DWG CLI — VPN setup on Docker: WireGuard without a web interface, AdGuard Home and Unbound

TrustMe · August 4, 2026, 3:18pm

Archived article. DWG builds and accompanying scripts have not been updated for a long time and require a serious update. The material is preserved as historical.

DWG CLI — a build based on the same DWG script to run your own WireGuard VPN server on Docker, but without a built-in web interface: includes the standard WireGuard, AdGuard Home and Unbound, and client management is done directly from the console.

All builds in the series: Discussion of DWG » | DWG-CLI » | DWG-UI » | DWG-DARK » | DWG [multi] »

Composition of the build

The DWG-CLI build includes:

A Unbound container — provides its own DNS server with DNS caching and additional privacy parameters.
An AdGuard Home container (a more modern alternative to PiHole) — used for blocking ads and analytics trackers, as well as for editing the list of DNS servers that Unbound queries. It has a very useful parallel DNS query feature not present in PiHole.
A WireGuard container — used to run the WireGuard VPN server part.

Main repositories with updates on GitHub

Requirements

Clean, empty server.
Supported operating systems (verified working): Ubuntu 20.04, 22.04, 23.10; Debian 11, 12.

The script installs everything automatically, and explanations for each step can be found in the comments inside the script itself.

Installation command

apt update && apt install curl sudo git -y && curl -Of https://raw.githubusercontent.com/DigneZzZ/dwg-cli/main/setup.sh && chmod +x setup.sh && ./setup.sh

What will be installed

First, Git to be able to clone my repository.
Docker — the latest version.
Docker-compose — the latest version.
WireGuard — interactive mode for entering the number of users (names/quantity).
AdGuard Home — interactive mode for creating a user and password (can be left default).
Unbound — everything in stock.
apache2-utils — required to generate hash passwords.
ssh.sh — script to change the SSH port.
ufw.sh — script to install the UFW firewall.
peer.sh — outputs the list of peers and their settings.

Connecting WireGuard clients

In the terminal responses there will be QR codes you can use (if you want) to set up the WireGuard client on your phone.

You can also use the following command to display peer information after changing into the dwg-cli folder:

cd dwg-cli

./p.sh

Screenshot of the command output for peers

Screenshot of AdGuard Home

Client configuration files

You can download the client configuration files to connect to WireGuard via SFTP using FileZilla or another SFTP client.

Configurations are located in Peer1, Peer2, etc., under the path /user/dwg-cli/wireguard (where user is your Linux username).

The file with the extension .conf is mainly used for connecting from a PC and contains the textual information for connecting the WireGuard client. It can also be used to import tunnels from a file.

The file with the extension .png is saved QR codes for quick connection of the WireGuard client from a mobile device.

Login credentials for the AdGuard Home admin panel (default)

# AGH login and password may differ by build; always check the documentation on GitHub
http://10.2.0.100 or http://agh.local
login: admin 
password: admin

# or this login-password combination
login: admin 
password: 12345678

# Script to change AGH password
bash <(wget -qO- https://raw.githubusercontent.com/DigneZzZ/dwg/main/change.sh)

Useful links

Originally published 01.04.2023 on openode.xyz; migrated and updated 04.08.2026.