[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_152":153},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_141":-5,"_142":11,"_143":21,"_144":11,"_145":-5,"_146":11,"_147":-5,"_148":149,"_150":91,"_151":-7},"canonicalUrl","https://hub.docker.com/r/james/wg-api/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","james","reponame","wg-api","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2020-02-20T19:55:56.839618Z","description","WG-API is a JSON-RPC Server for WireGuard ","is_private","last_updated","2022-03-22T16:30:55.264143Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.distribution.manifest.list.v2+json","name","pull_count",1219813,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# WG-API 🔐\n\nWG-API presents a JSON-RPC interface on top of a WireGuard network interface.\n\n* 💖 **Add/Remove Peers**\n Modify known peers without reloading\n\n* 📈 **Statistics**\n View data usage and allowed IPs of all peers\n\n* 📞 **JSON-RPC 2.0 API**\n No custom client integrations required, standard API accepted everywhere.\n\n**NOTE:** WG-API is currently only compatible with the WireGuard Linux kernel module and userland wireguard-go. It does not currently work with the MacOS NetworkExtension.\n\n\n## Getting WG-API\n\n### Pre-Built Binary\n\nBinaries for Linux are available [here](https://github.com/jamescun/wg-api/releases).\n\n### Build Yourself\n\nWG-API requires at least Go 1.13.\n\n```sh\ngo install github.com/jamescun/wg-api/cmd\n```\n\nThis should install the server binary `wg-api` in your $GOPATH/bin.\n\n### Docker\n\nWG-API can also be run inside a Docker container, however the container will need to existing within the same network namespace as the host and have network administrator capability (CAP_NET_ADMIN) to be able to control the WireGuard interface.\n\n```sh\ndocker run --name=wg-api -d -p 8080:8080 --network host --cap-add NET_ADMIN james/wg-api:latest wg-api --device=\n```\n\n\n## Configuring WG-API\n\nWG is configured using command line arguments:\n\n```sh\n$ wg-api --help\nWG-API presents a JSON-RPC API to a WireGuard device\nUsage: wg-api [options]\n\nHelpers:\n --list-devices list wireguard devices on this system and their name to be\n given to --device\n --version display the version number of WG-API\n\nOptions:\n --device= (required) name of WireGuard device to manager\n --listen=<[host:]port> address where API server will bind\n (default localhost:8080)\n --tls enable Transport Layer Security (SSL) on server\n --tls-key TLS private key\n --tks-cert TLS certificate file\n --tls-client-ca enable mutual TLS authentication (mTLS) of the client\n --token opaque value provided by the client to authenticate\n requests. may be specified multiple times.\n\nEnvironment Variables:\n WGAPI_TOKENS comma seperated list of authentication tokens, equivalent to\n calling --token one or more times.\n\nWarnings:\n WG-API can perform sensitive network operations, as such it should not be\n publicly exposed. It should be bound to the local interface only, or\n failing that, be behind an authenticating proxy or have mTLS enabled.\n Additionally authentication tokens should be configured.\n```\n\nThe only required argument is `--device`, which tells WG-API which WireGuard device to control. To control multiple WireGuard devices, launch multiple instances of WG-API.\n\nBy default, this launches WG-API on `localhost:8080` which may conflict with the typical development environment. To bind it elsewhere, use `--listen`:\n\n```sh\n$ wg-api --device= --listen=localhost:1234\n```\n\n**NOTE:** `--listen` will not prevent you from binding the server to a public interface. Care should be taken to prevent public access to the WG-API server; such as binding it only to a local interface, enabling auth tokens, placing an authenticating reverse proxy in-front of it or using mTLS (detailed below).\n\nAuthentication tokens can be provided either on the command line or via an environment variable. `--token` may be specified multiple times, or a comma-seperated list may be provided with the `WGAPI_TOKENS` environment variable. Environment variables are preferred as the token may be visible from process lists when using the command line `--token`.\n\n```sh\n$ WGAPI_TOKENS= wg-api --device=\n```\n\nThen provided as part of the HTTP exchange in the HTTP `Authorization` header as the `Token` scheme.\n\n```sh\n$ curl http://localhost:8080 -H \"Authorization: Token \" ...\n```\n\n```\nPOST / HTTP/1.1\nHost: localhost:8080\nAuthorization: Token \nContent-Type: application/json\n```\n\nWG-API can optional listen using TLS and HTTP/2. To enable TLS, you will also need a TLS Certificate and matching private key.\n\n```sh\n$ wg-api --device= --tls --tls-key=key.pem --tls-cert=cert.pem\n```\n\nAnd optionally WG-API can request and validate client certificates to implement TLS Mutual Authentication (mTLS):\n\n```sh\n$ wg-api --device= --tls --tls-key=key.pem --tls-cert=cert.pem --tls-client-ca=clientca.pem\n```\n\n\n## Using WG-API\n\nWG-API exposes a JSON-RPC 2.0 API with five methods.\n\nAll calls are made using the POST method, and require the `Content-Type` header to be set to `application/json`. The server ignores the URL path it is given, allowing the server to be mounted under another hierarchy in a reverse proxy.\n\nThe structures expected by the server can be found in [client/client.go](client/client.go).\n\nAuthentication may optionally be configured. This is supplied via the `Authorization` header as the `Token` scheme. See [Configuring WG-API](##Configuring-WG-API) for an example.\n\n\n### GetDeviceInfo\n\nGetDeviceInfo returns information such as the public key and type of interface for the currently configured device.\n\n```sh\ncurl http://localhost:8080 -H \"Content-Type: application/json\" -d '{\"jsonrpc\": \"2.0\", \"method\": \"GetDeviceInfo\", \"params\": {}}'\n```\n\n#### Example Response\n\n```json\n{\n \"device\": {\n \"name\": \"wg0\",\n \"type\": \"Linux kernel\",\n \"public_key\": \"xoY2MZZ1UmbEakFBPyqryHwTaMi6ae4myP+vuILmJUY=\",\n \"listen_port\": 51820,\n \"num_peers\": 13\n }\n}\n```\n\n\n### ListPeers\n\nListPeers retrieves information about all Peers known to the current WireGuard interface, including allowed IP addresses and usage stats, optionally with pagination.\n\n```sh\ncurl http://localhost:8080 -H \"Content-Type: application/json\" -d '{\"jsonrpc\": \"2.0\", \"method\": \"ListPeers\", \"params\": {}}'\n```\n\n#### Example Response\n\n```json\n{\n \"peers\": [\n {\n \"public_key\": \"xoY2MZZ1UmbEakFBPyqryHwTaMi6ae4myP+vuILmJUY=\",\n \"has_preshared_key\": false,\n \"endpoint\": \"67.234.65.104:57436\",\n \"last_handshake\": \"2020-02-20T16:35:12Z\",\n \"receive_bytes\": 834854756,\n \"transmit_bytes\": 3883746,\n \"allowed_ips\": [\n \"10.1.1.0/24\"\n ],\n \"protocol_version\": 1\n },\n ...\n ]\n}\n```\n\n\n### GetPeer\n\nGetPeer retrieves a specific Peer by their public key.\n\n```sh\ncurl http://localhost:8080 -H \"Content-Type: application/json\" -d '{\"jsonrpc\": \"2.0\", \"method\": \"GetPeer\", \"params\": {\"public_key\": \"xoY2MZZ1UmbEakFBPyqryHwTaMi6ae4myP+vuILmJUY=\"}}'\n```\n\n#### Example Response\n\n```json\n{\n \"peer\": {\n \"public_key\": \"xoY2MZZ1UmbEakFBPyqryHwTaMi6ae4myP+vuILmJUY=\",\n \"has_preshared_key\": false,\n \"endpoint\": \"67.234.65.104:57436\",\n \"last_handshake\": \"2020-02-20T16:35:12Z\",\n \"receive_bytes\": 834854756,\n \"transmit_bytes\": 3883746,\n \"allowed_ips\": [\n \"10.1.1.0/24\"\n ],\n \"protocol_version\": 1\n }\n}\n```\n\n\n### AddPeer\n\nAddPeer inserts a new Peer into the WireGuard interfaces table, multiple calls to AddPeer can be used to update details of the Peer.\n\n```sh\ncurl http://localhost:8080 -H \"Content-Type: application/json\" -d '{\"jsonrpc\": \"2.0\", \"method\": \"AddPeer\", \"params\": {\"public_key\": \"xoY2MZZ1UmbEakFBPyqryHwTaMi6ae4myP+vuILmJUY=\",\"allowed_ips\": [ \"10.1.1.0/24\" ]}}'\n```\n\n\n### RemovePeer\n\nRemovePeer deletes a Peer from the WireGuard interfaces table by their public key,\n\n```sh\ncurl http://localhost:8080 -H \"Content-Type: application/json\" -d '{\"jsonrpc\": \"2.0\", \"method\": \"RemovePeer\", \"params\": {\"public_key\": \"xoY2MZZ1UmbEakFBPyqryHwTaMi6ae4myP+vuILmJUY=\"}}'\n```\n\n## Thanks\n\nWith many thanks to:\n\n - [Jason A. Donenfeld](https://github.com/zx2c4)\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",20254409,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":130,"_131":94,"_132":33,"_133":56,"_57":134,"_135":136,"_137":127,"_138":130,"_139":66,"_140":21},"content_type","creator",657,"full_size",3721584,"id",87615825,"images",[101,119,124],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":117,"_63":66,"_118":-5},"architecture","amd64","digest","sha256:76428f4fe0efee9e0d17c8d89920535d536675f604a9f5081075615cac0d2411","features","","last_pulled","2026-10-10T07:02:13.460405744Z","last_pushed","2022-03-22T16:30:55Z","os","linux","os_features","os_version","size",4028122,"variant",{"_102":120,"_104":121,"_106":107,"_108":122,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":123,"_63":66,"_118":-5},"arm64","sha256:a8560b4ddab984d16d6a188d50a523f09ee739a644617c974100569be4c048e3","2026-10-10T07:02:13.479759451Z",3732129,{"_102":125,"_104":126,"_106":107,"_108":127,"_110":128,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_118":129},"arm","sha256:cfa827a26f6d2af59f37c452713ac1138429dd5bfcfbd659731a4b6cad38273a","2026-10-10T07:02:13.502968295Z","2022-03-22T16:30:54Z","v7","2022-03-22T16:30:55.051381Z","last_updater","last_updater_username","media_type","latest","repository",8522362,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":154,"_161":162,"_148":173,"_174":11},{"_40":155,"_42":156,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":157,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":158,"_79":11,"_80":160,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":159},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_163":64,"_164":-5,"_165":-5,"_166":167},"count","next","previous","results",[168],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":169,"_50":130,"_131":94,"_132":33,"_133":56,"_57":134,"_135":136,"_137":127,"_138":130,"_139":66,"_140":21},[170,171,172],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":117,"_63":66,"_118":-5},{"_102":120,"_104":121,"_106":107,"_108":122,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":123,"_63":66,"_118":-5},{"_102":125,"_104":126,"_106":107,"_108":127,"_110":128,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_118":129},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
76428f4fe0ef	linux/amd64	3.84 MB
cfa827a26f6d	linux/arm/v7	3.55 MB
a8560b4ddab9	linux/arm64	3.56 MB

james/wg-api

Tags for james/wg-api