Wireguard server config helper

Automatically append peer configuration to the server config file and save client config file. All keys are generated automatically and put into the files.

Peer IP address is determined automatically.

Example output

Sensitive values are shown as XXXXX.

This how running the script looks like:

vita@TERMINATOR:~/wghelper$ py wghelp.py
editing wg0.conf
all done
assuming this server's ip is XXXXX and wireguard is running on port 51820/udp.
peer adresses: 10.0.0.8/32, fd00::8/128
peer config saved to peers/peer-10-0-0-8.conf
dont forget to
    systemctl restart wg-quick@wg0
vita@TERMINATOR:~/wghelper$ py wghelp.py
editing wg0.conf
all done
assuming this server's ip is XXXXX and wireguard is running on port 51820/udp.
peer adresses: 10.0.0.9/32, fd00::9/128
peer config saved to peers/peer-10-0-0-9.conf
dont forget to
    systemctl restart wg-quick@wg0
vita@TERMINATOR:~/wghelper$ py wghelp.py
editing wg0.conf
all done
assuming this server's ip is XXXXX and wireguard is running on port 51820/udp.
peer adresses: 10.0.0.10/32, fd00::a/128
peer config saved to peers/peer-10-0-0-10.conf
dont forget to
    systemctl restart wg-quick@wg0

The following is appended to wg0.conf:

# generated by wghelp on 2025-09-17 04:20:46.225901
[Peer]
PublicKey = XXXXX
PresharedKey = XXXXX
AllowedIPs = 10.0.0.8/32, fd00::8/128

# generated by wghelp on 2025-09-17 04:20:52.767358
[Peer]
PublicKey = XXXXX
PresharedKey = XXXXX
AllowedIPs = 10.0.0.9/32, fd00::9/128

# generated by wghelp on 2025-09-17 04:20:55.032672
[Peer]
PublicKey = XXXXX
PresharedKey = XXXXX
AllowedIPs = 10.0.0.10/32, fd00::a/128

And this is peer-10-0-0-8.conf:

# generated by wghelp on 2025-09-17 04:20:46.225901
[Interface]
PrivateKey = XXXXX
Address = 10.0.0.8/32, fd00::8/128
DNS = 193.110.81.0, 2a0f:fc80::  # dns0.eu

[Peer]
PublicKey = XXXXX
PresharedKey = XXXXX
AllowedIPs = 0.0.0.0/0, ::/0  # tunnel both ipv4 and ipv6
Endpoint = XXXXX:51820  # your wireguard server address and port
PersistentKeepalive = 25

Limitations

This only works for server configs where all the keys are in the file. No external files are resolved.

See also

GitHub Gist: IPv6 Wireguard server config, with instructions