diff --git a/flake.lock b/flake.lock
index 158e19c..e49aea6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -936,11 +936,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1666166753,
-        "narHash": "sha256-Gev83ZYEkEEXKcz+ChNajNzzuqPodjVbSlgdHLHXtVs=",
+        "lastModified": 1674110639,
+        "narHash": "sha256-IpvJcMtRxcUM4gk8Ha0yKsIJs7Dmo+r9XBb8wUM2sDo=",
         "ref": "main",
-        "rev": "c5c4fad9987a0aaab4d2b072fe40ec55f15462d2",
-        "revCount": 39,
+        "rev": "ef5f10f16f670e26c950bacf95d3d0ec90f0a371",
+        "revCount": 40,
         "type": "git",
         "url": "ssh://gitea@git.ingolf-wagner.de/palo/nixos-secrets.git"
       },
diff --git a/nixos/machines/pepe/configuration.nix b/nixos/machines/pepe/configuration.nix
index acebc02..b2f3154 100644
--- a/nixos/machines/pepe/configuration.nix
+++ b/nixos/machines/pepe/configuration.nix
@@ -21,6 +21,7 @@
     ./taskwarrior-pushover.nix
     #./neo4j.nix
     ./jellyfin.nix
+    ./wireguard.nix
 
   ];
 
diff --git a/nixos/machines/pepe/wireguard.nix b/nixos/machines/pepe/wireguard.nix
new file mode 100644
index 0000000..982f8ec
--- /dev/null
+++ b/nixos/machines/pepe/wireguard.nix
@@ -0,0 +1,30 @@
+{ pkgs, config, ... }:
+{
+  networking.firewall.trustedInterfaces = [ "wg0" ];
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+  sops.secrets.wireguard_private = { };
+
+
+  # Enable WireGuard
+  networking.wg-quick.interfaces = {
+    # Hub and Spoke Setup
+    # https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config/
+    wg0 = {
+      address = [ "10.100.0.2/32" ];
+      listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+      privateKeyFile = config.sops.secrets.wireguard_private.path;
+      mtu = 1280;
+
+      # server
+      peers = [
+        {
+          # robi
+          publicKey = "uWR93xJe5oEbX3DsAYpOS9CuSg1VmXEQxJzdlJpe3DU=";
+          allowedIPs = [ "10.100.0.1/24" ];
+          endpoint = "ingolf-wagner.de:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}
diff --git a/nixos/machines/robi/configuration.nix b/nixos/machines/robi/configuration.nix
index df558be..90f7639 100644
--- a/nixos/machines/robi/configuration.nix
+++ b/nixos/machines/robi/configuration.nix
@@ -27,6 +27,7 @@
     ./transmission2.nix
     ./vaultwarden.nix
     ./nginx.nix
+    ./wireguard.nix
 
 
     #../../system/server
diff --git a/nixos/machines/robi/wireguard.nix b/nixos/machines/robi/wireguard.nix
new file mode 100644
index 0000000..9c6f2c7
--- /dev/null
+++ b/nixos/machines/robi/wireguard.nix
@@ -0,0 +1,45 @@
+{ pkgs, config, ... }:
+{
+  networking.firewall.trustedInterfaces = [ "wg0" ];
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+  sops.secrets.wireguard_private = { };
+  boot.kernel.sysctl."net.ipv4.ip_forward" = true;
+
+  # Enable WireGuard
+  networking.wg-quick.interfaces = {
+    # Hub and Spoke Setup
+    # https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config/
+    wg0 = {
+      address = [ "10.100.0.1/32" ];
+      listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+      privateKeyFile = config.sops.secrets.wireguard_private.path;
+      mtu = 1280;
+
+      postUp = ''
+        ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
+      '';
+      postDown = ''
+        ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
+      '';
+
+      # clients
+      peers = [
+        {
+          # pepe
+          publicKey = "wb54y/fG8ocSH9QrDmfajez/fUcJBZK369xLu37XBHk=";
+          allowedIPs = [ "10.100.0.2/32" ];
+        }
+        {
+          # sterni
+          publicKey = "SdMRgC5IM7dywzZxLAHm45cpj9J3IENTMClZm1BxbV4=";
+          allowedIPs = [ "10.100.0.3/32" ];
+        }
+        {
+          # iphone
+          publicKey = "XPVzH+wBLsqukTHHjngkGJhYN0nRdQ7esadiimMJQnI=";
+          allowedIPs = [ "10.100.0.4/32" ];
+        }
+      ];
+    };
+  };
+}
diff --git a/nixos/machines/sterni/configuration.nix b/nixos/machines/sterni/configuration.nix
index 736919c..ca17c47 100644
--- a/nixos/machines/sterni/configuration.nix
+++ b/nixos/machines/sterni/configuration.nix
@@ -14,6 +14,7 @@
     #./wireshark.nix
     ./scanner.nix
     ./qemu.nix
+    ./wireguard.nix
 
   ];
 
diff --git a/nixos/machines/sterni/wireguard.nix b/nixos/machines/sterni/wireguard.nix
new file mode 100644
index 0000000..682651d
--- /dev/null
+++ b/nixos/machines/sterni/wireguard.nix
@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+  sops.secrets.wireguard_private = { };
+
+  # Enable WireGuard
+  networking.wg-quick.interfaces = {
+    # Hub and Spoke Setup
+    # https://www.procustodibus.com/blog/2020/11/wireguard-hub-and-spoke-config/
+    wg0 = {
+      address = [ "10.100.0.3/32" ];
+      listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+      privateKeyFile = config.sops.secrets.wireguard_private.path;
+      mtu = 1280;
+
+      peers = [
+        {
+          # robi
+          publicKey = "uWR93xJe5oEbX3DsAYpOS9CuSg1VmXEQxJzdlJpe3DU=";
+          allowedIPs = [ "10.100.0.1/24" ];
+          endpoint = "ingolf-wagner.de:51820";
+        }
+      ];
+    };
+  };
+}