diff --git a/components/network/sshd/default.nix b/components/network/sshd/default.nix
index a4f9737..95bad56 100644
--- a/components/network/sshd/default.nix
+++ b/components/network/sshd/default.nix
@@ -38,7 +38,6 @@ in
 {
 
   imports = [
-    ./known-hosts-bootup.nix
     ./known-hosts-public.nix
   ];
 
diff --git a/components/network/sshd/known-hosts-bootup.nix b/components/network/sshd/known-hosts-bootup.nix
deleted file mode 100644
index 769d185..0000000
--- a/components/network/sshd/known-hosts-bootup.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-{ config, lib, pkgs, private_assets, ... }:
-with lib;
-let
-
-  computers = {
-    pepe = {
-      onionId = fileContents "${private_assets}/onion_id_pepe";
-      # SHA256:aOZbqpgc5CcTNtRAzjuG/0BQZ9MF5c9u/N+UC88y8kI
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5K4UHD8cIcXB33UiOj5vyXJj+4CyyiLFDMwcyad92a";
-    };
-    chungus = {
-      onionId = fileContents "${private_assets}/onion_id_chungus";
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJpPfGAiARWgZbID+2IIT9dbo/PqgG/pkFsBaBUKGiu";
-    };
-  };
-
-in
-{
-
-  config = mkIf (config.components.network.sshd.enable) {
-
-    services.openssh.knownHosts = {
-      "robi-init-ssh" = {
-        hostNames = [
-          "[robi]:2222"
-          "[144.76.13.147]:2222"
-        ];
-        # SHA256:rhvbJ84cPXXezaoJiY7tFsG8CJxI2F/lLKz8q+xUW+g
-        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKQ7XB6Cs9FJmHkuZ9ihbj76WsK0uJBh882ceyKaaKJ";
-      };
-    } // (mapAttrs'
-      (name:
-        { onionId, publicKey, ... }: {
-          name = "${name}-init-ssh";
-          value = {
-            hostNames = [ "[${onionId}]:2222" ];
-            inherit publicKey;
-          };
-        })
-      computers);
-
-    environment.systemPackages =
-      let
-
-        sshTor = mapAttrsToList
-          (name:
-            { onionId, ... }:
-            pkgs.writers.writeDashBin "ssh-boot-to-${name}-via-tor" ''
-              ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222
-            '')
-          computers;
-
-        passwordTor = mapAttrsToList
-          (name:
-            { onionId, ... }:
-            pkgs.writers.writeDashBin "unlock-boot-${name}-via-tor" ''
-              ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222 '
-              echo -n "enter password : "
-              read password
-              echo "$password" > /crypt-ramfs/passphrase
-              '
-            '')
-          computers;
-
-        unlockInit = mapAttrsToList
-          (name:
-            { public_ip, ... }:
-            pkgs.writers.writeDashBin "unlock-boot-${name}" ''
-              ${pkgs.openssh}/bin/ssh root@${public_ip} -p 2222 '
-              echo -n "enter password : "
-              read password
-              echo "$password" | systemctl default
-              '
-            '')
-          {
-            orbi = {
-              public_ip = "95.216.66.212";
-            };
-          };
-
-      in
-      sshTor ++ passwordTor ++ unlockInit;
-
-  };
-}
diff --git a/components/nixos/tor-ssh.nix b/components/nixos/tor-ssh.nix
index d311506..0ba6b0f 100644
--- a/components/nixos/tor-ssh.nix
+++ b/components/nixos/tor-ssh.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, factsGenerator, clanLib, ... }:
 with lib;
 with types;
 
@@ -17,19 +17,96 @@ with types;
         "lspci -v will tell you which kernel module is used for the ethernet interface";
     };
 
-    ssh = {
-
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = config.components.nixos.boot.enable;
-      };
-
+    ssh.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.components.nixos.boot.enable;
+    };
 
+    tor.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.components.nixos.boot.ssh.enable;
     };
   };
 
   config = mkMerge [
 
+    # todo : not working at the moment, because onion hostnames are secrets
+    (
+      let
+        onionIds = clanLib.readFactFromAllMachines "tor.initrd.hostname";
+        generateOnionUnlockScript = machine: onionId: pkgs.writers.writeDashBin "unlock-boot-${machine}-via-tor" ''
+          ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222
+        '';
+      in
+      {
+        # add known hosts
+        services.openssh.knownHosts =
+          mapAttrs
+            (_machine: onionId: {
+              hostNames = [ "[${onionId}]:2222" ];
+            })
+            onionIds;
+
+        # create unlook tor boot script
+        environment.systemPackages =
+          mapAttrsToList generateOnionUnlockScript onionIds;
+      }
+    )
+
+    # tor part
+    # --------
+    (mkIf (config.components.nixos.boot.tor.enable) {
+
+      #services.tor = {
+      #  enable = true;
+      #  client.enable = true;
+      #  relay.onionServices.bootup.map = [{ port = 2222; }];
+      #};
+
+      # tor setup
+      clanCore.facts.services.initrd_tor = factsGenerator.tor { name = "initrd"; };
+
+      boot.initrd.secrets = {
+        "/etc/tor/onion/bootup/tor.priv" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.priv".path;
+        "/etc/tor/onion/bootup/hostname" = config.clanCore.facts.services.initrd_tor.secret."tor.initrd.hostname".path;
+      };
+
+      #boot.initrd.extraUtilsCommands = ''
+      #  copy_bin_and_libs ${pkgs.tor}/bin/tor
+      #'';
+
+      # fixme: this thing is not working for some reason.
+      boot.initrd.systemd.packages = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
+      boot.initrd.systemd.services.tor = {
+        path = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
+        # todo: set wanted by
+        script =
+          let
+            torRc = pkgs.writeText "tor.rc" ''
+              DataDirectory /etc/tor
+              SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+              SOCKSPort 127.0.0.1:9063
+              HiddenServiceDir /etc/tor/onion/bootup
+              HiddenServicePort 2222 127.0.0.1:2222
+            '';
+          in
+          ''
+            echo "tor: preparing onion folder"
+            # have to do this otherwise tor does not want to start
+            chmod -R 700 /etc/tor
+
+            echo "make sure localhost is up"
+            ip a a 127.0.0.1/8 dev lo
+            ip link set lo up
+
+            echo "tor: starting tor"
+            tor -f ${torRc} --verify-config
+            tor -f ${torRc}
+          '';
+      };
+    })
+
+
     # ssh part
     # --------
     (mkIf (config.components.nixos.boot.ssh.enable) {
diff --git a/machines/chungus/configuration.nix b/machines/chungus/configuration.nix
index f82494b..7e13a7c 100644
--- a/machines/chungus/configuration.nix
+++ b/machines/chungus/configuration.nix
@@ -65,14 +65,8 @@
 
   services.printing.enable = false;
 
-  #virtualisation.containers.storage.settings = {
-  #  # fixes: Error: 'overlay' is not supported over zfs, a mount_program is required: backing file system is unsupported for this graph driver
-  #  storage.options.mount_program = "${pkgs.fuse-overlayfs}/bin/fuse-overlayfs";
-  #};
   virtualisation.podman.extraPackages = [ pkgs.zfs ]; # make sure /var/lib/containers/storage is a zfs dataset
 
-  #sops.defaultSopsFile = ../../secrets/chungus.yaml;
-
   networking.hostName = "chungus";
 
   hardware.opengl = {
@@ -85,9 +79,6 @@
     ];
   };
 
-  # just enable lan
-  #networking.dhcpcd.allowInterfaces = [ "enp0s25" ];
-
   # nix-shell -p speedtest_cli --run speedtest
   #configuration.fireqos = {
   #  enable = false;