Provision WireGuard Peers Automatically

Generate peer keys, assign addresses and allowed IPs, and reload the interface so new peers join the mesh without hand-editing config or restarting tunnels.

~40 minnetworkingvpnautomation

Task

Automate adding and removing WireGuard peers with per-peer keys and routing.

When to use this

Adding a peer means editing the server config by hand and restarting the tunnel, which drops everyone briefly and invites mistakes.

Prerequisites

WireGuard installed on the server and peers
A way to distribute peer configs securely

Steps

1. Generate a key pair per peer and record its public key and assigned address.

Expected output: Each peer has a unique identity and address.

2. Add a peer block with the AllowedIPs scoped to that peer address.

Expected output: Peers can route only their own address by default.

3. Apply changes with wg syncconf so the interface is not fully restarted.

Expected output: Existing peers stay connected during updates.

4. Remove the peer block and key when access is revoked, then resync.

wg syncconf wg0 <(wg-quick strip wg0)

Expected output: Revocation takes effect immediately.

Troubleshooting

Problem

Config reload drops sessions

Solution

Use wg syncconf on a stripped config, not a full down/up, to keep existing peers connected.

Problem

Private keys stored on the server

Solution

Keep private keys with the peer only; the server needs only public keys.

Limitations

WireGuard has no built-in user management, so provisioning and revocation are your responsibility.
AllowedIPs is a routing/crypto-routing mechanism, not a fine-grained firewall; pair it with real firewall rules.

Context

Automate adding and removing WireGuard peers with per-peer keys and routing. Adding a peer means editing the server config by hand and restarting the tunnel, which drops everyone briefly and invites mistakes.

Steps

Generate a key pair per peer and record its public key and assigned address. Expected: Each peer has a unique identity and address.
Add a peer block with the AllowedIPs scoped to that peer address. Expected: Peers can route only their own address by default.
Apply changes with wg syncconf so the interface is not fully restarted. Expected: Existing peers stay connected during updates.
Remove the peer block and key when access is revoked, then resync. Expected: Revocation takes effect immediately.

# generate a peer
wg genkey | tee peer.key | wg pubkey > peer.pub
# server config addition
[Peer]
PublicKey = <peer.pub>
AllowedIPs = 10.8.0.5/32
# apply without dropping peers
wg syncconf wg0 <(wg-quick strip wg0)

Verify

Each peer has a unique identity and address.
Peers can route only their own address by default.
Existing peers stay connected during updates.
Revocation takes effect immediately.

Limits

WireGuard has no built-in user management, so provisioning and revocation are your responsibility.
AllowedIPs is a routing/crypto-routing mechanism, not a fine-grained firewall; pair it with real firewall rules.