diff --git a/modules/wireguard.nix b/modules/wireguard.nix
new file mode 100644
index 00000000..1bb0ebd1
--- /dev/null
+++ b/modules/wireguard.nix
@@ -0,0 +1,54 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.mossnet.wg;
+in
+{
+  options = {
+    mossnet.wg = {
+      enable = mkEnableOption "Gain access to all mossnet systems through wireguard, but only if it's already included in the server config";
+      ips = lib.mkOption {
+        type = with types; listOf str;
+        default = { };
+        example = literalExample ''
+          [ "10.0.69.2/24" ];
+        '';
+        description = ''
+          The IP this machine is allowed to connect to
+        '';
+        privateKeyFile = lib.mkOption {
+          type = types.path;
+          default = { };
+          example = literalExample ''
+            /run/agenix/wg-curve
+          '';
+          description = ''
+            The private ssh key file to use to connect!
+            Remember set age.secrets.*.file and age.secrets.*.user
+          '';
+        };
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    networking.firewall.allowedUDPPorts = [ 60990 ];
+    networking.wireguard.interfaces = {
+      wg0 = {
+        ips = cfg.ips;
+        listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+
+        privateKeyFile = cfg.privateKeyFile;
+        peers = [
+          # For a client configuration, one peer entry for the server will suffice.
+          {
+            publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
+            allowedIPs = [ "10.0.69.0/24" ];
+            # Set this to the server IP and port.
+            endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}