diff --git a/host/kastanje.nix b/host/kastanje.nix
index 35b7adb..fd2d88c 100644
--- a/host/kastanje.nix
+++ b/host/kastanje.nix
@@ -28,6 +28,40 @@
 
   networking.hostName = "kastanje"; # Define your hostname.
 
+  networking.wireguard.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    wg0 = {
+      # Determines the IP address and subnet of the client's end of the tunnel interface.
+      ips = [ "192.168.2.7/24" ];
+
+      # Path to the private key file.
+      #
+      # Note: The private key can also be included inline via the privateKey option,
+      # but this makes the private key world-readable; thus, using privateKeyFile is
+      # recommended.
+      privateKeyFile = "/etc/wireguard/privkey";
+
+      peers = [
+        # For a client configuration, one peer entry for the server will suffice.
+        {
+          # Public key of the server (not a file path).
+          publicKey = "EQEle/TXlS3ZE2wPxXhdAdo45dzK+DXi5nglgK6KDXs=";
+
+          # Forward all the traffic via VPN.
+          # allowedIPs = [ "0.0.0.0/0" ];
+          # Or forward only particular subnets
+          allowedIPs = [ "192.168.2.0/24" ];
+
+          # Set this to the server IP and port.
+          endpoint = "root.mgmt.vpn.qo.is:51820";
+
+          # Send keepalives every 25 seconds. Important to keep NAT tables alive.
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
   # Configure network proxy if necessary
   # networking.proxy.default = "http://user:password@proxy:port/";
   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";