{% extends "base.html" %} {% block content %}

WireGuard mesh

A private road
home.

Give a laptop or phone its own address inside your network. Warden generates the keys, writes the hub config, and hands you a client file.

{% if mesh_enabled %}
{% endif %}
{% if not mesh_enabled %}

Not enabled

The mesh is waiting.

Enable WireGuard in warden.yaml to generate a hub, enroll peers, and download ready-to-import client configurations.

mesh:
  enabled: true
  interface: wg0
  address: 10.44.0.1/24
  listen_port: 51820
  endpoint: vpn.example.com:51820
  config_path: /etc/wireguard/wg0.conf
Edit configuration Restart Warden after saving mesh settings.
{% else %} {% if not mesh_status.available %}
WireGuard is not readable from this process{% if mesh_status.detail %}: {{ mesh_status.detail }}{% endif %}. Peer configs can still be generated; apply and live handshakes need wg installed and root access.
{% elif not mesh_status.applied %}
Interface {{ mesh.interface }} is not up yet{% if mesh_status.detail %} — {{ mesh_status.detail }}{% endif %}. Add peers, then press “Apply to host”.
{% endif %} {% if last_apply %}
Last apply {{ last_apply.timestamp|relative_time }}{% if last_apply.output %} — {{ last_apply.output|truncate_middle(240) }}{% endif %}
{% endif %}
Interface
{{ mesh.interface }}
Hub address
{{ mesh.address }}
Listen port
{{ mesh.listen_port }}
Peers
{{ peer_count }}

Peers

{% if mesh_status.applied %} interface live{% else %}config only{% endif %}
{% for row in peers %} {% else %} {% endfor %}
Peer Address Endpoint Handshake Transfer
{{ row.peer.name }} {{ row.peer.public_key[:12] }}… {{ row.peer.address }} {{ row.endpoint or '—' }} {{ row.rx|bytes }} ↓ · {{ row.tx|bytes }} ↑
No peers yet. Add a laptop, phone, or a whole subnet.
{% if hub_public_key %}
Hub public key {{ hub_public_key }}
{% endif %}

Applying config

“Apply to host” writes {{ mesh.config_path or '/etc/wireguard/' ~ mesh.interface ~ '.conf' }} and runs wg-quick or wg syncconf. Warden must run as root or with CAP_NET_ADMIN to touch the interface.

Peer private keys stay in Warden's SQLite database so you can download a client file again later.

{% endif %} {% endblock %} {% block modals %} {% if mesh_enabled %}

Add a peer

One device, one address, one key.

A private key, preshared key, and client configuration are generated as soon as you save.

Client configuration

Import this file into the WireGuard app on the peer.


    
This file contains a private key. Transfer it over a channel you trust and delete it from shared storage afterwards.

  

  

    
    
    
  


{% endif %}
{% endblock %}