AWG Admin v1.2.0

Amnezia-WG Admin v1.2.0

Richer metrics history, a new way to pull official agent binaries straight from GitHub releases (arch-aware), consistent alphabetical ordering, per-peer status badges, and two important fixes.

✨ New

• Deploy an agent from GitHub releases. The agent-source picker now has a "GitHub releases…" option that lists the newest official awg-agent binaries — double-click one to save it as a source, no URL to paste. The userspace/kernel variant is detected automatically, and binaries you've already added are marked.
• Architecture-aware. The agent now reports its CPU architecture, so the releases picker offers only binaries that will actually run on that server (no more accidentally picking an arm64 build for an amd64 box). The arch is shown next to the agent version, e.g. 1.0.0 (amd64).
• Metrics history — time range. A 1h / 3h / 6h / 24h / All selector filters every chart to a recent window.
• Metrics history — per-peer online dot. Each peer in the Peers tab shows a green/grey dot for whether it's currently connected.
• Metrics history — sparkline tooltip. Hover a peer's activity sparkline to see the exact time and traffic at that point.

🔧 Improved

• Alphabetical ordering everywhere — servers, users, peers, tunnels, and the metrics Peers tab are now sorted A→Z (case- and accent-insensitive, natural number ordering). Tunnel gateways stay pinned to the top of the metrics list.
• Per-peer status badge. Each peer shows an enabled/disabled badge next to its name, matching the user-status style (replacing the old inline "Disabled" text).
• Desktop debug logs actually work. With Settings → Logs → Debug mode on, normal operations (viewing peers, toggling a peer, etc.) now appear in the log — previously only errors and startup showed up.

📦 Downloads

Desktop app

• Windows — amnezia-wg-admin-amd64-installer_1.2.0.exe (installer) or amnezia-wg-admin_1.2.0.exe (portable).
• macOS — amnezia-wg-admin_1.2.0.dmg (universal, Intel + Apple Silicon). Ad-hoc signed, not notarized — on first launch right-click → Open, or xattr -cr "/Applications/Amnezia-WG Admin.app".
• Linux — amnezia-wg-admin_1.2.0 (requires libgtk-3, libwebkit2gtk-4.1).

Standalone server

• awg-admin binaries (linux / macOS / windows × amd64 / arm64).
• Docker: ghcr.io/ks-tool/awg-admin:1.2.0 (and :latest).

⬆️ Upgrade notes

• Just replace the binary / re-pull the image — no data or config migration. Your ~/.awg-admin database is unchanged.
• Arch filtering and the (amd64) version display require a new agent. Deploy agent v1.1.0+ to a server for them to take effect there; against an older agent the picker simply shows all binaries and the version has no arch suffix.

AWG Admin v1.1.1

What's Changed

• Fix hardcoded API_BASE_URL by @ks-tool in #3

Full Changelog: v1.1.0...v1.1.1

AWG Agent v1.1.0

Agent v1.1.0

A small, backward-compatible release: the agent now reports its host CPU architecture, which the admin uses to offer only runnable agent binaries in the new "GitHub releases" source picker. No changes to interface/tunnel management, configuration, or dependencies.

Released independently of the admin app (tag agent/v1.1.0).

What's new

• GET /info now reports the host CPU architecture — a new arch field on HostInfo (runtime.GOARCH, e.g. amd64 / arm64). The admin (v1.2.0+) uses it to filter the "GitHub releases" agent-source picker to matching-CPU binaries and to show the arch next to the agent version (1.0.0 (amd64)).

Compatibility

• Backward compatible. arch is a purely additive field; nothing else in /info or any other endpoint changed. An older admin simply ignores it.
• No behavior changes to interface configuration, tunnels, metrics, hooks, or the kernel/userspace backends.
• Dependencies unchanged — amneziawg-go stays pinned to v0.2.19 (the AmneziaWG 2.0 line; do not upgrade to v1.0.x).

AWG Admin v1.1.0

Amnezia-WG Admin v1.1.0

A backward-compatible release — upgrading from v1.0.0 needs no migration or
manual steps. Highlights: the app version is now visible in Settings, agent
sources are editable, the userspace agent can be deployed over systemd, and
removing a tunnel no longer drops your client peers.

ℹ️ The product was renamed from Amnezia Admin to Amnezia-WG Admin
(window title, docs and the macOS app/.dmg). Your data and configuration are
unchanged.

✨ New

• App version in Settings — the Settings page now shows the build version,
  stamped into both the web-server and desktop builds and logged at startup.
• Editable agent sources — a per-entry edit button opens a pre-filled form
  (create and edit are now one unified form).
• Deploy the userspace agent over systemd — URL/file sources gained a
  “Userspace agent (no kernel module)” flag that skips the kernel-module
  pre-check, so awg-agent-userspace is no longer Docker-only.
• Interface-level DNS — a DNS field in the interface form (under Advanced
  settings) that’s used for a peer’s client config whenever the peer leaves its
  own DNS empty.
• Cleaner forms — the interface and peer dialogs now show only the required
  fields, with everything optional tucked behind an Advanced settings
  expander.

🐛 Fixed

• Removing a tunnel keeps client peers. Previously it wiped every peer on
  the entry interface, leaving them listed but unreachable (“peer not found on
  interface” when fetching a config). Now only the tunnel’s own gateway/relay
  peers are removed. (Fixes existing setups going forward; peers orphaned by an
  earlier tunnel removal must be re-added — their keys/addresses are still on
  their user records.)
• Actionable deploy errors — the agent deploy now surfaces the real failure
  reason instead of a generic “failed to deploy”.
• More robust server-side download — falls through from curl to wget when
  curl runs but fails (e.g. a curl built without HTTPS support on an https://
  URL), not only when curl is missing.
• Correct agent version tag — the agent now reports a proper vX.Y.Z in
  GET /info and the agent dialog.

📖 Documentation

• The README now covers only the project (overview, architecture, building); all
  install, configuration and feature docs moved into docs/GUIDE.md (English +
  Russian), both rewritten in a consistent style.

📦 Packaging & CI

• Agent binaries are published as raw files, so their release-asset URLs are
  directly deployable.
• Fixed the Linux (webkit2gtk-4.1 + libsoup-3.0) and macOS (.app upload) desktop
  builds.
• Linting is now clean per module.

Downloads

• Desktop app: Windows (.exe + NSIS installer), macOS (.dmg, universal
  Intel/Apple Silicon), Linux binary.
• Standalone server: linux / macOS / Windows archives (amd64 + arm64) and a
  multi-arch Docker image on GHCR.

Full Changelog: v1.0.0...v1.1.0

AWG Admin v1.0.0

An admin tool for managing AmneziaWG/WireGuard servers, the VPN peers connected to them, and the users those peers belong to. One instance manages many servers, each running a small agent that owns the actual interfaces on that box.

Runs two ways from the same codebase:

• Desktop app (Wails) — Windows, macOS, Linux. Local, single-user, no login.
• Self-hosted web server — a small service you host yourself, reachable from a browser (single admin login).

Features

• Servers & one-click deploy — add a server with SSH (key, uploaded key, or password; passphrase-protected keys supported), then Deploy agent over SSH — systemd (kernel/dkms) or Docker (userspace) — with fail-fast pre-checks. Reusable agent-source presets (release URL, local file, or Docker image), with image sources hidden when the server has no usable Docker.
• Interfaces — create/edit/delete AmneziaWG/WireGuard interfaces with addresses, keys and obfuscation parameters filled in for you; an Amnezia tab with generated, editable Jc/S/H/I params; an activate toggle; wg-quick-style hook commands.
• Users & peers — issue/revoke peers per user with ready-to-use client configs and QR codes, optional per-peer DNS/PSK/imported keys, migrate a peer to another interface, and activate/deactivate a peer without deleting it. Input validation catches duplicate/out-of-subnet addresses and name/port/subnet clashes.
• Multi-hop tunnels — a wizard chains a client's entry interface out through a second server, so clients egress through a chosen exit node (shared address pool, policy routing set up for you).
• The agent dialog — one place to operate a server's agent: its reported version and capabilities, deploy, sync, reconcile, the monitoring toggle, and profiling (toggle + download a pprof dump for diagnosing a misbehaving agent).
• Dashboard & metrics — per-server tri-state agent status, agent type/host-info badges, active vs currently-connected peer counts, and CPU/RAM/load/network + per-peer traffic charts.
• Reconcile — diff what the agent actually has against your database and resolve drift (import / delete / re-push).
• Reaching agents — automatic SSH tunnel (resilient reconnect/retry), or direct mTLS on a public IP.
• Backup & migration — export your whole setup to a portable JSON f installs with awg-migrate.
• Fully bilingual (English / Russian); desktop log capture + debug toggle.

Getting it

• Desktop — download for your OS below:
  • Windows: amnezia-admin-amd64-installer_.exe (NSIS) or
  • macOS: amnezia-admin_.dmg (universal). Unsigned — right-click → Open, or xattr -cr "/Applications/Amnezia Admin.app".
  • Linux: the plain binary (needs libgtk-3, libwebkit2gtk-4.1).
• Self-hosted server — the awg-admin archive below, or Docker:
  docker run -d --name awg-admin -p 8080:8080 -v awg-admin-data:/data
• First login is admin / admin — change it immediately under Settings.

Then deploy the agent to each server you want to manage.

AWG Agent 1.0.0

The per-server daemon for Amnezia Admin: it owns the actual AmneziaWG/WireGuard interfaces on a managed server and exposes a small HTTP API (reached over an SSH tunnel or direct mTLS) that the admin app drives. Two builds, Linux only, amd64 + arm64:

• awg-agent — kernel backend (AmneziaWG-dkms / netlink). Needs the amneziawg kernel module for obfuscated interfaces (falls back to plain WireGuard).
• awg-agent-userspace — userspace backend with an in-process amneziawg-go device per interface: no kernel module, no netlink. Runs anywhere with /dev/net/tun, including Docker.

Features

• Two interchangeable backends behind one API — kernel (netlink/dkms) or userspace (in-process amneziawg-go, pinned to the AmneziaWG 2.0 line). The link kind follows the "Amnezia Interface" toggle.
• Full interface lifecycle — PUT | GET | DELETE /interfaces applies the complete device config (keys, listen port, firewall mark, AmneziaWG obfuscation params, peers) via wgctrl, with authoritative peer replacement.
• wg-quick-style hooks — PreUp/PostUp/PreDown/PostDown (sh -c, %i → interface name) for policy routing, iptables and custom routes; Table routing encoded as explicit hooks and reconciled on in-place updates. Device-referencing PreUp hooks run after the link is up, so a tunnel's policy route applies correctly even on an agent restart.
• Activate / deactivate toggles — a disabled interface is torn down (or never raised) with its config kept; a disabled peer is dropped from the live device but retained in config. Startup raises only active interfaces; shutdown tears active ones down.
• Metrics — GET /metrics (CPU/RAM/load/network + per-peer rx/tx/last-handshake; JSON or Prometheus via ?fmt=prom), GET /metrics/history (up to 48h, checkpointed to disk so charts survive a restart), PATCH /metrics to toggle collection at runtime. Gone interfaces/peers are evicted eagerly and reconciled each collection tick.
• Host capabilities — GET /info reports the backend kind, Docker availability, in-container status, kernel-module presence and creatable interface kinds.
• Runtime profiling — GET | PATCH /profiling toggles Go runtime profiling; while on, the standard net/http/pprof endpoints are served (403 until enabled) for goroutine/heap/CPU/trace dumps.
• IPv6 disabled on managed v4 interfaces (best-effort per-interface sysctl), so a tunnel never gets a link-local fe80:: or leaks IPv6.
• Reachability — plain HTTP on loopback (via SSH tunnel), or mTLS on a public IP (AWG_AGENT_TLS_CERT / _KEY / _CLIENT_CA).

Running

AWG_AGENT_ADDR=127.0.0.1:8080 AWG_AGENT_DB=/var/lib/awg-agent ./awg-agent

Or deploy from the admin app (server → Deploy agent). Prerequisites: kernel build needs amneziawg-dkms; userspace needs Docker + /dev/net/tun.

Docker image (userspace agent): ghcr.io/ks-tool/awg-agent-userspace: (multi-arch amd64/arm64).