diff --git a/devserver/ansible/inventory.yaml b/devserver/ansible/inventory.yaml
index 14c1562..3efd9b3 100644
--- a/devserver/ansible/inventory.yaml
+++ b/devserver/ansible/inventory.yaml
@@ -6,6 +6,19 @@ all:
     ansible_user: devict
   children:
     devserver:
+      vars:
+        # WireGuard spoke: peer only with the observability hub.
+        wireguard_address: 10.77.0.3/24
+        wireguard_peers:
+          - name: observability
+            public_key: "FILL_ME_OBSERVABILITY_PUBLIC_KEY"
+            allowed_ips: 10.77.0.1/32
+            endpoint: "167.172.226.184:51820"
+            persistent_keepalive: 25
+        # Alloy pushes over the mesh; default bridge network is enough.
+        alloy_docker_network: ""
+        alloy_loki_url: http://10.77.0.1:3100/loki/api/v1/push
+        alloy_mimir_url: http://10.77.0.1:9009/api/v1/push
       hosts:
         devict-devserver:
           # Resolve the droplet IP from terraform output
diff --git a/devserver/ansible/site.yaml b/devserver/ansible/site.yaml
index 67ae93b..6d25355 100644
--- a/devserver/ansible/site.yaml
+++ b/devserver/ansible/site.yaml
@@ -5,6 +5,8 @@
   roles:
     - common
     - docker
+    - wireguard
+    - alloy
     - docker-network
     - infisical
     - svc-caddy