diff --git a/flake.lock b/flake.lock
index 3d00d97..45978b3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,26 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1682101079,
+        "narHash": "sha256-MdAhtjrLKnk2uiqun1FWABbKpLH090oeqCSiWemtuck=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "2994d002dcff5353ca1ac48ec584c7f6589fe447",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "all-cabal-json": {
       "flake": false,
       "locked": {
@@ -189,6 +210,28 @@
         "type": "github"
       }
     },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1673295039,
+        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "devshell": {
       "flake": false,
       "locked": {
@@ -925,6 +968,7 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "bernbot": "bernbot",
         "blender-bin": "blender-bin",
         "blog": "blog",
diff --git a/flake.nix b/flake.nix
index fc03e5c..e392703 100644
--- a/flake.nix
+++ b/flake.nix
@@ -41,6 +41,9 @@
     vscode-extensions.url = "github:nix-community/nix-vscode-extensions";
     vscode-extensions.inputs.nixpkgs.follows = "nixpkgs";
 
+    agenix.url = "github:ryantm/agenix";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
+
     # needed for hyprland setup
     # hyprland.url = "github:hyprwm/Hyprland";
     # hyprland.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/hosts/tkaronto/default.nix b/hosts/tkaronto/default.nix
index 9cfb4d7..05dcf0f 100644
--- a/hosts/tkaronto/default.nix
+++ b/hosts/tkaronto/default.nix
@@ -9,6 +9,7 @@
   imports = with inputs;
   with nixos-hardware.nixosModules;
     [
+      inputs.agenix.nixosModules.default
       nixpkgs.nixosModules.notDetected
       nixos-persistence.nixosModule
       common-pc-ssd
diff --git a/hosts/tkaronto/modules/nix.nix b/hosts/tkaronto/modules/nix.nix
new file mode 100644
index 0000000..cc820b9
--- /dev/null
+++ b/hosts/tkaronto/modules/nix.nix
@@ -0,0 +1,5 @@
+{config, ...}: {
+  nix.extraOptions = ''
+    !include ${config.age.secrets.nixGithubAccessToken.path}
+  '';
+}
diff --git a/hosts/tkaronto/modules/secrets.nix b/hosts/tkaronto/modules/secrets.nix
new file mode 100644
index 0000000..37b5c33
--- /dev/null
+++ b/hosts/tkaronto/modules/secrets.nix
@@ -0,0 +1,4 @@
+{
+  age.secrets.nixGithubAccessToken.file = ../../../secrets/nixGithubAccessToken.age;
+  age.secrets.wgServerPrivateKey.file = ../../../secrets/wgServerPrivateKey.age;
+}
diff --git a/hosts/tkaronto/modules/wireguard.nix b/hosts/tkaronto/modules/wireguard.nix
new file mode 100644
index 0000000..c9f4ce4
--- /dev/null
+++ b/hosts/tkaronto/modules/wireguard.nix
@@ -0,0 +1,11 @@
+{config, ...}: {
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces."wg0" = {
+    privateKeyFile = config.age.secrets.wgServerPrivateKey.path;
+    peers = [{
+      publicKey = import ./wgProxyPublicKey.key.pub;
+      allowedIPs = ["10.99.0.1/32"];
+      endpoint = "${import ./wgProxyPublicIp}:51820";
+    }];
+  };
+}
\ No newline at end of file
diff --git a/hosts/wolumonde/default.nix b/hosts/wolumonde/default.nix
index 71ebe53..8a41124 100644
--- a/hosts/wolumonde/default.nix
+++ b/hosts/wolumonde/default.nix
@@ -1,12 +1,11 @@
 {
   inputs,
-  pkgs,
-  config,
-  lib,
   tlib,
   ...
-}: {
-  imports = tlib.importFolder (toString ./modules);
+}: { 
+  imports = [
+    inputs.agenix.nixosModules.default
+  ] ++ (tlib.importFolder (toString ./modules));
 
   boot.cleanTmpDir = true;
   zramSwap.enable = true;
diff --git a/hosts/wolumonde/modules/secrets.nix b/hosts/wolumonde/modules/secrets.nix
new file mode 100644
index 0000000..a16ddc2
--- /dev/null
+++ b/hosts/wolumonde/modules/secrets.nix
@@ -0,0 +1,4 @@
+{
+  age.secrets.bernbotToken.file = ../../../secrets/bernbotToken.age;
+  age.secrets.wgProxyPrivateKey.file = ../../../secrets/wgProxyPrivateKey.age;
+}
diff --git a/hosts/wolumonde/modules/wireguard.nix b/hosts/wolumonde/modules/wireguard.nix
new file mode 100644
index 0000000..264e684
--- /dev/null
+++ b/hosts/wolumonde/modules/wireguard.nix
@@ -0,0 +1,11 @@
+{config, ...}: {
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces."wg0" = {
+    listenPort = 51820;
+    privateKeyFile = config.age.secrets.wgProxyPrivateKey.path;
+    peers = [{
+      publicKey = import ./wgServerPublicKey.key.pub;
+      allowedIPs = ["10.99.0.2/32"];
+    }];
+  };
+}
\ No newline at end of file
diff --git a/modules/base/nix.nix b/modules/base/nix.nix
index 7abe5c9..910604f 100644
--- a/modules/base/nix.nix
+++ b/modules/base/nix.nix
@@ -2,7 +2,6 @@
   pkgs,
   lib,
   inputs,
-  config,
   ...
 }: {
   nix = {
@@ -20,7 +19,6 @@
       fallback = true
       extra-experimental-features = nix-command flakes
       builders-use-substitutes = true
-      netrc-file = /etc/nix/netrc
     '';
     nixPath = ["nixpkgs=${inputs.nixpkgs}" "home-manager=${inputs.home}"];
   };
diff --git a/pkgs-set/overlays/agenix.nix b/pkgs-set/overlays/agenix.nix
new file mode 100644
index 0000000..5d35278
--- /dev/null
+++ b/pkgs-set/overlays/agenix.nix
@@ -0,0 +1,3 @@
+{inputs}: final: prev: {
+  agenix = inputs.agenix.packages."${final.system}".agenix;
+}
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..c97fb0e
Binary files /dev/null and b/secrets/secrets.nix differ
diff --git a/secrets/ssh-key.pub b/secrets/ssh-key.pub
deleted file mode 100644
index 596e647..0000000
--- a/secrets/ssh-key.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDUeDBW4hnHgnT0SjVFeGDztht9owObSmiyWXmmIEGQp2IMPqFpCxkOU61osvfCf4ZT92Ok9iJTohLwFBvHJRD/+CH8/b54sgFAx1lLObkJOMLz4iWZ5y4fNtBYuIA2McQSQoMDpDz6TDym7v7HF7zoUyBmfHMT/9WiX/z6Ft9hY63eh9DcF7WVURzeUvXLApt9wUYUxxdC2KZ/VrDPrIOxCcOgj3le+1zTiD8zwfAGhkzRD3IEx0yCYK6oztrh6WTwA5ZW+cLziH2sVEvSHFa2O398gIvZpzsdYTcQt06d/oyZIvftcpxD8IvjpGgHEsN/mAg0ovexyqAVk+TV/1XySKaoPPVCekap0R50CVD9kEk+GlD78XBYi++aAMIq0/D+NOXkgksfODt3yJPPzQx4KH8gcn0dQJM5zeyTwDfclzMRqCwL1eVHY00EbtG9IcLmMsWk/lM6vpHfyHqHlqNJ3CnUuDBccz9p5ORC1cuj4r9CmXPPmh7OYk7gGiQb4oxuqsYClzp93qmU7qMvGwmxBJaVagNIJgBqb5fsne0OMlcer5CH4L31ozszkSkzCXtFWNoTdgQHU1J3DxxL9WQJCfKku4EPJadYOh80USnauOke5CqfsGtf6uMq4l5Ylcc1QcNhRqxpeTLAIZx0EYDhmQ4eGjAZbiv6ddUp9dAdiQ== openpgp:0xDE3C8FCD
diff --git a/secrets/wolumonde.key.pub b/secrets/wolumonde.key.pub
new file mode 100644
index 0000000..c4c9726
Binary files /dev/null and b/secrets/wolumonde.key.pub differ
diff --git a/secrets/yusdacra.key.pub b/secrets/yusdacra.key.pub
new file mode 100644
index 0000000..87fb0c7
Binary files /dev/null and b/secrets/yusdacra.key.pub differ
diff --git a/shells/default.nix b/shells/default.nix
index 15a74b2..97225a7 100644
--- a/shells/default.nix
+++ b/shells/default.nix
@@ -3,7 +3,7 @@ tlib.genPkgs (pkgs: {
   default = with pkgs;
     mkShell {
       name = "prts";
-      buildInputs = [git git-crypt alejandra helix];
+      buildInputs = [git git-crypt alejandra helix agenix];
       shellHook = "echo \"$(tput bold)welcome to PRTS, $USER$(tput sgr0)\"";
     };
 })