diff --git a/apps/wireguard/configmap.yaml b/apps/wireguard/configmap.yaml
deleted file mode 100644
index b65af57..0000000
--- a/apps/wireguard/configmap.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: v1
-data:
-  wg0.conf: |
-    # Based on the image's /defaults/server.conf. The init container adds
-    # PrivateKey from the SealedSecret. After editing peers, bump
-    # wireguard.whyredfire.dev/config-revision on the Deployment to restart it.
-    [Interface]
-    Address = 10.13.13.1
-    ListenPort = 51820
-    MTU = 1280
-    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
-    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
-
-    [Peer]
-    # macbook
-    PublicKey = xuWFr3AHPeh/gRO5NiCGnwHcr0e/8InaroXcY8S5eC0=
-    AllowedIPs = 10.13.13.2/32
-
-    [Peer]
-    # phone
-    PublicKey = 8VBoG0Bpwv1UhAOethIgRJXmaNWPErSWkqcfdjGmhHs=
-    AllowedIPs = 10.13.13.3/32
-kind: ConfigMap
-metadata:
-  name: wireguard
-  namespace: wireguard
diff --git a/apps/wireguard/deployment.yaml b/apps/wireguard/deployment.yaml
deleted file mode 100644
index 22d2b3b..0000000
--- a/apps/wireguard/deployment.yaml
+++ /dev/null
@@ -1,83 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: wireguard
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        wireguard.whyredfire.dev/config-revision: "1"
-      labels:
-        app.kubernetes.io/name: wireguard
-    spec:
-      containers:
-        - env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Etc/UTC
-          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
-          livenessProbe:
-            exec:
-              command:
-                - wg
-                - show
-                - wg0
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          name: wireguard
-          ports:
-            - containerPort: 51820
-              name: wireguard
-              protocol: UDP
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-          volumeMounts:
-            - mountPath: /config
-              name: config
-      initContainers:
-        - args:
-            - |
-              set -euo pipefail
-              umask 077
-              mkdir -p /config/wg_confs
-              awk -v keyfile=/secret/private-key '
-                { print }
-                /^\[Interface\]/ { getline key < keyfile; print "PrivateKey = " key }
-              ' /template/wg0.conf > /config/wg_confs/wg0.conf
-          command:
-            - /bin/bash
-            - -c
-          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
-          name: render-config
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /template
-              name: template
-              readOnly: true
-            - mountPath: /secret
-              name: secret
-              readOnly: true
-      volumes:
-        - emptyDir:
-            medium: Memory
-          name: config
-        - configMap:
-            name: wireguard
-          name: template
-        - name: secret
-          secret:
-            defaultMode: 256
-            secretName: wireguard
diff --git a/apps/wireguard/kustomization.yaml b/apps/wireguard/kustomization.yaml
deleted file mode 100644
index 9d38556..0000000
--- a/apps/wireguard/kustomization.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - configmap.yaml
-  - deployment.yaml
-  - service.yaml
diff --git a/apps/wireguard/sealed-secret.yaml b/apps/wireguard/sealed-secret.yaml
deleted file mode 100644
index 0dd9d96..0000000
--- a/apps/wireguard/sealed-secret.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  encryptedData:
-    private-key: AgCyimGRHeoQAc4xVkr09bpRHYtZBG2Gjc1IkOM9D/p+f7n7/Va2hJixDL1ieVBXufEm485MYcLV74j1dG6q/Xyad+Y2VsAlWGIFlC+1rCO0V/dEKGOav8bxxhcMV56YUDgNR4ZtBOnN5aLgq2P/72CIbRpa9I4ofNUmoMV+Eh50hY9oVJgdmeb6Dx+03q5Zkf1LTJZMxnYi5r6bbzznT1bqQM9gZml4N2b3cBBVrtLIBlPFkHeyxhmS+0ZnQgXiu+oFEkAvXLKB44AmerJ6UFYjX5ly933UzOm2KsTR4pIGHRsj6vZvjCb6cJUxCAhFOn9Nq+B984TeNTomCglYVc3p5XRVAsSVL+MBT1EfNoz9qSec8sHiufnsgHG6cre6DDriv0HD+yfg8tCK7IX0HbETb2aQXgNNFvdnSL5S6rqbffctl/ivfj3RsZmJCcaxwrWR6khmn6nzOkqNeKSMjmpAxSTdAlve6EFFWqvFz4D0LpYpk/73kyaWvczuzV//cGlYBwVOBA9CPCyAexdrQ78wbzn0zaCdo7yKqTQtgZestXnyCICUyrXm+1WQzd8W/lGHtr/hV7D3H//RQAGxnlWERvWCZlYIF6xkz9eApvWl72gE4cwzcgme+1+EkyPgSmLgtyh78B/kucEZC2Qy2chGJEAlwJln02HxbJ0RX8Bo1ko+kxCHzZl12zA02A1yzQGzEt7Oya9K/wrhWX8plYFK4Zq811yHmVqJEeu5bseCSi+O0tHmnl5vafRFyjw=
-  template:
-    metadata:
-      name: wireguard
-      namespace: wireguard
diff --git a/apps/wireguard/service.yaml b/apps/wireguard/service.yaml
deleted file mode 100644
index 8d35529..0000000
--- a/apps/wireguard/service.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  externalIPs:
-    - 192.168.2.5
-  ports:
-    - name: wireguard
-      port: 51820
-      protocol: UDP
-      targetPort: wireguard
-  selector:
-    app.kubernetes.io/name: wireguard
diff --git a/argocd-apps/apps/kustomization.yaml b/argocd-apps/apps/kustomization.yaml
index c4964f9..523b6f9 100644
--- a/argocd-apps/apps/kustomization.yaml
+++ b/argocd-apps/apps/kustomization.yaml
@@ -11,4 +11,3 @@ resources:
   - redoost.yaml
   - rustbin.yaml
   - scriptscribe.yaml
-  - wireguard.yaml
diff --git a/argocd-apps/apps/wireguard.yaml b/argocd-apps/apps/wireguard.yaml
deleted file mode 100644
index b0c55d2..0000000
--- a/argocd-apps/apps/wireguard.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: wireguard
-  namespace: argocd
-spec:
-  destination:
-    namespace: wireguard
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: apps/wireguard
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true