diff --git a/components/network/tinc/private.nix b/components/network/tinc/private.nix
index 9867819..7819ffc 100644
--- a/components/network/tinc/private.nix
+++ b/components/network/tinc/private.nix
@@ -10,14 +10,11 @@
 }:
 let
   hosts = {
-    mobi = "10.23.42.23";
-    sterni = "10.23.42.24";
     bobi = "10.23.42.25";
-    pepe = "10.23.42.26";
-    cream = "10.23.42.27";
-    chungus = "10.23.42.28";
     cherry = "10.23.42.29";
-    robi = "10.23.42.111";
+    chungus = "10.23.42.28";
+    cream = "10.23.42.27";
+    mobi = "10.23.42.23";
     orbi = "10.23.42.100";
   };
   subDomains = {
@@ -25,21 +22,9 @@ let
     "transmission2.orbi" = hosts.orbi;
     "sonarr.orbi" = hosts.orbi;
     "radarr.orbi" = hosts.orbi;
+    "lidarr.orbi" = hosts.orbi;
     "prowlarr.orbi" = hosts.orbi;
     "photoprism.orbi" = hosts.orbi;
-    # robi
-    "grafana.robi" = hosts.robi;
-    "loki.robi" = hosts.robi;
-    "prometheus.robi" = hosts.robi;
-    "sync.robi" = hosts.robi;
-    "transmission.robi" = hosts.robi;
-    "transmission2.robi" = hosts.robi;
-    "sonarr.robi" = hosts.robi;
-    "radarr.robi" = hosts.robi;
-    "tdarr.robi" = hosts.robi;
-    "prowlarr.robi" = hosts.robi;
-    "jellyseerr.robi" = hosts.robi;
-    "unmanic.robi" = hosts.robi;
     # chungus
     "de.tts.chungus" = hosts.chungus;
     "en.tts.chungus" = hosts.chungus;
diff --git a/machines/chungus/configuration.nix b/machines/chungus/configuration.nix
index dcb6b29..76c025b 100644
--- a/machines/chungus/configuration.nix
+++ b/machines/chungus/configuration.nix
@@ -59,6 +59,7 @@
 
   components.nixos.boot.enable = true;
   components.nixos.boot.kernelModules = [ "e1000e" ];
+  components.nixos.boot.tor.enable = false;
 
   components.monitor.enable = true;
   components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
diff --git a/machines/chungus/sync-rbackup.nix b/machines/chungus/sync-rbackup.nix
index 2213cf6..a228176 100644
--- a/machines/chungus/sync-rbackup.nix
+++ b/machines/chungus/sync-rbackup.nix
@@ -34,6 +34,12 @@ in
       dst = "/media/arr/sonarr";
       delete = false;
     };
+    lidarr = {
+      sshKeyPath = config.clan.core.facts.services.rbackup.secret."ssh.rbackup.id_ed25519".path;
+      src = "root@orbi.${tld}:/media/arr/lidarr";
+      dst = "/media/arr/lidarr";
+      delete = false;
+    };
   };
 
 
diff --git a/machines/orbi/media-arr.nix b/machines/orbi/media-arr.nix
index 1925a57..1ccf76d 100644
--- a/machines/orbi/media-arr.nix
+++ b/machines/orbi/media-arr.nix
@@ -1,6 +1,6 @@
 { config, ... }:
 {
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 7878 8989 ];
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 7878 8989 8686 ];
 
   # download series
   services.sonarr = {
@@ -16,6 +16,13 @@
     user = "media";
   };
 
+  # download music
+  services.lidarr = {
+    enable = true;
+    group = "media";
+    user = "media";
+  };
+
   # better indexer apis
   services.prowlarr = {
     enable = true;
@@ -59,6 +66,18 @@
         proxyWebsockets = true;
       };
     };
+    "lidarr.${config.networking.hostName}.private" = {
+      serverAliases = [ "lidarr.ingolf-wagner.de" ];
+      extraConfig = ''
+        allow ${config.tinc.private.subnet};
+        allow ${config.wireguard.wg0.subnet};
+        deny all;
+      '';
+      locations."/" = {
+        proxyPass = "http://localhost:8686";
+        proxyWebsockets = true;
+      };
+    };
     "prowlarr.${config.networking.hostName}.private" = {
       extraConfig = ''
         allow ${config.tinc.private.subnet};