diff --git a/.gitattributes b/.gitattributes
index fdfc04b..dca0b4c 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,3 @@
 secrets/**/*.secret filter=git-crypt diff=git-crypt
 secrets/matrix-email-config.nix filter=git-crypt diff=git-crypt
-secrets/wireguard.nix filter=git-crypt diff=git-crypt
 home/secrets/*.secret filter=git-crypt diff=git-crypt
diff --git a/README.org b/README.org
index 16dad36..dc9d8ff 100644
--- a/README.org
+++ b/README.org
@@ -42,5 +42,3 @@ RSS reader
 Grafana and Prometheus are currently used as a glorified =htop=.
 
 ** Nextcloud
-
-** Wireguard VPN
diff --git a/hosts/boreal/default.nix b/hosts/boreal/default.nix
index 3ccfe73..2cb59ee 100644
--- a/hosts/boreal/default.nix
+++ b/hosts/boreal/default.nix
@@ -32,11 +32,6 @@ in
     };
   };
 
-  services.tailscale = {
-    enable = true;
-    package = pkgs.unstable.tailscale;
-  };
-
   networking.hostName = "boreal"; # Define your hostname.
   networking.domain = "alarsyo.net";
 
@@ -87,22 +82,7 @@ in
 
     pipewire.enable = true;
 
-    wireguard = {
-      enable = false;
-      iface = "wg";
-      port = 51820;
-
-      net = {
-        v4 = {
-          subnet = "10.0.0";
-          mask = 24;
-        };
-        v6 = {
-          subnet = "fd42:42:42";
-          mask = 64;
-        };
-      };
-    };
+    tailscale.enable = true;
   };
 
   services = {
diff --git a/hosts/poseidon/default.nix b/hosts/poseidon/default.nix
index 298f35d..b81dbf3 100644
--- a/hosts/poseidon/default.nix
+++ b/hosts/poseidon/default.nix
@@ -21,11 +21,6 @@ in
 
   boot.supportedFilesystems = [ "btrfs" ];
 
-  boot.kernel.sysctl = {
-    "net.ipv6.conf.all.forwarding" = true;
-    "net.ipv4.ip_forward" = true;
-  };
-
   services.btrfs = {
     autoScrub = {
       enable = true;
@@ -33,18 +28,6 @@ in
     };
   };
 
-  services.tailscale = {
-    enable = true;
-    package = pkgs.unstable.tailscale;
-  };
-  systemd.services.tailscaled = {
-      path = [ pkgs.procps ];
-  };
-  networking.firewall = {
-    trustedInterfaces = [ "tailscale0" ];
-    allowedUDPPorts = [ config.services.tailscale.port ];
-  };
-
   virtualisation.docker = {
     enable = true;
   };
@@ -140,6 +123,8 @@ in
       enable = true;
     };
 
+    tailscale.enable = true;
+
     tgv = {
       enable = true;
     };
@@ -149,23 +134,6 @@ in
       username = "alarsyo";
       password = secrets.transmission-password;
     };
-
-    wireguard = {
-      enable = true;
-      iface = "wg";
-      port = 51820;
-
-      net = {
-        v4 = {
-          subnet = "10.0.0";
-          mask = 24;
-        };
-        v6 = {
-          subnet = "fd42:42:42";
-          mask = 64;
-        };
-      };
-    };
   };
 
   # Enable the OpenSSH daemon.
diff --git a/secrets/default.nix b/secrets/default.nix
index 9df6f72..547eb06 100644
--- a/secrets/default.nix
+++ b/secrets/default.nix
@@ -18,8 +18,6 @@ with lib;
 
     borg-backup = import ./borg-backup { inherit lib; };
 
-    wireguard = pkgs.callPackage ./wireguard.nix { };
-
     matrixEmailConfig = import ./matrix-email-config.nix;
   };
 }
diff --git a/secrets/wireguard.nix b/secrets/wireguard.nix
deleted file mode 100644
index 3a19c05..0000000
Binary files a/secrets/wireguard.nix and /dev/null differ
diff --git a/services/default.nix b/services/default.nix
index 1761fc1..79b72f4 100644
--- a/services/default.nix
+++ b/services/default.nix
@@ -19,8 +19,8 @@
     ./pipewire.nix
     ./postgresql-backup.nix
     ./postgresql.nix
+    ./tailscale.nix
     ./tgv.nix
     ./transmission.nix
-    ./wireguard.nix
   ];
 }
diff --git a/services/tailscale.nix b/services/tailscale.nix
new file mode 100644
index 0000000..75fef50
--- /dev/null
+++ b/services/tailscale.nix
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.my.services.tailscale;
+in
+{
+  options.my.services.tailscale = {
+    enable = lib.mkEnableOption "Tailscale";
+  };
+
+  config = mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      package = pkgs.unstable.tailscale;
+    };
+
+    # FIXME: remove when upgrading to 21.11, added to module by default
+    systemd.services.tailscaled = {
+      path = [ pkgs.procps ];
+    };
+
+    networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+
+    # enable IP forwarding to use as exit node
+    boot.kernel.sysctl = {
+      "net.ipv6.conf.all.forwarding" = true;
+      "net.ipv4.ip_forward" = true;
+    };
+  };
+}
diff --git a/services/wireguard.nix b/services/wireguard.nix
deleted file mode 100644
index 9d13b55..0000000
--- a/services/wireguard.nix
+++ /dev/null
@@ -1,122 +0,0 @@
-# Stolen from:
-#
-# https://gitea.belanyi.fr/ambroisie/nix-config/src/branch/main/services/wireguard.nix
-
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.my.services.wireguard;
-  hostName = config.networking.hostName;
-
-  peers = config.my.secrets.wireguard.peers;
-  thisPeer = peers."${hostName}";
-  otherPeers = lib.filterAttrs (name: _: name != hostName) peers;
-
-  extIface = config.my.networking.externalInterface;
-in
-{
-  options.my.services.wireguard = with lib; {
-    enable = mkEnableOption "Wireguard VPN service";
-
-    iface = mkOption {
-      type = types.str;
-      default = "wg";
-      example = "wg0";
-      description = "Name of the interface to configure";
-    };
-
-    port = mkOption {
-      type = types.port;
-      default = 51820;
-      example = 55555;
-      description = "Port to configure for Wireguard";
-    };
-
-    net = {
-      v4 = {
-        subnet = mkOption {
-          type = types.str;
-          default = "10.0.0";
-          example = "10.100.0";
-          description = "Which prefix to use for internal IPs";
-        };
-        mask = mkOption {
-          type = types.int;
-          default = 24;
-          example = 28;
-          description = "The CIDR mask to use on internal IPs";
-        };
-      };
-      v6 = {
-        subnet = mkOption {
-          type = types.str;
-          default = "fd42:42:42";
-          example = "fdc9:281f:04d7:9ee9";
-          description = "Which prefix to use for internal IPs";
-        };
-        mask = mkOption {
-          type = types.int;
-          default = 64;
-          example = 68;
-          description = "The CIDR mask to use on internal IPs";
-        };
-      };
-    };
-  };
-
-  config.networking = lib.mkIf cfg.enable {
-    wg-quick.interfaces."${cfg.iface}" = {
-      listenPort = cfg.port;
-      address = with cfg.net; with lib; [
-        "${v4.subnet}.${toString thisPeer.clientNum}/${toString v4.mask}"
-        "${v6.subnet}::${toString thisPeer.clientNum}/${toHexString v6.mask}"
-      ];
-      privateKey = thisPeer.privateKey;
-
-      peers = lib.mapAttrsToList
-        (name: peer: {
-          inherit (peer) publicKey;
-        } // lib.optionalAttrs (thisPeer ? externalIp) {
-          # Only forward from server to clients
-          allowedIPs = with cfg.net; [
-            "${v4.subnet}.${toString peer.clientNum}/32"
-            "${v6.subnet}::${toString peer.clientNum}/128"
-          ];
-        } // lib.optionalAttrs (peer ? externalIp) {
-          # Known addresses
-          endpoint = "${peer.externalIp}:${toString cfg.port}";
-        } // lib.optionalAttrs (!(thisPeer ? externalIp)) {
-          # Forward all traffic to server
-          allowedIPs = with cfg.net; [
-            "0.0.0.0/0"
-            "::/0"
-          ];
-          # Roaming clients need to keep NAT-ing active
-          persistentKeepalive = 10;
-        })
-        otherPeers;
-    } // lib.optionalAttrs (thisPeer ? externalIp) {
-      # Setup forwarding on server
-      postUp = with cfg.net; ''
-        ${pkgs.iptables}/bin/iptables -A FORWARD -i ${cfg.iface} -j ACCEPT
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
-        ${pkgs.iptables}/bin/ip6tables -A FORWARD -i ${cfg.iface} -j ACCEPT
-        ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
-      '';
-      preDown = with cfg.net; ''
-        ${pkgs.iptables}/bin/iptables -D FORWARD -i ${cfg.iface} -j ACCEPT
-        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${v4.subnet}.1/${toString v4.mask} -o ${extIface} -j MASQUERADE
-        ${pkgs.iptables}/bin/ip6tables -D FORWARD -i ${cfg.iface} -j ACCEPT
-        ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s ${v6.subnet}::1/${toString v6.mask} -o ${extIface} -j MASQUERADE
-      '';
-
-    };
-
-    nat = lib.optionalAttrs (thisPeer ? externalIp) {
-      enable = true;
-      externalInterface = extIface;
-      internalInterfaces = [ cfg.iface ];
-    };
-
-    firewall.allowedUDPPorts = lib.optional (thisPeer ? externalIp) cfg.port;
-  };
-}