Editing WireGuard

= WireGuard =

== Key Management (wg) ==

The `wg` utility provides everything required to generate and manage WireGuard key material.

=== Generate a Private Key ===

Generate a new private key:

<pre>
wg genkey
</pre>

Save it to a file:

<pre>
wg genkey > private.key
</pre>

=== Derive a Public Key ===

A WireGuard public key is always derived from the private key.

Generate the corresponding public key:

<pre>
wg pubkey < private.key
</pre>

Save it:

<pre>
wg pubkey < private.key > public.key
</pre>

=== Generate a Key Pair ===

Generate both the private and public key in one command:

<pre>
wg genkey | tee private.key | wg pubkey > public.key
</pre>

=== Generate a Preshared Key (PSK) ===

Generate a new preshared key:

<pre>
wg genpsk
</pre>

Save it:

<pre>
wg genpsk > psk.key
</pre>

=== Notes ===

* Every WireGuard interface has a single '''private/public key pair'''.
* Every peer has its own '''public key'''.
* A '''PresharedKey''' is optional and unique per peer.
* Public keys are deterministic and can always be regenerated from the private key.
* Only the private key must remain secret.
* Public keys are safe to share.
* PSKs must be configured identically on both peers.