WireGuard: how to add endpoints using command-line?

[tony124]

Hello,

I am new to WireGuard. I have followed the official docs and could connect 1 client to WireGuard on my opnsense server. Now I would like to add a few dozens of endpoints for my users -- each user gets his/her own wg config. Can I do that via command line? Can I simply edit /usr/local/etc/wireguard/wg0.conf and then issue /usr/local/etc/rc.d/wireguard restart?

[mimugmail]

No, you could write a script calling the needed API calls, but there is none available yet

[Patrick M. Hausen]

You could add 2 or 3, then export the configuration, then try to understand the structure of the exported XML and edit that for re-import ...

[tony124]

No, you could write a script calling the needed API calls, but there is none available yet

so I guess my best bet is to wait till the API is avail.? Do you know when it might be supported (if at all)?

[tony124]

You could add 2 or 3, then export the configuration, then try to understand the structure of the exported XML and edit that for re-import ...

yes that would be a workaround, thanks for the hint. I'd prefer to do partial restore for wireguard only, but it seems partial restore for WireGuard is not possible yet.

The xml fragment for a wg client seems fairly simple, so I am thinking of doing the following:

(1) export the entire config
(2) delete all existing wg endpoints
(3) add all desired wg endpoints
(4) re-import the entire config

When I add/remove an endpoint I can simply repeat the above procedure and have my wg server config correct. Does it seem reasonable/doable?

[mimugmail]

You can open /conf/config.xml and insert the xml part manually without a restore.
The API for Wireguard is already here, you just need to read the docs how to use it.

[tony124]

You can open /conf/config.xml and insert the xml part manually without a restore.
The API for Wireguard is already here, you just need to read the docs how to use it.

thanks for the hint. So it seems that I can edit /conf/config.xml as needed, make sure that it's valid and then run
/usr/local/etc/rc.d/wireguard restart ?

[mimugmail]

No you need to set another API call for reconfigure services.
Just read the developer docs about the API, maybe this makes it clearer.