gnused
+    jq
+    w3m
+  ];
+in
+stdenv.mkDerivation {
+  name = "netcup-1.0.0";
+  src = fetchgit {
+    url = "http://cgit.cd.krebsco.de/netcup";
+    rev = "tags/v1.0.0";
+    sha256 = "0m6mk16pblvnapxykxdccvphslbv1gjfziyr86bnqin1xb1g99bq";
+  };
+  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+  patchPhase = ''
+    path=${shell.escape (sed.escape PATH)}
+    sed -i "1s/.*/&\nPATH=$path/" vcp
+  '';
+  installPhase = ''
+    mkdir -p $out/bin
+    cp vcp $out/bin
+  '';
+}