diff --git a/mastus/blog.nix b/mastus/blog.nix
new file mode 100644
index 0000000..8a069ef
--- /dev/null
+++ b/mastus/blog.nix
@@ -0,0 +1,46 @@
+{ config, pkgs, ... }:
+
+{
+  services.nginx.httpConfig = ''
+    server {
+      listen [::]:443;
+      listen 443;
+      server_name gabrielebner.at www.gabrielebner.at 2b7e.org www.2b7e.org www.gebner.org;
+
+      ssl on;
+      ssl_certificate_key /etc/sslcerts/key.pem;
+      ssl_certificate /etc/sslcerts/fullchain.pem;
+      ssl_dhparam /etc/nginx/dhparam.pem;
+      ssl_protocols TLSv1.1 TLSv1.2;
+      ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
+      ssl_prefer_server_ciphers on;
+      add_header Strict-Transport-Security max-age=15768000;
+      ssl_stapling on;
+      ssl_stapling_verify on;
+
+      location / {
+        rewrite ^(.*) https://gebner.org$1 permanent;
+      }
+    }
+
+    server {
+      listen [::]:443;
+      listen 443;
+      server_name gebner.org;
+
+      ssl on;
+      ssl_certificate_key /etc/sslcerts/key.pem;
+      ssl_certificate /etc/sslcerts/fullchain.pem;
+      ssl_dhparam /etc/nginx/dhparam.pem;
+      ssl_protocols TLSv1.1 TLSv1.2;
+      ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
+      ssl_prefer_server_ciphers on;
+      add_header Strict-Transport-Security max-age=15768000;
+      ssl_stapling on;
+      ssl_stapling_verify on;
+
+      root /srv/www.gebner.org;
+      error_page 404 403 /pages/404.html;
+    }
+  '';
+}
diff --git a/mastus/configuration.nix b/mastus/configuration.nix
index b347fb5..8dfeee0 100644
--- a/mastus/configuration.nix
+++ b/mastus/configuration.nix
@@ -11,6 +11,7 @@
       ./www.nix
       ./gogs.nix
       ./letsencrypt.nix
+      ./blog.nix
     ];
 
   boot.loader.grub.enable = true;