diff --git a/files/wireguard/preshared.key b/files/wireguard/preshared.key
new file mode 100644
index 0000000..18a729d
--- /dev/null
+++ b/files/wireguard/preshared.key
@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+35383466626232303066643935333239346135616232366464393935366531346165316535356239
+3561313239663637663462643131386462323133316365370a393736663761326239396531336532
+64313761633331383535343863373066666239303363313139303134373566663636316631656562
+6636656161623364350a653964633331386561336363663237303132373863373563616663343165
+62633466346633373735616234633466643138373835393530616637393632363431373733313331
+6234623066313439646163363838373762343839386435316262
diff --git a/files/wireguard/server.key b/files/wireguard/server.key
new file mode 100644
index 0000000..c838860
--- /dev/null
+++ b/files/wireguard/server.key
@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+38393631323066623436313135633436613965643331323966346635666538613933343833346164
+3738316333353933643764303134653662373139326165630a323638636137646238326637393263
+34356639636330643861623836613636356435616164303439363362396464663631653965636339
+3634363030313231340a373735313939343963343262646338626266653336303763313064363766
+33663138666237663030363362356164396238336337313733393035663364396537666635376666
+3734313634336138363764613166306237366439666230396234
diff --git a/files/wireguard/server.pub b/files/wireguard/server.pub
new file mode 100644
index 0000000..08b69af
--- /dev/null
+++ b/files/wireguard/server.pub
@@ -0,0 +1 @@
+CeybSMpJiicXmndIuhe89Bay3z3PEdYNyAwIFsacBEo=
diff --git a/playbook.yml b/playbook.yml
index ce09c6a..0f6f302 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -8,6 +8,7 @@
     - common
   tasks:
     - import_tasks: 'tasks/setup.yml'
+    - import_tasks: 'tasks/network.yml'
     - import_tasks: 'tasks/nfs.yml'
     - import_tasks: 'tasks/radicale.yml'
     - import_tasks: 'tasks/syncthing.yml'
diff --git a/tasks/network.yml b/tasks/network.yml
new file mode 100644
index 0000000..66e80ae
--- /dev/null
+++ b/tasks/network.yml
@@ -0,0 +1,68 @@
+- name: copy network configuration files
+  become: true
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    mode: '0640'
+  loop:
+    - {
+        src: 'templates/network/br0.netdev.j2',
+        dest: '/etc/systemd/network/br0.netdev',
+      }
+    - {
+        src: 'templates/network/br0.network.j2',
+        dest: '/etc/systemd/network/br0.network',
+      }
+    - {
+        src: 'templates/network/enp5s0.network.j2',
+        dest: '/etc/systemd/network/enp5s0.network',
+      }
+    - {
+        src: 'templates/network/wg0.netdev.j2',
+        dest: '/etc/systemd/network/wg0.netdev',
+      }
+    - {
+        src: 'templates/network/wg0.network.j2',
+        dest: '/etc/systemd/network/wg0.network',
+      }
+
+- name: create wireguard directories
+  become: true
+  file:
+    path: '{{ item | dirname }}'
+    owner: root
+    group: systemd-network
+    mode: '0640'
+    state: directory
+  loop:
+    - '{{ vpn_server_key_path }}'
+    - '{{ vpn_server_public_key_path }}'
+
+- name: copy wireguard credentials
+  become: true
+  copy:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    group: systemd-network
+    mode: '0640'
+  loop:
+    - {
+        src: 'files/wireguard/server.pub',
+        dest: '{{ vpn_server_public_key_path }}',
+      }
+    - {
+        src: 'files/wireguard/server.key',
+        dest: '{{ vpn_server_key_path }}',
+      }
+    - {
+        src: 'files/wireguard/preshared.key',
+        dest: '{{ vpn_preshared_path }}',
+      }
+
+- name: restart systemd-networkd
+  become: true
+  systemd:
+    name: systemd-networkd
+    state: restarted
+    enabled: true
diff --git a/templates/network/br0.netdev.j2 b/templates/network/br0.netdev.j2
new file mode 100644
index 0000000..f397806
--- /dev/null
+++ b/templates/network/br0.netdev.j2
@@ -0,0 +1,6 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[NetDev]
+Name={{ bridge_interface }}
+Kind=bridge
+MACAddress={{ bridge_mac }}
diff --git a/templates/network/br0.network.j2 b/templates/network/br0.network.j2
new file mode 100644
index 0000000..983c8c6
--- /dev/null
+++ b/templates/network/br0.network.j2
@@ -0,0 +1,7 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[Match]
+Name={{ bridge_source_interface }}
+
+[Network]
+Bridge={{ bridge_interface }}
diff --git a/templates/network/enp5s0.network.j2 b/templates/network/enp5s0.network.j2
new file mode 100644
index 0000000..63d30a5
--- /dev/null
+++ b/templates/network/enp5s0.network.j2
@@ -0,0 +1,10 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[Match]
+Name={{ bridge_interface }}
+
+[Network]
+DHCP=ipv4
+Address={{ lan_ip_address }}/24
+Gateway={{ lan_ip_address[:-3] }}1
+DNS={{ lan_ip_address[:-3] }}1
diff --git a/templates/network/wg0.netdev.j2 b/templates/network/wg0.netdev.j2
new file mode 100644
index 0000000..6bd6f89
--- /dev/null
+++ b/templates/network/wg0.netdev.j2
@@ -0,0 +1,17 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[NetDev]
+Name={{ vpn_interface }}
+Kind=wireguard
+Description=WireGuard tunnel wg0
+
+[WireGuard]
+ListenPort={{ vpn_port }}
+PrivateKeyFile={{ vpn_server_key_path }}
+
+{% for peer in vpn_peers %}
+[WireGuardPeer]
+PublicKey={{ peer.public_key }}
+PresharedKeyFile={{ vpn_preshared_path }}
+AllowedIPs={{ peer.ip }}/32
+{% endfor %}
diff --git a/templates/network/wg0.network.j2 b/templates/network/wg0.network.j2
new file mode 100644
index 0000000..2e96448
--- /dev/null
+++ b/templates/network/wg0.network.j2
@@ -0,0 +1,7 @@
+# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
+
+[Match]
+Name={{ vpn_interface }}
+
+[Network]
+Address={{ vpn_listen_address }}/24
diff --git a/templates/nftables.j2 b/templates/nftables.j2
index 4e9402e..95dc43e 100644
--- a/templates/nftables.j2
+++ b/templates/nftables.j2
@@ -19,14 +19,14 @@ table ip filter {
     # allow icmp
     ip protocol icmp accept
 
-    iifname 'br0' tcp dport {{ ssh_port }} accept comment 'SSH'
-    iifname 'br0' tcp dport { {{ http_port }}, {{ https_port }} } accept comment 'HTTP/HTTPS'
+    iifname "br0" tcp dport {{ ssh_port }} accept comment "SSH"
+    iifname "br0" tcp dport { {{ http_port }}, {{ https_port }} } accept comment "HTTP/HTTPS"
 
-    iifname 'br0' tcp dport {{ vpn_port }} accept comment 'Wireguard'
+    iifname "br0" tcp dport {{ vpn_port }} accept comment "Wireguard"
 
-    iifname '{{ vpn_interface }}' tcp dport { {{ http_port }}, {{ https_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'HTTP/HTTPS'
-    iifname '{{ vpn_interface }}' tcp dport {{ transmission_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'Transmission'
-    iifname '{{ vpn_interface }}' tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'Syncthing'
-    iifname '{{ vpn_interface }}' tcp dport {{ mpd_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment 'MPD'
+    iifname "{{ vpn_interface }}" tcp dport { {{ http_port }}, {{ https_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "HTTP/HTTPS"
+    iifname "{{ vpn_interface }}" tcp dport {{ transmission_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Transmission"
+    iifname "{{ vpn_interface }}" tcp dport { {{ syncthing_gui_port }}, {{ syncthing_protocol_port }} } ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "Syncthing"
+    iifname "{{ vpn_interface }}" tcp dport {{ mpd_port }} ip saddr {{ vpn_source_range }} ip daddr {{ vpn_destination_range }} accept comment "MPD"
   }
 }
diff --git a/templates/transmission.j2 b/templates/transmission.j2
index 5f59729..f66e85e 100644
--- a/templates/transmission.j2
+++ b/templates/transmission.j2
@@ -52,7 +52,7 @@
     "rpc-port": {{ transmission_port }},
     "rpc-url": "/transmission/",
     "rpc-username": "transmission",
-    "rpc-whitelist": "127.0.0.1, {{ vpn_listen_address:[-1] }}*",
+    "rpc-whitelist": "127.0.0.1, {{ vpn_listen_address[:-1] }}*",
     "rpc-whitelist-enabled": true,
     "scrape-paused-torrents-enabled": true,
     "script-torrent-done-enabled": false,
diff --git a/vars/main.yml b/vars/main.yml
index 11e819a..79cd0e4 100644
--- a/vars/main.yml
+++ b/vars/main.yml
@@ -6,3 +6,4 @@ packages:
   - openvpn
   - mpd
   - python3-virtualenv
+  - wireguard-tools
diff --git a/vars/mpd.yml b/vars/mpd.yml
index ef78d01..e41e3e5 100644
--- a/vars/mpd.yml
+++ b/vars/mpd.yml
@@ -1,4 +1 @@
-mpd_port: 21000
-mpd_http_port: 21001
-
 mpd_music_dir: '/home/sonny/music'
diff --git a/vars/network.yml b/vars/network.yml
index 6d142f5..aea1db1 100644
--- a/vars/network.yml
+++ b/vars/network.yml
@@ -1,3 +1,8 @@
+bridge_interface: 'br0'
+bridge_source_interface: 'enp5s0'
+bridge_mac: '70:85:c2:5a:ce:91'
+lan_ip_address: '192.168.178.185'
+
 http_port: 80
 https_port: 443
 ssh_port: 39901
diff --git a/vars/vpn.yml b/vars/vpn.yml
index 762680d..9faed18 100644
--- a/vars/vpn.yml
+++ b/vars/vpn.yml
@@ -6,10 +6,18 @@ vpn_interface: 'wg0'
 vpn_source_range: '10.0.0.0/24'
 vpn_destination_range: '10.0.0.1/32'
 
+vpn_server_public_key_path: '/etc/wireguard/keys/public/server.pub'
+vpn_server_key_path: '/etc/wireguard/keys/private/server.key'
+vpn_preshared_path: '/etc/wireguard/keys/private/preshared.key'
+
 vpn_peers:
   - {
-      name: 'desktop', ip: '10.0.0.3'
+      name: 'desktop',
+      ip: '10.0.0.3',
+      public_key: 'izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4=',
     }
   - {
-      name: 'laptop', ip: '10.0.0.2'
+      name: 'laptop',
+      ip: '10.0.0.2',
+      public_key: 'EbWLf2+7x/RymeeiVuX72nZOBqPvdhu2V9pYhszpQEw=',
     }