diff --git a/dankclaw/.env.example b/dankclaw/.env.example
index b9b0612..60a1258 100644
--- a/dankclaw/.env.example
+++ b/dankclaw/.env.example
@@ -6,9 +6,16 @@ SEARXNG_SECRET=changeme
 SEARXNG_BASE_URL=http://search.dankclaw.local/
 
 # Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
-VPN_SERVICE_PROVIDER=mullvad
+# Single-peer WireGuard model. Fill from your provider's WireGuard config.
+VPN_SERVICE_PROVIDER=protonvpn
 VPN_TYPE=wireguard
 WIREGUARD_PRIVATE_KEY=changeme
+WIREGUARD_ADDRESSES=0.0.0.0/32
+WIREGUARD_PUBLIC_KEY=changeme
+WIREGUARD_ENDPOINT_IP=0.0.0.0
+WIREGUARD_ENDPOINT_PORT=51820
+WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
+WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
 
 # Gitea database
 GITEA_DB_PASSWORD=changeme
diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 471e4d8..1d43cdf 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -16,6 +16,12 @@ services:
       VPN_SERVICE_PROVIDER: "${VPN_SERVICE_PROVIDER}"
       VPN_TYPE: "${VPN_TYPE}"
       WIREGUARD_PRIVATE_KEY: "${WIREGUARD_PRIVATE_KEY}"
+      WIREGUARD_ADDRESSES: "${WIREGUARD_ADDRESSES}"
+      WIREGUARD_PUBLIC_KEY: "${WIREGUARD_PUBLIC_KEY}"
+      WIREGUARD_ENDPOINT_IP: "${WIREGUARD_ENDPOINT_IP}"
+      WIREGUARD_ENDPOINT_PORT: "${WIREGUARD_ENDPOINT_PORT}"
+      WIREGUARD_ALLOWED_IPS: "${WIREGUARD_ALLOWED_IPS}"
+      WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL: "${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}"
     ports:
       # SearXNG's published port lives on gluetun (network_mode: service:gluetun)
       - "8081:8080"