diff --git a/provision/nixos/hosts/torus/configuration.nix b/provision/nixos/hosts/torus/configuration.nix
index 385ca5e7..4f441c6a 100644
--- a/provision/nixos/hosts/torus/configuration.nix
+++ b/provision/nixos/hosts/torus/configuration.nix
@@ -1,5 +1,11 @@
 { config, pkgs, user, lib, ... }:
 {
+  imports = [ 
+    ./wireguard-server.nix
+    ./samba-server.nix
+    ../../modules 
+  ];
+
   nix = {
     package = pkgs.nixFlakes;
     extraOptions = "experimental-features = nix-command flakes";
@@ -28,8 +34,14 @@
 
   # Set networking options
   networking.hostName = "torus"; 
-  networking.networkmanager.enable = true;  
+  # Needed for wireguard-server
+  boot.kernel.sysctl = {
+    "net.ipv4.conf.all.forwarding" = true;
+  };
+  networking.firewall.enable = true;
   networking.firewall.checkReversePath = "loose";
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 ];
 
   # Set your time zone.
   time.timeZone = "America/Los_Angeles";
@@ -78,8 +90,6 @@
     defaults.email = "starrtyler88@gmail.com";
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  networking.firewall.allowedUDPPorts = [ 80 443 ];
 
   security.pam.services.nginx.setEnvironment = false;
   systemd.services.nginx.serviceConfig = {
@@ -103,9 +113,6 @@
       "media.tstarr.us" = (SSL // {
         locations."/".proxyPass = "http://localhost:8096/"; 
       });
-      "joplin.tstarr.us" = (SSL // {
-        locations."/".proxyPass = "http://localhost:22300/"; 
-      });
       "wiki.tstarr.us" = (SSL // {
         locations."/".proxyPass = "http://localhost:4567/"; 
         extraConfig = ''
@@ -117,13 +124,11 @@
   };
 
   # Enable modules
-  imports = [ ../../modules ];
   modules = {
     devel = {
       tooling.enable = true;
     };
     services = {
-      samba-server.enable = true;
       jellyfin.enable = true;
       syncthing.enable = true;
     };
diff --git a/provision/nixos/hosts/torus/samba-server.nix b/provision/nixos/hosts/torus/samba-server.nix
new file mode 100644
index 00000000..015086ba
--- /dev/null
+++ b/provision/nixos/hosts/torus/samba-server.nix
@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+{
+  services.samba = {
+    enable = true;
+    extraConfig = ''
+      workgroup = WORKGROUP
+      server string = smbnix
+      netbios name = smbnix
+      security = user 
+      hosts allow = 192.168.1. 127.0.0.1 localhost
+      hosts deny = 0.0.0.0/0
+      guest account = nobody
+      map to guest = bad user
+    '';
+
+    shares = {
+      private = {
+        "path" = "/engi";
+        browseable = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "force user" = "tstarr";
+        "force group" = "users";
+      };
+      public = {
+        "path" = "/engi";
+        browseable = "yes";
+        "read only" = "yes";
+        "guest ok" = "yes";
+      };
+    };
+  };
+
+  # Curiously, `services.samba` does not automatically open
+  # the needed ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 445 139 ];
+  networking.firewall.allowedUDPPorts = [ 137 138 ];
+
+  # To make SMB mounting easier on the command line
+  environment.systemPackages = with pkgs; [ cifs-utils ];
+}
diff --git a/provision/nixos/hosts/torus/wireguard-server.nix b/provision/nixos/hosts/torus/wireguard-server.nix
new file mode 100644
index 00000000..f039a55d
--- /dev/null
+++ b/provision/nixos/hosts/torus/wireguard-server.nix
@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+{
+  # Enable NAT
+  networking.nat = {
+    enable = true;
+    enableIPv6 = true;
+    externalInterface = "enp4s0";
+    internalInterfaces = [ "wg0" ];
+  };
+  
+  # Open ports in the firewall
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 51820 ];
+  };
+    
+  networking.wg-quick.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    wg0 = {
+      # Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface
+      address = [ "192.168.2.1/24" ];
+      # The port that WireGuard listens to - recommended that this be changed from default
+      listenPort = 51820;
+      # Path to the server's private key
+      privateKeyFile = "/engi/apps/wireguard/private";
+  
+      # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
+      postUp = ''
+        ${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
+  
+      '';
+  
+      # Undo the above
+      preDown = ''
+        ${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT 
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE
+      '';
+  
+      peers = [
+        { 
+          # Adjudicator
+          publicKey = "r2/IeYCO1T+l248387wUBoNnc2DK9O8pHcIr/NQqezM=";
+          allowedIPs = [ "192.168.2.2/32" ];
+        }
+        # More peers can be added here.
+      ];
+    };
+  };
+}
diff --git a/provision/nixos/modules/services/default.nix b/provision/nixos/modules/services/default.nix
index ecbd0763..2cd18a94 100644
--- a/provision/nixos/modules/services/default.nix
+++ b/provision/nixos/modules/services/default.nix
@@ -1,4 +1,4 @@
 { ... }:
 {
-  imports = [ ./syncthing.nix ./samba-server.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
+  imports = [ ./syncthing.nix ./samba-client.nix ./jellyfin.nix ./virt-manager.nix ./peripherals.nix ];
 }
diff --git a/provision/nixos/modules/services/samba-server.nix b/provision/nixos/modules/services/samba-server.nix
deleted file mode 100644
index b328c842..00000000
--- a/provision/nixos/modules/services/samba-server.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let cfg = config.modules.services.samba-server;
-in {
-  options.modules.services.samba-server.enable = lib.mkEnableOption "samba-server";
-  config = lib.mkIf cfg.enable {
-    services.samba = {
-      enable = true;
-      extraConfig = ''
-        workgroup = WORKGROUP
-        server string = smbnix
-        netbios name = smbnix
-        security = user 
-        hosts allow = 192.168.1. 127.0.0.1 localhost
-        hosts deny = 0.0.0.0/0
-        guest account = nobody
-        map to guest = bad user
-      '';
-
-      shares = {
-        private = {
-          "path" = "/engi";
-          browseable = "yes";
-          "read only" = "no";
-          "guest ok" = "no";
-          "force user" = "tstarr";
-          "force group" = "users";
-        };
-        public = {
-          "path" = "/engi";
-          browseable = "yes";
-          "read only" = "yes";
-          "guest ok" = "yes";
-        };
-      };
-    };
-
-    # Curiously, `services.samba` does not automatically open
-    # the needed ports in the firewall.
-    networking.firewall.allowedTCPPorts = [ 445 139 ];
-    networking.firewall.allowedUDPPorts = [ 137 138 ];
-
-    # To make SMB mounting easier on the command line
-    environment.systemPackages = with pkgs; [ cifs-utils ];
-  };
-}