WireGuard bar widget

[glafeara]

Hi all,

I'd like to share a bar plugin: glafeara.wireguard — a WireGuard widget for the Omarchy bar.

Preview:

Repo: https://github.com/glafeara/omarchy-wireguard

Install:

omarchy plugin add https://github.com/glafeara/omarchy-wireguard.git

omarchy plugin enable glafeara.wireguard

omarchy bar plugin add glafeara.wireguard right

What it does:

• Bar icon shows connection state; left click opens the panel, right click disconnects (or opens the panel when nothing is up), middle click refreshes.
• The panel lists every WireGuard connection NetworkManager knows about, with full keyboard navigation.
• Import .conf files via a file picker or from the clipboard; edit an existing tunnel as wg-quick-style text.
• Switching is exclusive: the tunnel you pick comes up, every other WireGuard tunnel goes down. Wifi, ethernet and tailscale are never touched.
• IPC commands (status, toggle, down, importConfig, …) via omarchy-shell.

No sudo, no root shell. Everything goes through NetworkManager over D-Bus, authorized by polkit — no sudoers rules, no password prompts. And unlike wg-quick, NetworkManager never executes PreUp/PostUp hooks, so a config is data, not code: importing a malicious config can't run commands. Every incoming config is validated key by key before import; a rejected import changes nothing.

The whole thing is three QML files and one shell script, MIT-licensed — no install scripts, no services, no network calls of its own.

I'll be glad if this is useful to someone.

[glafeara]

A few things I ran into building this — might save someone time, whether you're scripting nmcli or writing your own bar plugin.

1. How I ended up on NetworkManager. v1 did the obvious thing: sudo wg-quick up through a sudoers rule. The price was a passwordless root rule living on the system forever, just to flip a tunnel. Worse, wg-quick runs shell hooks from the config — so an imported config is code running as root, and one malicious .conf is game over. Turns out NetworkManager already solves this: it speaks WireGuard natively, and on stock Omarchy a logged-in user can manage networking without a password. So v2 deleted the sudoers rule, and configs went back to being data instead of code.

2. nmcli connection import auto-activates the tunnel — the last thing you want for a file you just downloaded. So I wrote my own importer that builds the profile with autoconnect off. Nothing connects until you say so.

3. Keep secrets out of argv. Command-line arguments are visible to every process on the system, so private keys go in via stdin. Catch: nmcli connection edit reports success even when it silently failed, so the backend reads the values back to verify they were actually stored.

4. Real validation. Every key in an incoming config is checked with wg pubkey, which catches the truncated base64 you get from copy-paste. Hook directives are rejected outright: they'd never run with this backend, and silently dropping them would lie about what the tunnel does.

5. Names aren't identifiers. NetworkManager happily allows several connections with the same name, so internally everything is addressed by UUID, and commands refuse to guess when a name is ambiguous. Also, the kernel caps interface names at 15 characters — provider files like US-New York 03.conf need a rename on import.

6. Multi-monitor races. The bar runs one widget instance per monitor, so two connects can race each other. All mutating commands go through a lock.

7. Editing a live tunnel safely. Saving an edit rebuilds the profile — the old one is deleted only once the new one fully works, so a failure never leaves you with nothing.

8. DNS. wg-quick makes tunnel DNS exclusive by default; in NetworkManager that's a negative dns-priority. Easy to miss, and missing it means DNS leaks.