New hub

For a hub that has no WireGuard interface yet. If wg0 already runs under wg-quick or WGDashboard, follow Migration instead.

1. Host firewall and forwarding

cerberd doesn’t touch forwarding, the firewall or NAT. Set them up in the host configuration so they don’t depend on wg0 existing:

echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/90-wireguard.conf && sysctl --system
# allow UDP <listen_port> in, and forwarding between wg0 and wherever spokes go,
# in nftables / iptables-persistent

2. Configuration

install -m640 -g cerberd /etc/cerberd/wg0.yaml.example /etc/cerberd/wg0.yaml
$EDITOR /etc/cerberd/wg0.yaml

The file name is the interface: /etc/cerberd/wg0.yaml configures wg0. The minimum is hub.overlay; set hub.endpoint too so generated spoke configs are complete:

hub:
  overlay: 10.99.0.0/24             # peers get /32s inside; the hub takes the first host
  listen_port: 51820
  endpoint: hub.example.net:51820   # written into spoke configs
client:
  allowed_ips: [10.0.0.0/8]         # what spokes route to the hub
  keepalive: 25

All keys and defaults: Configuration.

3. Database and hub key

cerberd init wg0
# created /var/lib/cerberd/wg0.db
# hub public key: ...

init generates the hub’s private key and stores it in the database. To keep an existing key, pass --private-key-file /path/to/key. It refuses to overwrite an existing database.

4. Start

systemctl enable --now cerberd@wg0
cerberd status

cerberd creates wg0, sets its key, port, MTU and address, and brings it up.

5. Add peers

cerberd overlay free 10.99.0.0/24              # a free address, e.g. 10.99.0.2/32
cerberd peer add laptop --ip 10.99.0.2/32      # generates the key pair
cerberd peer config laptop > laptop.conf       # wg-quick config for the client

cerberd peer add site-a --ip 10.99.0.3/32 --ip 10.210.1.0/24 --routeros
cerberd peer config site-a --format routeros   # RouterOS script for the spoke

Optional: TCP API

To manage peers from another machine, enable the token-protected TCP listener. See REST API → Authentication.