diff --git a/playbooks/key_config.yml b/playbooks/key_config.yml
new file mode 100644
index 0000000..bf9a2ef
--- /dev/null
+++ b/playbooks/key_config.yml
@@ -0,0 +1,27 @@
+- name: configure keys for wireguard client and server
+  hosts: wireguard
+  become: true
+
+  tasks:
+    - name: create wireguard directory
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: directory
+        mode: "0700"
+
+    - name: generate server private and public keys
+      shell: "wg genkey | tee /etc/wireguard/server.private.key | wg pubkey > /etc/wireguard/server.public.key"
+      args:
+        creates: /etc/wireguard/server.private.key
+      #creates stops the command running again if the file already exists, avoiding infinite key regen
+
+    - name: set correct permissions for private and public keys
+      shell: "chmod 600 /etc/wireguard/server.private.key /etc/wireguard/server.public.key"
+
+    - name: generate client private and public keys
+      shell: "wg genkey | tee /etc/wireguard/client.private.key | wg pubkey > /etc/wireguard/client.public.key"
+      args:
+        creates: /etc/wireguard/client.private.key
+
+    - name: set correct permissions for private and public keys
+      shell: "chmod 600 /etc/wireguard/client.private.key /etc/wireguard/client.public.key"