diff --git a/flake.lock b/flake.lock
index 556e167..ce60128 100644
--- a/flake.lock
+++ b/flake.lock
@@ -235,11 +235,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1725103162,
-        "narHash": "sha256-Ym04C5+qovuQDYL/rKWSR+WESseQBbNAe5DsXNx5trY=",
+        "lastModified": 1725432240,
+        "narHash": "sha256-+yj+xgsfZaErbfYM3T+QvEE2hU7UuE+Jf0fJCJ8uPS0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "12228ff1752d7b7624a54e9c1af4b222b3c1073b",
+        "rev": "ad416d066ca1222956472ab7d0555a6946746a80",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1725529639,
-        "narHash": "sha256-dRQHGPv6a5sFkIpjhZ1cXLrHG5rfXnVJVE3ETVq1ilY=",
+        "lastModified": 1725541414,
+        "narHash": "sha256-2btQOiIw+yMrxAHzVCp5ou9IbWkzYhQ5dIS3vRO7Sd8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "72cd6b31e8256c9b28939fd02b9f87efafd2375c",
+        "rev": "72c08881a42221c2de613b425b735c4cd7f85d86",
         "type": "github"
       },
       "original": {
diff --git a/nixos/server.nix b/nixos/server.nix
index ec583dc..7039f68 100644
--- a/nixos/server.nix
+++ b/nixos/server.nix
@@ -33,9 +33,9 @@
     ./server/nginx.nix
     ./server/owncast.nix
     ./server/minecraft
-    ./server/tandoor.nix
     ./server/vaultwarden.nix
     ./server/transmission.nix
+    ./server/wireguard.nix
     ./server/misc.nix
 
     # Matrix
diff --git a/nixos/server/firewall.nix b/nixos/server/firewall.nix
index c78d44e..6173789 100644
--- a/nixos/server/firewall.nix
+++ b/nixos/server/firewall.nix
@@ -43,6 +43,7 @@
             chain POSTROUTING {
               type nat hook postrouting priority 100; policy accept;
               oifname "${ips.netInt}" masquerade
+	      ip saddr 10.100.0.0/24 oifname "${ips.netInt}" masquerade comment "WireGuard"
             }
           '';
         };
diff --git a/nixos/server/tandoor.nix b/nixos/server/tandoor.nix
deleted file mode 100644
index b0c3576..0000000
--- a/nixos/server/tandoor.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{outputs, ...}: {
-  services = {
-    tandoor-recipes = {
-      enable = true;
-      port = 5030;
-    };
-    nginx.virtualHosts."recipes.${outputs.secrets.jimDomain}" =  {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:5030";
-        proxyWebsockets = true;
-      };
-    };
-  };
-}
diff --git a/nixos/server/wireguard.nix b/nixos/server/wireguard.nix
new file mode 100644
index 0000000..6873d8a
--- /dev/null
+++ b/nixos/server/wireguard.nix
@@ -0,0 +1,28 @@
+{outputs, ...}: let
+  ips = import ../modules/ips.nix;
+in {
+  # enable NAT
+  networking.nat.enable = true;
+  networking.nat.externalInterface = "${ips.netInt}";
+  networking.nat.internalInterfaces = [ "wg0" ];
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      # Wireguard interface name can be arbitrary
+      wg0 = {
+        # Determines the IP address and subnet of the server's end of the tunnel interface.
+        ips = [ "10.100.0.1/24" ];
+        listenPort = 51820;
+	privateKey = outputs.secrets.wireguardPriv;
+        peers = [
+          { # Jimbo
+            publicKey = outputs.secrets.wirePhonePub;
+            allowedIPs = [ "10.100.0.2/32" ];
+          }
+        ];
+      };
+    };
+  };
+}
diff --git a/secrets.nix b/secrets.nix
index 5ad04f0..bcf084a 100644
Binary files a/secrets.nix and b/secrets.nix differ