diff --git a/hosts/physique/hyponix/services/wireguard.nix b/hosts/physique/hyponix/services/wireguard.nix
new file mode 100644
index 0000000..c8c412b
--- /dev/null
+++ b/hosts/physique/hyponix/services/wireguard.nix
@@ -0,0 +1,37 @@
+{config, ...}:
+let
+  listenPort = 53141;
+in
+{
+  networking.firewall.allowedUDPPorts = [ listenPort ];
+
+  age.secrets.wg-key-hyponix = {
+    file = "../../../../secrets/services/wireguard/wg-key-hyponix.age";
+  };
+  
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      wg0 = {
+        ips = ["10.100.10.2/24" "fd00::2/7"];
+
+        listenPort = listenPort;
+
+        privateKeyFile = config.age.secrets.wg-key-hyponix.path;
+
+        peers = [
+          {
+            name = "pixos";
+            publicKey = "kaPe5pz2NTW9yMSy92wCV6WQF/sDYK6hHf8e9yN1ZlY=";
+            allowedIPs = [
+              "fd00::1/128"
+              "10.100.0.1/32"
+            ];
+            endpoint = "pixos.bytestall.info:${listenPort}";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}
diff --git a/secrets.nix b/secrets.nix
index ede176e..417b0e5 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -8,10 +8,11 @@ in
 let
   admins = [ lzebulon ];
   physiques = [ hyponix ];
-  servers = hyponix;
+  servers = [ hyponix ];
 in
 {
   "secrets/services/forgejo/forgejo-runner-token-1.age".publicKeys = admins ++ [ hyponix ];
   "secrets/services/searxng.age".publicKeys = admins ++ [ hyponix ];
+  "secrets/services/wireguard/wg-key-hyponix.age".publicKeys = admins ++ [hyponix];
 }
   
diff --git a/secrets/services/wireguard/wg-key-hyponix.age b/secrets/services/wireguard/wg-key-hyponix.age
new file mode 100644
index 0000000..7198d2f
Binary files /dev/null and b/secrets/services/wireguard/wg-key-hyponix.age differ