diff --git a/m/apex/wireguard.nix b/m/apex/wireguard.nix
index 0a6ac5f0..6cb42bb7 100644
--- a/m/apex/wireguard.nix
+++ b/m/apex/wireguard.nix
@@ -25,11 +25,17 @@
           # Send keepalives every 25 seconds. Important to keep NAT tables alive.
           persistentKeepalive = 25;
         }
+        {
+          name = "raccoon";
+          publicKey = "QUfnGXSMEgu2bviglsaSdCjidB51oEDBFpnSFcKGfDI=";
+          allowedIPs = [ "10.106.0.236/32" ];
+        }
       ];
     };
   };
 
   networking.hosts = {
     "10.106.0.1" = [ "fox" ];
+    "10.106.0.236" = [ "raccoon.wg" ];
   };
 }
diff --git a/m/fox/wireguard.nix b/m/fox/wireguard.nix
index d0b4349e..d5b4e414 100644
--- a/m/fox/wireguard.nix
+++ b/m/fox/wireguard.nix
@@ -29,12 +29,18 @@
           # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
           allowedIPs = [ "10.106.0.30/32" ];
         }
+        {
+          name = "raccoon";
+          publicKey = "QUfnGXSMEgu2bviglsaSdCjidB51oEDBFpnSFcKGfDI=";
+          allowedIPs = [ "10.106.0.236/32" ];
+        }
       ];
     };
   };
 
   networking.hosts = {
     "10.106.0.30" = [ "apex" ];
+    "10.106.0.236" = [ "raccoon.wg" ];
   };
 
   networking.firewall = {
diff --git a/m/raccoon/configuration.nix b/m/raccoon/configuration.nix
index cec17e6f..7a608e20 100644
--- a/m/raccoon/configuration.nix
+++ b/m/raccoon/configuration.nix
@@ -8,6 +8,7 @@
     ../module/ssh-hut-extern.nix
     ../module/nvidia.nix
     ../eudy/kernel/perf.nix
+    ./wireguard.nix
   ];
 
   # Don't install Grub on the disk yet
diff --git a/m/raccoon/wireguard.nix b/m/raccoon/wireguard.nix
new file mode 100644
index 00000000..31f7d699
--- /dev/null
+++ b/m/raccoon/wireguard.nix
@@ -0,0 +1,39 @@
+{ config, ... }:
+
+{
+  networking.firewall = {
+    allowedUDPPorts = [ 666 ];
+  };
+
+  age.secrets.wgRaccoon.file = ../../secrets/wg-raccoon.age;
+
+  # Enable WireGuard
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.106.0.236/24" ];
+      listenPort = 666;
+      privateKeyFile = config.age.secrets.wgRaccoon.path;
+      # Public key: QUfnGXSMEgu2bviglsaSdCjidB51oEDBFpnSFcKGfDI=
+      peers = [
+        {
+          name = "fox";
+          publicKey = "VfMPBQLQTKeyXJSwv8wBhc6OV0j2qAxUpX3kLHunK2Y=";
+          allowedIPs = [ "10.106.0.1/32" ];
+          endpoint = "fox.ac.upc.edu:666";
+        }
+        {
+          name = "apex";
+          publicKey = "VwhcN8vSOzdJEotQTpmPHBC52x3Hbv1lkFIyKubrnUA=";
+          allowedIPs = [ "10.106.0.30/32" ];
+          endpoint = "ssfhead.bsc.es:666";
+        }
+      ];
+    };
+  };
+
+  networking.hosts = {
+    "10.106.0.1"  = [ "fox.wg" ];
+    "10.106.0.30" = [ "apex.wg" ];
+  };
+}
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 96732490..920d52dc 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -4,6 +4,7 @@ let
   hut = [ keys.hosts.hut ] ++ adminsKeys;
   fox = [ keys.hosts.fox ] ++ adminsKeys;
   apex = [ keys.hosts.apex ] ++ adminsKeys;
+  raccoon = [ keys.hosts.raccoon ] ++ adminsKeys;
   mon = [ keys.hosts.hut keys.hosts.tent ] ++ adminsKeys;
   tent = [ keys.hosts.tent ] ++ adminsKeys;
   # Only expose ceph keys to safe nodes and admins
@@ -29,4 +30,5 @@ in
 
   "wg-fox.age".publicKeys = fox;
   "wg-apex.age".publicKeys = apex;
+  "wg-raccoon.age".publicKeys = raccoon;
 }
diff --git a/secrets/wg-raccoon.age b/secrets/wg-raccoon.age
new file mode 100644
index 00000000..f32a2aa3
Binary files /dev/null and b/secrets/wg-raccoon.age differ