DEV Community

Cover image for Introducing islandr: Self-Hosted WireGuard Access Management Without the SaaS Tax
Chris
Chris

Posted on

Introducing islandr: Self-Hosted WireGuard Access Management Without the SaaS Tax

#wireguard #selfhosted #homelab #vpn

I've used WireGuard on my homelab for years, mostly through PiVPN — run a command, add a peer, hand someone a QR code. Raw WireGuard is excellent, but PiVPN gets you tunnels, not access control. Past two or three peers the real problem shows up: who has what keys, who's authorized to reach what, who do you revoke when someone leaves?

The market answer is: pay for Tailscale, or wrestle with a complex self-hosted stack. Neither sat right — I didn't want my traffic routed through someone else's control plane, and I didn't want a Kubernetes-grade setup for a dozen peers.

So I built islandr.

The Problem with Existing Options

If you've tried to self-host WireGuard management, you know the landscape:

  • Tailscale / Headplane / NetBird: great UX, but SaaS-dependent or still complex to operate
  • Headscale: solid, but requires separate ACL tooling and has a learning curve
  • WireGuard alone: you end up maintaining handcrafted config files and a mental model of who-has-what

What I wanted was straightforward: a single binary I could drop on a €1 VPS, point at WireGuard, and get user management, group-based ACLs, and a self-service portal — with zero cloud dependency.

islandr is that binary.

What islandr Does

islandr runs as a hub-and-spoke VPN manager. Your public VM (the hub) runs both WireGuard and islandr. Peers — road warriors, home devices, site gateways — connect to the hub through encrypted tunnels.

islandr hub dashboard — peers, status, and live topology

On top of that, islandr gives you:

  • User accounts with local auth or OIDC (Microsoft 365 or Google — one provider active at a time)
  • Group-based ACLs with per-port resource rules, enforced via nftables
  • Self-service portal — users enroll their own devices, download configs, scan QR codes, rotate keys, no admin required for routine tasks
  • Device discovery — scan a site's own CIDR to map what's reachable and adopt real hosts as resources in one click
  • Browser-based RDP via IronRDP WebAssembly, directly in the UI
  • Geo map — a world map dashboard tab showing where your gateways and sites actually are
  • Audit logging, config import/export, bulk operations

Self-service portal — a user enrolling a device and downloading its config by QR code

It's targeted at teams of 5–50 people or serious homelabbers who've outgrown flat key distribution but don't need enterprise mesh networking.

Getting Started

Two ways in: install the native binary on a Linux box with WireGuard and nftables for full enforcement, or docker run the container to click around the UI first (enforcement runs degraded without the host socket proxy — details in the install guide).

ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
curl -fsSL "https://github.com/chriscohnen/islandr/releases/latest/download/islandr-runner-linux-${ARCH}" -o /tmp/islandr
sudo install -m 0755 /tmp/islandr /usr/local/bin/islandr
Enter fullscreen mode Exit fullscreen mode

From the UI you create a WireGuard interface, add users and groups, generate peers with QR-code enrollment, and wire up ACL rules — WireGuard config and nftables rules are applied automatically as you go.

Group-based ACL matrix — which groups reach which resources, applied atomically

Under the Hood

islandr is built with:

  • Quarkus 3 + Java 21 — fast startup, native-compilable via GraalVM
  • SQLite (lab/single-node) or PostgreSQL (production)
  • Vue 3 on the frontend, served as ES modules — no npm build pipeline, no node_modules to manage
  • Direct wg and nft CLI invocation — islandr drives the tools you already trust, it doesn't replace them

The native GraalVM binary starts in milliseconds and runs comfortably on ARM64 (Raspberry Pi, Ampere VMs) as well as x86_64.

Current Status

islandr is at v0.15.1, early access. Core functionality is complete and in daily use — I'm treating this release as a hardening and feedback phase before a stable 1.0. Beyond what's covered above, that includes built-in TLS with automatic Let's Encrypt certs and a connection activity heatmap so a device gone quiet stands out at a glance.

Actively working on: documentation depth, edge case hardening, and a stable API contract.

Try It

If you've been running WireGuard the hard way and wanted a management layer that stays on your infrastructure, give islandr a try. It's the tool I wanted to find before I had to build it.

Top comments (0)