diff --git a/machines/hosts.nix b/machines/hosts.nix
index 5a264b8..29bbe9c 100644
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -133,7 +133,12 @@ in
         network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
       };
 
-      # last host id: 20
+      wordpress = {
+        type = "microvm";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
+      };
+
+      # last host id: 21
     };
   };
 }
diff --git a/machines/wordpress/configuration.nix b/machines/wordpress/configuration.nix
new file mode 100644
index 0000000..63aba76
--- /dev/null
+++ b/machines/wordpress/configuration.nix
@@ -0,0 +1,139 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# 1. copy wp folder to host
+# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
+# 3. create user through webinterface
+# 4. delete hello world post
+# 5. run importer
+
+with lib;
+
+let
+
+  user = "wordpress";
+  stateDir = "/var/lib/wordpress/rm16bleibt.org";
+  webserver = config.services.nginx;
+  uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
+  fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";
+
+in {
+  networking = {
+    hostName = mkDefault "wordpress";
+    useDHCP = false;
+  };
+
+  imports = [
+    inputs.self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+  };
+
+  users.users.wordpress = {
+    group = webserver.group;
+    isSystemUser = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d '${stateDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
+    "d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+  ];
+
+  services.phpfpm.pools = {
+    "wordpress-rm16bleibt.org" = {
+      user = user;
+      group = webserver.group;
+      settings = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+        "listen.owner" = webserver.user;
+        "listen.group" = webserver.group;
+      };
+    };
+  };
+
+  services.mysql = {
+    enable = true;
+    #package = mkDefault pkgs.mariadb;
+    package = pkgs.mysql84;
+    ensureDatabases = ["wordpress"];
+    ensureUsers = [
+      {
+        name = "wordpress";
+        ensurePermissions = {
+          "wordpress.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."rm16bleibt.org" = {
+      #serverName = "rm16bleibt.org";
+      root = "/var/lib/wordpress/rm16bleibt.org";
+      extraConfig = ''
+        index index.php;
+      '';
+      locations = {
+        "/" = {
+          priority = 200;
+          extraConfig = ''
+            try_files $uri $uri/ /index.php$is_args$args;
+          '';
+        };
+        "~ \\.php$" = {
+          priority = 500;
+          extraConfig = ''
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
+            fastcgi_index index.php;
+            include "${config.services.nginx.package}/conf/fastcgi.conf";
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
+
+            # Mitigate https://httpoxy.org/ vulnerabilities
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_intercept_errors off;
+            fastcgi_buffer_size 16k;
+            fastcgi_buffers 4 16k;
+            fastcgi_connect_timeout 300;
+            fastcgi_send_timeout 300;
+            fastcgi_read_timeout 300;
+          '';
+        };
+        "~ /\\." = {
+          priority = 800;
+          extraConfig = "deny all;";
+        };
+        "~* /(?:uploads|files)/.*\\.php$" = {
+          priority = 900;
+          extraConfig = "deny all;";
+        };
+        "~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
+          priority = 1000;
+          extraConfig = ''
+            expires max;
+            log_not_found off;
+          '';
+        };
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+