taphix/amneziawg-api

AmneziaWG is a VPN tool similar to WireGuard that encrypts internet traffic. When you run AmneziaWG on multiple servers, the normal approach is to log into each server separately and run shell commands. This project adds a single HTTP control layer on top so that other software, dashboards, or billing systems can manage those VPN servers through a standard web API instead. The core idea is straightforward: this application runs on one machine (the control plane), holds SSH credentials to reach your VPN servers, and translates API calls into shell commands on the remote machines. When you ask it to create a new VPN client, it connects to the target server over SSH, runs the management script there, collects the resulting config file and QR code, and stores them locally so you can download them through the API. The API covers the main tasks: registering a VPN server by providing its address and SSH key path, creating a client with a name and expiration date, listing active clients with their connection status, extending a subscription, removing a client, and downloading the generated config file or QR image. All requests require a bearer token you set in an environment file. A per-server command queue prevents two operations from conflicting on the same host at the same time. The project runs as a Python application using FastAPI and SQLite for storage. You can start it directly with a virtual environment or use the included Docker Compose file, which is designed to sit behind a reverse proxy. The README covers both paths and includes working example curl commands for every API endpoint. One thing this project does not do is install AmneziaWG on your servers. You need a working AmneziaWG setup on each remote machine before this control plane is useful. The project is licensed under MIT.