Simple Web based configuration generator for WireGuard
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
vx3r 4fd1e34f5f
merge and conflicts
5 days ago
.github/workflows Add dependabot to the repo 5 months ago
api feat(auth): Added token based auth for stats api 3 months ago
auth update all before V2 dev start 2 years ago
cmd/wg-gen-web update all before V2 dev start 2 years ago
core feat(auth): Added token based auth for stats api 3 months ago
model update npm 2 years ago
storage update all before V2 dev start 2 years ago
template update all before V2 dev start 2 years ago
ui merge and conflicts 5 days ago
util go fmt and golint 3 years ago
version refactor, remove dirty migration, npm update 3 years ago
.env improve formatting and layout 2 years ago
.gitignore update-git-ignore 2 years ago
.gitlab-ci.yml update all before V2 dev start 2 years ago
Dockerfile Merge branch 'master' into v2 5 days ago
LICENSE-WTFPL Initial commit 3 years ago Merge pull request #110 from JeremyBolster/update-dependencies 2 weeks ago
dev.dockerfile update npm 2 years ago
go.mod Updates found by dependabot on my fork 5 months ago
go.sum Updates found by dependabot on my fork 5 months ago
wg-gen-web_cover.png logo, send email 3 years ago
wg-gen-web_screenshot.png document auth, update screen 3 years ago

Wg Gen Web

Simple Web based configuration generator for WireGuard

Simple Web based configuration generator for WireGuard.

Go Report Card License: WTFPL Discord Build docker images via buildx GitHub last commit Docker Pulls GitHub go.mod Go version GitHub code size in bytes

Why another one ?

All WireGuard UI implementations are trying to manage the service by applying configurations and creating network rules. This implementation only generates configuration and its up to you to create network rules and apply configuration to WireGuard. For example by monitoring generated directory with inotifywait.

The goal is to run Wg Gen Web in a container and WireGuard on host system.


  • Self-hosted and web based
  • Automatically select IP from the network pool assigned to client
  • QR-Code for convenient mobile client configuration
  • Sent email to client with QR-code and client config
  • Enable / Disable client
  • Generation of wg0.conf after any modification
  • IPv6 ready
  • User authentication (Oauth2 OIDC)
  • Dockerized
  • Pretty cool look




The easiest way to run Wg Gen Web is using the container image

docker run --rm -it -v /tmp/wireguard:/data -p 8080:8080 -e "WG_CONF_DIR=/data" vx3r/wg-gen-web:latest

Docker compose snippet, used for demo server, wg-json-api service is optional

version: '3.6'
    image: vx3r/wg-gen-web:latest
    container_name: wg-gen-web-demo
    restart: unless-stopped
      - "8080/tcp"
      - WG_CONF_DIR=/data
      - WG_INTERFACE_NAME=wg0.conf
      - SMTP_PORT=587
      - SMTP_PASSWORD=******************
      - SMTP_FROM=Wg Gen Web <>
      - OAUTH2_PROVIDER_NAME=github
      - OAUTH2_CLIENT_ID=******************
      - OAUTH2_CLIENT_SECRET=******************
      - /etc/wireguard:/data
    image: james/wg-api:latest
    container_name: wg-json-api
    restart: unless-stopped
      - NET_ADMIN
    network_mode: "host"
    command: wg-api --device wg0 --listen <API_LISTEN_IP>:8182

Please note that mapping /etc/wireguard to /data inside the docker, will erase your host's current configuration. If needed, please make sure to backup your files from /etc/wireguard.

A workaround would be to change the WG_INTERFACE_NAME to something different, as it will create a new interface (wg-auto.conf for example), note that if you do so, you will have to adapt your daemon accordingly.

To get the value for <API_LISTEN_IP> take a look at the WireGuard Status Display section. If the status display should be disabled, remove the whole service from the docker-compose file or use as <API_LISTEN_IP>.

Directly without docker

Fill free to download latest artifacts from my GitLab server:

Put everything in one directory, create .env file with all configurations and run the backend.

Automatically apply changes to WireGuard

Using systemd

Using systemd.path monitor for directory changes see systemd doc

# /etc/systemd/system/wg-gen-web.path
Description=Watch /etc/wireguard for changes



This .path will activate unit file with the same name

# /etc/systemd/system/wg-gen-web.service
Description=Reload WireGuard

ExecStart=/usr/bin/systemctl reload wg-quick@wg0.service


Which will reload WireGuard service

Using inotifywait

For any other init system, create a daemon running this script

while inotifywait -e modify -e create /etc/wireguard; do
  wg-quick down wg0
  wg-quick up wg0

How to use with existing WireGuard configuration

After first run Wg Gen Web will create server.json in data directory with all server informations.

Feel free to modify this file in order to use your existing keys

What is out of scope

  • Generation or application of any iptables or nftables rules
  • Application of configuration to WireGuard by Wg Gen Web itself


Wg Gen Web can use Oauth2 OpenID Connect provider to authenticate users. Currently there are 4 implementations:

  • fake not a real implementation, use this if you don't want to authenticate your clients.

Add the environment variable:

  • github in order to use GitHub as Oauth2 provider.

Add the environment variable:

  • google in order to use Google as Oauth2 provider. Not yet implemented
help wanted
  • oauth2oidc in order to use RFC compliant Oauth2 OpenId Connect provider.

Add the environment variable:


Wg Gen Web will only access your profile to get email address and your name, no other unnecessary scopes will be requested.

WireGuard Status Display

Wg Gen Web integrates a WireGuard API implementation to display client stats. In order to enable the Status API integration, the following settings need to be configured:

# integration

# Optional: Token Auth

# Optional: Basic Auth

To setup the WireGuard API take a look at, or simply use the provided docker-compose file from above.


Due to the fact that the wg-api container operates on the host network, the wg-gen-web container cannot directly talk to the API. Thus the docker-host gateway IP of the wg-gen-web container has to be used. If the default bridge network (docker0) is used, this IP should be If a custom network is used, you can find the gateway IP by inspecting the output of:

docker network inspect <network name>

Use the IP address found for Gateway as the API_LISTEN_IP.

Please feel free to test and report any bugs.

Need Help

  • Join us on Discord
  • Create an issue



From the top level directory run

$ go run main.go


Inside another terminal session navigate into the ui folder

$ cd ui

Install required dependencies

$ npm install

Set the base url for the api

$ export VUE_APP_API_BASE_URL=http://localhost:8080/api/v1.0

Start the development server. It will rebuild and reload the site once you make a change to the source code.

$ npm run serve

Now you can access the site from a webbrowser with the url http://localhost:8081.

Application stack