wg-admin is an open-source web UI that manages existing WireGuard hosts without downtime

wg-admin, an open-source project that reached Hacker News's front page on 7 September 2026, provides a web interface for a WireGuard server that is already running. Rather than generating its own configuration or replacing wg-quick, the tool reads the files already present in /etc/wireguard and manages them in place.

What it does

According to the project's GitHub repository, wg-admin lists every *.conf file under /etc/wireguard and exposes each interface's peers through a browser. Administrators can add, rename, edit, key-rotate and remove peers, and the panel surfaces live data from wg, including each peer's last handshake, transfer counters and endpoint.

Adding a peer generates its keys, picks the next unused IPv4 address in the interface's subnet, and writes the server-side file. For peers created or rotated through the UI, wg-admin can also produce a downloadable client .conf file or a QR code for mobile onboarding.

Applying changes without dropping the tunnel

The central design decision is how edits reach the running interface. wg-admin writes the updated configuration file and then runs wg syncconf while the interface is up, which applies the new settings without tearing the tunnel down; if the interface is down, only the file is updated. The repository presents this as a deliberate alternative to panels that generate a fresh configuration, assume control of wg-quick, and force administrators to relearn their setup.

Everything beyond peer management stays untouched. Existing [Interface] options, such as address, listen port, private key, PostUp and PostDown hooks, MTU, routing table and DNS, and existing [Peer] entries with their public keys, AllowedIPs, pre-shared keys and keepalive settings are preserved exactly as written. A comment placed above a peer, such as "# Alice", serves as the display name. Before any file is changed, a backup is saved under /var/lib/wg-admin/backups/.

One constraint comes from WireGuard itself: servers never store client private keys, so downloadable client files and QR codes exist only for peers created or key-rotated inside wg-admin. Peers that predate the tool can still be edited or removed. Client-only details, including the public endpoint, DNS servers and client-side AllowedIPs, live in a separate state file at /var/lib/wg-admin/state. rather than in the server configuration.

Installation and access controls

The listed requirements are Linux with Python 3.11 or newer, the wireguard-tools package, and root or equivalent access to /etc/wireguard plus the CAP_NET_ADMIN capability. On a host that already runs WireGuard, installation is a git clone followed by sudo ./install.sh; the UI then listens on 127.0.0.1:8080 and prompts for an admin password on first use.

The service binds to localhost by default, and the documentation recommends keeping it there, fronting it with a TLS-terminating reverse proxy such as Caddy or nginx if other people need access. Host, port, config directory and state directory are configured in /etc/wg-admin.env. A demo mode runs against a sample directory and never invokes wg, and the project ships with pytest tests for development.

Why it matters

WireGuard's minimalism extends to its tooling: wg and wg-quick are terse, and routine peer management on a busy server means hand-editing files and risky restarts. Most existing web panels solve this by taking ownership of the configuration, which is unappealing for servers already running in production. By editing files in place and applying them with wg syncconf, wg-admin offers convenience for daily peer work without reworking a VPN the operator already trusts.

The project is MIT-licensed, developed by Sergiu Voicu, co-founder of LogiMaxx Systems, and accepts issues and pull requests on GitHub.