Operate WireGuard access without losing control of the server.
WG Mini UI brings existing WireGuard deployments, peer lifecycles, address allocation, access policy, backup, recovery, and audit into one focused administrative workflow.
Bring an existing WireGuard server under managed operations.
WG Mini UI can adopt a running Linux WireGuard deployment without replacing standard WireGuard clients. Readiness checks identify legacy peers and configuration issues before peer lifecycle, address allocation, and access policy move into a controlled browser workflow.
- Adopt an existing Linux WireGuard server with readiness checks and a reviewable migration plan
- Manage peer creation, enable, disable, expiration, address changes, and removal from one interface
- Allocate peer addresses from named Address Pools and non-overlapping Allocation Ranges
- Apply Access Profile-based nftables policy for restricted or reverse-management access
- Create automatic pre-change backups, review restores, and retain an operational audit trail
- Deliver configurations for standard WireGuard clients, including client-owned public key workflows
Give administrators encrypted access to PBX consoles and SIP tools without publishing the admin surface to the internet.
Let approved staff reach selected internal calling, reporting, CRM, or workflow systems through a managed peer.
Create a time-bounded support lane, review it, then disable or remove it when the work is complete.
Keep identity, address allocation, routing, and authorization distinct.
Each peer carries operational context, while Address Pool, Allocation Range, Access Profile, and Client Routing remain separate decisions. That separation prevents a profile change from silently renumbering a peer or changing the routes already installed on a client.
Review marker coverage, legacy peers, duplicate keys, and duplicate addresses before changes begin.
Select a routed Address Pool and a named Allocation Range without silently spilling into another range.
Use Access Profiles to enforce restricted or blocked nftables policy while preserving return traffic for reverse administration.
Create backups before mutations, review restore impact, and keep a trace of operational changes.
Policy changes are checked, backed up, and visible.
Network Policy is compiled into a WG Mini UI-owned nftables table with Off, Observe, and Enforce modes. Save & Apply validates the policy, creates a backup, applies it transactionally, and rolls back saved and runtime state if reconciliation fails. Operations then exposes policy status, counters, drift, backups, restore checks, and audit events.
Focused WireGuard control, built around standard clients.
WG Mini UI manages a trusted Linux WireGuard gateway rather than replacing the WireGuard protocol or requiring a proprietary endpoint agent. It is designed for controlled administrative deployment; SSO, MFA, reverse-proxy authentication, and multi-tenant packaging remain deployment-specific hardening work.
Use the managed network for a concrete maintenance task.
WG Mini UI manages the gateway, peers, addresses, and policy. LanPier adds a customer-controlled workflow for reaching compatible on-site web management pages and SSH services through that existing WireGuard path.
Explore LanPier ->
A private family archive is a practical reason to operate WireGuard well.
Personal Archive can stay on a private host while trusted phones, tablets, and computers reach it through standard WireGuard clients. It is a concrete example of why peer lifecycle, restricted routes, backup, and recovery matter outside a PBX environment.
Explore Personal Archive ->
Bring a WireGuard deployment under managed operations.
Start with the existing server, the people and systems that need access, and the network boundaries each peer should have.