Algo VPN: Ansible Scripts That Build a Personal WireGuard and IPsec Server
Set up a personal VPN in the cloud
At a glance
- What is it?
- Algo is a set of Ansible playbooks that provision a personal VPN on a cloud VM you control, supporting WireGuard and IKEv2 only. It is a deployment tool, not a hosted service, and its config is treated as write-once.
- Who is it for?
- Adopt Algo if you want a personal WireGuard or IKEv2 endpoint on a cloud VM you own and are comfortable running Ansible from a local machine. Do not adopt it if you need OpenVPN, IKEv1, L2TP, or anonymity guarantees, since the README lists those as unsupported.
- Can I use it commercially?
- Yes, with strict conditions. AGPL-3.0 is a network copyleft licence: if people use a modified version over a network, for example as a hosted service, you must offer them its source code under the same licence.
- Is it still maintained?
- Yes. The repository last received commits 7 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The Problem Algo Solves: A VPN Endpoint You Own, Not One You Rent
Algo targets a specific gap. If you want a VPN endpoint that you control rather than a commercial subscription, you have to provision a cloud VM, install and configure WireGuard or strongSwan, generate per-device credentials, and keep the host patched. Algo is the automation layer for that work. The README describes it as "a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN." The intended user is someone with a cloud account and basic command-line familiarity, not a network engineer. The scripts run from your local system and create a new virtual machine on the provider you pick, then configure it. The README explicitly frames it as privacy-focused rather than anonymity-focused, and lists as an anti-feature any claim to protect you from state intelligence services. That framing matters: this is a tool for owning your traffic path, not for hiding that you have one.
How the Ansible Playbooks Build the Server
The mechanism is a local Ansible run against a freshly created cloud instance. You supply cloud credentials and a provider choice, and the playbooks create the VM, install the VPN software, generate a certificate authority and per-user credentials, and write client configuration files back to your local machine. The README states the result is based on Ubuntu 22.04 LTS with automatic security updates enabled. Two protocols are supported. WireGuard is offered for iOS, macOS, Linux, Android, and Windows 11. IKEv2 with strong crypto (AES-GCM, SHA2, and P-256) is offered for iOS, macOS, and Linux only. For Apple devices, Algo generates profiles that auto-configure iOS and macOS for IPsec with no client software required, and it also generates WireGuard .conf files and QR codes. Output lands in a configs directory, in a subdirectory named with the server's IP address. The server also runs a local DNS resolver at 172.16.0.1, which the README notes can optionally block ads. Shell access is exposed through a generated SSH config: ssh -F configs/<server_ip>/ssh_config <hostname>.
Running It: config.cfg, ./algo, and the PKI Prompt
Deployment starts with a cloud account on a supported provider. The README lists DigitalOcean, Amazon Lightsail, Amazon EC2, Vultr, Microsoft Azure, Google Compute Engine, Scaleway, DreamCompute, Linode, OpenStack-based hosts, CloudStack-based hosts, and Hetzner Cloud, plus your own Ubuntu server for advanced users via a separate document. You then clone the repository with git clone https://github.com/trailofbits/algo.git, or download the ZIP, which unzips to a directory named algo-master. Configuration happens in config.cfg, where you specify the users you want to create in the users list. The README advises creating a unique user for each device. Deployment is then a single command: ./algo on macOS and Linux, or .\algo.ps1 on Windows, where the PowerShell script uses WSL because Ansible requires a Unix-like environment. On first run the script installs a Python environment (Python 3.11 or later); later runs start immediately. One prompt deserves attention. For IPsec, if you want to add or delete users later, the README says you must answer yes to "Do you want to retain the keys (PKI)?" during deployment, because that preserves the certificate authority needed for user management.
Configuration Is Close to Write-Once
The most consequential limitation is stated in the deployment steps rather than in a limitations section. The README warns that you should review configuration options before deployment, because changing your mind about them later "may require you to deploy a brand new server," pointing to an FAQ entry. That is a real operational cost. Optional features such as the ad-blocking DNS resolver and limited SSH users for tunneling are selected during the run, and the README describes them as optional and not required for a fully functional VPN server. The practical consequence is that Algo suits a stable personal setup better than an environment where requirements shift. A second constraint is protocol scope. The anti-features list rules out L2TP, IKEv1, and RSA, and says Algo does not install Tor, OpenVPN, or "other risky servers." If a client device only speaks OpenVPN, Algo will not serve it. A third is credential handling: the post-deployment banner prints p12 and SSH key passwords and the CA key password, and the README tells you to secure the configs directory because it contains private keys. Those files are the deployment's secrets, and their safety is your responsibility.
Where Algo Does Not Fit: Client Compatibility and Anonymity
Two cases make Algo the wrong tool. The first is client compatibility. The supported set is WireGuard on iOS, macOS, Linux, Android, and Windows 11, and IKEv2 on iOS, macOS, and Linux. A router or appliance that only supports OpenVPN or IKEv1 is out of scope, and the README treats that as deliberate rather than a gap to be filled. The second is threat model. The anti-features section states plainly that Algo does not claim to provide anonymity or censorship avoidance. Anyone choosing a VPN to obscure their identity or to route around network filtering is looking at the wrong project, and the maintainers say so before you deploy. A third consideration is operational: because the scripts run from your local machine against a cloud API, you need working credentials for that provider and a machine with Python 3.11 or later, or WSL on Windows. Algo is not a managed service, and nothing in the README suggests a hosted control plane.
Compared with WireGuard's Own Tooling
The obvious alternative is installing WireGuard directly with wg-quick and a hand-written server config. The difference is what each one automates. WireGuard's own tooling gives you the tunnel and expects you to handle key generation, peer management, firewall rules, and OS updates yourself. Algo wraps that in Ansible and adds the surrounding work: cloud VM creation across a list of providers, a certificate authority for IKEv2, generated client profiles and QR codes, helper scripts to add, remove, and manage users, a local DNS resolver, and automatic security updates on Ubuntu 22.04 LTS. The trade is control. A hand-rolled wg-quick setup lets you change any parameter at any time; Algo's config.cfg is closer to a one-time declaration, and the README warns that later changes may require a new server. If you want a single protocol and full manual control, plain WireGuard is simpler. If you want IKEv2 profiles for Apple devices plus WireGuard configs from one run, Algo covers both.
Maintenance, Licensing, and What to Verify First
Algo is licensed AGPL-3.0, which is a copyleft licence with network-use provisions. If you modify the scripts and offer the modified version as a network service, the licence terms are likely to apply to your modified source. This is a general description, not legal advice; read the licence text if your use is commercial. On maintenance, the repository is not archived and the release history shows v2.0.0 in August 2025 and v2.0.1 in November 2025, after a long gap following v1.1 in 2019, so the 2.x line is the current one. The server side is pinned to Ubuntu 22.04 LTS with automatic security updates, which shifts patching to the distribution but leaves you responsible for re-running Algo or rebuilding when you want configuration changes. Before deploying, verify three things: that your chosen provider appears in the supported list, whether you need to answer yes to the PKI retention prompt for later IPsec user management, and that the users list in config.cfg has one entry per device you plan to connect.
Editorial conclusion
Adopt Algo if you want a personal WireGuard or IKEv2 endpoint on a cloud VM you own and are comfortable running Ansible from a local machine. Do not adopt it if you need OpenVPN, IKEv1, L2TP, or anonymity guarantees, since the README lists those as unsupported. Before deploying, verify that your provider is on the supported list, confirm you can retain the PKI at the prompt if you plan to add IPsec users later, and check whether the users list in config.cfg matches the devices you actually intend to connect.
Community notes