diff --git a/network.yml b/network.yml
new file mode 100644
index 0000000000000000000000000000000000000000..72875d35845c8bb1ba32a088ab6d68a40675bb9e
--- /dev/null
+++ b/network.yml
@@ -0,0 +1,8 @@
+---
+# Deploy tunnel
+- hosts: boeing.adm.crans.org
+  vars:
+    # Debian mirror on adm
+    debian_mirror: http://mirror.adm.crans.org/debian
+  roles:
+    - wireguard
diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..bf89f3c740b6e34d50de809083323785a5885947
--- /dev/null
+++ b/roles/wireguard/tasks/main.yml
@@ -0,0 +1,15 @@
+---
+- name: Add Debian unstable repository
+  apt_repository:
+    repo: "deb {{ debian_mirror }} unstable main"
+    state: present
+
+- name: Limit unstable packages
+  template:
+    src: apt/preferences.d/limit-unstable.j2
+    dest: /etc/apt/preferences.d/limit-unstable
+
+- name: Install wireguard
+  apt:
+    update_cache: true
+    name: wireguard
diff --git a/roles/wireguard/templates/apt/preferences.d/limit-unstable.j2 b/roles/wireguard/templates/apt/preferences.d/limit-unstable.j2
new file mode 100644
index 0000000000000000000000000000000000000000..5de43d804c593981387bcde971dcd3d1a94f5ece
--- /dev/null
+++ b/roles/wireguard/templates/apt/preferences.d/limit-unstable.j2
@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+
+Package: *
+Pin: release a=unstable
+Pin-Priority: 90