diff --git a/hosts/containers/c3d2-web/default.nix b/hosts/containers/c3d2-web/default.nix
index dc6e92ed..7ab192e9 100644
--- a/hosts/containers/c3d2-web/default.nix
+++ b/hosts/containers/c3d2-web/default.nix
@@ -19,6 +19,7 @@ in
   services.nginx = {
     enable = true;
     virtualHosts = {
+      # c3d2
       "www.c3d2.de" = {
         default = true;
         serverAliases = [
@@ -27,31 +28,29 @@ in
           "cccdd.de" "www.cccdd.de"
           "dresden.ccc.de" "www.dresden.ccc.de"
         ];
-        # TODO:
-        # enableACME = true;
-        # forceSSL = true;
+        enableACME = true;
+        forceSSL = true;
         root = "${webroot}/c3d2";
         extraConfig = ''
-          index portal.html;
+          index portal.html index.html;
         '';
         locations = {
           # SpaceAPI
           "/status.png".proxyPass = "http://[${hostRegistry.hosts.spaceapi.ip6}]:3000/status.png";
           "/spaceapi.json".proxyPass = "http://[${hostRegistry.hosts.spaceapi.ip6}]:3000/spaceapi.json";
           # Jabber
-          # TODO: does this work?
           "/http-bind".proxyPass = "http://jabber.c3d2.de:5280/http-bind";
-          # TODO: websockets too?
         };
       };
 
+      # datenspuren
       "datenspuren.de" = {
         serverAliases = [
           "www.datenspuren.de"
+          "ds.c3d2.de" "datenspuren.c3d2.de"
         ];
-        # TODO:
-        # enableACME = true;
-        # forceSSL = true;
+        enableACME = true;
+        forceSSL = true;
         root = "${webroot}/c3d2/datenspuren";
         extraConfig = ''
           index index.html;
@@ -59,6 +58,18 @@ in
         '';
       };
 
+      # autotopia
+      "autotopia.c3d2.de" = {
+        enableACME = true;
+        forceSSL = true;
+        root = "${webroot}/c3d2/autotopia";
+        extraConfig = ''
+          index index.html;
+          rewrite ^/$ /2020/ redirect;
+        '';
+      };
+
+      # hooks, logs
       "c3d2-web.serv.zentralwerk.org" = {
         enableACME = true;
         forceSSL = true;
@@ -174,5 +185,4 @@ in
         ProtectSystem = "full";
       };
     };
-  # TODO: letsencrypt /.well-known before DNS switch
 }
diff --git a/hosts/containers/public-access-proxy/default.nix b/hosts/containers/public-access-proxy/default.nix
index 355d2c28..7f9e8db9 100644
--- a/hosts/containers/public-access-proxy/default.nix
+++ b/hosts/containers/public-access-proxy/default.nix
@@ -47,6 +47,18 @@
         hostNames = [ "sdr.hq.c3d2.de" ];
         proxyTo.host = hostRegistry.hosts.radiobert.ip4;
       }
+      {
+        hostNames = [
+          "www.c3d2.de" "c3d2.de"
+          "c3dd.de" "www.c3dd.de"
+          "cccdd.de" "www.cccdd.de"
+          "dresden.ccc.de" "www.dresden.ccc.de"
+          "datenspuren.de" "www.datenspuren.de"
+          "datenspuren.c3d2.de" "ds.c3d2.de"
+          "autotopia.c3d2.de"
+        ];
+        proxyTo.host = hostRegistry.hosts.c3d2-web.ip4;
+      }
     ];
   };