Self-hosted WireGuard® access management
No one left on an
IT island.
Your network, your server, your data. Islandr gives small teams sovereign WireGuard® access management — peers, groups, ACLs and a self-service portal in one native binary, with no SaaS subscription and no external control plane.
Features
One console. No cloud lock-in.
Peers, groups, ACLs, firewall enforcement and self-service — managed in one interface. No SaaS subscription, no vendor account, no config files emailed around.
Peers & devices
Who — and which device — may connect. Client and site peers, IP suggestion from the WG subnet, CIDR-overlap validation, keys generated server-side or imported.
Self-service portal
End users fetch their own configs: QR code and .conf download, add a device, rotate keys — with no admin in the loop.
Groups & ACLs
Who may reach what. Group-based, resource-level access rules instead of “everyone reaches everything” on a flat network.
WireGuard & firewall
The hub manages WireGuard via wg/wg-quick; nftables enforces the rules. A mock adapter keeps dev and CI running with no real binaries.
Auth & identity
A local recovery admin plus OIDC for Microsoft 365 and Google. All provider config lives in the DB and is editable at runtime — no restart, no properties round-trip.
Native delivery
As a Quarkus native build (GraalVM) Islandr starts in milliseconds and runs via systemd as one binary on x86_64 and ARM64. SQLite for the lab, PostgreSQL for prod.
Who it's for
Built for small teams that run their own infrastructure.
Islandr is VPN management plus role-based access control in one binary — for teams of 5 to 50 who self-host on a €5 VM, a home server, or a bare-metal box, and don't want a SaaS control plane calling home.
It is not Zero Trust, not an enterprise SASE product, and not a replacement for Tailscale if a managed service suits your team. It is a pragmatic tool for people who want to own the full stack.
- Small team (5 – 50 people), self-hosted stack
- Multiple sites or remote workers
- Need user + group + ACL management, not just keys
- Microsoft 365 or Google for identity (OIDC)
- Want one binary, no npm, no JVM at runtime
- Need mesh networking between peers (use Tailscale)
- Need enterprise audit compliance or SSO beyond OIDC
- Running hundreds of peers or dozens of admins
Solid network security, without the enterprise overhead. Islandr encrypts every connection with WireGuard®, segments access by group, and enforces rules at the hub — fully under your control, no vendor in the loop.
How it works
Hub & spoke — a constellation of islands
The sea is the internet. A VM with a public IP is the bright home star; every islander finds its way back through an encrypted WireGuard tunnel.
The hub (home star)
A VM with a public IP runs WireGuard, nftables and the Islandr backend — the central node that coordinates identities, keys and rules.
Peers connect
Road warriors, home offices and mobile devices join as dynamic peers; site gateways (router, UCG) as static peers — routing an entire subnet into the network.
Self-service hands out configs
Users download their .conf or scan the QR code themselves. No more config files travelling the company by email.
Policy enforces
Groups & ACLs decide which paths in the constellation are open — nftables enforces them at the hub. Everything else stays invisible.
When it fits
A typical setup — from CG-NAT to multi-site
No fixed IPv4 from your provider? Router without WireGuard server mode? Home lab behind CG-NAT? A €3–5 VM in the cloud becomes the hub — every device and every site connects as a peer, regardless of what sits in front of it at home.
Islandr fits when…
- Your provider gives no fixed IPv4 (CG-NAT)
- Your router has no WireGuard server mode
- You need more than one site — home, office, lab
- You want central user management, not manual key files
- Team members should self-service their own device configs
You might not need it when…
- Your router already supports WireGuard server mode and one site is enough
- You only have two or three devices and manage keys manually
- You are fine with a SaaS control plane (Tailscale works great)
In the interface
Everything in one console.
Admin console and self-service portal — available in light and dark mode, in English and German.
Install
Up and running in under a minute
A single native binary — no JVM at runtime, no npm toolchain. Pick your path.
# Clone & run with Quarkus live coding git clone https://github.com/chriscohnen/islandr.git cd islandr ./gradlew quarkusDev # → http://localhost:8080 (admin / admin in the %dev profile)
# Download pre-built binary (x86_64 or ARM64) ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') curl -fsSL "https://github.com/chriscohnen/islandr/releases/latest/download/islandr-runner-linux-${ARCH}" \ -o /tmp/islandr curl -fsSL "https://github.com/chriscohnen/islandr/releases/latest/download/islandr-runner-linux-${ARCH}.sha256" \ | sha256sum -c - # Install & run as a systemd service sudo install -o root -g root -m 0755 /tmp/islandr /usr/local/bin/islandr sudo tee /etc/systemd/system/islandr.service >/dev/null <<'EOF' [Service] Environment=ISLANDR_ADMIN_USER=admin Environment=ISLANDR_ADMIN_PASSWORD=change-me ExecStart=/usr/local/bin/islandr Restart=always [Install] WantedBy=multi-user.target EOF sudo systemctl enable --now islandr
services: islandr: image: ghcr.io/chriscohnen/islandr:latest ports: ["8080:8080"] cap_add: ["NET_ADMIN"] environment: ISLANDR_ADMIN_USER: admin ISLANDR_ADMIN_PASSWORD: change-me volumes: ["./data:/data"] # docker compose up -d → http://localhost:8080
In production the admin password has no default — without ISLANDR_ADMIN_PASSWORD the local login stays deliberately disabled (HTTP 503). A known default in containers would be a security hole.
Get started
One binary, one command — home in under a minute.
→ then open http://localhost:8080
Built with agentic coding
One person, agent-assisted — from PRD to a tested walking skeleton.
Islandr is a solo exploration of how far agent-assisted development really goes: product spec, architecture decision records, OIDC built from scratch, and a backend with real tests — not a toy. Early access, and honest about what works and what’s next.
The name
No one left on an IT island.
Remote workers, home offices, branch sites — each one is an island. Isolated by CG-NAT, by the router that doesn't support WireGuard server mode, by the distance from the corporate network. They're not the problem. The missing ferry is.
A ferry connects islands. But a ferry is a thing. More interesting is the person on the island — the islander. The employee working from home, the device at the remote site, the lab behind a double NAT. Each one waiting for a safe, reliable route back to the mainland.
Islander became Islandr — the dropped e is how software tools spell themselves. The promise stays: sovereign, encrypted access, and nobody stranded.