senn-techDietPi 10.8: WireGuard server and clients with QR code via dietpi-wireguard
DietPi v10.8 came out on 21 October 2026. The most visible addition for home servers and small sites is dietpi-wireguard: a tool that manages WireGuard servers and their clients from a menu or the command line and draws a client config as a QR code in the terminal. The request has been open since September 2019 as issue 3100 and was closed on 3 October 2026. The original request already says "a QR-code is generated for the clients to scan".
This post is based on the release notes, the script in tag v10.8 and one German report. We have not run the tool. So we label what we read in the script (verified), what we conclude from it (inferred) and what the vendor claims (vendor-claimed).
What the tool does
According to the release notes, dietpi-wireguard creates servers and clients, shows client configs as a QR code, disables, enables and removes clients, changes their settings and adjusts the server's port, address and IPv6 settings. The script itself (verified, tag v10.8) knows these subcommands: init, list, add <name>, remove, disable, enable, qr <name>, rename, set, server and cleanup. Options include --endpoint, --dns, --allowed-ips, --keepalive and --psk.
The defaults (verified, script and documentation) are UDP port 51820, interface wg0, server address 10.9.0.1/24 and, for IPv6, a subnet derived from fd10:<n>::1/64. You can set the port ahead of time with SOFTWARE_WIREGUARD_PORT in /boot/dietpi.txt. For clients to connect from the internet, the router has to forward the UDP port to the DietPi system, as the documentation says.
From backup to revocation
The order is our inference from the script, and we have not run it. Backup first, then the update and a check, then server and client.
cp -a /etc/wireguard /root/wireguard-backup-$(date +%F)
dietpi-wireguard list
dietpi-wireguard add phone --endpoint vpn.example.org
dietpi-wireguard qr phone
--endpoint is the server's public hostname or address. If you leave out the port, the script's help says it takes the server's ListenPort. You scan the QR code with the WireGuard app on the phone. It is drawn with qrencode -t ansiutf8, and the qrencode package is installed as a prerequisite together with wireguard-tools. The script warns that the code may not fit into every terminal.
There are two ways to revoke access. disable <name> keeps the peer so you can switch it back on. remove deletes it after a confirmation prompt.
What happens to existing configs
The tool has no database of its own. The script header (verified) says: "Works with the existing configs in /etc/wireguard, without an own database". The server is the file /etc/wireguard/<interface>.conf with its ListenPort, and client names come from file names of the form <interface>-<name>.conf. The release notes say this also applies to servers that were not installed through dietpi-software. linuxnews.de writes that the tool uses the existing configurations under /etc/wireguard.
If you run a hand-built setup, one thing in the script matters (verified). New and changed client configs live in /etc/wireguard/clients/, and configs found in /etc/wireguard/ are moved there when you change them. Disabled peers move out of the server config into /etc/wireguard/<interface>.disabled. Before every change the script copies the server config to .<interface>.conf.bak and deletes that copy after success. The clients directory is created with mode 0700.
From that follows our recommendation (inferred): back up /etc/wireguard, look at ls /etc/wireguard/clients after the first run, and start with dietpi-wireguard list alone to see whether your hand-made peers are recognised. Whether this works cleanly for every custom setup is untested. That it works well is a vendor claim.
Changes to dietpi-software and IPv6
dietpi-software now creates the WireGuard server with dietpi-wireguard init and no longer creates a client. The documentation says: "No client configuration is created during the installation." If you were used to finding a client config right after installation, you now create the first client yourself with add.
According to the release notes, new servers get an IPv6 subnet (NAT66) and IPv6 forwarding so clients can use IPv6 through the tunnel, which the previous config did not allow. Existing servers can be switched over with dietpi-wireguard, for example dietpi-wireguard server ipv6=on. linuxnews.de reports the same. After a change to the subnet or IPv6, clients have to import their config again, which the script's help states. Turning IPv6 off in dietpi-config also turns it off for the WireGuard servers, because they could not start otherwise.
The QR code is a secret
The script strips only comments from the QR code content (verified). A normal client config contains the client's private key, so the key is in the code (inferred). Do not show the code on a shared screen, paste it into a ticket or send it to a chat group. Whoever holds a code can connect as that client until the peer is blocked with disable or remove.
What else is in the release
If you run DietPi in production, read the full release notes before moving to 10.8. HAProxy is now a DietPi-built DEB package, the workers run as user haproxy, and an existing /etc/haproxy/haproxy.cfg is left alone. According to the release notes, the package upgrade also reaches users who installed HAProxy earlier from Debian with apt instead of through dietpi-software. There are also software names instead of numbers (nodered instead of 122; numbers still work) and dietpi-software free is gone. Immich-ML no longer supports Debian Bookworm and Forky.
If you run WireGuard on a Raspberry Pi or a small server, dietpi-wireguard bundles several manual steps into one tool. It is three days old, so there is no field experience yet. Try it on a copy of the system first, and only then on the server that gives field staff or a home office access to the network.
Further sources
- DietPi v10.8, release notes on GitHub: dietpi-wireguard, IPv6, HAProxy, software names
- DietPi v10.8 on dietpi.com: release page with date
- DietPi documentation: VPN: default port 51820, port forwarding, no client config at install
- dietpi-wireguard script in tag v10.8: commands, file paths, QR code
- Feature request: issue 3100: open since 2019
- linuxnews.de: DietPi 10.8 brings new WireGuard management: existing configs, IPv6, NAT66
- Wikimedia Commons: DietPi logo: logo, CC BY-SA 4.0, author MichaIng
- Wikimedia Commons: WireGuard logo: logo, public domain
What is dietpi-wireguard and when did it appear?+
dietpi-wireguard is a new tool in DietPi v10.8, released on 21 October 2026. According to the release notes it manages WireGuard servers and their clients from a menu or the command line: create servers and clients, show client configs as a QR code, disable, enable and remove clients, and change the server's port, address and IPv6 settings.
Does dietpi-wireguard work with a WireGuard server I set up by hand?+
According to the release notes, yes: the tool works with the existing configs in /etc/wireguard, including servers that were not installed through dietpi-software. We have not tested it. The script shows that changes move client configs to /etc/wireguard/clients/ and that disabled peers go into a .disabled file. Back up /etc/wireguard first.
Why does the QR code count as a secret?+
The QR code contains the complete client config, and the script only strips comments. It follows (inferred) that the client's private key is inside the code, as in any normal client config. Keep the QR code off shared screens and out of tickets.