diff --git a/profiles/macos/configuration.nix b/profiles/macos/configuration.nix
index fafb4d5..589cf2d 100644
--- a/profiles/macos/configuration.nix
+++ b/profiles/macos/configuration.nix
@@ -1,6 +1,7 @@
 { config, pkgs, inputs, ... }: {
   imports = [
     inputs.home-manager.darwinModules.home-manager
+    ./services/wg-quick
   ];
 
   environment.systemPackages = [
diff --git a/services/wg-quick/default.nix b/services/wg-quick/default.nix
new file mode 100644
index 0000000..639655a
--- /dev/null
+++ b/services/wg-quick/default.nix
@@ -0,0 +1,28 @@
+# hosts/macbook/services/wireguard/default.nix
+{ config, pkgs, ... }: {
+
+  sops.secrets."wireguard/mac_private_key" = {
+    owner = "marc";  # ton username macOS
+    mode = "0400";
+  };
+
+  networking.wg-quick.interfaces.wg1 = {
+    address = [ "10.100.0.2/24" ];
+    dns = [ "1.1.1.1" ];
+    privateKeyFile = config.sops.secrets."wireguard/mac_private_key".path;
+
+    peers = [
+      {
+        publicKey = "dsOBj2AfqF7YQ1JTGfYjlFse5sFZzwudOBiEMDLAzhU=";  # wg show wg1 public-key sur le VPS
+        endpoint = "104.129.12.158:51821";
+        allowedIPs = [ "0.0.0.0/0" "::/0" ];
+        persistentKeepalive = 25;
+      }
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+    wireguard-go   # backend userspace requis sur macOS
+  ];
+}
diff --git a/users/mac/home.nix b/users/mac/home.nix
index 85185cc..d11801b 100644
--- a/users/mac/home.nix
+++ b/users/mac/home.nix
@@ -66,6 +66,11 @@
     fastfetch
     htop
     nodejs
+
+    upscayl
+    upscayl-ncnn
+    realesrgan-ncnn-vulkan
+    imagemagick
   ];
 
   # nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [