diff --git a/13-inch-thin-cannon/wireguard.nix b/13-inch-thin-cannon/wireguard.nix
new file mode 100644
index 0000000..9a277a4
--- /dev/null
+++ b/13-inch-thin-cannon/wireguard.nix
@@ -0,0 +1,18 @@
+{ config, pkgs, ... }:
+{
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.0.0.3/24" ];
+      dns = [ "10.2.0.1"];
+      privateKeyFile = config.age.secrets."wireguard-key-13-inch-thin-cannon".path;
+      peers = [
+        {
+          publicKey = "sn2DwUHXSLYbub6dVFKRhE2QHcji5I8TMSotCTlGFw0";
+          allowedIPs = [ "0.0.0.0/0" "::/0" ];
+          endpoint = "185.159.158.226:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..12868a4
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,65 @@
+AGENIX_KEY ?= $(HOME)/.config/agenix/key.txt
+AGENIX_PUBKEY = $(AGENIX_KEY).pub
+
+SECRETS_DIR = secrets
+SECRETS = $(wildcard $(SECRETS_DIR)/*.age)
+
+.DEFAULT_GOAL = help
+
+.PHONY: help
+help:
+	@echo "Usage:"
+	@echo "  make agenix-key     - Generate age key (if missing)"
+	@echo "  make agenix-pubkey   - Show public key"
+	@echo "  make agenix-edit F=<file> - Create/edit an encrypted secret"
+	@echo "  make agenix-decrypt F=<file> - Decrypt and print a secret"
+	@echo "  make agenix-rekey    - Re-encrypt all secrets to current key"
+
+.PHONY: agenix-key
+agenix-key:
+	@if [ -f "$(AGENIX_KEY)" ]; then \
+		echo "Key already exists at $(AGENIX_KEY)"; \
+	else \
+		mkdir -p "$(dir $(AGENIX_KEY))" && \
+		nix run nixpkgs#age-keygen -- -o "$(AGENIX_KEY)" && \
+		echo "Generated age key: $(AGENIX_KEY)"; \
+	fi
+
+.PHONY: agenix-pubkey
+agenix-pubkey: agenix-key
+	@nix run nixpkgs#age-keygen -- -y "$(AGENIX_KEY)" | tee "$(AGENIX_PUBKEY)"
+
+.PHONY: agenix-edit
+agenix-edit: agenix-key
+	@if [ -z "$(F)" ]; then \
+		echo "Usage: make agenix-edit F=secrets/example.age"; \
+		exit 1; \
+	fi
+	@nix run nixpkgs#age -- -e -i "$(AGENIX_KEY)" -o "$(F)" 2>/dev/null; \
+	if [ -f "$(F)" ]; then \
+		nix run nixpkgs#age -- -d -i "$(AGENIX_KEY)" "$(F)" > /tmp/agenix-edit.$$ && \
+		$${EDITOR:-vi} /tmp/agenix-edit.$$ && \
+		nix run nixpkgs#age -- -e -i "$(AGENIX_KEY)" -o "$(F)" < /tmp/agenix-edit.$$ && \
+		rm /tmp/agenix-edit.$$ && \
+		echo "Encrypted: $(F)"; \
+	fi
+
+.PHONY: agenix-decrypt
+agenix-decrypt: agenix-key
+	@if [ -z "$(F)" ]; then \
+		echo "Usage: make agenix-decrypt F=secrets/example.age"; \
+		exit 1; \
+	fi; \
+	nix run nixpkgs#age -- -d -i "$(AGENIX_KEY)" "$(F)"
+
+.PHONY: agenix-rekey
+agenix-rekey: agenix-pubkey
+	@pubkey=$$(cat "$(AGENIX_PUBKEY)"); \
+	for secret in $(SECRETS); do \
+		echo "Rekeying $$secret..."; \
+		tmp=$$(mktemp); \
+		nix run nixpkgs#age -- -d -i "$(AGENIX_KEY)" "$$secret" > "$$tmp" 2>/dev/null && \
+		nix run nixpkgs#age -- -e -r "$$pubkey" -o "$$secret" < "$$tmp" && \
+		rm "$$tmp"; \
+	done; \
+	echo "Done"
diff --git a/modules/secrets.nix b/modules/secrets.nix
index 41101ef..902ce9c 100644
--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -5,7 +5,19 @@
   ...
 }: {
   age = {
-    identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-    secrets = { };
+    identityPaths = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/home/file_magic/.config/agenix/key.txt"
+    ];
+    secrets = {
+      wireguard-key-13-inch-thin-cannon = {
+        file = ../secrets/wireguard-key-13-inch-thin-cannon.age;
+        mode = "400";
+      };
+      wireguard-key-thick-black-cannon = {
+        file = ../secrets/wireguard-key-thick-black-cannon.age;
+        mode = "400";
+      };
+    };
   };
 }
diff --git a/secrets/wireguard-key-13-inch-thin-cannon.age b/secrets/wireguard-key-13-inch-thin-cannon.age
new file mode 100644
index 0000000..e69de29
diff --git a/secrets/wireguard-key-thick-black-cannon.age b/secrets/wireguard-key-thick-black-cannon.age
new file mode 100644
index 0000000..e69de29
diff --git a/thick-black-cannon/wireguard.nix b/thick-black-cannon/wireguard.nix
new file mode 100644
index 0000000..44cc1ae
--- /dev/null
+++ b/thick-black-cannon/wireguard.nix
@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+{
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.0.0.2/24" ];
+      privateKeyFile = config.age.secrets."wireguard-key-thick-black-cannon".path;
+      peers = [
+        {
+          publicKey = "CHANGE_ME";
+          allowedIPs = [ "10.0.0.0/24" ];
+          endpoint = "CHANGE_ME:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}