diff --git a/modules/microvms.nix b/modules/microvms.nix
index e5dfa8c..ac46b9b 100644
--- a/modules/microvms.nix
+++ b/modules/microvms.nix
@@ -12,7 +12,9 @@
 }: let
   inherit
     (lib)
+    any
     attrNames
+    attrValues
     concatStringsSep
     escapeShellArg
     filterAttrs
@@ -173,7 +175,9 @@
           # would not come online if the private key wasn't rekeyed yet).
           # FIXME ideally this would be conditional at runtime if the
           # agenix activation had an error, but this is not trivial.
-          ${wgConfig}.linkConfig.RequiredForOnline = "no";
+          ${wgConfig} = mkIf vmCfg.localWireguard {
+            linkConfig.RequiredForOnline = "no";
+          };
 
           "10-${vmCfg.networking.mainLinkName}" = {
             matchConfig.MACAddress = mac;
@@ -194,16 +198,18 @@
           };
         };
 
-        extra.wireguard."${nodeName}-local-vms" = {
-          server = {
-            host =
-              if config.networking.domain == null
-              then "${config.networking.hostName}.local"
-              else config.networking.fqdn;
-            inherit (cfg.networking.wireguard) port;
-            openFirewallRules = ["untrusted-to-local"];
+        extra.wireguard = mkIf vmCfg.localWireguard {
+          "${nodeName}-local-vms" = {
+            server = {
+              host =
+                if config.networking.domain == null
+                then "${config.networking.hostName}.local"
+                else config.networking.fqdn;
+              inherit (cfg.networking.wireguard) port;
+              openFirewallRules = ["untrusted-to-local"];
+            };
+            linkName = "local-vms";
           };
-          linkName = "local-vms";
         };
       };
     };
@@ -338,6 +344,12 @@ in {
             description = mdDoc "Whether this VM should be started automatically with the host";
           };
 
+          localWireguard = mkOption {
+            type = types.bool;
+            default = false;
+            description = mdDoc "Whether this VM should be connected to a local wireguard network with other VMs (that opt-in here) on the same host.";
+          };
+
           system = mkOption {
             type = types.str;
             description = mdDoc "The system that this microvm should use";
@@ -350,18 +362,20 @@ in {
   config = mkIf (vms != {}) (
     {
       # Define a local wireguard server to communicate with vms securely
-      extra.wireguard."${nodeName}-local-vms" = {
-        server = {
-          host =
-            if config.networking.domain == null
-            then "${config.networking.hostName}.local"
-            else config.networking.fqdn;
-          inherit (cfg.networking.wireguard) openFirewallRules port;
-          reservedAddresses = [cfg.networking.wireguard.cidrv4 cfg.networking.wireguard.cidrv6];
+      extra.wireguard = mkIf (any (x: x.localWireguard) (attrValues vms)) {
+        "${nodeName}-local-vms" = {
+          server = {
+            host =
+              if config.networking.domain == null
+              then "${config.networking.hostName}.local"
+              else config.networking.fqdn;
+            inherit (cfg.networking.wireguard) openFirewallRules port;
+            reservedAddresses = [cfg.networking.wireguard.cidrv4 cfg.networking.wireguard.cidrv6];
+          };
+          linkName = "local-vms";
+          ipv4 = net.cidr.host 1 cfg.networking.wireguard.cidrv4;
+          ipv6 = net.cidr.host 1 cfg.networking.wireguard.cidrv6;
         };
-        linkName = "local-vms";
-        ipv4 = net.cidr.host 1 cfg.networking.wireguard.cidrv4;
-        ipv6 = net.cidr.host 1 cfg.networking.wireguard.cidrv6;
       };
     }
     // extraLib.mergeToplevelConfigs ["nodes" "disko" "microvm" "systemd"] (mapAttrsToList microvmConfig vms)
diff --git a/secrets/wireguard/proxy-sentinel/keys/ward-adguardhome.age b/secrets/wireguard/proxy-sentinel/keys/ward-adguardhome.age
new file mode 100644
index 0000000..08c86fd
--- /dev/null
+++ b/secrets/wireguard/proxy-sentinel/keys/ward-adguardhome.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 VczE+OsT7Zya9rBR65dI5xm9FbO2iK14HV8qLB/wV2w
+RSnNlXpkqJ6STDMSy+0BHjsYHR7YdMsDyOt6PVYFYxk
+-> piv-p256 xqSe8Q A+jwRnWsBQca7hXebaSyKrXHd2ICnvw3X94Q0Mxe59pt
+TJL+yvBvKQPSLll/ctZyz7Y8ntocPebBEl+IJDhE10A
+-> ~-grease
+32CCgSQWq2oLMQ1FhitTfzoSd+8qezti
+--- Azc3CtkmP/6VjOJBqPKMTmQa1znxJzHMTua8vHIsClM
+
)���[ޞqs�2x�3�τ��ՐdC?�/��R �d���Jiw6C�$T[t�Y9��VJ�4~{m7��������2O`
\ No newline at end of file
diff --git a/secrets/wireguard/proxy-sentinel/keys/ward-adguardhome.pub b/secrets/wireguard/proxy-sentinel/keys/ward-adguardhome.pub
new file mode 100644
index 0000000..463cb52
--- /dev/null
+++ b/secrets/wireguard/proxy-sentinel/keys/ward-adguardhome.pub
@@ -0,0 +1 @@
+UEPxia5t/CEZa7V2DeWBrCAwzKXB6lwJXCr+ZTjqE0I=
diff --git a/secrets/wireguard/proxy-sentinel/psks/sentinel+ward-adguardhome.age b/secrets/wireguard/proxy-sentinel/psks/sentinel+ward-adguardhome.age
new file mode 100644
index 0000000..d6df672
--- /dev/null
+++ b/secrets/wireguard/proxy-sentinel/psks/sentinel+ward-adguardhome.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> X25519 xeAabZlGUTMQDnQPL3fi+IBAnPxt5GXyfz8SnYI+/kE
+YBpu6a23WMTh+db/7zcSqdPP/lLzY2LG/2VKArXQS7s
+-> piv-p256 xqSe8Q Aoac6u3HAfBUroc4ZHRLVulBlk51ugPP/ZS3RD5a5a7x
+CLztuOf3ImKoGGHoFu+8vCVJxystyl7vM+sgvu8e4I8
+-> bk:\01W-grease jC 7kLh(`e ]><&#N^S
+S0DHVlbf/gS6trRCuidFQzycUcA4T82nwrrZj6gHC/bx2A7IUmp2MGQSYjdFWiXO
+p15kMneA5s5MdXs5LLnGQU3CFiXAGHIm9E5ULN042DB0yuLQv9/qFXzKAKmDcEVx
+EvE
+--- j+2MYGrV0W9A3AzlqRJia/MI0pa5wAfR9DF1WZqGL7I
+O��/Q5�m�����ՌfL��$f��k��3�d
/�s�d@ߖMs����v�V���!���$������-1
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-grafana.age b/secrets/wireguard/ward-local-vms/keys/ward-grafana.age
deleted file mode 100644
index cd5277f..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-grafana.age
+++ /dev/null
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> X25519 1VMVSzcANsteZ4hAHqn/TJJcEU1jqj2m3fgY6SNe1Vc
-w5a7A0Suk4RHNVUbqdLnodZf5qPmAd214QtOqHLMFU8
--> piv-p256 xqSe8Q Ah1xDNBFPyADUPmDyZn1nrdd1etkCGCP9k1FVzO2ax05
-SLRXGnfmBI+MucpBj5IhdCLOSCE+VdEsVGJrV8Uno1c
--> Bk(9k-grease
-X7PFQXIU0w0BA4i39o/DvXD7RvSI6a/19qbgDus8QspP2zizCYLRiir4GC/eEmbx
-naZ8rbadAiqF33d9TJjt0GHLAKEO41LLag
---- S9BGD+Tn7zOwdYaOL6bxMJg+miYxMClrfVYF++N1bT8
-Yʾ�S/O���}��
 `̒GSt�Hg�/cѻɼ���+G����`����y�O2-��e�S������/.��ij�$ͳK
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-grafana.pub b/secrets/wireguard/ward-local-vms/keys/ward-grafana.pub
deleted file mode 100644
index 029880c..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-grafana.pub
+++ /dev/null
@@ -1 +0,0 @@
-JhRPg09Lsu7OJ2YpyZHD+/KaKYT9xHJ6D8Ljhwa7JXU=
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-kanidm.age b/secrets/wireguard/ward-local-vms/keys/ward-kanidm.age
deleted file mode 100644
index f19c451..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-kanidm.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 fh0OvxTr6Zttk6+VAI9c4Y9ann6FIkTmBvC7Y82SrxI
-Y6k/ZKI7a1J0/hcPrPdl25l6takAd//omssdtLinYlo
--> piv-p256 xqSe8Q AjohzpU4WsG47TdoKLAUQ38ebUvlFSh6HK+tpFIa8XiD
-OIBdk79gYZCYn6Cpb7g/wYMdiP2f244nGfkuhHvtIdM
--> PvW.-grease M`]UA5 5e} %97ce
-IC2uBMgrkvgSG7PDF7sNIA
---- Ewa38w9RjdbGnOTGDW9Np0S5URA9FP1vLSm+5ewr0vk
-�����mV.�蘮iLA`�fL�1hO��@V�=.���l�` ��;�Ŵ=�/�YڹJß��+W�a���z
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-kanidm.pub b/secrets/wireguard/ward-local-vms/keys/ward-kanidm.pub
deleted file mode 100644
index 8e72e4e..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-kanidm.pub
+++ /dev/null
@@ -1 +0,0 @@
-utKdEpCoObpQQBsgTdHo9ILebtAmky2ODzzvyxqCNGU=
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-loki.age b/secrets/wireguard/ward-local-vms/keys/ward-loki.age
deleted file mode 100644
index a341789..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-loki.age
+++ /dev/null
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> X25519 O1NBBwVWvWhnRLKR57Ldnm++nsREvItUx7y3CoYbyDk
-qzXlz8hM1DkmUFC660wNlyxIBSODgM6k0PlA+iDcvZw
--> piv-p256 xqSe8Q A7uxodKTlFBlNpZQ+9IV8uoIfMkIDLvfe1R1bLN3e8CQ
-2JrmKsJhDqKPmDLFTYCGCvSX3TCMsYkSLm97YMhTTEQ
--> =`3-grease 9\-*u:1 BN= lECLO U+:8
-u8vyFBLzDcpmLIAXUy0NpiR04hdO4N4tdmjs9YqeUTYplSc6ydvuk6g1USSD6xBF
-1xuMyist7OXPZfvIK87O1WiiNOhIc+cZBososRUlarwSa6/QP++mj30
---- 6d695xfRviZx/RZ8PBoOxviqgq7yQ1wSKimRfdn52WU
-T�y�T��7'��G&Z�K���06n[N��p/)Rх�<�%�d��;µD��.�YzK�߰.��HXs�
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-loki.pub b/secrets/wireguard/ward-local-vms/keys/ward-loki.pub
deleted file mode 100644
index 50cc011..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-loki.pub
+++ /dev/null
@@ -1 +0,0 @@
-fw4acGjuoFWZxA3RIwFK28N1apOM1RTueQJvqAzW4B0=
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-nginx.age b/secrets/wireguard/ward-local-vms/keys/ward-nginx.age
deleted file mode 100644
index cd1d621..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-nginx.age
+++ /dev/null
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> X25519 +S2DEXP2FxIlF3HeWNul/QHE4fuVwv7ausZO8C1Yvko
-USoULC2zp6mkLEGQFc4ELAotOQkq85yjfC3ImZQe6g0
--> piv-p256 xqSe8Q AuVsMp2nyVB5I6ae7X4rnTT6gH/AyOwkVH5C8qRzenCu
-QLdaqASucS24wx5LuoFVD+LBdgsd+wGITMhJBOCrqpY
--> z&m(b4Nw-grease ,&}.>' UWDXz
-adqzHHC2X08jrZz0h0y+MuJHM6/kuSUNad8+19cY88IRTF2ujQnoDVDS
---- 8dc8Ta84I8RY7YGIcEuZStaEncGXv1uwJw2ncy3QgtU
-��r}�j�E�A]���W�4g�3���A�"�Ȥ�ʚ
-�ru3�_�E �/���ztK�ߔ�݈��I/���}��*
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-nginx.pub b/secrets/wireguard/ward-local-vms/keys/ward-nginx.pub
deleted file mode 100644
index 478d9b8..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-nginx.pub
+++ /dev/null
@@ -1 +0,0 @@
-Zs0W99JiuCv1F3NMTp/PcMBrt1bzWttJWNEh00Freyw=
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-test.age b/secrets/wireguard/ward-local-vms/keys/ward-test.age
deleted file mode 100644
index 3d09ef7..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-test.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 whbY47wmwEeXqdKJ7MwjiyAIDpj+fruueMmPTEgnJgY
-Z3QdAcWt5mkB3eWZeNkq0eq+UJ5DjL98uciSXb91pVg
--> piv-p256 xqSe8Q AxUBFcdy+TQ/aXS8/1dZWQxbHUbPdjdm6RcM3vyj1qxB
-huH3sE7CutLMnL2AA7riZLG2q7vfKHq1yw1cCWIUcGo
--> _-~<XC-grease 6~]V 3\ 3l4
-VdckN3SwUIKhL7vUKNG8p3cfd64n+Ac
---- qCoQNOQPvZlq2nU8hwmpk9zGRJe5VLK5/t6DHyQ3omw
-S�������<,̘��?�n�S@s��9_��2@��q=�Q
!J���Lf��Gl�a?��-�j+��3xf�~Px�O�\�:�
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-test.pub b/secrets/wireguard/ward-local-vms/keys/ward-test.pub
deleted file mode 100644
index 9a4283d..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-test.pub
+++ /dev/null
@@ -1 +0,0 @@
-ledSlUTiISwDaIZpR1tiWpK0ZQsPOYExCZCAGY5rAC8=
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-vaultwarden.age b/secrets/wireguard/ward-local-vms/keys/ward-vaultwarden.age
deleted file mode 100644
index 6c01974..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-vaultwarden.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 QhMKv/vatS9aasHJC2HyElb48Ge4v32ui8D8WjuWmG8
-sqq3AAjc2/daHzwrB3eczjl97UupH/7z8JP+iBcwV48
--> piv-p256 xqSe8Q A+h3Xv+Q3aaCcOk2P21RbFva28uIBru0ygvgbDux2623
-RxWTuljV2p12ppqGJXZn1K/WrfQXglDRkaPYaYupKmQ
--> lW=F-grease K1G) ~`6k E96)NYBZ
-6cTJrhmLT13+g9X4Yq8
---- NUlUtQ5p4wPVHeP6v80ItUv7+IHggcWboLTpaeHGBMw
-H�:ML�,2c
�b��g��U�=���y�����~8���^*�t����4���Q$r��BKBɥc�}�;�]�#K
]�
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward-vaultwarden.pub b/secrets/wireguard/ward-local-vms/keys/ward-vaultwarden.pub
deleted file mode 100644
index 8fb6c63..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward-vaultwarden.pub
+++ /dev/null
@@ -1 +0,0 @@
-KABWFKtu7ZgyyDmLRhtdY2ffjBZ+vcpdAd2FscvLZGc=
diff --git a/secrets/wireguard/ward-local-vms/keys/ward.age b/secrets/wireguard/ward-local-vms/keys/ward.age
deleted file mode 100644
index 9b755e0..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 Zfuwveyf86nRchq2VM9pUX2GpEJ7fOCD8S/ZpgnohBo
-cTqLLXd0WDjeUw8v3Zi7tEu8AuHqGMouNNVMBvDSz/s
--> piv-p256 xqSe8Q AhkBYH9xbuiZzDEEPZKdI+b8cRBwpFynKCcG27IRcxeP
-d7JvnhavlhklbmkUna76PL6E+oVVNl8AQs+Y2XgWOLM
--> #+BWuCW-grease -y#r [YV T?;fL)t^ lrGksIs
-PWmuTyDWS1KmdmgKW3B7ITyE6Yl/Vb2cTggzNr2rDQ
---- xHLh9TYKLUEcU+rYSNyUomo0H9bNx92gC1To/qTAav8
-iEN��d�c� ���Mf��'
�>�:��;ݗ�m�x0�v'YY(d��V��]��r�PVϊdÉj,N�r&���C�
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/keys/ward.pub b/secrets/wireguard/ward-local-vms/keys/ward.pub
deleted file mode 100644
index fd32d3f..0000000
--- a/secrets/wireguard/ward-local-vms/keys/ward.pub
+++ /dev/null
@@ -1 +0,0 @@
-E5VkPLuSW3IJ1fK3FerHCfPc6xyTzD7q8D3AATmWME0=
diff --git a/secrets/wireguard/ward-local-vms/psks/ward+ward-grafana.age b/secrets/wireguard/ward-local-vms/psks/ward+ward-grafana.age
deleted file mode 100644
index b0e3939..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward+ward-grafana.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 l+Kx2WdyZAcXw1khpjWLlp3i0ZGsL55c4uglYcjM8lg
-X7K6tEd5ShwZTV77QJGOUze5xqC7h52p/sgxdYjd+Hw
--> piv-p256 xqSe8Q Almjk6hOZRvyUCMKI/zvfBxtiRHkeJ0osoqhgkNKJwWb
-zICEosfjzSTe4KF29PpxpUiEb3+U7tSVgPd6DBGrTF8
--> ZiQW'-grease f cV
-hIn+gaL0Gga0VyVw9KFhgc/tIrleJnE
---- rtrMiXdLfW6uqYP8F8OUPGxJxiBV2L7x4/6zQk6MbVo
-�������+��f>>��Ø�1d��"���d����uN�y=ѭ������tf+_�m���=���)*������
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward+ward-kanidm.age b/secrets/wireguard/ward-local-vms/psks/ward+ward-kanidm.age
deleted file mode 100644
index 774b6dd..0000000
Binary files a/secrets/wireguard/ward-local-vms/psks/ward+ward-kanidm.age and /dev/null differ
diff --git a/secrets/wireguard/ward-local-vms/psks/ward+ward-loki.age b/secrets/wireguard/ward-local-vms/psks/ward+ward-loki.age
deleted file mode 100644
index a277ab1..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward+ward-loki.age
+++ /dev/null
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> X25519 rW9QHscgqpdm+lcxeBwmYXf+Xh9+0mt7wfEcZlW+Wk0
-qbp2mKScdG+c+cCsjFOd3vSeFK5Ubg7SctLBYPGfdC0
--> piv-p256 xqSe8Q Azz0X6lwp9Tk1Rh4NWaV2jJNvhUyls/eDQdykqMBMtGe
-Isn+owms8+HeTuE4iDqScC0EqlcHEQS5cavBvHc3nmM
--> t6ik'-grease Fx[zHS (=r V,5^F7& \Vij,]
-syd+RpzGO++6gQKMmHRrt1RQQSJuR52z5Bbzd+Op5fQibQoGEfTEWAqjDlp+9Rm5
-nwVsEJ6n8blUfPo
---- 75D6UhGrjkmbYzJt11ucaFYj2sGqtOTj5jY8CqlR25Q
-���q8f�w������JM�K�R��H�B��'���	-�պI�yxɑ�`4����}POkZKuu��/�G(�a���
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward+ward-nginx.age b/secrets/wireguard/ward-local-vms/psks/ward+ward-nginx.age
deleted file mode 100644
index 27d85ff..0000000
Binary files a/secrets/wireguard/ward-local-vms/psks/ward+ward-nginx.age and /dev/null differ
diff --git a/secrets/wireguard/ward-local-vms/psks/ward+ward-test.age b/secrets/wireguard/ward-local-vms/psks/ward+ward-test.age
deleted file mode 100644
index b801563..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward+ward-test.age
+++ /dev/null
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> X25519 W2AeVTtVkO93zSxX59GwhBy5NwRacz6w0dEk5JptS0Q
-QZfGRkvYZjvWoK64RwH/D1pSm+Q5Z/bWa+wCiStim80
--> piv-p256 xqSe8Q A5ODsP5r/eJxRYohpCeC/os0qx+HITx9coafiXkO5aCY
-Lfzy5uPK315poUK59pDa9UsyjzY0bf94BvpJQC4qAEQ
--> mF-grease d w /I6vG!UZ 1fNC
-QAvTqQEf64QZ9WPtav9CjSYIx8UjIHOMdaPyzKG8OaYa6d8QsrTog1OP7sqJemmE
-+1gSHFORe7ofpxrzCFE
---- vbL5PR2z5571aWqnQ6+6Vk8Ni11SDvWtH8dl8i3Z44k
-Hl-bS_	�/����*B+f_���̹�娛Y�/_�ߡϾDC\I!{��[�Y��p���^Z��G�@ZE)�Nr���
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward+ward-vaultwarden.age b/secrets/wireguard/ward-local-vms/psks/ward+ward-vaultwarden.age
deleted file mode 100644
index cba358a..0000000
Binary files a/secrets/wireguard/ward-local-vms/psks/ward+ward-vaultwarden.age and /dev/null differ
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-kanidm.age b/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-kanidm.age
deleted file mode 100644
index 9b09e50..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-kanidm.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 0rM+VxBb/RV2VTW5xCQEsiKcEavMhS84MczYVNu3M28
-JqY5QAqkTOe+DPTcQ+hE8VyydiuCTB/oMfybJy77nTw
--> piv-p256 xqSe8Q A7YPM7afy7jQlOjLSGnRZxM1Lpjq/MIrE/Re/eXvTWLG
-DVs5SmBiriP1N5Ao/JZCW4kMMsM5Pn3GZq2wGEUIQ5Y
--> WkDB[!<@-grease NA %r x ?p8%w^w
-KzfsXKRvSOnHZCqBCNA
---- 0nKf16DM2WX3m8hCsuXJhepeoqW4ijIFDvrS7j9RUuI
-���8�3���x�0"~<���1�+�ٔzb�՝=$
-�\�w��u}��)����������tR5�T78������
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-loki.age b/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-loki.age
deleted file mode 100644
index 14a8c04..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-loki.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 uqBWvpQ8DR8aQY2r3Vhw6axyVbKmgXvEXFLZuM7rA1o
-+uCVaGfiloQOtRdJXkqi3DmyflJxCmnHBdTd8i+Pafc
--> piv-p256 xqSe8Q AoCH6+psiFFiq55UYRSO1xsTxDAbspFul9JLvoa15kwp
-6jgEbmnQtGkajeVOOVcna+3lBwWn9ugUAOueJ3xHMpo
--> z-grease n3dm|_ '/E`@% H
-85u5GUpIwcbSPBPN9Kulccacf9/mWWvIHfTb
---- feOoiwcKK14ARe6JX6Fgn8mql8i6pQ9D8RLo5VF13VI
-&L)�/���ʇ����^H�,b�N<��B��K�6�>��KE�8� ��M߀�Á�1������s���%Bd��g��r
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-vaultwarden.age b/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-vaultwarden.age
deleted file mode 100644
index 1f377e7..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward-grafana+ward-vaultwarden.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 +9XaBavmWqwwDxFFtVwee/8rKza1JHZ0mSK90eY+r38
-WQnmfsxNRISCQ5pTIptSXdonwTU14z4OrQkldXBxEBQ
--> piv-p256 xqSe8Q A0Jy6YUqXxVwFDwsamsMoUGK0Un/AtE9Ku5s3gSnicax
-YjYo8ybAvbrTdCnAWQa46sZ4qP6Z7JJHXjDgye4e+GQ
--> i-grease W?" *Ry# Y{bH" E^Qy+Ls
-ds/OM23+0bJHIIH5W5rdZjG+SU9QWq2OSWhqLEU
---- 2S/2SUwFjSZnQoM0IOKJf/OMyMbsUydgw3pat3bV36E
-����+}����ȶ~L���O|��7�4WYiv:���2�.G���H_�mal�²~H��ތ#Y�����޹f��� 
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-kanidm+ward-loki.age b/secrets/wireguard/ward-local-vms/psks/ward-kanidm+ward-loki.age
deleted file mode 100644
index f47879f..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward-kanidm+ward-loki.age
+++ /dev/null
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> X25519 UnfKesPLrwZKz3l1tgw3u0eSpH/znFoeEtDJMkBzz3E
-SdRp4/E0e54l1P9f7/qh6Y/FT3AItVnNyu+z+IRE91Q
--> piv-p256 xqSe8Q Ai0cV8qTPFWewQC9MDQUm5pnKUa2Vkq1CwbWcpTURxOj
-56B02YgriclCJMU8qT8J9auzEAi2dQFrYZwCSIny7Lc
--> PS-rC-grease kf8 Ri>B
-yrzDq1oL2vHsqwzYr5I8nV+oC7QWnGWDMLVe
---- L7Jd7UDHK8K1mjVqv25iOui+8jbVx+fcd3Bp0aqFstQ
-�{"�qK�s�qˠ��|?'2�������
-�S]j�W2����N���M���;�h���`񰕠ژ�"*e��xy
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-kanidm+ward-vaultwarden.age b/secrets/wireguard/ward-local-vms/psks/ward-kanidm+ward-vaultwarden.age
deleted file mode 100644
index c62dd80..0000000
Binary files a/secrets/wireguard/ward-local-vms/psks/ward-kanidm+ward-vaultwarden.age and /dev/null differ
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-nginx.age b/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-nginx.age
deleted file mode 100644
index 5d55211..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-nginx.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 tsXV4JtgAA9LV20N0kSAJsjjryQprw6ZPk7WHRd/RxM
-BCBtOXrX3S4M6VhrxEu/jqd0+NK7u0yihfjPNWMAetc
--> piv-p256 xqSe8Q Au8WHiiLnTKqaifTsfng53Wrhx0gOYUTnGntqb6TQ1u8
-54l7G8toHQ6xQr2e7L/NG2D/nGsoAiaQeMmMU0NNM5U
--> ]VC-R^ya-grease 7UGA{FS L '/;3i cb
-ThjXpck
---- l3wNdfGj/93+AZvU9Zbm0/FsRX/yI+i/ra8FGsXcGi8
-^L��Û�.9|�v(:#7�������1"�	᷇�JɚS��{~��
�JJ�!a]���:|�9�s%ͨ$�->
���
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-test.age b/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-test.age
deleted file mode 100644
index a2290ec..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-test.age
+++ /dev/null
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> X25519 EwXeZd0IpklL9wc+XfGvgNo+KW7aIeVQ20xK8gS7GUE
-lRs4jMx71JTMaU3goAZIS6PUniF1PgRblh/XambNBgI
--> piv-p256 xqSe8Q Ao1nUGIKQowWKh2HJsRomf8ppqm6d1LRlmkNycdy60RZ
-R5hz4JFxCGsg0XffMHRp9WiKgAkgLdLjWL0cz7gvCbc
--> gqa#.-grease =
-YchB+M/TWA53+KFNwlzS/Ogiaq3UEen+vf0o3g0Q2VCSVQ
---- ILPRvlvwoVUWYi5S2r3HGgFwAmU4Rc6rEgHqFI5RjF4
-���7�	
-.]�G�|eR����y��L1p0w`��wJV�#A���vl
H"CfԱ�-o�ѯ�«+g�0#'�(<�a_�
\ No newline at end of file
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-vaultwarden.age b/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-vaultwarden.age
deleted file mode 100644
index 0de5097..0000000
Binary files a/secrets/wireguard/ward-local-vms/psks/ward-loki+ward-vaultwarden.age and /dev/null differ
diff --git a/secrets/wireguard/ward-local-vms/psks/ward-nginx+ward-test.age b/secrets/wireguard/ward-local-vms/psks/ward-nginx+ward-test.age
deleted file mode 100644
index 1d66e76..0000000
--- a/secrets/wireguard/ward-local-vms/psks/ward-nginx+ward-test.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> X25519 95jd7mMbmilIpQbvDmu48FfMFZZbkioExF8KTw3fNXI
-CxWXmbD6kArjmJ2Y4lYVcwaQghWyJzS6DsQ4djspUf4
--> piv-p256 xqSe8Q A13AOGXe31ASOihylki3jl8xCxp2bh2lYnzQC44Rbe10
-+R8gYDIFyANNPLvdQcq8+67dy+tFcVqS/7rYAbN7pz8
--> 6q.AXp(-grease
-GJOOcphfNDKW
---- E/iTzPRKqfS52YBWVcbVAak5koIxmdanzTXRt/5MZnM
-�۸�6�W�n�?W}7Jp[B�o|T�:���T���]Yk����B����o޽6zqV��?+��^M��*/���
�
\ No newline at end of file