wg-helper-script

WireGuard helper CLI for initializing, validating, and emitting server/client configs with optional QR codes. Includes client management (add/disable/remove) and AmneziaWG parameters.

Features

• Initialize a secure YAML config (init) with generated keys.
• Validate configuration (validate-cfg).
• Emit server and client .conf files and client QR codes (emit-configs).
• Manage clients: client-add, client-disable, client-remove.

Install

python -m pip install wg-helper-script

Quickstart

wg-helper-script init -o config.yml --overwrite
wg-helper-script validate-cfg -c config.yml
wg-helper-script emit-configs -c config.yml

Run with module if not installed: python -m wg_helper_script ....

Requires Python 3.11+.

Configuration

• YAML file (default ./config.yml). Paths inside are relative to the config location.
• Environment overrides: prefix WGHS_ (e.g., WGHS_CONFIG, WGHS_SERVER_NAME, WGHS_SERVER_DNS).

Server keys: if both are omitted on init, a valid keypair is generated. Validation ensures keys are well‑formed and match when both present.

Commands

• init: Generate initial config. Flags mirror env vars (e.g., --server-name, --server-dns).
• validate-cfg: Load and validate a config file.
• emit-configs: Write server/client configs under server-path/clients-path. Use --only-server or --only-clients. QR generation can be disabled by (--qr/--no-qr).
• client-add NAME: Adds a client with next free IP, keys, psk.
• client-disable NAME: Marks a client disabled.
• client-remove NAME: Removes a client.

Init Options

The init command accepts flags and/or WGHS_* environment variables. Unspecified Amnezia fields are auto‑generated within recommended ranges when Amnezia is enabled.

Security Notes

• Do not commit real private keys. Examples are placeholders.
• Emitted configs and config.yml are written with 0600 permissions on POSIX.