# WireGuard Client Configurations

This directory stores generated client configuration files.

## Security Notice

⚠️ **NEVER commit client configs to Git!**

Client configs contain:
- Private keys
- Preshared keys
- Network topology information

`.gitignore` is configured to exclude all `.conf`, `.key`, `.qr.txt`, and `.qr.png` files.

## Generate New Client

```bash
cd ../../scripts
sudo ./generate-client-config.sh <device-name>
```

Configs will be created here:
- `<device-name>.conf` - WireGuard configuration
- `<device-name>.qr.txt` - QR code (ASCII)
- `<device-name>.qr.png` - QR code (PNG)

## Backup Client Configs

```bash
# Securely backup configs (encrypted)
tar -czf - *.conf | gpg --symmetric --cipher-algo AES256 -o wireguard-clients-backup-$(date +%Y%m%d).tar.gz.gpg
```

## Revoke Client Access

```bash
# On server
sudo nano /etc/wireguard/wg0.conf
# Remove [Peer] section for client

# Reload WireGuard
sudo systemctl reload wg-quick@wg0

# Delete client config
rm <device-name>.*
```