# wireguird: a Linux tray client for WireGuard that drives wg-quick

> wireguird is a GTK client for Linux that lists WireGuard tunnels from /etc/wireguard, brings them up and down, and shows connection state in the system tray, with the red and black indicator the official Windows client uses. It is a Go application built with gotk3 and packaged as a Debian package.

**UnnoTed/wireguird** — wireguard gtk gui for linux

- Repository: https://github.com/UnnoTed/wireguird
- Stars: 1,036 · Forks: 76
- Language: Go
- License: MIT
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/unnoted-wireguird

## What it does, and what it deliberately does not do

wireguird is a Linux GTK GUI client for WireGuard, and the feature list is four items long.

The system tray icon goes red when connected and black when disconnected. It looks the same and does almost the same things as the official WireGuard Windows GUI client. It lists tunnels from `/etc/wireguard`. And it controls WireGuard through `wg-quick`.

That last point is the one that shapes the whole tool, and the project has been explicit about it, with the earlier wording struck through and replaced. Driving the tunnels through `wg-quick` means the client is a front end for a tool you already have rather than a second implementation of the tunnel lifecycle. That is a small design decision with large practical consequences. `wg-quick` is the script that reads a `.conf` file in `/etc/wireguard`, sets up the interface, configures the routing, and tears it back down, and it handles the details that are easy to get subtly wrong, such as the DNS handling and the route cleanup on shutdown.

The consequence is that the client works with the configurations you have already written, with no separate format and no import step. The cost is that the client inherits `wg-quick`'s behaviour, including its requirements, which is why the build and install instructions call out `resolvconf` as a dependency.

The tray icon convention is deliberately borrowed from the Windows client, and the red and black choice is a system convention rather than a decorative one.

The project is MIT licensed, written in Go, and the last push to the repository was on 2026-05-02, with the newest release v1.1.0 from 2023-09-30.

## The GTK stack, and the wgctrl library underneath

The dependency list is where you can see what kind of application this is.

`github.com/gotk3/gotk3` at 0.6.1 is the Go binding for GTK 3, which is the toolkit choice. `github.com/UnnoTed/go-appindicator` is the author's own AppIndicator library, and that is the piece that makes the system tray work, since GTK on Linux does not have a portable tray API and the AppIndicator specification is how desktop environments agree on one. `github.com/UnnoTed/horizontal` is the author's own layout helper, and the fact that both are the same author tells you this is a person maintaining a small stack of their own libraries alongside the application.

The library that does the actual WireGuard work is `golang.zx2c4.com/wireguard/wgctrl`, which is the Go implementation of the WireGuard userspace control interface. So the client does not shell out to `wg` for everything; it has a proper control library available and uses `wg-quick` for the configuration-driven path.

The rest of the list is ordinary Go infrastructure. `github.com/rs/zerolog` for structured logging, `github.com/dustin/go-humanize` for the human readable sizes and rates a tunnel status display needs, `gopkg.in/ini.v1` for reading configuration files, `golang.org/x/net` for the network pieces, and `github.com/ungerik/go-dry`.

The go.mod declares Go 1.21, and the indirect list is long, which is what a GTK application pulls in. The cloud.google.com and Azure entries in the indirect list are the kind of thing that arrives through a dependency that vendors a lot, and they are harmless here but are a reminder that a desktop GUI library can carry a large module graph.

There is also a `bazil.org/fuse` indirect entry, which is a hint that some part of the tree reaches for a FUSE filesystem, likely the tunnel implementation's handling of the userspace variant of WireGuard.

## The interface is a Glade file, which is how you would build it

The repository layout shows a GTK application built the traditional way, and the most telling file is `wireguird.glade` at the root.

Glade is the GTK user interface designer, and a `.glade` file is a declarative description of your windows and widgets, as XML, that is loaded at runtime or compiled into the binary. Using it means the layout is data rather than code, so a change to the arrangement of a dialog is an edit to an XML file and not a rebuild, and the layout can be inspected without reading Go code.

Alongside it, the `gui/` directory holds the Go code that wires the interface to the logic, `static/` holds the assets, `Icon/` the application icons, `flags/` the command line flag definitions, and `settings/` the configuration handling.

There is a `run.sh` at the root, which is the usual convenience script for running a GTK application from a source checkout with the right environment. And `main.go` at the root is the entry point, with the packages arranged around it.

Two build-related files are worth noting. The `.goreleaser.yaml` is the GoReleaser configuration, which is how the Debian packages are produced, and `deb/` is the directory holding the packaging templates. GoReleaser is a build tool that produces release artefacts for many platforms from one configuration, and it is the standard choice for a Go desktop application that ships packages.

`fileb0x.toml` is the configuration for FileB0x, and the file name with the zero in it is not a typo, it is the actual name of the project.

The `settings/` directory and the `gopkg.in/ini.v1` dependency together suggest that the application has a settings file, and the settings are stored in the INI format, which is a reasonable choice for a configuration with a flat set of named options.

## Installation, and the list of what was tested where

The download section is a list of Debian packages with the versions each was tested against, and that list is the most useful thing in it.

v0.2.0 was tested on Ubuntu 18.04 LTS, 20.04 LTS, and 21.04, and shipped as a 1.8MB package. v1.0.0 was tested on Ubuntu 22.04 LTS and 22.10, and on Linux Mint 21.1, shipping at 2.6MB. And v1.1.0 was tested on Ubuntu 23.04, also at 2.6MB.

So the newest release was tested on Ubuntu 23.04, which tells you the age of the testing matrix. The release history agrees: v0.2.0 in 2021, v1.0.0 in March 2023, and v1.1.0 in September 2023, with the last push to the repository in May 2026.

The installation of the package is two commands:

```sh
wget https://github.com/UnnoTed/wireguird/releases/download/v1.1.0/wireguird_amd64.deb
sudo dpkg -i ./wireguird_amd64.deb
```

The `amd64` in the file name is the architecture, and only that one is published, which is consistent with a Linux desktop tool.

Building from source needs the Debian dependencies `wireguard-tools`, `libgtk-3-dev`, `libayatana-appindicator3-dev`, `golang-go`, and `resolvconf`. The presence of `libayatana-appindicator3-dev` confirms the AppIndicator route, and `wireguard-tools` is what provides `wg` and `wg-quick`.

The build itself uses GoReleaser rather than a plain `go build`:

```sh
git clone https://github.com/UnnoTed/wireguird
cd wireguird
go install github.com/goreleaser/goreleaser/v2@latest
goreleaser release --snapshot --clean
```

The `--snapshot` flag is the one to note. It produces a build without cutting a release, which is what you want when you are checking that your tree still builds. The release itself, with the version metadata and the artefact upload, is the same command without the snapshot flag, and the configuration lives in `.goreleaser.yaml`.

## Where wireguird is the wrong tool

The limits are mostly about the shape of the tool rather than about anything being broken.

First, it is a desktop application. The system tray icon is the primary interface, and a system tray requires a desktop session. On a headless server, in a container, or over SSH, there is no tray and the application has nothing to draw into. If you are running WireGuard on a server, you want the command line, and `wg-quick` is already it.

Second, the `wg-quick` path is convenient but it is also a constraint. Driving tunnels through a shell script means the client inherits the script's expectations, including the `resolvconf` requirement and the way `wg-quick` handles DNS and routes. A tool that spoke to the kernel interface and the userspace API directly could offer things a script cannot, such as a live view of handshake counters and transfer rates per peer without parsing output. wireguird gives you the client behaviour of the official Windows app, which is a different thing from giving you a monitoring dashboard.

Third, the tunnel list comes from `/etc/wireguard`, which means root-level configuration files and therefore a privileged install. The package installs a system service and a desktop entry, and the interface is not scoped to an unprivileged user with their own tunnels elsewhere.

Fourth, the platform list is effectively Linux only, and specifically GTK 3 on a desktop with an AppIndicator implementation. The project calls it a Linux GTK GUI client, and the only packages published are Debian ones for amd64. There is no Flatpak, no AppImage, and no other architecture, so a distribution that is not Debian derived, or a machine on arm64, needs a build.

Fifth, the version numbers tell you where the project is. v1.1.0 is the newest release and it is from September 2023, the testing matrix stops at Ubuntu 23.04, and the last commit is from May 2026. Something is still being worked on, but the released artefact you would install is a couple of years old, and the newer Ubuntu releases it was never tested against are the ones people are actually running.

Sixth, the third party dependency on the author's own `go-appindicator` and `horizontal` packages means the tray behaviour and the layout behaviour live outside this repository. That is normal Go practice, and it is also a place where a bug in the app can be a bug in a package you did not choose, and where an update to a dependency can change the appearance of your application without any change to it.

## Conclusion

wireguird fits a Linux user who wants a graphical way to bring WireGuard tunnels up and down without living in a terminal, and who is on a system where the official Windows client is not an option. It is the wrong choice if your desktop has no system tray, because the tray icon is the whole point, and it is the wrong choice for a headless server. Check three things before you install it: that your distribution is covered by the tested versions, since the newest release was tested on Ubuntu 23.04, that you have the wireguard-tools and GTK development packages the build needs, and that you read the note about wg-quick, because the client drives tunnels through that script rather than talking to the kernel interface directly, which is what makes it work with the configurations you already have.

## FAQ

### What is wireguird and what does it do?

It is a Linux GTK GUI client for WireGuard. It lists the tunnels from `/etc/wireguard`, controls them through `wg-quick`, and shows the connection state in the system tray, with the icon going red when connected and black when disconnected.

### How do I install wireguird from a package?

Download the Debian package for your architecture and install it with `sudo dpkg -i ./wireguird_amd64.deb`. The published packages are amd64 only, with v1.1.0 at 2.6MB tested on Ubuntu 23.04, v1.0.0 at 2.6MB tested on Ubuntu 22.04 LTS and 22.10 and Linux Mint 21.1, and v0.2.0 at 1.8MB tested on Ubuntu 18.04, 20.04, and 21.04.

### How do I build wireguird from source?

Install the Debian dependencies `wireguard-tools`, `libgtk-3-dev`, `libayatana-appindicator3-dev`, `golang-go`, and `resolvconf`, then clone the repository and run `go install github.com/goreleaser/goreleaser/v2@latest` followed by `goreleaser release --snapshot --clean`. The release configuration lives in `.goreleaser.yaml` and the packaging templates in `deb/`.

### What does wireguird need to run on a headless server?

It does not suit that case, because the system tray icon is its main interface and a tray requires a desktop session. The library it drives, `wgctrl`, is the WireGuard control interface, and on a server you would use the command line tools directly, since wireguird controls tunnels through `wg-quick`.

## Sources

- [Issues](https://github.com/UnnoTed/wireguird/issues)
- [License: MIT](https://github.com/UnnoTed/wireguird/blob/master/LICENSE)
- [README](https://github.com/UnnoTed/wireguird/blob/master/README.md)
- [Releases](https://github.com/UnnoTed/wireguird/releases)
- [UnnoTed/wireguird on GitHub](https://github.com/UnnoTed/wireguird)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/unnoted-wireguird