diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..bee8a64
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+__pycache__
diff --git a/README.md b/README.md
index b6090a2..c616b44 100644
--- a/README.md
+++ b/README.md
@@ -252,6 +252,31 @@ Example Playbook
     - wireguard
 ```
 
+Run tests
+---------
+
+Make sure to have vagrant and VirtualBox installed (we could also do with libvirt, feel free to PR).
+Then you need the following pip:
+
+```
+pip install molecule python-vagrant
+```
+
+Then to run the full test suite:
+
+```
+molecule test
+```
+
+Or if you prefer to run things separately:
+
+```
+molecule create # to create the VMs
+molecule converge # to run the playbook, and so the role you are developing
+molecule verify # to run the test suite
+molecule destroy # to delete the VMs
+molecule login --host instance-1 # to login into instance-1
+
 License
 -------
 
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
new file mode 100644
index 0000000..583addc
--- /dev/null
+++ b/molecule/default/molecule.yml
@@ -0,0 +1,61 @@
+---
+scenario:
+  name: default
+
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: instance-1
+    box: ubuntu/bionic64
+    memory: 512
+    cpus: 1
+    interfaces:
+      - network_name: private_network
+        type: static
+        ip: 192.168.11.3
+        auto_config: true
+    groups:
+      - vpn
+  - name: instance-2
+    box: ubuntu/bionic64
+    memory: 512
+    cpus: 1
+    interfaces:
+      - network_name: private_network
+        type: static
+        ip: 192.168.11.4
+        auto_config: true
+    groups:
+      - vpn
+
+provisioner:
+  name: ansible
+  inventory:
+    host_vars:
+      instance-1:
+        wireguard_address: "10.8.0.101/24"
+      instance-2:
+        wireguard_address: "10.8.0.102/24"
+  log: true
+  lint:
+    name: ansible-lint
+    enabled: false
+  playbooks:
+    test: playbook.yml
+
+lint:
+  name: yamllint
+  enabled: false
+
+verifier:
+  name: testinfra
+  directory: tests
+  lint:
+    name: flake8
+  options:
+    # show which tests where executed in test output
+    v: 1
+    s: true
+
diff --git a/molecule/default/playbook.yml b/molecule/default/playbook.yml
new file mode 100644
index 0000000..7149112
--- /dev/null
+++ b/molecule/default/playbook.yml
@@ -0,0 +1,20 @@
+---
+- name: Prepare
+  hosts: all
+  become: true
+  tasks:
+  - name: Add the inventory into /etc/hosts
+    lineinfile:
+      dest: /etc/hosts
+      regexp: '.*{{ item }}$'
+      line: "{{ hostvars[item]['ansible_enp0s8']['ipv4']['address'] }} {{item}}"
+      state: present
+    when: hostvars[item]['ansible_enp0s8']['ipv4']['address'] is defined
+    with_items:
+      - "{{ groups['all'] }}"
+
+- name: Test
+  hosts: all
+  become: true
+  roles:
+    - role: ansible-role-wireguard
diff --git a/molecule/default/tests/test_default.py b/molecule/default/tests/test_default.py
new file mode 100644
index 0000000..24d8d98
--- /dev/null
+++ b/molecule/default/tests/test_default.py
@@ -0,0 +1,30 @@
+import os
+import pytest
+import testinfra.utils.ansible_runner
+
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+@pytest.mark.parametrize("pkg_name", [
+    ("wireguard-tools"),
+    ("wireguard-dkms"),
+])
+def test_is_wireguard_installed(host, pkg_name):
+    pkg = host.package(pkg_name)
+
+    assert pkg.is_installed
+
+
+@pytest.mark.parametrize("private_ip", [
+    ("10.8.0.101"),
+    ("10.8.0.102"),
+])
+def test_is_vpn_connected(host, private_ip):
+    assert host.addr(private_ip).is_reachable
+
+
+def test_is_wireguard_running_and_enabled(host):
+    assert host.service("wg-quick@wg0").is_running
+    assert host.service("wg-quick@wg0").is_enabled