Owns the hub
One daemon per WireGuard interface, like wg-quick. It creates wg0, holds
its key and applies per-peer diffs. Stopping it leaves wg0 forwarding.
cerberd
A WireGuard controller for a Linux hub. It owns the hub interface, keeps peers in SQLite behind an HTTP API, and builds direct links between MikroTik spokes so their traffic can skip the hub.
Peers in a database
Names, keys, overlay and LAN reservations, tags and blocked state live in SQLite. You edit them with the CLI or the HTTP API, with conflict checks.
Direct links
cerberd drives RouterOS spokes over REST and punches direct WireGuard links between them. The hub path stays as the fallback.
Import from wg-quick
It adopts an existing wg-quick or WGDashboard hub without downtime: keys, names, groups as tags, restricted peers as blocked.
Where to start
Section titled “Where to start”- New here: Overview explains the model in two minutes.
- Setting up a hub: Installation, then New hub or Migrate from wg-quick / WGDashboard.
- Running one: Peers, Direct links, Upgrades.
- Integrating: REST API.