Step-by-Step Guide to Setting Up WireGuard 1.0 and Tailscale 1.50 for 2026 Remote Team VPNs

import subprocess
import os
import json
import logging
from pathlib import Path
from typing import Dict, List, Optional

# Configure logging for audit trails
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.FileHandler("wg_provision.log"), logging.StreamHandler()]
)
logger = logging.getLogger(__name__)

WG_BIN = "/usr/bin/wg"
WG_QUICK_BIN = "/usr/bin/wg-quick"
WG_CONFIG_DIR = Path("/etc/wireguard")
WG_DEFAULT_PORT = 51820
WG_SUBNET = "10.0.0.0/24"

def generate_wg_keypair() -> Dict[str, str]:
    """Generate WireGuard public/private key pair using wg utility.

    Returns:
        Dict with "private_key" and "public_key" strings.
    Raises:
        RuntimeError: If wg binary is missing or key generation fails.
    """
    try:
        # Generate private key
        priv_proc = subprocess.Popen(
            [WG_BIN, "genkey"],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True
        )
        priv_key, priv_err = priv_proc.communicate()
        if priv_proc.returncode != 0:
            raise RuntimeError(f"Private key generation failed: {priv_err.strip()}")

        # Derive public key from private key
        pub_proc = subprocess.Popen(
            [WG_BIN, "pubkey"],
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True
        )
        pub_key, pub_err = pub_proc.communicate(input=priv_key)
        if pub_proc.returncode != 0:
            raise RuntimeError(f"Public key derivation failed: {pub_err.strip()}")

        return {
            "private_key": priv_key.strip(),
            "public_key": pub_key.strip()
        }
    except FileNotFoundError:
        raise RuntimeError(f"WireGuard binary not found at {WG_BIN}. Install wireguard-tools first.")

def write_wg_server_config(
    interface: str,
    server_keys: Dict[str, str],
    peers: List[Dict[str, str]],
    listen_port: int = WG_DEFAULT_PORT
) -> Path:
    """Write WireGuard server configuration file.

    Args:
        interface: WireGuard interface name (e.g., wg0)
        server_keys: Dict with server's private/public keys
        peers: List of peer dicts with "public_key", "allowed_ips"
        listen_port: UDP port to listen on
    Returns:
        Path to written config file
    Raises:
        PermissionError: If unable to write to config dir
        ValueError: If peer config is invalid
    """
    config_path = WG_CONFIG_DIR / f"{interface}.conf"
    try:
        # Ensure config directory exists with correct permissions
        WG_CONFIG_DIR.mkdir(parents=True, exist_ok=True)
        # Set restrictive permissions on config dir (only root can write)
        os.chmod(str(WG_CONFIG_DIR), 0o700)

        # Build config file content
        config_lines = [
            "[Interface]",
            f"PrivateKey = {server_keys['private_key']}",
            f"Address = {WG_SUBNET}",
            f"ListenPort = {listen_port}",
            "PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE",
            "PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE",
            "SaveConfig = true"
        ]

        # Add peer sections
        for peer in peers:
            if "public_key" not in peer or "allowed_ips" not in peer:
                raise ValueError(f"Invalid peer config: {peer}")
            config_lines.extend([
                "\n[Peer]",
                f"PublicKey = {peer['public_key']}",
                f"AllowedIPs = {peer['allowed_ips']}"
            ])
            if "endpoint" in peer:
                config_lines.append(f"Endpoint = {peer['endpoint']}")

        # Write config with restricted permissions
        with open(config_path, "w") as f:
            f.write("\n".join(config_lines) + "\n")
        os.chmod(str(config_path), 0o600)  # Only root can read/write
        logger.info(f"Wrote server config to {config_path}")
        return config_path
    except PermissionError:
        raise PermissionError(f"Failed to write config to {config_path}: Run as root.")
    except Exception as e:
        logger.error(f"Config write failed: {str(e)}")
        raise

def provision_wireguard_server(
    interface: str = "wg0",
    peer_list: Optional[List[Dict[str, str]]] = None
) -> Dict[str, str]:
    """Full provisioning flow for a WireGuard 1.0 server.

    Args:
        interface: Interface name
        peer_list: Pre-generated peer configs (optional)
    Returns:
        Dict with server public key and config path
    """
    peer_list = peer_list or []
    try:
        # Check if WireGuard is installed
        subprocess.run([WG_BIN, "--version"], check=True, capture_output=True)
        logger.info(f"WireGuard 1.0 detected: {subprocess.check_output([WG_BIN, '--version']).decode().strip()}")
    except subprocess.CalledProcessError:
        raise RuntimeError("WireGuard 1.0 not installed. Run: apt install wireguard-tools")

    # Generate server keys
    server_keys = generate_wg_keypair()
    logger.info(f"Generated server keys. Public key: {server_keys['public_key'][:20]}...")

    # Write config
    config_path = write_wg_server_config(interface, server_keys, peer_list)

    # Bring up interface
    try:
        subprocess.run([WG_QUICK_BIN, "up", interface], check=True, capture_output=True)
        logger.info(f"Interface {interface} is up")
    except subprocess.CalledProcessError as e:
        raise RuntimeError(f"Failed to bring up {interface}: {e.stderr.decode().strip()}")

    return {
        "public_key": server_keys["public_key"],
        "config_path": str(config_path),
        "interface": interface
    }

if __name__ == "__main__":
    # Example usage: Provision server with 2 pre-configured peers
    test_peers = [
        {"public_key": "peer1_pub_key_here", "allowed_ips": "10.0.0.2/32"},
        {"public_key": "peer2_pub_key_here", "allowed_ips": "10.0.0.3/32"}
    ]
    try:
        result = provision_wireguard_server(peer_list=test_peers)
        print(json.dumps(result, indent=2))
    except Exception as e:
        logger.error(f"Provisioning failed: {str(e)}")
        exit(1)

# Terraform 1.8+ configuration for deploying Tailscale 1.50 on AWS
# For 2026 remote teams: multi-region mesh VPN with SSO integration

terraform {
  required_version = ">= 1.8.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    tailscale = {
      source  = "tailscale/tailscale"
      version = "~> 0.17.0"  # Supports Tailscale 1.50+
    }
  }
}

# Configure AWS provider for us-east-1 (primary) and eu-west-1 (secondary)
provider "aws" {
  region = "us-east-1"
  default_tags {
    tags = {
      Project     = "remote-team-vpn"
      ManagedBy   = "terraform"
      ToolVersion = "tailscale-1.50"
    }
  }
}

provider "aws" {
  alias  = "eu"
  region = "eu-west-1"
}

# Configure Tailscale provider with OAuth client (create via Tailscale admin panel)
provider "tailscale" {
  client_id     = var.tailscale_client_id
  client_secret = var.tailscale_client_secret
  tailnet       = var.tailscale_tailnet
}

# Variables for team configuration
variable "tailscale_client_id" {
  type        = string
  description = "Tailscale OAuth Client ID (with device write permissions)"
  sensitive   = true
}

variable "tailscale_client_secret" {
  type        = string
  description = "Tailscale OAuth Client Secret"
  sensitive   = true
}

variable "tailscale_tailnet" {
  type        = string
  description = "Your Tailscale tailnet name (e.g., example.com)"
}

variable "team_nodes" {
  type = map(object({
    region    = string
    instance_type = string
    count     = number
  }))
  default = {
    "us-dev" = {
      region        = "us-east-1"
      instance_type = "t3.micro"
      count         = 2
    },
    "eu-dev" = {
      region        = "eu-west-1"
      instance_type = "t3.micro"
      count         = 2
    }
  }
  description = "Node configuration per region for remote team"
}

# Fetch latest Ubuntu 24.04 AMI (supports Tailscale eBPF acceleration)
data "aws_ami" "ubuntu" {
  for_each    = toset([for k, v in var.team_nodes : v.region])
  most_recent = true
  owners      = ["099720109477"]  # Canonical

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-24.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  provider = aws.${each.value == "eu-west-1" ? "eu" : ""}
}

# IAM role for EC2 instances to access SSM (no SSH keys needed)
resource "aws_iam_role" "tailscale_node" {
  name = "tailscale-node-role-2026"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })

  inline_policy {
    name = "ssm-access"
    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Action   = ["ssm:UpdateInstanceInformation", "ssm:SendCommand"]
          Effect   = "Allow"
          Resource = "*"
        }
      ]
    })
  }
}

resource "aws_iam_instance_profile" "tailscale_node" {
  name = "tailscale-node-profile-2026"
  role = aws_iam_role.tailscale_node.name
}

# Deploy Tailscale nodes per region
resource "aws_instance" "tailscale_node" {
  for_each = {
    for idx, node in flatten([
      for group_key, group in var.team_nodes : [
        for i in range(group.count) : {
          key   = "${group_key}-${i}"
          region = group.region
          instance_type = group.instance_type
        }
      ]
    ]) : node.key => node
  }

  ami                    = data.aws_ami.ubuntu[each.value.region].id
  instance_type          = each.value.instance_type
  iam_instance_profile   = aws_iam_instance_profile.tailscale_node.name
  vpc_security_group_ids = [aws_security_group.tailscale_node[each.value.region].id]

  # User data script to install Tailscale 1.50
  user_data = <<-EOF
    #!/bin/bash
    set -euxo pipefail

    # Install Tailscale 1.50 specifically (pin version for reproducibility)
    curl -fsSL https://tailscale.com/install.sh | sh
    apt-get update && apt-get install -y tailscale=1.50.0-1

    # Enable IP forwarding for mesh networking
    echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
    sysctl -p

    # Start Tailscale with OAuth auth (no interactive login)
    tailscale up \
      --auth-key ${var.tailscale_client_secret} \
      --hostname "remote-team-${each.key}" \
      --accept-routes \
      --advertise-routes 10.0.${each.value.region == "us-east-1" ? "1" : "2"}.0/24 \
      --ssh  # Enable Tailscale SSH (no bastion needed)

    # Verify Tailscale version
    tailscale version | grep "1.50.0" || (echo "Tailscale 1.50 install failed" && exit 1)
  EOF

  tags = {
    Name = "tailscale-node-${each.key}"
  }

  lifecycle {
    create_before_destroy = true
  }
}

# Security group to allow Tailscale UDP traffic (port 41641) and SSH via Tailscale
resource "aws_security_group" "tailscale_node" {
  for_each = toset([for k, v in var.team_nodes : v.region])
  name     = "tailscale-sg-${each.value}"
  vpc_id   = data.aws_vpc.default[each.value].id

  # Allow Tailscale UDP traffic (required for mesh connectivity)
  ingress {
    from_port   = 41641
    to_port     = 41641
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]  # Tailscale uses NAT traversal, so open to internet
  }

  # Allow all outbound traffic (Tailscale handles encryption)
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  provider = aws.${each.value == "eu-west-1" ? "eu" : ""}
}

# Fetch default VPC per region
data "aws_vpc" "default" {
  for_each = toset([for k, v in var.team_nodes : v.region])
  default  = true
  provider = aws.${each.value == "eu-west-1" ? "eu" : ""}
}

# Create Tailscale ACL to restrict access to engineering team only
resource "tailscale_acl" "engineering_only" {
  name = "remote-team-acl-2026"
  acl = jsonencode({
    action = "accept"
    src    = ["autogroup:engineering"]  # Map to your IdP group
    dst    = ["autogroup:tailnet"]
  })
}

# Outputs for team onboarding
output "tailscale_node_ips" {
  value = {
    for k, v in aws_instance.tailscale_node : k => v.public_ip
  }
  description = "Public IPs of Tailscale nodes for debugging"
}

output "tailscale_admin_url" {
  value = "https://login.tailscale.com/admin/tailnet/${var.tailscale_tailnet}/devices"
  description = "Link to Tailscale admin panel to manage nodes"
}

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    "os"
    "os/signal"
    "syscall"
    "time"
    "strings"

    "github.com/prometheus/client_golang/prometheus"
    "github.com/prometheus/client_golang/prometheus/promhttp"
    "github.com/tailscale/tailscale-client-go/tailscale"  // v2.0+ supports Tailscale 1.50
)

// Define Prometheus metrics
var (
    wireguardThroughput = prometheus.NewGaugeVec(
        prometheus.GaugeOpts{
            Name: "wireguard_throughput_bps",
            Help: "WireGuard interface throughput in bits per second",
        },
        []string{"interface", "direction"},  // direction: rx/tx
    )
    wireguardPeerCount = prometheus.NewGauge(
        prometheus.GaugeOpts{
            Name: "wireguard_peer_count",
            Help: "Number of active WireGuard peers",
        },
    )
    tailscaleLatency = prometheus.NewHistogramVec(
        prometheus.HistogramOpts{
            Name:    "tailscale_latency_ms",
            Help:    "Tailscale peer-to-peer latency in milliseconds",
            Buckets: prometheus.DefBuckets,
        },
        []string{"src_node", "dst_node"},
    )
    tailscaleNodeCount = prometheus.NewGauge(
        prometheus.GaugeOpts{
            Name: "tailscale_node_count",
            Help: "Number of active Tailscale nodes in tailnet",
        },
    )
)

func init() {
    // Register metrics with Prometheus
    prometheus.MustRegister(wireguardThroughput)
    prometheus.MustRegister(wireguardPeerCount)
    prometheus.MustRegister(tailscaleLatency)
    prometheus.MustRegister(tailscaleNodeCount)
}

// WireGuardStats holds WireGuard interface stats from /proc
type WireGuardStats struct {
    Interface string `json:"interface"`
    RXBytes   uint64 `json:"rx_bytes"`
    TXBytes   uint64 `json:"tx_bytes"`
    PeerCount int    `json:"peer_count"`
}

// fetchWireGuardStats parses /proc/net/wireguard/{iface} to get throughput
func fetchWireGuardStats(iface string) (*WireGuardStats, error) {
    // Read WireGuard proc file (requires root or CAP_NET_ADMIN)
    procPath := fmt.Sprintf("/proc/net/wireguard/%s", iface)
    data, err := os.ReadFile(procPath)
    if err != nil {
        return nil, fmt.Errorf("failed to read %s: %w", procPath, err)
    }

    stats := &WireGuardStats{Interface: iface}
    // Parse proc output (simplified for example; full parser would handle all fields)
    var rxBytes, txBytes uint64
    peerCount := 0
    for _, line := range strings.Split(string(data), "\n") {
        if strings.HasPrefix(line, "rx_bytes:") {
            fmt.Sscanf(line, "rx_bytes: %d", &rxBytes)
        } else if strings.HasPrefix(line, "tx_bytes:") {
            fmt.Sscanf(line, "tx_bytes: %d", &txBytes)
        } else if strings.HasPrefix(line, "peer:") {
            peerCount++
        }
    }

    stats.RXBytes = rxBytes
    stats.TXBytes = txBytes
    stats.PeerCount = peerCount
    return stats, nil
}

// fetchTailscaleStats uses Tailscale Client API to get node and latency stats
func fetchTailscaleStats(ctx context.Context, client *tailscale.Client) (int, map[string]float64, error) {
    // List all nodes in tailnet
    nodes, err := client.Devices.List(ctx)
    if err != nil {
        return 0, nil, fmt.Errorf("failed to list Tailscale nodes: %w", err)
    }

    latencyMap := make(map[string]float64)
    // Get latency to each node via Tailscale ping (requires Tailscale 1.50+)
    for _, node := range nodes {
        if len(node.Addresses) == 0 {
            continue
        }
        pingRes, err := client.Ping.Ping(ctx, node.Addresses[0].IP.String())
        if err != nil {
            log.Printf("Failed to ping node %s: %v", node.Name, err)
            continue
        }
        latencyMap[node.Name] = pingRes.LatencyMs
    }

    return len(nodes), latencyMap, nil
}

func main() {
    // Load configuration from environment
    wgIface := os.Getenv("WG_IFACE")
    if wgIface == "" {
        wgIface = "wg0"  // Default WireGuard interface
    }
    tailnet := os.Getenv("TAILSCALE_TAILNET")
    tailscaleAPIKey := os.Getenv("TAILSCALE_API_KEY")
    if tailnet == "" || tailscaleAPIKey == "" {
        log.Fatal("TAILSCALE_TAILNET and TAILSCALE_API_KEY must be set")
    }

    // Initialize Tailscale client (v2.0+ supports 1.50 features)
    tsClient, err := tailscale.NewClient(tailscaleAPIKey, tailnet)
    if err != nil {
        log.Fatalf("Failed to create Tailscale client: %v", err)
    }

    // Start Prometheus metrics server
    go func() {
        http.Handle("/metrics", promhttp.Handler())
        log.Fatal(http.ListenAndServe(":9100", nil))
    }()

    // Collect stats every 10 seconds
    ticker := time.NewTicker(10 * time.Second)
    defer ticker.Stop()

    // Handle graceful shutdown
    ctx, cancel := context.WithCancel(context.Background())
    defer cancel()
    sigChan := make(chan os.Signal, 1)
    signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)

    log.Println("Starting VPN metrics collector for WireGuard 1.0 and Tailscale 1.50")
    for {
        select {
        case <-ticker.C:
            // Collect WireGuard stats
            wgStats, err := fetchWireGuardStats(wgIface)
            if err != nil {
                log.Printf("WireGuard stats error: %v", err)
            } else {
                wireguardThroughput.WithLabelValues(wgIface, "rx").Set(float64(wgStats.RXBytes * 8))  // Bits per second
                wireguardThroughput.WithLabelValues(wgIface, "tx").Set(float64(wgStats.TXBytes * 8))
                wireguardPeerCount.Set(float64(wgStats.PeerCount))
            }

            // Collect Tailscale stats
            nodeCount, latencyMap, err := fetchTailscaleStats(ctx, tsClient)
            if err != nil {
                log.Printf("Tailscale stats error: %v", err)
            } else {
                tailscaleNodeCount.Set(float64(nodeCount))
                for nodeName, latency := range latencyMap {
                    tailscaleLatency.WithLabelValues("monitor", nodeName).Observe(latency)
                }
            }

        case <-sigChan:
            log.Println("Shutting down metrics collector")
            return
        }
    }
}

# /etc/apt/preferences.d/tailscale
Package: tailscale
Pin: version 1.50.0-1
Pin-Priority: 1000

tailscale up --ssh --hostname "dev-laptop-2026"

import re

def get_wg_peer_health(iface="wg0"):
    with open(f"/proc/net/wireguard/{iface}") as f:
        content = f.read()
    peers = re.findall(r"peer: ([a-zA-Z0-9+/=]+)\n.*?last_handshake: ([0-9]+)", content, re.DOTALL)
    for pub_key, handshake_time in peers:
        if int(handshake_time) > 180:  # Handshake older than 3 minutes
            print(f"Unhealthy peer: {pub_key[:10]}... last handshake {handshake_time}s ago")

wireguard-tailscale-2026/
├── terraform/                  # Terraform configs for Tailscale deployment (Code Example 2)
│   ├── main.tf
│   ├── variables.tf
│   └── outputs.tf
├── python/                     # WireGuard provisioning scripts (Code Example 1)
│   ├── wg_provision.py
│   └── requirements.txt
├── go/                         # Metrics collector (Code Example 3)
│   ├── main.go
│   ├── go.mod
│   └── go.sum
├── configs/                    # Example WireGuard and Tailscale configs
│   ├── wg0.conf.example
│   └── tailscale-acl.json.example
├── docs/                       # Troubleshooting guides
│   └── common-pitfalls.md
└── README.md                   # Setup instructions