diff --git a/2configs/elchos/stats.nix b/2configs/elchos/stats.nix
index 9f27b66..b613320 100644
--- a/2configs/elchos/stats.nix
+++ b/2configs/elchos/stats.nix
@@ -1,73 +1,48 @@
 { config, lib, pkgs, ... }:
 
+# requires nsupdate to get correct hostname (from ./search.nix)
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
+
 with import <stockholm/lib>;
-let
-  sec = toString <secrets>;
-  acmepath = "/var/lib/acme/";
-  acmechall = acmepath + "/challenges/";
-  ext-dom = "stats.nsupdate.info";
-  #ssl_cert = "${sec}/wildcard.krebsco.de.crt";
-  #ssl_key  = "${sec}/wildcard.krebsco.de.key";
-  ssl_cert = "${acmepath}/${ext-dom}/fullchain.pem";
-  ssl_key = "${acmepath}/${ext-dom}/key.pem";
-in {
-  networking.firewall = {
-    allowedTCPPorts = [ 2003 80 443 ];
-    allowedUDPPorts = [ 2003 ];
+{
+
+  services.nginx = {
+    enable = mkDefault true;
+    virtualHosts = {
+      "stats.nsupdate.info" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations = {
+          "/"  = {
+            proxyPass  = "http://localhost:3000/";
+            extraConfig = ''
+              proxy_set_header   Host             $host;
+              proxy_set_header   X-Real-IP        $remote_addr;
+              proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
+            '';
+          };
+        };
+      };
+    };
   };
 
   services.grafana = {
     enable = true;
     addr = "127.0.0.1";
-    extraOptions = { "AUTH_ANONYMOUS_ENABLED" = "true"; };
     users.allowSignUp = false;
     users.allowOrgCreate = false;
     users.autoAssignOrg = false;
+    auth.anonymous.enable = true;
     security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""}
   };
-  krebs.nginx = {
-    enable = true;
-    servers.elch-stats = {
-      server-names = [ ext-dom ];
-      listen = [ "80" "443 ssl" ];
-      ssl = {
-          enable = true;
-          # these certs will be needed if acme has not yet created certificates:
-          certificate =   ssl_cert;
-          certificate_key = ssl_key;
-          force_encryption = true;
-      };
-
-      locations = [
-          (nameValuePair "/" ''
-            proxy_set_header   Host $host;
-            proxy_set_header   X-Real-IP          $remote_addr;
-            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass http://localhost:3000/;
-          '')
-          (nameValuePair  "/.well-known/acme-challenge" ''
-            root ${acmechall}/${ext-dom}/;
-          '')
-      ];
-    };
-  };
-
-  security.acme.certs."${ext-dom}" = {
-    email = "acme@syntax-fehler.de";
-    webroot = "${acmechall}/${ext-dom}/";
-    group = "nginx";
-    allowKeysForGroup = true;
-    postRun = "systemctl reload nginx.service";
-    extraDomains."${ext-dom}" = null ;
-  };
 
   services.graphite = {
-    web = {
+    api = {
       enable = true;
-      host = "127.0.0.1";
-      port = 8080;
+      listenAddress = "127.0.0.1";
+      port = 18080;
     };
     carbon = {
       enableCache = true;
@@ -85,7 +60,7 @@ in {
 
         [elchos]
         patterhn = ^elchos\.
-        retention = 10s:30d,60s:1y
+        retentions = 10s:30d,60s:3y
 
         [default]
         pattern = .*
@@ -93,4 +68,9 @@ in {
         '';
     };
   };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 2003 80 443 ];
+    allowedUDPPorts = [ 2003 ];
+  };
 }