A command-line interface for managing WireGuard configuration files using the wgconfig library.
uv tool install .Or run directly with:
uv run wgcli --helpwgcli [OPTIONS] COMMAND [ARGS]...
Commands:
attr Manage attributes in a WireGuard config file
init Initialize a new WireGuard config file
interface Show interface configuration from a WireGuard config file
peer Manage peers in a WireGuard config file
wgcli supports shell completion for bash, zsh, and fish. The completion provides:
- Config file paths from
/etc/wireguard/ - Peer public keys from the specified config file
To enable completion:
Bash:
_WGCLI_COMPLETE=bash_source wgcli > ~/.wgcli-complete.bash
echo ". ~/.wgcli-complete.bash" >> ~/.bashrcZsh:
_WGCLI_COMPLETE=zsh_source wgcli > ~/.wgcli-complete.zsh
echo ". ~/.wgcli-complete.zsh" >> ~/.zshrcFish:
_WGCLI_COMPLETE=fish_source wgcli > ~/.config/fish/completions/wgcli.fish# Create a new config file
wgcli init wg0.conf
# Create with a comment
wgcli init wg0.conf --comment "Server configuration"# Add interface attributes
wgcli attr add wg0.conf Address 10.0.0.1/24
wgcli attr add wg0.conf ListenPort 51820
wgcli attr add wg0.conf PrivateKey "your_private_key_here"# Add a new peer
wgcli peer add wg0.conf "client_public_key_here"
# Add a peer with a comment
wgcli peer add wg0.conf "client_public_key_here" --comment "John's laptop"
# Add peer attributes
wgcli attr add wg0.conf AllowedIPs 10.0.0.2/32 --peer "client_public_key_here"
wgcli attr add wg0.conf Endpoint 192.168.1.100:51820 --peer "client_public_key_here"# List all peers
wgcli peer list wg0.conf
# List all peers including disabled ones
wgcli peer list wg0.conf --include-disabled
# List peers with verbose details (includes internal metadata)
wgcli peer list wg0.conf -v
# Show a specific peer
wgcli peer show wg0.conf "client_public_key_here"
# Show interface configuration
wgcli interface wg0.conf
# Show interface with verbose details
wgcli interface wg0.conf -v# Disable a peer (comments out the peer section)
wgcli peer disable wg0.conf "client_public_key_here"
# Enable a peer
wgcli peer enable wg0.conf "client_public_key_here"
# Remove a peer completely
wgcli peer remove wg0.conf "client_public_key_here"# Remove a specific attribute value
wgcli attr remove wg0.conf DNS --value 1.1.1.1
# Remove all values of an attribute
wgcli attr remove wg0.conf DNS
# Remove an attribute from a peer
wgcli attr remove wg0.conf Endpoint --peer "client_public_key_here"# Initialize server config
wgcli init /etc/wireguard/wg0.conf --comment "VPN Server"
# Configure interface
wgcli attr add /etc/wireguard/wg0.conf Address 10.0.0.1/24
wgcli attr add /etc/wireguard/wg0.conf ListenPort 51820
wgcli attr add /etc/wireguard/wg0.conf PrivateKey "$(wg genkey)"
wgcli attr add /etc/wireguard/wg0.conf PostUp "iptables -A FORWARD -i wg0 -j ACCEPT"
wgcli attr add /etc/wireguard/wg0.conf PostDown "iptables -D FORWARD -i wg0 -j ACCEPT"
# Add first client
CLIENT_PUBKEY="$(wg pubkey < client_private.key)"
wgcli peer add /etc/wireguard/wg0.conf "$CLIENT_PUBKEY" --comment "Client 1"
wgcli attr add /etc/wireguard/wg0.conf AllowedIPs 10.0.0.2/32 --peer "$CLIENT_PUBKEY"
# View the configuration
wgcli peer list /etc/wireguard/wg0.conf
wgcli interface /etc/wireguard/wg0.conf# Initialize client config
wgcli init wg0-client.conf --comment "VPN Client"
# Configure interface
wgcli attr add wg0-client.conf Address 10.0.0.2/32
wgcli attr add wg0-client.conf PrivateKey "$(wg genkey)"
wgcli attr add wg0-client.conf DNS 1.1.1.1
# Add server as peer
SERVER_PUBKEY="your_server_public_key_here"
wgcli peer add wg0-client.conf "$SERVER_PUBKEY" --comment "VPN Server"
wgcli attr add wg0-client.conf AllowedIPs 0.0.0.0/0 --peer "$SERVER_PUBKEY"
wgcli attr add wg0-client.conf Endpoint vpn.example.com:51820 --peer "$SERVER_PUBKEY"
wgcli attr add wg0-client.conf PersistentKeepalive 25 --peer "$SERVER_PUBKEY"
# View the configuration
wgcli interface wg0-client.conf
wgcli peer show wg0-client.conf "$SERVER_PUBKEY"-
The
wgconfiglibrary automatically handles the special file name format. You can use:wg0-> resolves to/etc/wireguard/wg0.confwg0.conf-> resolves to/etc/wireguard/wg0.conf- Or use any custom path
-
Use
--peeroption withattrcommands to target specific peers instead of the interface -
Disabled peers remain in the config file but are commented out with
#!. This allows you to temporarily disable peers without losing their configuration -
Use
peer listto view all peers in a config file,peer showto view a specific peer, andinterfaceto view interface configuration
See LICENSE file for details.