wg-easy v0.1.0

Networking

wg-easy — the easiest way to run a WireGuard VPN with a web UI: create clients, show QR codes for phones, and see live traffic, all from the browser. Deployed as a host-networked Nomad service with the NET_ADMIN capability and IP forwarding enabled, plus a persistent config volume.

nomad-pack run wg-easy --registry nomploy

…or one line (add registry + run)

curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- wg-easy

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 27k ⚑ Report an issue

1 task web 51821wg 51820 1 volume image ghcr.io/wg-easy/wg-easy:14 pinned :14 image bumped today

Variables 11

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run wg-easy -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "wg-easy"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The wg-easy container image. Pin a tag in production.
image = "ghcr.io/wg-easy/wg-easy:14"

# Public IP or hostname clients connect to (WG_HOST). SET THIS to your server's public address.
wg_host = "vpn.example.com"

# Password for the web UI (PASSWORD). CHANGE THIS.
password = "change-me-please"

# Host port for the web UI (PORT).
web_port = 51821

# Host UDP port for WireGuard traffic (WG_PORT). Must be reachable from the internet.
wg_port = 51820

# Named volume for WireGuard config (/etc/wireguard): keys and client definitions.
data_volume = "wg_easy_data"

# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# Resources for the wg-easy task.
resources = {
    cpu    = 300
    memory = 128
  }

Name	Type	Default	Description
job_name	string	"wg-easy"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"ghcr.io/wg-easy/wg-easy:14"	The wg-easy container image. Pin a tag in production.
wg_host set me	string	"vpn.example.com"	Public IP or hostname clients connect to (WG_HOST). SET THIS to your server's public address.
password set me	string	"change-me-please"	Password for the web UI (PASSWORD). CHANGE THIS.
web_port	number	51821	Host port for the web UI (PORT).
wg_port	number	51820	Host UDP port for WireGuard traffic (WG_PORT). Must be reachable from the internet.
data_volume	string	"wg_easy_data"	Named volume for WireGuard config (/etc/wireguard): keys and client definitions.
constraints	list	[]	Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 300 memory = 128 }	Resources for the wg-easy task.

Back up this pack

This pack stores data in one Docker named volume: wg_easy_data

restic

# Run on the node hosting this pack. Point restic at your repo first:
#   export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>"
#   export RESTIC_PASSWORD="<repo-password>"
#   export AWS_ACCESS_KEY_ID=<key>  AWS_SECRET_ACCESS_KEY=<secret>
restic backup \
  /var/lib/docker/volumes/wg_easy_data/_data

rclone (sync to S3/R2)

rclone sync /var/lib/docker/volumes/wg_easy_data/_data backup:<bucket>/wg_easy_data

Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.

Readme

wg-easy

wg-easy — the easiest way to run your own WireGuard VPN. Create and manage clients from a clean web UI, show QR codes to set up phones in seconds, and watch live traffic. Your own private tunnel back to home/lab, no third party.

Single host-networked Nomad service with the NET_ADMIN capability, IP forwarding enabled, and a persistent config volume.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run wg-easy --registry=nomploy

Configure

Variable	Default	Description
`wg_host`	`vpn.example.com`	`WG_HOST` — your server's public IP/hostname. Set this.
`password`	`change-me-please`	Web UI password (`PASSWORD`). Change it.
`web_port`	`51821`	Web UI port (`PORT`).
`wg_port`	`51820`	WireGuard UDP port (`WG_PORT`). Must be reachable from the internet.
`data_volume`	`wg_easy_data`	`/etc/wireguard` — keys and client configs.
`image`	`ghcr.io/wg-easy/wg-easy:14`	Container image. Pin a tag in production.
`resources`	`{ cpu = 300, memory = 128 }`	Task resources.

Set wg_host to your public address and forward UDP wg_port to this node. Create clients in the web UI and scan the QR code on mobile. The job adds NET_ADMIN + SYS_MODULE and enables net.ipv4.ip_forward so traffic routes through the tunnel. Front the web UI with a reverse proxy for TLS and never expose it without a password. Pin the job to the node holding the volume with constraints.