diff --git a/petalius.nix b/petalius.nix
index 77c76b5..a0e195b 100644
--- a/petalius.nix
+++ b/petalius.nix
@@ -106,11 +106,24 @@
       publicKey = "ByLlJbevlTBooAo2RIZGGJvBHKqA9qiOpHBvR5yuJX4=";
       allowedIPs = ["10.56.0.0/14" "10.60.1.1"];
       # endpoint = "htdf-gw.gebner.org:35869";
-      endpoint = "80.109.2.154:35869";
+      # endpoint = "80.109.2.154:35869";
+      endpoint = "127.0.0.1:35869";
     }];
   };
   systemd.services.wireguard-wg0.wantedBy = pkgs.lib.mkOverride 10 [];
 
+  systemd.services.wstunnel = {
+    path = with pkgs; [
+      (haskell.lib.justStaticExecutables
+        (haskellPackages.callPackage ./pkgs/wstunnel.nix {}))
+    ];
+    wantedBy = [ "wireguard-wg0.service" ];
+    after = [ "network.target" ];
+    script = ''
+      wstunnel -L 35869:htdf-gw.gebner.org:35869 -u wss://gebner.org
+    '';
+  };
+
   services.resolved = {
     domains = [];
     enable = true;