diff --git a/home/.chezmoiexternal.toml b/home/.chezmoiexternal.toml
index 23c3253b..f4852bde 100644
--- a/home/.chezmoiexternal.toml
+++ b/home/.chezmoiexternal.toml
@@ -15,17 +15,28 @@
     url = "https://github.com/wbthomason/packer.nvim.git"
     refreshPeriod = "168h"
 
-[".config/xmonad/xmonad"]
+[".task"]
     type = "git-repo"
-    url = "https://github.com/xmonad/xmonad"
+    url = "git@github.com:starr-dusT/task.git"
     refreshPeriod = "168h"
 
-[".config/xmonad/xmonad-contrib"]
+["documents/zet"]
     type = "git-repo"
-    url = "https://github.com/xmonad/xmonad-contrib"
+    url = "git@github.com:starr-dusT/zet.git"
     refreshPeriod = "168h"
 
-[".config/xmonad/xmobar"]
-    type = "git-repo"
-    url = "https://codeberg.org/xmobar/xmobar"
-    refreshPeriod = "168h"
+### OLD ###
+#[".config/xmonad/xmonad"]
+#    type = "git-repo"
+#    url = "https://github.com/xmonad/xmonad"
+#    refreshPeriod = "168h"
+#
+#[".config/xmonad/xmonad-contrib"]
+#    type = "git-repo"
+#    url = "https://github.com/xmonad/xmonad-contrib"
+#    refreshPeriod = "168h"
+#
+#[".config/xmonad/xmobar"]
+#    type = "git-repo"
+#    url = "https://codeberg.org/xmobar/xmobar"
+#    refreshPeriod = "168h"
diff --git a/home/bin/executable_linux-mount-engi b/home/bin/executable_linux-mount-engi
index bd500f5a..52a43e00 100644
--- a/home/bin/executable_linux-mount-engi
+++ b/home/bin/executable_linux-mount-engi
@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 
-sudo mount -t cifs -o rw,uid=$(id -u $(whoami)),gid=$(id -g $(whoami)),vers=3.0,credentials=/home/tstarr/.smb //192.168.1.136/private /home/tstarr/mnt/engi
+sudo mount -t cifs -o rw,uid=$(id -u $(whoami)),gid=$(id -g $(whoami)),vers=3.0,credentials=/home/tstarr/.smb //192.168.1.175/private /home/tstarr/mnt/engi
diff --git a/home/bin/executable_linux-toggle-vpn b/home/bin/executable_linux-toggle-vpn
new file mode 100644
index 00000000..5847a92e
--- /dev/null
+++ b/home/bin/executable_linux-toggle-vpn
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+if [ -f ~/.wg0 ]; then
+    sudo systemctl stop wg-quick-wg0.service
+    rm ~/.wg0
+else
+    sudo systemctl restart wg-quick-wg0.service
+    touch ~/.wg0
+fi
diff --git a/home/dot_config/sway/config.tmpl b/home/dot_config/sway/config.tmpl
index de1db5af..0ccce0bb 100644
--- a/home/dot_config/sway/config.tmpl
+++ b/home/dot_config/sway/config.tmpl
@@ -91,7 +91,8 @@ gaps left               0
 
 for_window [title="Steam - News"]   floating enable
 for_window [title="Friends List"]   floating enable
-for_window [title="Picture-in-Picture"] sticky toggle
+for_window [title=".*mpv$"] sticky toggle
+for_window [title=".*mpv$"] floating enable
 
 for_window [app_id="file"] floating enable, \
     border pixel 5, \
@@ -126,7 +127,6 @@ mode utility {
     bindsym q exit
     bindsym r reload
     bindsym g exec "~/.config/sway/scripts/gamemode.sh", $e
-    bindsym v exec "~/.config/sway/scripts/toggle-vpn.sh {{ .hostname }}", $e
     bindsym Escape mode default
 }
 
@@ -197,6 +197,7 @@ mode open {
     bindsym b exec chromium, $e
     bindsym s exec steam || flatpak run com.valvesoftware.Steam, $e
     bindsym d exec discord || flatpak run com.discordapp.Discord, $e
+    bindsym m exec mpv $(wl-paste), $e
     bindsym Escape mode default
 }
 
diff --git a/home/dot_config/sway/scripts/executable_status.sh.tmpl b/home/dot_config/sway/scripts/executable_status.sh.tmpl
index b99b49fe..20f758e9 100644
--- a/home/dot_config/sway/scripts/executable_status.sh.tmpl
+++ b/home/dot_config/sway/scripts/executable_status.sh.tmpl
@@ -44,11 +44,11 @@ txmb=$(echo "scale = 1; $tx / 1280000" | bc | awk '{printf "%05.1f\n", $0}')
 rxmb=$(echo "scale = 1; $rx / 1280000" | bc | awk '{printf "%05.1f\n", $0}')
 
 # Vpn status
-vpn=$(nmcli c show --active | grep wireguard | cut -d ' ' -f1)
-if $vpn ; then
+if [ -f ~/.wg0 ] ; then
+    vpn="wg0"
+else
     vpn="none"
 fi
 
 #<span foreground='#c16b26'>lel</span>
 echo -e "👍 $txmb 👎 $rxmb | 📡 $vpn | ⬆️ $uptime_formatted | 🔉<span foreground='$volume_color'>$volume%</span> | $gamemode | 🐧 $linux_version | $date_formatted "
-
diff --git a/home/dot_config/sway/scripts/executable_toggle-vpn.sh b/home/dot_config/sway/scripts/executable_toggle-vpn.sh
deleted file mode 100644
index 326fe195..00000000
--- a/home/dot_config/sway/scripts/executable_toggle-vpn.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-cons=$(nmcli -t -f NAME c show --active | grep $1)
-if [ $cons ]; then
-    nmcli c down $1 1> /dev/null
-else
-    nmcli c up $1 1> /dev/null
-fi
diff --git a/home/private_dot_wireguard/kestrel.pub b/home/private_dot_wireguard/kestrel.pub
new file mode 100644
index 00000000..d4d0402e
--- /dev/null
+++ b/home/private_dot_wireguard/kestrel.pub
@@ -0,0 +1 @@
+hPso657fppLYvBU31Rtqqg792JEoPv7r82JgLoF8S2Y=
diff --git a/home/private_dot_wireguard/kestrel.tmpl b/home/private_dot_wireguard/kestrel.tmpl
new file mode 100644
index 00000000..400eef8b
--- /dev/null
+++ b/home/private_dot_wireguard/kestrel.tmpl
@@ -0,0 +1 @@
+{{ (secret "Wireguard - Kestrel Secret" "NOTES") }}
diff --git a/provision/nixos/flake.nix b/provision/nixos/flake.nix
index ba824760..6f84b844 100644
--- a/provision/nixos/flake.nix
+++ b/provision/nixos/flake.nix
@@ -48,7 +48,7 @@
 
         torus = lib.nixosSystem {
           inherit system;
-          specialArgs = { inherit user; };
+          specialArgs = { inherit user; inherit pkgs-unstable; };
           modules = [
             ./hosts/torus/configuration.nix
             ./hosts/torus/hardware.nix
diff --git a/provision/nixos/hosts/kestrel/configuration.nix b/provision/nixos/hosts/kestrel/configuration.nix
index fba7d41a..20720f66 100644
--- a/provision/nixos/hosts/kestrel/configuration.nix
+++ b/provision/nixos/hosts/kestrel/configuration.nix
@@ -1,5 +1,9 @@
 { config, pkgs, user, lib, ... }:
 {
+  imports = [ 
+    ../../modules 
+  ];
+
   nix = {
     package = pkgs.nixFlakes;
     extraOptions = "experimental-features = nix-command flakes";
@@ -32,7 +36,6 @@
 
   # Set networking options
   networking.hostName = "kestrel"; 
-  networking.networkmanager.enable = true;  
   networking.firewall.checkReversePath = "loose";
   networking.firewall.enable = false;
 
@@ -52,7 +55,7 @@
   # Define user account.
   users.users.${user} = {
     isNormalUser = true;
-    extraGroups = [ "wheel" "docker" "libvirtd" ]; # Enable ‘sudo’ for the user.
+    extraGroups = [ "dialout" "wheel" "docker" "libvirtd" ]; # Enable ‘sudo’ for the user.
   };
 
   # List packages installed in system profile.
@@ -63,7 +66,6 @@
   ];
 
   # Enable modules
-  imports = [ ../../modules ];
   modules = {
     desktop = {
       sway.enable = true;
@@ -78,16 +80,22 @@
       steam.enable = true;
     };
     services = {
-      #jellyfin.enable = true;
+      jellyfin.enable = false;
       peripherals.enable = true;
       samba-client.enable = true;
-      #samba-server.enable = true;
       syncthing.enable = true;
       virt-manager.enable = true;
     };
     system = {
       ssh.enable = true;
       terminal.enable = true;
+      wireguard-client = {
+        enable = true;
+        privateKeyFile = "/home/${user}/.wireguard/kestrel";
+        address = [ "192.168.2.3/24" ];
+        publicKey = "bd7bbZOngl/FTdBlnbIhgCLNf6yx5X8WjiRB7E1NEQQ=";
+        endpoint = "66.218.43.87";
+      };
     };
   };
   # Did you read the comment?
diff --git a/provision/nixos/hosts/torus/configuration.nix b/provision/nixos/hosts/torus/configuration.nix
index 385ca5e7..4f441c6a 100644
--- a/provision/nixos/hosts/torus/configuration.nix
+++ b/provision/nixos/hosts/torus/configuration.nix
@@ -1,5 +1,11 @@
 { config, pkgs, user, lib, ... }:
 {
+  imports = [ 
+    ./wireguard-server.nix
+    ./samba-server.nix
+    ../../modules 
+  ];
+
   nix = {
     package = pkgs.nixFlakes;
     extraOptions = "experimental-features = nix-command flakes";
@@ -28,8 +34,14 @@
 
   # Set networking options
   networking.hostName = "torus"; 
-  networking.networkmanager.enable = true;  
+  # Needed for wireguard-server
+  boot.kernel.sysctl = {
+    "net.ipv4.conf.all.forwarding" = true;
+  };
+  networking.firewall.enable = true;
   networking.firewall.checkReversePath = "loose";
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 ];
 
   # Set your time zone.
   time.timeZone = "America/Los_Angeles";
@@ -78,8 +90,6 @@
     defaults.email = "starrtyler88@gmail.com";
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  networking.firewall.allowedUDPPorts = [ 80 443 ];
 
   security.pam.services.nginx.setEnvironment = false;
   systemd.services.nginx.serviceConfig = {
@@ -103,9 +113,6 @@
       "media.tstarr.us" = (SSL // {
         locations."/".proxyPass = "http://localhost:8096/"; 
       });
-      "joplin.tstarr.us" = (SSL // {
-        locations."/".proxyPass = "http://localhost:22300/"; 
-      });
       "wiki.tstarr.us" = (SSL // {
         locations."/".proxyPass = "http://localhost:4567/"; 
         extraConfig = ''
@@ -117,13 +124,11 @@
   };
 
   # Enable modules
-  imports = [ ../../modules ];
   modules = {
     devel = {
       tooling.enable = true;
     };
     services = {
-      samba-server.enable = true;
       jellyfin.enable = true;
       syncthing.enable = true;
     };
diff --git a/provision/nixos/hosts/torus/samba-server.nix b/provision/nixos/hosts/torus/samba-server.nix
new file mode 100644
index 00000000..b5a9d67c
--- /dev/null
+++ b/provision/nixos/hosts/torus/samba-server.nix
@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+{
+  services.samba = {
+    enable = true;
+    extraConfig = ''
+      workgroup = WORKGROUP
+      server string = smbnix
+      netbios name = smbnix
+      security = user 
+      hosts allow = 192.168.2. 192.168.1. 127.0.0.1 localhost
+      hosts deny = 0.0.0.0/0
+      guest account = nobody
+      map to guest = bad user
+    '';
+
+    shares = {
+      private = {
+        "path" = "/engi";
+        browseable = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "force user" = "tstarr";
+        "force group" = "users";
+      };
+      public = {
+        "path" = "/engi";
+        browseable = "yes";
+        "read only" = "yes";
+        "guest ok" = "yes";
+      };
+    };
+  };
+
+  # Curiously, `services.samba` does not automatically open
+  # the needed ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 445 139 ];
+  networking.firewall.allowedUDPPorts = [ 137 138 ];
+
+  # To make SMB mounting easier on the command line
+  environment.systemPackages = with pkgs; [ cifs-utils ];
+}
diff --git a/provision/nixos/hosts/torus/wireguard-server.nix b/provision/nixos/hosts/torus/wireguard-server.nix
new file mode 100644
index 00000000..7c88f1c8
--- /dev/null
+++ b/provision/nixos/hosts/torus/wireguard-server.nix
@@ -0,0 +1,57 @@
+{ config, lib, pkgs, ... }:
+{
+  # Enable NAT
+  networking.nat = {
+    enable = true;
+    enableIPv6 = true;
+    externalInterface = "enp4s0";
+    internalInterfaces = [ "wg0" ];
+  };
+  
+  # Open ports in the firewall
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 51820 ];
+  };
+    
+  networking.wg-quick.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    wg0 = {
+      # Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface
+      address = [ "192.168.2.1/24" ];
+      # The port that WireGuard listens to - recommended that this be changed from default
+      listenPort = 51820;
+      # Path to the server's private key
+      privateKeyFile = "/engi/apps/wireguard/private";
+  
+      # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
+      postUp = ''
+        ${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
+  
+      '';
+  
+      # Undo the above
+      preDown = ''
+        ${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE
+      '';
+  
+      peers = [
+        { 
+          # Adjudicator
+          publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM=";
+          allowedIPs = [ "192.168.2.2/32" ];
+        }
+        { 
+          # Kestrel
+          publicKey = "hPso657fppLYvBU31Rtqqg792JEoPv7r82JgLoF8S2Y=";
+          allowedIPs = [ "192.168.2.3/32" ];
+        }
+        # More peers can be added here.
+      ];
+    };
+  };
+}
diff --git a/provision/nixos/modules/services/default.nix b/provision/nixos/modules/services/default.nix
index ecbd0763..2cd18a94 100644
--- a/provision/nixos/modules/services/default.nix
+++ b/provision/nixos/modules/services/default.nix
@@ -1,4 +1,4 @@
 { ... }:
 {
-  imports = [ ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
+  imports = [ ./syncthing.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
 }
diff --git a/provision/nixos/modules/services/jellyfin.nix b/provision/nixos/modules/services/jellyfin.nix
index b4aaf5fd..78cce358 100644
--- a/provision/nixos/modules/services/jellyfin.nix
+++ b/provision/nixos/modules/services/jellyfin.nix
@@ -8,5 +8,4 @@ in {
     services.jellyfin.openFirewall = true;
     services.jellyfin.user = "${user}";
   };
-
 }
diff --git a/provision/nixos/modules/services/peripherals.nix b/provision/nixos/modules/services/peripherals.nix
index 6648802b..ac69fd04 100644
--- a/provision/nixos/modules/services/peripherals.nix
+++ b/provision/nixos/modules/services/peripherals.nix
@@ -4,10 +4,17 @@ let cfg = config.modules.services.peripherals;
 in {
   options.modules.services.peripherals.enable = lib.mkEnableOption "peripherals";
   config = lib.mkIf cfg.enable {
-    # Enable sound.
-    sound.enable = true;
-    hardware.pulseaudio.enable = true;
-    hardware.pulseaudio.support32Bit = true;
+
+    # rtkit is optional but recommended
+    security.rtkit.enable = true;
+    services.pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      # If you want to use JACK applications, uncomment this
+      #jack.enable = true;
+    };
 
     services = {
       gvfs.enable = true;
diff --git a/provision/nixos/modules/services/samba-server.nix b/provision/nixos/modules/services/samba-server.nix
deleted file mode 100644
index b328c842..00000000
--- a/provision/nixos/modules/services/samba-server.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let cfg = config.modules.services.samba-server;
-in {
-  options.modules.services.samba-server.enable = lib.mkEnableOption "samba-server";
-  config = lib.mkIf cfg.enable {
-    services.samba = {
-      enable = true;
-      extraConfig = ''
-        workgroup = WORKGROUP
-        server string = smbnix
-        netbios name = smbnix
-        security = user 
-        hosts allow = 192.168.1. 127.0.0.1 localhost
-        hosts deny = 0.0.0.0/0
-        guest account = nobody
-        map to guest = bad user
-      '';
-
-      shares = {
-        private = {
-          "path" = "/engi";
-          browseable = "yes";
-          "read only" = "no";
-          "guest ok" = "no";
-          "force user" = "tstarr";
-          "force group" = "users";
-        };
-        public = {
-          "path" = "/engi";
-          browseable = "yes";
-          "read only" = "yes";
-          "guest ok" = "yes";
-        };
-      };
-    };
-
-    # Curiously, `services.samba` does not automatically open
-    # the needed ports in the firewall.
-    networking.firewall.allowedTCPPorts = [ 445 139 ];
-    networking.firewall.allowedUDPPorts = [ 137 138 ];
-
-    # To make SMB mounting easier on the command line
-    environment.systemPackages = with pkgs; [ cifs-utils ];
-  };
-}
diff --git a/provision/nixos/modules/system/default.nix b/provision/nixos/modules/system/default.nix
index 3d1a89d9..9abd35a0 100644
--- a/provision/nixos/modules/system/default.nix
+++ b/provision/nixos/modules/system/default.nix
@@ -1,4 +1,4 @@
 { ... }:
 {
-  imports = [ ./terminal.nix ./ssh.nix ];
+  imports = [ ./wireguard-client.nix ./terminal.nix ./ssh.nix ];
 }
diff --git a/provision/nixos/modules/system/terminal.nix b/provision/nixos/modules/system/terminal.nix
index 68daffba..91c33085 100644
--- a/provision/nixos/modules/system/terminal.nix
+++ b/provision/nixos/modules/system/terminal.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, user, ... }:
+{ config, lib, pkgs, pkgs-unstable, user, ... }:
 
 let cfg = config.modules.system.terminal;
 in {
@@ -32,6 +32,13 @@ in {
       # for neovim
         nodejs 
         ripgrep
+
+    ] ++ [
+      pkgs-unstable.taskwarrior
+      # for taskwarrior
+        pkgs-unstable.taskwarrior-tui
+        pkgs-unstable.taskopen
+        pkgs-unstable.timewarrior
     ];
   };
 }
diff --git a/provision/nixos/modules/system/wireguard-client.nix b/provision/nixos/modules/system/wireguard-client.nix
new file mode 100644
index 00000000..f2c48917
--- /dev/null
+++ b/provision/nixos/modules/system/wireguard-client.nix
@@ -0,0 +1,37 @@
+{ config, lib, pkgs, user, ... }:
+
+let cfg = config.modules.system.wireguard-client;
+
+in {
+  options.modules.system.wireguard-client = with lib; {
+    enable = lib.mkEnableOption "wireguard-client";
+    privateKeyFile = lib.mkOption { type = with types; str; };
+    address = lib.mkOption { type = with types; listOf str; };
+    publicKey = lib.mkOption { type = with types; str; };
+    endpoint = lib.mkOption { type = with types; str; };
+    autostart = lib.mkOption {
+      type = with types; bool;
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall = {
+      allowedUDPPorts = [ 51820 ];
+    };
+    networking.wg-quick.interfaces = {
+      wg0 = {
+        address = cfg.address;
+        listenPort = 51820; 
+        privateKeyFile = cfg.privateKeyFile;
+        autostart = cfg.autostart;
+        peers = [{
+            publicKey = cfg.publicKey;
+            allowedIPs = [ "0.0.0.0/0" "::/0" ];
+            endpoint = "${cfg.endpoint}:51820"; 
+            persistentKeepalive = 25;
+        }];
+      };
+    };
+  };
+}