The self-hosted WireGuard dashboard you actually want to use.
Manage multiple VPN interfaces, control every peer, monitor live traffic, and enforce bandwidth policies — all from a single beautiful web UI. No CLI. No config files. No bullshit.
Most WireGuard UIs are glorified config file editors. Velar is a full management platform — built for people who run real infrastructure and want a proper interface to go with it.
- Multi-interface — run separate VPN networks on the same server, isolated
- Multi-instance federation — link remote Velar nodes as slaves; manage all clients, interfaces, and traffic from one master UI
- Production-grade security — JWT in memory, httpOnly cookies, AES-256 key encryption, TOTP
- Batteries included — AdGuard Home, bandwidth limiting, LAN access, email notifications, one-time config links
- Zero dependencies — SQLite, Docker, done
Create and manage multiple WireGuard interfaces independently — each with its own port, subnet, DNS, keys, and peer list. Bring interfaces up/down with one click. Velar writes and syncs .conf files automatically.
Add, edit, disable, or delete VPN clients in seconds. No key management by hand — Velar generates keypairs, preshared keys, and assigns IPs automatically. Every change is live.
Live stats per peer via WebSocket — bytes transferred, last handshake time, connection status dot. The dashboard updates continuously without page refresh.
Cap download and upload independently per peer using Linux tc (traffic control). Set a 10 Mbps download limit on one client while leaving another unlimited. Limits survive interface restarts and are enforced at the kernel level.
↓ Download— shapes egress via HTB qdisc (server → client)↑ Upload— polices ingress (client → server) with packet drop on excess- Configurable per client from the dashboard, applied instantly
Enable local network access per interface with one click. Velar detects your host's LAN subnet automatically and switches all clients to split-tunnel mode (VPN subnet + LAN subnet instead of 0.0.0.0/0). Connect to your VPN from anywhere and still reach 192.168.1.x devices.
- QR code — scan with the WireGuard app, connected in 10 seconds
- Config viewer — read the full
.confin the UI and copy it with one click - One-time download links — share a single-use, time-limited URL that delivers the config without requiring login
- Email delivery — send the config or a download link directly to the client's inbox
Every admin-initiated change is recorded and searchable. The Audit Log page gives you a full, timestamped trail of what happened and who did it:
- Complete coverage — client create/update/delete/enable/disable, interface up/down/create/delete, backup export/restore, API token lifecycle, TOTP changes, password changes, sync operations
- Federation-aware — mutations made through the slave proxy are logged on the master with inferred action names (e.g.
slave.interface.up,slave.client.delete) - Server-side search — free-text search across action, target name, and detail; prefix-based category filter (Clients, Interfaces, Instances, Slave, Admin, Backup, Tokens)
- Colour-coded action badges — distinct colour per action type for instant visual scanning
- Admin attribution — every entry shows which admin performed the action
- Configurable page size — 10 / 20 / 30 / 50 / 100 entries per page
- TOTP two-factor authentication (Google Authenticator, Aegis, any TOTP app)
- WireGuard private keys encrypted at rest with AES-256-GCM
- JWT access tokens kept in memory only — never written to
localStorage - httpOnly refresh cookies — immune to XSS token theft
- bcrypt password hashing + forced password change on first login
- Rate limiting on login, API token creation, and slave proxy endpoints
- WebSocket
Originheader validation — only connections fromCORS_ORIGINare accepted
Manage AdGuard Home directly from Velar, for both master and all federated slave nodes from a single UI:
- Blocklists — add, remove, enable/disable filter lists, force refresh
- Custom rules — write and save DNS block/allow rules
- DNS rewrites — map domains to custom answers
- Protection toggles — Safe Browsing, Parental Control, per-engine Safe Search
- Service blocking — browse all services grouped by category (Social, Streaming, Gaming, AI, …), toggle individually or Block all / Unblock all per category
- Pull from AdGuard — re-sync the Velar UI with the live AdGuard state at any time
- AdGuard federation — enable AdGuard per slave and optionally turn on auto-sync to push master's config to slaves every 5 minutes (filters, rules, rewrites, services, protection settings)
- Dashboard aggregate — see total DNS queries, blocked requests, and per-instance block rate at a glance on the dashboard
- DNS preset selector — Cloudflare, Google, Quad9, or your own
- DDNS support — auto-tracks your public IP
- Per-interface connectivity checker — verifies the interface is UP and the UDP port is bound
- Dark mode by default, switchable to light — preference persisted, no flash on reload
- Fully mobile-responsive — bottom nav bar on small screens with a "More" drawer for secondary pages; drill-in navigation on the Instances page; compact adaptive headers on all management pages
- Thin themed scrollbar, smooth transitions, shadcn/ui component system
- Live connection indicator in the nav
Set a monthly, weekly, or total data cap per client. Enforcement is handled by Linux nftables at the kernel level — packets are dropped the instant the budget is exhausted, with zero overshoot. Velar sends warning emails at 80% usage and on suspension, and re-enables the peer automatically when the quota is raised or reset. Usage is tracked across server restarts.
Run Velar on multiple servers and manage them all from a single master interface. Register remote nodes as slaves — full client/interface management, live stats, traffic totals, and event feeds are federated into one unified dashboard. Each slave runs a stripped, token-secured API with no web UI. The master handles all email delivery on behalf of slaves (download links, portal links, lifecycle notifications). See the Federation Guide →.
Select multiple clients and enable, disable, or delete them in one action — no clicking through each card individually.
- SQLite — single file, zero infrastructure, easy backup
- Backup & Restore — export all interfaces and clients as a JSON file; restore onto any Velar instance. Keys are never exported — fresh WireGuard keypairs are generated on restore and clients are notified by email automatically.
- Subnet editing with automatic client IP re-allocation (preserves host offset)
WG_MOCK=truemode for development without root/WireGuard
git clone https://github.com/AlexArtaud-Dev/Velar.git && cd Velar
cp .env.example .env
# Set WG_HOST (your public IP) and APP_SECRET (openssl rand -hex 32)
nano .env
docker compose up -dOpen http://your-server-ip → login with admin + the temporary password from:
docker compose logs api | grep -i passwordYou'll be forced to change it on first login.
For full setup instructions including WireGuard kernel setup, port forwarding, DDNS, and reverse proxy configuration, see the Installation Guide →
| Layer | Technology |
|---|---|
| Backend | Go 1.22, Gin, GORM, SQLite |
| Frontend | React 18, TypeScript, Vite, Tailwind CSS, shadcn/ui |
| Auth | bcrypt, JWT, httpOnly cookies, TOTP |
| VPN | WireGuard, wg-quick |
| Bandwidth | Linux tc (HTB + ingress police) |
| Quotas | Linux nftables (named quotas, kernel-level enforcement) |
| DNS | AdGuard Home |
| Runtime | Docker, Docker Compose |
| Document | Description |
|---|---|
| Installation Guide | Server setup, Docker, first login, port forwarding |
| Configuration Reference | All environment variables explained |
| Federation Guide | Multi-instance slave setup, master registration, email routing |
| Architecture | How Velar works internally, request flow, services |
| Bandwidth Limiting | How tc-based shaping works, limits and caveats |
| Data Quotas | nftables kernel-level quota enforcement, periods, suspension flow |
| LAN Access | Split-tunnel setup, subnet detection, requirements |
| Reverse Proxy | Nginx, Caddy, SWAG + Authelia examples |
| Troubleshooting | Common issues and fixes |
Proprietary software — source available for personal self-hosting only. Redistribution or commercial use requires written permission. See LICENSE · Contact: smlartaudalexandre@gmail.com