diff --git a/modules/darwin/base/default.nix b/modules/darwin/base/default.nix
index 97f4e669..6f3342f6 100644
--- a/modules/darwin/base/default.nix
+++ b/modules/darwin/base/default.nix
@@ -7,6 +7,7 @@ in
   imports = [
     ./emacs
     ./nix
+    ./wireguard
   ];
 
   users.users.${username}.home = "/Users/${username}";
diff --git a/modules/darwin/base/wireguard/default.nix b/modules/darwin/base/wireguard/default.nix
new file mode 100644
index 00000000..7b6e94d7
--- /dev/null
+++ b/modules/darwin/base/wireguard/default.nix
@@ -0,0 +1,25 @@
+{ config, ... }:
+
+let
+  data = config.chvp.base.network.wireguard.data;
+  subnet = config.chvp.base.network.wireguard.subnet;
+  pskFile = config.chvp.base.network.wireguard.pskFile;
+in
+{
+  networking.wg-quick.interfaces."wg0" = {
+    address = [ "${data.${config.networking.hostName}.ip}/32" ];
+    autostart = true;
+    dns = [ data.lasting-integrity.ip ];
+    mtu = 1342;
+    peers = [
+      {
+        allowedIPs = [ subnet ];
+        endpoint = "lasting-integrity.vanpetegem.me:51820";
+        presharedKeyFile = pskFile;
+        persistentKeepalive = 25;
+        publicKey = data.lasting-integrity.pubkey;
+      }
+    ];
+    privateKeyFile = data.${config.networking.hostName}.privkeyFile;
+  };
+}
diff --git a/modules/nixos/base/network/wireguard.nix b/modules/nixos/base/network/wireguard.nix
index e797f2dc..b4efd284 100644
--- a/modules/nixos/base/network/wireguard.nix
+++ b/modules/nixos/base/network/wireguard.nix
@@ -1,141 +1,100 @@
 { config, lib, pkgs, ... }:
 
 let
-  data = {
-    fairphone = {
-      pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
-      ip = "10.240.0.4";
-    };
-    kholinar = {
-      pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
-      privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
-      ip = "10.240.0.3";
-    };
-    lasting-integrity = {
-      pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
-      privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
-      ip = "10.240.0.1";
-    };
-    urithiru = {
-      pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
-      privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
-      ip = "10.240.0.2";
-    };
-  };
-  subnet = "10.240.0.0/24";
-  pskFile = config.age.secrets."files/wireguard/psk".path;
+  data = config.chvp.base.network.wireguard.data;
+  subnet = config.chvp.base.network.wireguard.subnet;
+  pskFile = config.chvp.base.network.wireguard.pskFile;
 in
 {
-  options.chvp.base.network.wireguard = {
-    server = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    onCorporate = lib.mkOption {
-      default = false;
-      example = true;
-    };
+  networking.firewall = {
+    allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
+    allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
+    trustedInterfaces = [ "wg0" ];
   };
-  config = {
-    networking.firewall = {
-      allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
-      allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
-      trustedInterfaces = [ "wg0" ];
-    };
-    boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
-    services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
-      enable = true;
-      resolveLocalQueries = true;
-      settings = {
-        server = {
-          interface = [ "10.240.0.1" "127.0.0.1" "::1" ];
-          access-control = [
-            "127.0.0.0/8 allow"
-            "10.240.0.0/24 allow"
-          ];
-          private-domain = "internal";
-          domain-insecure = "internal";
-          local-zone = builtins.map (name: ''"${name}.internal" redirect'') (builtins.attrNames data);
-          local-data = builtins.map (name: ''"${name}.internal IN A ${data.${name}.ip}"'') (builtins.attrNames data);
-        };
-        forward-zone = {
-          name = ''"."'';
-          forward-addr = [
-            "1.1.1.1@853"
-            "1.0.0.1@853"
-            "2606:4700:4700::1111@853"
-            "2606:4700:4700::1001@853"
-          ];
-          forward-tls-upstream = "yes";
-        };
+  boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
+  services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
+    enable = true;
+    resolveLocalQueries = true;
+    settings = {
+      server = {
+        interface = [ "10.240.0.1" "127.0.0.1" "::1" ];
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.240.0.0/24 allow"
+        ];
+        private-domain = "internal";
+        domain-insecure = "internal";
+        local-zone = builtins.map (name: ''"${name}.internal" redirect'') (builtins.attrNames data);
+        local-data = builtins.map (name: ''"${name}.internal IN A ${data.${name}.ip}"'') (builtins.attrNames data);
+      };
+      forward-zone = {
+        name = ''"."'';
+        forward-addr = [
+          "1.1.1.1@853"
+          "1.0.0.1@853"
+          "2606:4700:4700::1111@853"
+          "2606:4700:4700::1001@853"
+        ];
+        forward-tls-upstream = "yes";
       };
     };
-    systemd = {
-      network = {
-        netdevs.wg0 = {
-          enable = true;
-          netdevConfig = {
-            Name = "wg0";
-            Kind = "wireguard";
-            MTUBytes = "1342";
+  };
+  systemd = {
+    network = {
+      netdevs.wg0 = {
+        enable = true;
+        netdevConfig = {
+          Name = "wg0";
+          Kind = "wireguard";
+          MTUBytes = "1342";
+        };
+        wireguardConfig =
+          if config.chvp.base.network.wireguard.server then {
+            PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
+            ListenPort = 51820;
+          } else {
+            PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
           };
-          wireguardConfig =
-            if config.chvp.base.network.wireguard.server then {
-              PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
-              ListenPort = 51820;
-            } else {
-              PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
-            };
-          wireguardPeers =
-            if config.chvp.base.network.wireguard.server then
-              (builtins.map
-                (name: {
-                  PublicKey = data.${name}.pubkey;
-                  AllowedIPs = "${data.${name}.ip}/32";
-                  PresharedKeyFile = pskFile;
-                })
-                (builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
-            else
-              ([{
-                PublicKey = data.lasting-integrity.pubkey;
-                AllowedIPs = subnet;
-                Endpoint =
-                  if config.chvp.base.network.wireguard.onCorporate
-                  then "127.0.0.1:51820"
-                  else "lasting-integrity.vanpetegem.me:51820";
+        wireguardPeers =
+          if config.chvp.base.network.wireguard.server then
+            (builtins.map
+              (name: {
+                PublicKey = data.${name}.pubkey;
+                AllowedIPs = "${data.${name}.ip}/32";
                 PresharedKeyFile = pskFile;
-                PersistentKeepalive = 25;
-              }]);
-        };
-        networks.wg0 = {
-          enable = true;
-          name = "wg0";
-          address = [ "${data.${config.networking.hostName}.ip}/32" ];
-          domains = [ "internal" ];
-          dns = [ data.lasting-integrity.ip ];
-          linkConfig.MTUBytes = "1342";
-          routes = [
-            (
-              if config.chvp.base.network.wireguard.server then {
-                Gateway = "${data.${config.networking.hostName}.ip}";
-                Destination = subnet;
-              } else {
-                Gateway = "${data.lasting-integrity.ip}";
-                Destination = subnet;
-                GatewayOnLink = true;
-              }
-            )
-          ];
-        };
+              })
+              (builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
+          else
+            ([{
+              PublicKey = data.lasting-integrity.pubkey;
+              AllowedIPs = subnet;
+              Endpoint = "lasting-integrity.vanpetegem.me:51820";
+              PresharedKeyFile = pskFile;
+              PersistentKeepalive = 25;
+            }]);
+      };
+      networks.wg0 = {
+        enable = true;
+        name = "wg0";
+        address = [ "${data.${config.networking.hostName}.ip}/32" ];
+        domains = [ "internal" ];
+        dns = [ data.lasting-integrity.ip ];
+        linkConfig.MTUBytes = "1342";
+        routes = [
+          (
+            if config.chvp.base.network.wireguard.server then {
+              Gateway = "${data.${config.networking.hostName}.ip}";
+              Destination = subnet;
+            } else {
+              Gateway = "${data.lasting-integrity.ip}";
+              Destination = subnet;
+              GatewayOnLink = true;
+            }
+          )
+        ];
       };
     };
-    age.secrets."files/wireguard/psk" = {
-      file = ../../../../secrets/files/wireguard/psk.age;
-      owner = "systemd-network";
-    };
-    age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
-      file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
-      owner = "systemd-network";
-    };
   };
+  age.secrets."files/wireguard/psk".owner = "systemd-network";
+  age.secrets."files/wireguard/${config.networking.hostName}.privkey".owner = "systemd-network";
 }
diff --git a/modules/shared/base/default.nix b/modules/shared/base/default.nix
index 2aa491a7..c9270bd0 100644
--- a/modules/shared/base/default.nix
+++ b/modules/shared/base/default.nix
@@ -6,6 +6,7 @@
     ./nix
     ./phone-push
     ./tmux
+    ./wireguard
     ./zfs
     ./zsh
   ];
diff --git a/modules/shared/base/wireguard/default.nix b/modules/shared/base/wireguard/default.nix
new file mode 100644
index 00000000..418cd5d0
--- /dev/null
+++ b/modules/shared/base/wireguard/default.nix
@@ -0,0 +1,56 @@
+{ config, lib, ... }:
+
+let
+  data = {
+    fairphone = {
+      pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
+      ip = "10.240.0.4";
+    };
+    kholinar = {
+      pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
+      privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
+      ip = "10.240.0.3";
+    };
+    lasting-integrity = {
+      pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
+      privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
+      ip = "10.240.0.1";
+    };
+    thaylen-city = {
+      pubkey = "O0q2/W7dRM4LvAL9MSDZqAbGSzqi8AHLVl1sJsRDsUY=";
+      privkeyFile = config.age.secrets."files/wireguard/thaylen-city.privkey".path;
+      ip = "10.240.0.5";
+    };
+    urithiru = {
+      pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
+      privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
+      ip = "10.240.0.2";
+    };
+  };
+  subnet = "10.240.0.0/24";
+  pskFile = config.age.secrets."files/wireguard/psk".path;
+in
+{
+  options.chvp.base.network.wireguard = {
+    server = lib.mkOption {
+      default = false;
+      example = true;
+    };
+    data = lib.mkOption {
+      default = data;
+      readOnly = true;
+    };
+    subnet = lib.mkOption {
+      default = subnet;
+      readOnly = true;
+    };
+    pskFile = lib.mkOption {
+      default = pskFile;
+      readOnly = true;
+    };
+  };
+  config = {
+    age.secrets."files/wireguard/psk".file = ../../../../secrets/files/wireguard/psk.age;
+    age.secrets."files/wireguard/${config.networking.hostName}.privkey".file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
+  };
+}
diff --git a/secrets.nix b/secrets.nix
index 92a82eb9..23edb2e1 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -98,6 +98,7 @@ in
 
   "secrets/files/wireguard/kholinar.privkey.age".publicKeys = [ kholinar ] ++ users;
   "secrets/files/wireguard/lasting-integrity.privkey.age".publicKeys = [ lasting-integrity ] ++ users;
+  "secrets/files/wireguard/thaylen-city.privkey.age".publicKeys = [ thaylen-city ] ++ users;
   "secrets/files/wireguard/urithiru.privkey.age".publicKeys = [ urithiru ] ++ users;
   "secrets/files/wireguard/psk.age".publicKeys = hosts ++ users;
 
diff --git a/secrets/files/wireguard/thaylen-city.privkey.age b/secrets/files/wireguard/thaylen-city.privkey.age
new file mode 100644
index 00000000..f97f6170
--- /dev/null
+++ b/secrets/files/wireguard/thaylen-city.privkey.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 KOkamg Ave15/4+uu5FWfIK1qLwImESyCDLzilWQeuNiim7MHc
+yU/8z7o6CAQdeoXwOPL6tdJ17kV9Q/jWRZldPk4m9so
+-> ssh-ed25519 s9rb8g r/CcbdZE6VCXnb2VbVFJCbcn/ANYIja0ulmr81tydhQ
+KiKlxc6G1ry4/ryYZ6hoKNJPvLGaN+Q4L2oPqp+3Zbs
+-> ssh-ed25519 +xxExQ TlRgGa91hF8kxkdVKyMQSe0A+8LRYRA270vVUnz4ySs
+9uRwCJxDtnOssBji90+WHg6S+0vohS889YxX47J6sPI
+--- Wgz5JZUMJpoXP/lEXZKIfGVyMdvgMcNeVpzOZ/FmDT0
+G�1N�;^ۊԌ�,�w��NM�.)���Tu}�J`��_�W�����Ѭ�
+'.que��`�r��E����+��V�ĕ
\ No newline at end of file