mustafachyi/nordgen repository overview

⁠Nordgen

Nordgen is a Go-based command-line tool that generates WireGuard configuration files for NordVPN servers.

The container exchanges a NordVPN access token for a NordLynx private key, downloads the current WireGuard server catalogue, applies the selected filters, and writes the generated configurations to a mounted directory.

The Go container provides the same main commands, configuration options, validation rules, and output structure as the Python package while allowing the application to run in a small container image without a Python runtime.

⁠Requirements

• Docker
• An active NordVPN subscription
• A 64-character NordVPN access token

Access tokens can be created from the Nord Account dashboard.

⁠Quick Start

The generated configurations are written to /data inside the container. Mount a local directory at /data to retain them after the container exits.

⁠Linux and macOS

⁠Interactive mode

mkdir -p generated_configs && docker run -it --rm -u "$(id -u):$(id -g)" -v "$(pwd)/generated_configs:/data" mustafachyi/nordgen:latest

⁠Non-interactive mode

mkdir -p generated_configs && docker run --rm -u "$(id -u):$(id -g)" -v "$(pwd)/generated_configs:/data" mustafachyi/nordgen:latest --token "YOUR_TOKEN" --dns 1.1.1.1 --keepalive 15 --group standard p2p --exclude-dedicated

⁠Retrieve the private key only

docker run --rm mustafachyi/nordgen:latest get-key --token "YOUR_TOKEN"

⁠Windows PowerShell

⁠Interactive mode

if (!(Test-Path "generated_configs")) { New-Item -ItemType Directory "generated_configs" | Out-Null }; docker run -it --rm -v "${PWD}/generated_configs:/data" mustafachyi/nordgen:latest

⁠Non-interactive mode

if (!(Test-Path "generated_configs")) { New-Item -ItemType Directory "generated_configs" | Out-Null }; docker run --rm -v "${PWD}/generated_configs:/data" mustafachyi/nordgen:latest --token "YOUR_TOKEN" --dns 1.1.1.1 --keepalive 15 --group standard p2p --exclude-dedicated

⁠Retrieve the private key only

docker run --rm mustafachyi/nordgen:latest get-key --token "YOUR_TOKEN"

⁠Windows Command Prompt

⁠Interactive mode

if not exist "generated_configs" mkdir "generated_configs" && docker run -it --rm -v "%cd%/generated_configs:/data" mustafachyi/nordgen:latest

⁠Non-interactive mode

if not exist "generated_configs" mkdir "generated_configs" && docker run --rm -v "%cd%/generated_configs:/data" mustafachyi/nordgen:latest --token "YOUR_TOKEN" --dns 1.1.1.1 --keepalive 15 --group standard p2p --exclude-dedicated

⁠Retrieve the private key only

docker run --rm mustafachyi/nordgen:latest get-key --token "YOUR_TOKEN"

⁠Commands

The following commands are equivalent:

nordgen [options]
nordgen generate [options]

Display the complete command reference with:

docker run --rm mustafachyi/nordgen:latest help

⁠Configuration Options

Options are placed after the image name in the Docker command.

The group option can be repeated or followed by multiple values:

docker run --rm -v "$(pwd)/generated_configs:/data" mustafachyi/nordgen:latest --token "YOUR_TOKEN" --group standard p2p

⁠Dedicated IP Servers

Servers in the dedicated group require an active NordVPN Dedicated IP subscription.

Configuration files can still be generated without that subscription, but connections to those servers may not succeed. Use --exclude-dedicated to omit them.

⁠Output

Each generation creates a timestamped directory under the mounted /data directory.

Example:

generated_configs/
└── nordvpn_configs_20260802_215200_123456789/
    ├── configs/
    │   └── <group_combo>/<country>/<city>/<server_name>.conf
    └── best_configs/
        └── <group_combo>/<country>/<city>/<server_name>.conf

The two output trees contain:

• configs/: One configuration for each unique server hostname that matches the selected filters.
• best_configs/: One selected server for each group combination, country, and city.

Servers are ordered primarily by their reported load. Geographic distance is used to resolve equal-load results when geolocation data is available. If geolocation is unavailable, hostname ordering is used as the fallback.

⁠Security Notes

The access token is used only to request the NordLynx private key and is not written to the generated files.

The generated WireGuard configurations contain the private key and should be treated as sensitive files.

Passing a token with --token may store it in shell history. Interactive mode prompts for the token instead.

⁠Source and License

Source code is available at:

https://github.com/mustafachyi/NordVPN-WireGuard-Config-Generator

Nordgen is distributed under the GNU General Public License version 3 or later.