Initial Setup

Configure Wiretastix, initialize the API token, and start the daemon.

After installing Wiretastix, you need to perform some initial setup steps to get the daemon running and ready to manage your WireGuard VPN.

0. Initialize the WireGuard Interface

Before starting Wiretastix, you need to ensure the WireGuard interface is initialized on your system. The core command to create the WireGuard interface is ip link add dev wg0 type wireguard. However, the method for persisting this configuration across reboots and bringing the interface up at boot varies significantly between Linux distributions.

For Debian/Ubuntu Systems

On Debian and Ubuntu, you can configure the interface by editing /etc/network/interfaces.

Edit /etc/network/interfaces:
Add the following stanza to your /etc/network/interfaces file. Replace $IFACE with the WireGuard interface name you configured in wiretastix.yaml (e.g., wg0).
```
auto wg0
iface wg0 inet manual
    pre-up ip link add $IFACE type wireguard
    post-down ip link del $IFACE
```
Bring up the interface:
To activate the interface without rebooting, run:
```
sudo ifup wg0
```
This command will bring up the WireGuard interface, allowing Wiretastix to manage it.

For Red Hat Derivatives and Other Distributions

For Red Hat-based distributions (like CentOS, Fedora, RHEL) and other Linux distributions, the approach to configure and persist WireGuard interfaces will differ. You will typically use network management tools specific to your distribution (e.g., NetworkManager, nmcli, ip commands in startup scripts, or systemd-networkd configurations). Consult your distribution’s documentation for the appropriate method to create and manage a WireGuard interface without assigning it an IP address.

1. Create the Configuration File

Wiretastix uses a YAML configuration file. A basic example is provided as wiretastix.yaml in the project root. You should copy this file to /etc/wiretastix/wiretastix.yaml (or another location and specify it with the -c flag when starting the daemon).

# Example wiretastix.yaml

# The apiserver config stanza provides the settings for the user frontend web interface
webserver:
    # If there is at least one host, the value will be used to automatically
    # request a TLS certificate from letsencryot
    acme-host:
    #  - wiretastix.local
    binding: :8085
    # The base url of the wiretastix endpoint.
    base: /
    # where the HTML templates and assets are stored
    html-assets: /usr/lib/wiretastix/html
    html-templates: /usr/lib/wiretastix/templates
    # If set to true, wiretastix will generate a self signed certificate and the web ui will be served
    # through those certificates. The certificates will change et every restart so this feature
    # should be used with care, mainly as a secure transport between a frontend proxy and wiretastix itself.
    auto-cert: true
    # Where wiretastix will store the certificates generated through ACME (letsencrypt)
    cert-dir: /etc/wiretastix/certs/

# The apiserver provides the endpoints to interact with the wiretastix settings
# and configure all the parameters.
apiserver:
    binding: 127.0.0.1:8095
    base: /wiretastix/api/v1/

# Database configuration
db:
  type: "sqlite" # or "postgres"
  dsn: "file:/var/lib/wiretastix/wiretastix.db?_journal=WAL&_fk=1" # SQLite DSN
  # dsn: "postgres://user:password@host:port/database?sslmode=disable" # PostgreSQL DSN

# WireGuard interface configuration
wireguard:
  name: "wg0" # Name of the WireGuard interface
  port: 51820 # Listening port for WireGuard
  ipv4: "10.0.0.1/24" # IPv4 address for the WireGuard interface
  ipv6: "fd00::1/64" # IPv6 address for the WireGuard interface

# Metrics server configuration (Prometheus)
metrics:
  binding: "127.0.0.1:9100" # Address and port for metrics
  path: "/metrics" # Path for metrics endpoint

# DNS Resolver configuration
resolver:
  binding: "127.0.0.1:53" # Address and port for the DNS resolver
  concurrency: 100 # Concurrency for DNS queries
  domain: "wg.local" # Domain for internal DNS resolution

# NFTables configuration
nftables:
  table: "wiretastix" # NFTables table name

2. Initialize the API Token

The Wiretastix CLI and any other clients need an API token to authenticate with the daemon. You can generate an initial token using the wiretastix-daemon with the --initialize flag.

sudo wiretastix-daemon --initialize -c /etc/wiretastix/wiretastix.yaml

This command will output a new API token. Copy this token immediately, as it will not be shown again. If you lose it, you will need to wipe existing tokens and generate a new one using the --wipe flag (e.g., sudo wiretastix-daemon --initialize --wipe -c /etc/wiretastix/wiretastix.yaml).

3. Start the Wiretastix Daemon

Once the configuration file is set up and you have an API token, you can start the Wiretastix daemon.

If you installed via Debian package, the daemon might already be running as a systemd service. You can check its status and start/stop it using:

sudo systemctl status wiretastix
sudo systemctl start wiretastix
sudo systemctl enable wiretastix # To start on boot

If you installed from source, you can run the daemon directly:

sudo wiretastix-daemon -c /etc/wiretastix/wiretastix.yaml

For verbose output, add the -v flag: sudo wiretastix-daemon -v -c /etc/wiretastix/wiretastix.yaml.

4. Connect with the CLI

With the daemon running and your API token, you can now use the wiretastix-cli to interact with the system. You can provide the API URL and token via command-line flags or environment variables.

# Using flags
wiretastix-cli --api https://127.0.0.1:8095/wiretastix/api/v1/ --token YOUR_API_TOKEN

# Using environment variables (recommended for convenience)
export WIRETASTIX_API="https://127.0.0.1:8095/wiretastix/api/v1/"
export WIRETASTIX_TOKEN="YOUR_API_TOKEN"
wiretastix-cli

Once connected, you will enter an interactive shell where you can manage your Wiretastix VPN.

Next Steps

Now that Wiretastix is running, you can proceed to Managing Peers to create your first WireGuard clients.