diff --git a/config/fudo/system.nix b/config/fudo/system.nix
index b25aaf4..5303a6c 100644
--- a/config/fudo/system.nix
+++ b/config/fudo/system.nix
@@ -20,6 +20,12 @@ in {
       default = [];
       example = ["redis.service"];
     };
+
+    tmpOnTmpfs = mkOption {
+      type = types.bool;
+      description = "Put tmp filesystem on tmpfs (needs enough RAM).";
+      default = true;
+    };
   };
 
   config = mkIf cfg.disableTransparentHugePages {
diff --git a/config/fudo/vpn.nix b/config/fudo/vpn.nix
new file mode 100644
index 0000000..bd0908b
--- /dev/null
+++ b/config/fudo/vpn.nix
@@ -0,0 +1,79 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.fudo.vpn;
+
+  peerOpts = { peer-name, ... }: {
+    options = with types; {
+      public-key = mkOption {
+        type = str;
+        description = "Peer public key.";
+      };
+
+      allowed-ips = mkOption {
+        type = listOf str;
+        description = "List of allowed IP ranges from which this peer can connect.";
+        example = [ "10.100.0.0/16" ];
+        default = [];
+      };
+    };
+  };
+
+in {
+  options.fudo.vpn = with types; {
+    enable = mkEnableOption "Enable Fudo VPN";
+
+    ips = mkOption {
+      type = str;
+      description = "IP range to assign this interface.";
+      default = "10.100.0.0/16";
+    };
+
+    private-key-file = mkOption {
+      type = str;
+      description = "Path to the secret key (generated with wg [genkey/pubkey]).";
+      example = "/path/to/secret.key";
+    };
+
+    listen-port = mkOption {
+      type = port;
+      description = "Port on which to listen for incoming connections.";
+      default = 51820;
+    };
+
+    peers = mkOption {
+      type = listOf str;
+      description = "A list of peers for which to generate config files.";
+      default = [];
+    };
+
+    peers = mkOption {
+      type = loaOf (submodule peerOpts);
+      description = "A list of peers allowed to connect.";
+      default = {};
+      example = {
+        peer0 = {
+          public-key = "xyz";
+          allowed-ips = ["10.100.1.0/24"];
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.wireguard = {
+      enable = true;
+      interfaces.wgtun0 = {
+        generatePrivateKeyFile = false;
+        ips = [ cfg.ips ];
+        listenPort = cfg.listen-port;
+        peers = mapAttrsToList (peer-name: peer-config: {
+          publicKey = peer-config.public-key;
+          allowedIPs = peer-config.allowed-ips;
+        }) cfg.peers;
+        privateKeyFile = cfg.private-key-file;
+      };
+    };
+  };
+}
diff --git a/config/local.nix b/config/local.nix
index a3e43b2..9bae47d 100644
--- a/config/local.nix
+++ b/config/local.nix
@@ -22,6 +22,7 @@ with lib;
     ./fudo/secure-dns-proxy.nix
     ./fudo/slynk.nix
     ./fudo/system.nix
+    ./fudo/vpn.nix
     ./fudo/webmail.nix
 
     ./informis/cl-gemini.nix
diff --git a/defaults.nix b/defaults.nix
index c6099b9..7635608 100644
--- a/defaults.nix
+++ b/defaults.nix
@@ -53,6 +53,7 @@
     lispPackages.cl-ppcre
     lispPackages.clx
     lispPackages.quicklisp
+    lsof
     lshw
     mkpasswd
     ncurses5
@@ -68,7 +69,6 @@
     pinentry.curses
     pv
     pwgen
-    racket
     ruby
     rustc
     sbcl
diff --git a/fudo/profiles/common-ui.nix b/fudo/profiles/common-ui.nix
index 424fbbf..88060ca 100644
--- a/fudo/profiles/common-ui.nix
+++ b/fudo/profiles/common-ui.nix
@@ -34,6 +34,7 @@ let
     mplayer
     mpv
     pdftk
+    racket
     redshift
     rhythmbox
     shotwell
diff --git a/fudo/profiles/server.nix b/fudo/profiles/server.nix
index 7e1b7c3..b99c451 100644
--- a/fudo/profiles/server.nix
+++ b/fudo/profiles/server.nix
@@ -53,8 +53,9 @@ in {
       systemPackages = with pkgs; [
         ldns
         ldns.examples
-        test-config
+        racket-minimal
         reboot-if-necessary
+        test-config
       ];
 
       noXlibs = true;
@@ -66,8 +67,8 @@ in {
 
     networking = {
       networkmanager.enable = mkForce false;
-    };
-
+    }
+;
     boot.tmpOnTmpfs = true;
 
     services.xserver.enable = false;
diff --git a/hosts/procul.nix b/hosts/procul.nix
index 2276e63..ead5d09 100644
--- a/hosts/procul.nix
+++ b/hosts/procul.nix
@@ -55,6 +55,13 @@ in {
       };
     };
 
+    # For WireGuard
+    nat = {
+      enable = true;
+      externalInterface = "extif0";
+      internalInterfaces = [ "wgtun0" ];
+    };
+
     interfaces = {
       extif0 = {
         # result of:
@@ -119,6 +126,8 @@ in {
       ];
     };
 
+    system.tmpOnTmpfs = false;
+
     secure-dns-proxy = {
       enable = true;
       upstream-dns = [ "https://cloudflare-dns.com/dns-query" ];
@@ -263,6 +272,26 @@ in {
     };
   };
 
+  fudo.vpn = {
+    enable = true;
+    ips = "10.100.0.0/16";
+    private-key-file = "/srv/wireguard/secure/secret.key";
+    peers = {
+      peter = {
+        allowed-ips = [ "10.100.1.0/24" ];
+        public-key = "d1NfRFWRkcKq2gxvqfMy7Oe+JFYf5DjomnsTyisvgB4=";
+      };
+      ken = {
+        allowed-ips = [ "10.100.2.0/24" ];
+        public-key = "y294rTCK0iSRhA6EIOErPzEuqzJMuYAG4XbHasySMVU=";
+      };
+      helen = {
+        allowed-ips = [ "10.100.3.0/24" ];
+        public-key = "7Hdko6RibhIYdoPLWXGwmElY5vKvZ+rURmqFTDUfC2w=";
+      };
+    };
+  };
+
   informis.cl-gemini = {
     enable = true;