diff --git a/hosts/hainich/configuration.nix b/hosts/hainich/configuration.nix
index ce2a565..f07db86 100644
--- a/hosts/hainich/configuration.nix
+++ b/hosts/hainich/configuration.nix
@@ -21,6 +21,7 @@
     ./services/workadventure.nix
     ./services/minecraft.nix
     ./services/mattermost.nix
+    ./services/keytracker.nix
   ];
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;
diff --git a/hosts/hainich/services/keytracker.nix b/hosts/hainich/services/keytracker.nix
index 43dc488..0b7ada5 100644
--- a/hosts/hainich/services/keytracker.nix
+++ b/hosts/hainich/services/keytracker.nix
@@ -1,31 +1,36 @@
 {pkgs, config, ...}:
 
 {
-
   services.keytracker = {
     enable = true;
     domain = "keytracker.infra4future.de";
     stateDir = "/var/lib/keytracker";
 
     # we have to overwrite this package, since the api url is backed into its code
-    frontendPackage = pkgs.keytracker-frontend.overrideAttrs (old: { apiUrl = "https://keytracker.infra4future.de:5000"; });
+    frontendPackage = pkgs.keytracker-frontend.overrideAttrs (old: { apiUrl = "https://keytracker.infra4future.de/api"; });
 
-    config.Default = {
-      Port = 5000;
-      DbPath = "history.db";
-      CorsOrigin = "off";
-    };
-    config.Keys = {
-      "8174875f7d85" = "Chris Büro;49c5dbda74fe86eae0dd1ce6;247f16f579033a6a947b3be301407319cd9bfe14f11554d71ea3190e04f7cb91";
-      "7fc944c9e632" = "Test=2;74fffaf6e463950fc6da3fd3;95313e37ff448b1a19b133fd8067c160f9f1c6d417f5d8dbec6f4f931097d389";
-      "7a05c8441f3a" = "testkey;694403310905ed4ac26e56f8;13852ec7855fc51b012874ea5786c215c37c3ed592685a04d1ad56152eccccc5";
-    };
+    config = ''
+      [Default]
+      CorsOrigin = "*"
+      DbPath = "history.db"
+      Port = 3029
+
+      [Keys]
+      4c81038150f6 = hacc;18673c03507bd03b3a719515;6869ef50fdd047289b58b7dc867dc859b5ddf0a5ab9c850fb7eec821e62f14f0
+      7a05c8441f3a = testkey;694403310905ed4ac26e56f8;13852ec7855fc51b012874ea5786c215c37c3ed592685a04d1ad56152eccccc5
+      7fc944c9e632 = Test=2;74fffaf6e463950fc6da3fd3;95313e37ff448b1a19b133fd8067c160f9f1c6d417f5d8dbec6f4f931097d389
+      8174875f7d85 = Chris Büro;49c5dbda74fe86eae0dd1ce6;247f16f579033a6a947b3be301407319cd9bfe14f11554d71ea3190e04f7cb91
+    '';
 
     nginx = {
       enableACME = true;
       forceSSL = true;
+      locations."^~ /api" = {
+        proxyPass = "http://localhost:3029/";
+      };
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 5000 ];
+  networking.firewall.allowedTCPPorts = [ 443 ];
+
 }
diff --git a/modules/default.nix b/modules/default.nix
index a6b276e..b004d2e 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -5,5 +5,6 @@ in {
   imports = [
     ./nftnat
     ./decklink.nix
+    ./keytracker.nix
   ];
 }
diff --git a/modules/keytracker.nix b/modules/keytracker.nix
index dc1735a..d93b493 100644
--- a/modules/keytracker.nix
+++ b/modules/keytracker.nix
@@ -26,8 +26,8 @@ in
       type = types.str;
     };
     config = mkOption {
-      default = {};
-      type = format.type;
+      default = "";
+      type = types.str;
     };
     nginx = mkOption {
       default = {};
@@ -37,7 +37,7 @@ in
 
   config =
     let cfg = config.services.keytracker;
-        configfile = format.generate "config" cfg.config;
+        configfile = pkgs.writeText "keytracker-config" cfg.config;
     in {
     services.nginx = mkIf cfg.enable {
       enable = true;
diff --git a/pkgs/keytracker/frontend.nix b/pkgs/keytracker/frontend.nix
index 3566874..7f8dee8 100644
--- a/pkgs/keytracker/frontend.nix
+++ b/pkgs/keytracker/frontend.nix
@@ -8,11 +8,11 @@ stdenv.mkDerivation rec {
 
   src = (fetchgit {
     url = "https://gitlab.infra4future.de/octycs/keytracker";
-    rev = "0a124c3e7bc5c0e840d45399ad5e69485bb3e49c";
-    sha256 = "1l3djg3qfisrvv9shi2p44h026n58pimwbvr2idjnaill688s1qf";
+    rev = "2e83366913732029e8a5913f121df969172244ed";
+    sha256 = "sha256-ty8m/ITR2gmui3dIJX04FkGT/9SGuirrALyWaNaNwhE=";
   }).outPath + "/frontend";
 
-  apiUrl = "https://localhost:5000";
+  apiUrl = "http://chaski.stuebinm.eu:3030";
 
   buildPhase = ''
     substituteInPlace assets/main.js --replace "http://localhost:5000" $apiUrl