xyz.sh adds no telemetry and performs no hidden actions. Read the full source on the page or download it with curl -fsSL xyz.sh/ .sh first; every script has a / .sh.sha256 checksum. Piping a remote script to bash is still a risk — review the source first. Private keys are generated locally and stored in /etc/wireguard (mode 600); nothing is uploaded. If the default route's source address is private, api.ipify.org is queried once after a notice; use --endpoint to avoid it.

Which operating systems are supported?

Declared support: Debian 11+, Ubuntu 20.04+, Rocky 9, and AlmaLinux 9. The script detects the distribution and warns on an unknown one. It was tested in Docker containers of these systems (syntax, --dry-run, and whatever can run in a container; see tests/RESULTS.md); parts that need systemd, kernel modules, or the public internet still need a real VPS.

Yes. Run it as root or via sudo bash; it exits with a message otherwise. --dry-run and --status show what it would do first.

Does it work on OpenVZ / LXC?

WireGuard needs a kernel module. OpenVZ and most LXC containers cannot load one, so wg-quick fails; use a KVM (full virtualisation) VPS.

WireGuard Server Setup Tutorial

This tutorial shows how to set up a WireGuard server on a VPS with xyz.sh/wireguard and connect clients.

Prerequisites

A KVM (full virtualisation) VPS with a 5.6+ kernel or the distro's WireGuard module, and root.

Allow UDP 51820 (or your chosen port) in the security group.

Follow local law and your provider's terms.

Steps

Optional: read the source with curl -fsSL xyz.sh/wireguard.sh and compare xyz.sh/wireguard.sh.sha256.

Install and create the first client: curl -fsSL xyz.sh/wireguard | bash -s -- -y

On a phone, install the WireGuard app and scan the QR code; on a computer import /etc/wireguard/clients/client1.conf.

Add clients: curl -fsSL xyz.sh/wireguard | bash -s -- --add-client laptop -y

Custom port, hostname or DNS: --port 51820 --endpoint vpn.example.com --dns 1.1.1.1

How to verify

Run wg show to see the interface and peer handshakes; latest handshake updates once a client connects. Or curl -fsSL xyz.sh/wireguard | bash -s -- --status.

How to undo or uninstall

curl -fsSL xyz.sh/wireguard | bash -s -- --uninstall -y stops wg-quick@wg0 and removes the xyz.sh-generated configs in /etc/wireguard and 99-xyz-wireguard.conf; the wireguard-tools package is kept.