Introducing islandr: Self-Hosted WireGuard Access Management Without the SaaS Tax

Chris — Tue, 04 Aug 2026 15:03:15 +0000

I've used WireGuard on my homelab for years, mostly through PiVPN — run a command, add a peer, hand someone a QR code. Raw WireGuard is excellent, but PiVPN gets you tunnels, not access control. Past two or three peers the real problem shows up: who has what keys, who's authorized to reach what, who do you revoke when someone leaves?

The market answer is: pay for Tailscale, or wrestle with a complex self-hosted stack. Neither sat right — I didn't want my traffic routed through someone else's control plane, and I didn't want a Kubernetes-grade setup for a dozen peers.

So I built islandr.

The Problem with Existing Options

If you've tried to self-host WireGuard management, you know the landscape:

Tailscale / Headplane / NetBird: great UX, but SaaS-dependent or still complex to operate
Headscale: solid, but requires separate ACL tooling and has a learning curve
WireGuard alone: you end up maintaining handcrafted config files and a mental model of who-has-what

What I wanted was straightforward: a single binary I could drop on a €1 VPS, point at WireGuard, and get user management, group-based ACLs, and a self-service portal — with zero cloud dependency.

islandr is that binary.

What islandr Does

islandr runs as a hub-and-spoke VPN manager. Your public VM (the hub) runs both WireGuard and islandr. Peers — road warriors, home devices, site gateways — connect to the hub through encrypted tunnels.

On top of that, islandr gives you:

User accounts with local auth or OIDC (Microsoft 365 or Google — one provider active at a time)
Group-based ACLs with per-port resource rules, enforced via nftables
Self-service portal — users enroll their own devices, download configs, scan QR codes, rotate keys, no admin required for routine tasks
Device discovery — scan a site's own CIDR to map what's reachable and adopt real hosts as resources in one click
Browser-based RDP via IronRDP WebAssembly, directly in the UI
Geo map — a world map dashboard tab showing where your gateways and sites actually are
Audit logging, config import/export, bulk operations

It's targeted at teams of 5–50 people or serious homelabbers who've outgrown flat key distribution but don't need enterprise mesh networking.

Getting Started

Two ways in: install the native binary on a Linux box with WireGuard and nftables for full enforcement, or docker run the container to click around the UI first (enforcement runs degraded without the host socket proxy — details in the install guide).

ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
curl -fsSL "https://github.com/chriscohnen/islandr/releases/latest/download/islandr-runner-linux-${ARCH}" -o /tmp/islandr
sudo install -m 0755 /tmp/islandr /usr/local/bin/islandr

From the UI you create a WireGuard interface, add users and groups, generate peers with QR-code enrollment, and wire up ACL rules — WireGuard config and nftables rules are applied automatically as you go.

Under the Hood

islandr is built with:

Quarkus 3 + Java 21 — fast startup, native-compilable via GraalVM
SQLite (lab/single-node) or PostgreSQL (production)
Vue 3 on the frontend, served as ES modules — no npm build pipeline, no node_modules to manage
Direct wg and nft CLI invocation — islandr drives the tools you already trust, it doesn't replace them

The native GraalVM binary starts in milliseconds and runs comfortably on ARM64 (Raspberry Pi, Ampere VMs) as well as x86_64.

Current Status

islandr is at v0.15.1, early access. Core functionality is complete and in daily use — I'm treating this release as a hardening and feedback phase before a stable 1.0. Beyond what's covered above, that includes built-in TLS with automatic Let's Encrypt certs and a connection activity heatmap so a device gone quiet stands out at a glance.

Actively working on: documentation depth, edge case hardening, and a stable API contract.

Try It

GitHub: github.com/chriscohnen/islandr — source, releases, and issue tracker
Homepage: islandr-gateway.net — overview and deployment docs
Feedback: open an issue or reach out directly — early adopter input shapes what gets built next

If you've been running WireGuard the hard way and wanted a management layer that stays on your infrastructure, give islandr a try. It's the tool I wanted to find before I had to build it.