diff --git a/doc/wireguard.md b/doc/wireguard.md
new file mode 100644
index 0000000..59b0948
--- /dev/null
+++ b/doc/wireguard.md
@@ -0,0 +1,15 @@
+# Wireguard
+
+## Initial setup
+
+```sh
+#!/bin/sh
+
+set -eux
+
+cd -- ../../secrets/files/etc/wireguard
+(umask 077; wg genkey | tee shione.private.key | wg pubkey > shione.public.key)
+# TODO: chmod 0600 all files under files/etc/wireguard.
+# TODO: Update files/etc/wireguard/wg0.conf accordingly.
+cd -- -
+```