diff --git a/atprotopds/ansible/inventory.yaml b/atprotopds/ansible/inventory.yaml
index ecbb6c4..b065488 100644
--- a/atprotopds/ansible/inventory.yaml
+++ b/atprotopds/ansible/inventory.yaml
@@ -3,6 +3,19 @@ all:
     ansible_user: devict
   children:
     pds:
+      vars:
+        # WireGuard spoke: peer only with the observability hub.
+        wireguard_address: 10.77.0.2/24
+        wireguard_peers:
+          - name: observability
+            public_key: "FILL_ME_OBSERVABILITY_PUBLIC_KEY"
+            allowed_ips: 10.77.0.1/32
+            endpoint: "167.172.226.184:51820"
+            persistent_keepalive: 25
+        # Alloy pushes over the mesh; default bridge network is enough.
+        alloy_docker_network: ""
+        alloy_loki_url: http://10.77.0.1:3100/loki/api/v1/push
+        alloy_mimir_url: http://10.77.0.1:9009/api/v1/push
       hosts:
         devict-pds:
           ansible_host: "{{ lookup('pipe', 'cd ' ~ inventory_dir ~ '/../terraform && terraform output -raw droplet_ipv4') }}"
\ No newline at end of file
diff --git a/atprotopds/ansible/site.yaml b/atprotopds/ansible/site.yaml
index bec73fe..6231046 100644
--- a/atprotopds/ansible/site.yaml
+++ b/atprotopds/ansible/site.yaml
@@ -11,4 +11,6 @@
   roles:
     - common
     - docker
+    - wireguard
+    - alloy
     - pds
\ No newline at end of file