vernizus/wirego repository overview

⁠wirego

Self-hosted WireGuard VPN manager with a full web dashboard — a single Go binary, no external dependencies, runs anywhere Docker does.

Source, full deployment guide, and docker-compose.yml: github.com/vernizus/wirego⁠

⁠Features

• Peer & group management — create peers, organize into groups with shared firewall rules, per-group internet access, DNS overrides, and keepalive settings
• Firewall & network control — per-peer/group firewall rules, kill switch (manual or scheduled), inter-VPN routing between interfaces
• Geofencing — allow/block peer connections by country
• Network monitoring — DNS query logging with blocklists, traffic flow tracking, port/host scan detection, impossible-travel alerts
• Alerting — email, Telegram, and webhook notifications with configurable rules and cooldowns
• Proxy chaining — route peer traffic through SOCKS5/HTTP proxy chains (multi-hop, rotation, health checks) for an extra anonymity layer
• AmneziaWG obfuscation — optional protocol obfuscation for DPI-hostile networks, per-interface
• RBAC — custom roles with granular permissions, full audit log
• Magic DNS — custom local DNS records for LAN resources
• Invite-based onboarding — generate time-limited invite links for new peers, no manual config file sharing

⁠Quick start

Two secrets are required — the container refuses to start without them, and they can never be changed after the first start (existing peer keys become unreadable and all sessions are invalidated if you do):

DB_KEY=$(head -c 32 /dev/urandom | base64 | tr -d '\\n')
JWT_KEY=$(head -c 64 /dev/urandom | base64 | tr -d '\\n')

docker run -d --name wirego \\
  --network host \\
  --user 0:0 \\
  --cap-add NET_ADMIN --cap-add NET_RAW --cap-add NET_BIND_SERVICE \\
  --cap-drop ALL \\
  --security-opt no-new-privileges:true \\
  --read-only \\
  --tmpfs /tmp:noexec,nosuid,size=50m \\
  --device /dev/net/tun:/dev/net/tun \\
  -v wirego_data:/data \\
  -e WIREGO_DB_ENCRYPTION_KEY="$DB_KEY" \\
  -e WIREGO_JWT_SIGNING_KEY="$JWT_KEY" \\
  vernizus/wirego:latest

Save $DB_KEY and $JWT_KEY somewhere safe before you lose the shell — they cannot be recovered.

Web dashboard available on the configured port (default :51821). The admin password is generated on first start and printed once to the container logs (docker logs wirego) — there is no fixed default password.

Everything else (firewall backend, log level, public IP/domain, DNS, TLS, and more) is configured from the web panel after first login — see the full deployment guide⁠ for the recommended docker-compose.yml and all configuration options.

⁠Tags

• latest / X.Y.Z — multi-arch build (amd64, arm64, armv7)