Skip to content
UMKIMDocs

WireGuard clients

Experimental: overlay access is privileged; treat client configs as secrets.

WireGuard operator clients provide split-tunnel access to the fleet management overlay. They are for trusted operator devices, not general remote access.

After the hub WireGuard server is configured, run from a trusted Ansible controller:

Terminal window
./scripts/wg-dev-client.sh <operator-device>

The helper records the client in the operator-client inventory, runs wireguard-clients.yml, and writes an importable configuration under output/wireguard-clients/.

  • Treat the generated configuration and private key as credentials.
  • Do not commit files under secrets/ or output/.
  • Transfer configurations only over an approved secure channel.
  • Remove the peer from inventory and the hub when a device is retired or lost.
  • Rotate the peer when compromise is suspected.

WireGuard does not configure public firewall policy for you. Keep management services restricted to the overlay or another reviewed administrative network.

See install the hub and secrets.