diff --git a/base.nix b/base.nix
index 89b3bae..5de4683 100644
--- a/base.nix
+++ b/base.nix
@@ -6,6 +6,7 @@
   #luj.secrets.enable = true;
   luj.ssh-server.enable = true;
   luj.programs.mosh.enable = true;
+  luj.deployment.enable = true;
 
   sops.defaultSopsFile = ./secrets/secrets.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
diff --git a/machines/core-security/default.nix b/machines/core-security/default.nix
index 9a9a933..3476571 100644
--- a/machines/core-security/default.nix
+++ b/machines/core-security/default.nix
@@ -14,12 +14,6 @@
   boot.loader.grub.device = "/dev/sda";
   boot.loader.grub.useOSProber = true;
 
-  deployment = {
-    targetHost = "core-security.luj";
-    targetPort = 45;
-    targetUser = "root";
-  };
-
   security.acme.defaults.email = "julien@malka.sh";
 
   networking.hostName = "core-security"; # Define your hostname.
diff --git a/machines/lambda/default.nix b/machines/lambda/default.nix
index 97d83e7..77f1c91 100644
--- a/machines/lambda/default.nix
+++ b/machines/lambda/default.nix
@@ -12,6 +12,8 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
+  deployment.buildOnTarget = true;
+
   networking.hostName = "lambda";
 
   time.timeZone = "Europe/Paris";
@@ -56,7 +58,7 @@
     };
   };
 
-  security.acme.certs."uptime.luj".server = "https://ca.luj:8444/acme/acme/directory";
+  security.acme.certs."uptime.luj".server = "https://ca.luj/acme/acme/directory";
 
   services.nginx.virtualHosts."uptime.luj" = {
     forceSSL = true;
@@ -92,7 +94,7 @@
   };
 
 
-  security.acme.certs."prometheus.luj".server = "https://ca.luj:8444/acme/acme/directory";
+  security.acme.certs."prometheus.luj".server = "https://ca.luj/acme/acme/directory";
   services.nginx.virtualHosts."prometheus.luj" = {
     forceSSL = true;
     enableACME = true;
diff --git a/modules/deployment/default.nix b/modules/deployment/default.nix
new file mode 100644
index 0000000..ae87716
--- /dev/null
+++ b/modules/deployment/default.nix
@@ -0,0 +1,22 @@
+{ lib, pkgs, config, ... }:
+with lib;
+let
+  cfg = config.luj.deployment;
+  hostname = config.networking.hostName;
+in
+{
+
+  options.luj.deployment.enable = mkEnableOption "activate deployment on machine";
+
+  config = mkIf cfg.enable {
+
+    deployment = {
+      targetHost = "${hostname}.${lib.luj.machines.${hostname}.tld}";
+      targetPort = 45;
+      targetUser = "root";
+      allowLocalDeployment = true;
+    };
+
+  };
+}
+