Signing In and Creating Your First Tunnel

How a user signs in via OIDC/SSO and gets zero-touch, self-service WireGuard peer provisioning from the web UI.

This is the first how-to for a reason: there is no admin command to create a user. Users are provisioned automatically the moment they successfully authenticate through your OIDC Identity Provider, and they get their own VPN tunnel by self-service through the web UI – not by an administrator creating anything on their behalf. Every other how-to guide in this section (managing peers, organizing users into groups, writing network rules) only has something to act on once at least one person has actually signed in this way.

If you haven’t yet configured an Identity Provider, do that first: see Configure OIDC Identity Provider.

1. Open the Web UI

Navigate to your Wiretastix web UI in a browser – the address and port come from webserver.binding in wiretastix.yaml (e.g., https://vpn.example.com:8085). You’ll land on a login card with a single Sign in button.

Click Sign in. You’ll be redirected to your configured OIDC provider (Google, Azure AD, Okta, Keycloak, Authentik, or whichever you’ve set up) to authenticate, then redirected back to Wiretastix.

The first time this succeeds for a given identity, Wiretastix creates a user record automatically from the OIDC claims (subject ID, email, name, nickname, and group memberships) – nobody needs to have created an account in advance. By default, newly auto-provisioned users are immediately enabled (new_users_enabled = 1, see the Default Configuration); an administrator can flip that setting so new users start disabled and need manual approval instead, but that’s an opt-in policy change, not the default.

3. Create a Tunnel

After signing in you land on your Account details page, showing your device usage (e.g. 0 / 10) and a list of “Your tunnels” (empty the first time). Click Create a new VPN tunnel.

This is the self-service equivalent of the CLI’s peer create – except it’s automatically tied to you, as the signed-in user, rather than creating an unmanaged peer.

4. Save Your Configuration

You’ll land on a page reading “Your new WireGuard tunnel is ready” with a scannable QR code and the raw config text below it, plus a Download button.

This is shown only once. There is no way to come back later and retrieve the same config again – if you lose it, the only option is to delete that tunnel and create a new one. Scan it with the WireGuard mobile app now, or download the file for a desktop client, before navigating away.

5. Manage Your Tunnels

Back on the dashboard, each tunnel can be renamed or deleted from the “Your tunnels” table. You can create additional tunnels up to your account’s device limit (max_devices); once you’re at the limit, the create button is replaced with a notice instead.

What This Means for Administrators

Because provisioning flows this way:

You cannot pre-create a user account for someone – they must sign in at least once themselves.
You can review, enable/disable, adjust device limits for, or delete users after they’ve signed in – see Manage Users.
You can create additional unmanaged peers yourself for machines/services that don’t authenticate as a person – see Managing Peers.
Group membership itself comes from the OIDC provider’s group claims at login, not from anything set in Wiretastix – see OIDC Integration.

Before the first real user signs in, make sure default_group and default_endpoint are set to real values, not the placeholders a fresh install ships with (fallback and 192.168.0.1:51820) – see Configuring Global Defaults. If a user’s claims don’t match any group you’ve created and no working default_group exists, or default_endpoint was never changed, step 3 above fails with a generic “Error creating additional device: not found” (or similar) instead of producing a tunnel. See Manage Groups for the fix.