# JIT WireGuard

DevFeed: [JIT WireGuard](<https://devfeed.tech/articles/jit-wireguard-1699.md>)

Original publisher: [Read original article](<https://fly.io/blog/jit-wireguard-peers/>)

Published: 2024-03-12T00:00:00Z

Content type: article

Language: en

Sources: [The Fly Blog](<https://devfeed.tech/sources/the-fly-blog.md>)

Topics: [fly.io](<https://devfeed.tech/topics/fly-io.md>), [API](<https://devfeed.tech/topics/api.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Firecracker](<https://devfeed.tech/topics/firecracker.md>), [GraphQL](<https://devfeed.tech/topics/graphql.md>), [Networks](<https://devfeed.tech/topics/networks.md>), [Remote Procedure Call (RPC)](<https://devfeed.tech/topics/rpc.md>), [Messaging](<https://devfeed.tech/topics/messaging.md>), [Server](<https://devfeed.tech/topics/server.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [SQLite](<https://devfeed.tech/topics/sqlite.md>), [Containers](<https://devfeed.tech/topics/containers.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [cdn](<https://devfeed.tech/tags/cdn.md>), [cli](<https://devfeed.tech/tags/cli.md>), [close-to-users](<https://devfeed.tech/tags/close-to-users.md>), [containers](<https://devfeed.tech/tags/containers.md>), [deploy-app-servers](<https://devfeed.tech/tags/deploy-app-servers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [elixir](<https://devfeed.tech/tags/elixir.md>), [firecracker](<https://devfeed.tech/tags/firecracker.md>), [fly](<https://devfeed.tech/tags/fly.md>), [fly-io](<https://devfeed.tech/tags/fly-io.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [heroku-alternative](<https://devfeed.tech/tags/heroku-alternative.md>), [heroku-competitor](<https://devfeed.tech/tags/heroku-competitor.md>), [hosting](<https://devfeed.tech/tags/hosting.md>), [i](<https://devfeed.tech/tags/i.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [messaging](<https://devfeed.tech/tags/messaging.md>), [networking](<https://devfeed.tech/tags/networking.md>), [networks](<https://devfeed.tech/tags/networks.md>), [postgresql-clusters](<https://devfeed.tech/tags/postgresql-clusters.md>), [rpc](<https://devfeed.tech/tags/rpc.md>), [servers](<https://devfeed.tech/tags/servers.md>), [sqlite](<https://devfeed.tech/tags/sqlite.md>)

## AI overview

Fly.io describes improvements to its WireGuard gateway architecture for greater speed and scalability. The article explains how flyctl creates a networking stack, obtains peer configurations through a GraphQL API, distributes them to regional gateways through RPC over NATS, and installs them using SQLite and WireGuard libraries.

## Source excerpt

We're Fly.io and we transmute containers into VMs, running them on our hardware around the world with the power of Firecracker alchemy. We do a lot of stuff with WireGuard, which has become a part of our customer API. This is a quick story about some tricks we played to make WireGuard faster and more scalable for the hundreds of thousands of people who now use it here. One of many odd decisions we've made at Fly.io is how we use WireGuard. It's not just that we use it in many places where other shops would use HTTPS and REST APIs. We've gone a step beyond that: every time you run flyctl, our lovable, sprawling CLI, it conjures a TCP/IP stack out of thin air, with its own IPv6 address, and speaks directly to Fly Machines running on our networks. There are plusses and minuses to this approach, which we talked about in a blog post a couple years back. Some things, like remote-operated Docker builders, get easier to express (a Fly Machine, as far as flyctl is concerned, might as well be on the same LAN). But everything generally gets trickier to keep running reliably. It was a decision. We own it. Anyways, we've made some improvements recently, and I'd like to talk about them. Where we left off Until a few weeks ago, our gateways ran on a pretty simple system. We operate dozens of "gateway" servers around the world, whose sole purpose is to accept incoming WireGuard connections and connect them to the appropriate private networks. Any time you run flyctl and it needs to talk to a Fly Machine (to build a container, pop an SSH console, copy files, or proxy to a service you're running), it spawns or connects to a background agent process. The first time it runs, the agent generates a new WireGuard peer configuration from our GraphQL API. WireGuard peer configurations are very simple: just a public key and an address to connect to. Our API in turn takes that peer configuration and sends it to the appropriate gateway (say, ord, if you're near Chicago) via an RPC we send over