{"id":51007526,"url":"https://github.com/synapticloop/digitalocean-wireguard-vpn","last_synced_at":"2026-06-20T22:01:34.507Z","repository":{"id":360410215,"uuid":"1249982136","full_name":"synapticloop/digitalocean-wireguard-vpn","owner":"synapticloop","description":"Easily and securely setup a Wireguard VPN using a DigitalOcean droplet.","archived":false,"fork":false,"pushed_at":"2026-05-26T09:51:49.000Z","size":71,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-26T10:26:22.366Z","etag":null,"topics":["digitalocean","security","vpn","vpn-server","wireguard"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/synapticloop.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-05-26T07:43:28.000Z","updated_at":"2026-05-26T09:59:31.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/synapticloop/digitalocean-wireguard-vpn","commit_stats":null,"previous_names":["synapticloop/digitalocean-wireguard-vpn"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/synapticloop/digitalocean-wireguard-vpn","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/synapticloop%2Fdigitalocean-wireguard-vpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/synapticloop%2Fdigitalocean-wireguard-vpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/synapticloop%2Fdigitalocean-wireguard-vpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/synapticloop%2Fdigitalocean-wireguard-vpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/synapticloop","download_url":"https://codeload.github.com/synapticloop/digitalocean-wireguard-vpn/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/synapticloop%2Fdigitalocean-wireguard-vpn/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34586666,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-20T02:00:06.407Z","response_time":98,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["digitalocean","security","vpn","vpn-server","wireguard"],"created_at":"2026-06-20T22:01:32.079Z","updated_at":"2026-06-20T22:01:34.499Z","avatar_url":"https://github.com/synapticloop.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DigitalOcean WireGuard VPN Admin\n\nA Django + SQLite WireGuard administration panel for a single DigitalOcean Ubuntu 24.04 LTS droplet.\n\n## Key decisions\n\n- Ubuntu 24.04 LTS target, with bootstrap disabling Ubuntu telemetry/crash reporting where present.\n- Nginx terminates HTTPS and listens only on the WireGuard address `10.44.0.1:443`.\n- Public surface is only WireGuard UDP `51820`; HTTP `80` opens temporarily for Certbot HTTP-01.\n- Public SSH is closed after setup; DigitalOcean console is the emergency recovery path.\n- Django identifies users by WireGuard source IP. No username/password login is used by default.\n- SQLite is the source of truth; `/etc/wireguard/wg0.conf` is generated.\n- Client private keys are generated server-side, shown once as a QR/config, and not retained after download.\n- Per-user usage limits are supported. Admin users are exempt from web-interface lockout.\n- DigitalOcean API token is optional during setup and can be added later in the web UI.\n- Privacy switches can disable persistent audit/config logs and persistent WireGuard usage accounting.\n\n## Remote install\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/synapticloop/digitalocean-wireguard-vpn/main/install.sh | sudo bash\n```\n\n`WG_ADMIN_DOMAIN` is optional. If it is omitted, the installer detects the server's public IPv4 address and uses that for the WireGuard endpoint and admin URL.\n\nOptional domain example:\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/synapticloop/digitalocean-wireguard-vpn/main/install.sh | sudo WG_ADMIN_DOMAIN=wg.example.com bash\n```\n\nThe installer bootstraps prerequisites such as `git`, clones the repository, then runs `scripts/bootstrap_ubuntu_2404.sh`. When a real domain is supplied, it attempts a Certbot HTTP-01 certificate. If certificate issuance fails, including IP-address installs, it creates a local self-signed HTTPS certificate so Nginx can still start on the WireGuard-only listener.\n\n## First admin\n\nThe bootstrap creates `/root/wg-admin-first-client.conf` with permissions `0600`. Import it into a WireGuard client, connect, then open:\n\n```text\nhttps://wg.example.com\n```\n\nIf no domain was supplied during install, use `https://\u003cserver-public-ip\u003e` instead.\n\nThe web interface refuses non-VPN access at multiple layers:\n\n- UFW only allows `443/tcp` on `wg0`.\n- Nginx binds to `10.44.0.1:443` and denies non-WireGuard addresses.\n- Django rejects requests outside `10.44.0.0/24` and requests from unregistered/disabled peers.\n\n## Important paths\n\n```text\n/opt/wg-admin                         Django app\n/var/lib/wg-admin/db.sqlite3          SQLite database\n/etc/wireguard/wg0.conf               generated WireGuard config\n/run/wg-admin/wg0.candidate.conf      generated candidate config\n/usr/local/sbin/wg-admin-commit       root-owned commit helper\n/root/wg-admin-first-client.conf      bootstrap admin client config\n```\n\n## Development notes\n\nThis is a starter project, not a production-audited VPN appliance. Review the commit helper, firewall rules, and privilege boundaries before exposing it beyond personal use.\n\n\nCreate a WireGuard VPN\n\n```\n█████████████████████████████████████\n█████████████████████████████████████\n████ ▄▄▄▄▄ █▄▀▀▄▄ █▄██▄▀██ ▄▄▄▄▄ ████\n████ █   █ ███▄█ ▄▄ ▀▀▀▀ █ █   █ ████\n████ █▄▄▄█ ██▄▀▄▀▄██▄█▄▄▀█ █▄▄▄█ ████\n████▄▄▄▄▄▄▄█ █ ▀▄▀ ▀ █▄█ █▄▄▄▄▄▄▄████\n████ ▄█▄ █▄██ ▄▄▀█▄▄█▄█ █▀▄▀▀█▀▀▄████\n████▀ █ ▄▀▄▄█▀  ▀▄▄▄█▀█▀   ▄█▀▄█▀████\n████▀ ▀▀ █▄ ▀ █▄▄▄▀ ██▀█ █ ▄▀▀▀▀ ████\n█████ ▀█▀▄▄ ▄▄█ ▄█▀▄██▄▄▄▀█ ▀█ █ ████\n████▀▀▄▀▀█▄ █  ▀▀▄█▄█▀█▀ ▀██▀▄▀▀█████\n████  ▀▄▀▄▄▄███▄▀▀█▄▀▄▀▄ ▀▄▀▀ ▀█▄████\n████▄▄█▄▄▄▄▄ ▄ █▄▀▄▀▀▄▀▄ ▄▄▄  ▄▄█████\n████ ▄▄▄▄▄ ███▀█▄█  █▀▄  █▄█ ▄██▀████\n████ █   █ █ █ █ ▀▄ ▀▀▀▄  ▄ ▄▄██▀████\n████ █▄▄▄█ █▀▀ ▀ ▄  ██ ▀█▀▀ ▄▀ ▄ ████\n████▄▄▄▄▄▄▄█▄▄▄█▄█▄█▄█▄▄▄▄██▄▄███████\n█████████████████████████████████████\n█████████████████████████████████████\n```\n\ncd /opt/wg-admin\n\nsudo systemctl restart wg-admin\nsudo -u wgadmin git pull","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsynapticloop%2Fdigitalocean-wireguard-vpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsynapticloop%2Fdigitalocean-wireguard-vpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsynapticloop%2Fdigitalocean-wireguard-vpn/lists"}