wgroster
wgroster is a self-hosted WireGuard portal that allows users to generate their own configuration and administrators to monitor live fleet status with drift detection.
Ficha actualizada 23 sept 2026, 8:31 · upstream 23 sept 2026, 8:28 · release 2026.09.10.141344
Qué es wgroster
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
<p><strong>wgroster</strong> is a minimalist, self-hosted portal where users can generate their own WireGuard configurations without needing the wg CLI tool installed. Administrators gain a live dashboard view of every concentrator and peer across the entire fleet.</p>
<p>The system operates on a <em>tracking-only</em> model: it never connects to or writes to your WireGuard servers. Provisioning peers remains entirely in your hands — either manually via Ansible, through the bundled agent that runs directly on each concentrator, or by downloading pre-configured .conf files.</p>
<p>At its core, wgroster provides a source of truth for <em>who gets which config</em> and displays <em>what each concentrator reports</em>. It does not interfere with the actual WireGuard server operation. Instead, it exposes the expected peer list (published by the hub) so that external tooling or the bundled agent can reconcile discrepancies between what the portal sees and what is actually running on the servers.</p>
<p>Key capabilities include:</p> <ul> <li><strong>Self-service enrollment</strong>: Users register machines via their public key, generate keys in-browser (no wg CLI needed), or scan a QR code for instant self-enrollment with optional approval gates.</li> <li><strong>Drift detection and reconciliation</strong>: Concentrators push status reports; wgroster compares them against declared peers and flags online/offline/missing-on-hub/mismatched-allowedIPs states. Admins can resolve drift by adopting peers or linking known machines.</li> <li><strong>Offboarding management</strong>: The system periodically checks directory membership to flag orphaned accounts, disables affected machines, and removes them from all peer lists.</li> <li><strong>Observability</strong>: Live status dashboards with per-peer throughput metrics, traffic curves (14-day history), identity/drift details, and reverse DNS lookups. Optional offline GeoIP lookup via MaxMind databases.</li> <li><strong>Security & auth</strong>: OpenLDAP integration for admin accounts, optional local admin mode, HMAC-signed session cookies, CSRF protection, login rate limiting, and strict CSP headers with hashed con
- Self-managed WireGuard fleets where you need to track peer health without touching your servers
- Multi-site deployments requiring per-endpoint IP management with drift detection
- Organizations using Ansible or similar automation tools for concentrator provisioning
- Teams that want a single source of truth for who is connected and what traffic each hub reports
- Environments where you need to reconcile peer lists across multiple concentrators without manual intervention
- Never connects to or writes to your WireGuard servers — it only reads status from agents on the hubs
- Self-service enrollment via QR code scanning eliminates the need for wg CLI on every device
- Built-in drift detection and reconciliation allows admins to fix misconfigured peers in a single step
- Live traffic monitoring with 14-day history curves per peer, plus reverse DNS lookups and optional offline GeoIP
- Pure-Go SQLite implementation with embedded assets and strict CSP for maximum security and performance
- Supports both OpenLDAP directory services and local admin mode without requiring external authentication
- Requires a central server to collect status reports from all concentrators — no peer-to-peer status sharing is supported
- Self-enrollment requires user interaction (QR code scan or browser key generation), which can be friction-heavy in high-volume deployments
- Drift detection only flags peers whose keys the portal has never seen; it cannot detect misconfigured peers that have already been provisioned but are not yet connected
- Offline GeoIP lookup is optional and requires pre-configured MaxMind databases, limiting its usefulness in environments without internet access to external services
- The agent kit must be installed on each concentrator — you cannot use wgroster alone as a standalone client
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
<p>Install the Docker image from <code>ghcr.io/wgroster/wgroster:latest</code>. Mount your config and data volumes, then start with <code>docker compose up -d</code>.</p> <p>The recommended approach is to use the systemd timer for agent-driven reconciliation rather than cron. The agent runs on each concentrator and pushes status updates back to wgroster without requiring the server to be reachable.</p> <p>For production, consider:</p> <ul> <li>Pinning a specific release tag in your CI/CD pipeline</li> <li>Enabling HSTS behind HTTPS for all endpoints</li> <li>Migrating from SQLite to PostgreSQL if you need complex queries or high throughput</li> <li>Implementing webhook alerts for critical drift events (e.g., peer disconnection)</li> </ul>
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.