diff --git a/web/sites/99-fallback-cupcake-2-kugel b/web/sites/99-fallback-cupcake-2-kugel
new file mode 100644
index 0000000000000000000000000000000000000000..34f112b2e8b5d2bb5f8225d79e0671097d27a196
--- /dev/null
+++ b/web/sites/99-fallback-cupcake-2-kugel
@@ -0,0 +1,58 @@
+
+resolver 213.186.33.99;
+
+server {
+	listen   80 default_server; ## listen for ipv4; this line is default and implied
+	listen   [::]:80 default_server ipv6only=on; ## listen for ipv6
+
+	root /var/www/tudo.re;
+
+	# Make site accessible from http://localhost/
+    server_name _;
+    location @tokugel {
+        # First attempt to serve request as file, then
+        # as directory, then fall back to displaying a 404.
+        # try_files $uri $uri/ /index.html;
+        # Uncomment to enable naxsi on this location
+        # include /etc/nginx/naxsi.rules
+        proxy_redirect off;
+        proxy_set_header Host $host;
+        proxy_pass http://kugel.tudo.re;
+    }
+
+    location '/.well-known/acme-challenge' {
+        default_type "text/plain";
+        alias /tmp/letsencrypt-auto/.well-known/acme-challenge;
+        try_files $uri @tokugel;
+    }
+
+    location / {
+	    rewrite ^(.*)$ https://$host$1 permanent;
+    }
+}
+
+
+server {
+    listen 443 default_server;
+	listen [::]:443 default_server ipv6only=on;
+	server_name _;
+
+	root /var/www/tudo.re;
+	index index.html index.htm;
+
+	ssl on;
+	# todo: replace /tmp/ by /etc/letsencrypt/live
+	ssl_certificate /tmp/www.tudo.re/fullchain.pem;
+	ssl_certificate_key /tmp/www.tudo.re/privkey.pem;
+
+    location / {
+        # First attempt to serve request as file, then
+        # as directory, then fall back to displaying a 404.
+        # try_files $uri $uri/ /index.html;
+        # Uncomment to enable naxsi on this location
+        # include /etc/nginx/naxsi.rules
+        proxy_redirect off;
+        proxy_set_header Host $host;
+        proxy_pass https://kugel.tudo.re;
+    }
+}