How to Install WireGuard with xCloud (One Click Apps)

WireGuard is a modern and lightweight VPN solution that helps keep your internet traffic private and secure. It’s known for being fast, easy to use, and much simpler than traditional VPN tools.

With xCloud’s One Click Apps, setting up WireGuard doesn’t require any complicated server work or technical expertise. Follow the guide to easily install WireGuard with xCloud, which involves just a few steps. Once it runs, you can update WireGuard from the dashboard without losing your VPN clients.

Note: WireGuard requires the WireGuard UDP port (default: 51820) to be open on your server firewall. If a firewall is enabled, make sure this port is allowed.

Step 1: Create an NGINX Server

First, you need to create an NGINX server to deploy WireGuard. Click the ‘New Server’ button on the dashboard and enter all the necessary credentials to connect your server. You can deploy WireGuard either on your own server or on an xCloud server.

Next, choose your server provider to deploy WireGuard with xCloud. You can either use an xCloud Managed Server or select your preferred provider. In this guide, we’ll use the xCloud Managed Server.

Afterward, enter the ‘Server Name’, set the ‘App Type’ to WireGuard(it is optional to select), and add any relevant ‘Tags’ to help identify your server later. 

Next, choose between the ‘General’ and ‘Premium’ options based on your requirements. Then, select a plan that best fits your needs.

Next, choose the ‘Region’ and ‘Ubuntu Version’ for your server. You can also enable or disable the Backup option as needed.

Note: The server location you have set will be used as the VPN location.

Under ‘Choose Web Server’, keep the ‘NGINX’ stack selected. Docker apps run on an NGINX server. xCloud installs Docker automatically the first time you deploy a container app, or you can install it ahead of time from Server → Settings → Server Settings → Install a Service → Docker. OpenLiteSpeed servers cannot run Docker.  Then click on the ‘Create’ button to proceed.

Once the server is created, you will be able to deploy your WireGuard Application on this server.

After creating a server, it may take a while to become fully operational. Wait a few minutes before deploying your applications to ensure everything starts correctly.

How to Install WireGuard with xCloud On A Cloud Server 

Learn how to install WireGuard on a cloud server. It walks you through creating a server, configuring the environment, and launching your WireGuard application easily.

Step 2: Access the One Click Apps Dashboard

Begin by logging into your xCloud account. Once logged in, navigate to your dashboard and click on the ‘New Site’ button.

Then choose your server from the dropdown menu. Next, click on the ‘Next’ button to proceed. 

This will take you to the site creation interface. From here, select your Server, then navigate to the One Click Apps section. You will see ‘WireGuard’, click on it to proceed with the deployment of this application.

Step 3: Set Up the WireGuard Application

In the site setup screen, you will be prompted to enter basic site information. Provide a ‘Site Title’ and add relevant ‘Tags’ to help organize your deployment.

Here, you will get a site deployment option. From here, proceed with the ‘Go Live’ option to install WireGuard. This will immediately create a live environment to publish your WireGuard application instantly.

Note: You will not be able to create a Demo site for WireGuard. Additionally, domains that are proxied through Cloudflare will not work with the WireGuard application. Please ensure the domain is not proxied in Cloudflare.

Step 4: Configure Domain Settings

Then, enter a domain for your WireGuard application in the blank field under the ‘Domain Setup’ option.

After that, go to the ‘DNS Setup’ section and enable the ‘SSL’ option. xCloud provides a free SSL certificate for this application. You can also use your own custom SSL certificate. Here you will get a ‘Site User’ of xCloud and click on the ‘Next’ Button to continue.

Step 5: Visit the Application 

After completing the setup, you will be able to visit your WireGuard site. From the dashboard, click on the ‘Visit Site’ app.

Step 6: Set Up WireGuard VPN

Once you are on the WireGuard VPN page, click on the ‘Continue’ button to proceed. 

Next, enter a ‘Username’, ‘Password’, and click on the ‘Create Account’ button to proceed.

Next, enter your domain in the ‘Host’ field. You will get a default ‘Port’ and click on the ‘Continue’ button to proceed.

Step 7: Create a Client

Next, click on the ‘New Client’ button to create a new client for WireGuard VPN.

Then enter the ‘Name’ and ‘Expiry Date’ and click on the ‘Create Client’ button to proceed. 

Next to the client, you will see a way to enable or disable the client, add the client via QR code, or download the configuration file. Finally, you can even delete the client if you wish.

And that’s it. This is how easily you can install and launch WireGuard using xCloud. With just a few guided steps, your VPN server is ready to use, fully configured, and secured with SSL. xCloud takes care of the heavy lifting, so you can focus on using WireGuard without worrying about complex setup or maintenance.

Update WireGuard from the dashboard

Since xCloud v2.9.7, a WireGuard site shows its installed version and the latest stable version, and you can start a tracked update from the dashboard. xCloud’s WireGuard app runs wg-easy, so the versions on this page are wg-easy release numbers. You need permission to manage site updates on the team to see this page.

Step 1: Open the WireGuard updates page

Open your WireGuard site and go to ‘WireGuard’ → ‘Updates’ in the site menu. The ‘Current Version’ card shows the version installed on your server. Click ‘Check for Updates’ to check the installed and latest versions again.

Step 2: Start the update

If a newer stable version exists, the ‘Available Update’ card shows it. Click ‘Update’. If you already run the latest version, the page shows ‘Up to Date’ instead and there is nothing to do.

xCloud only installs stable updates within the major version you already run, and the dashboard always compares against the single latest wg-easy release. When the latest release is a new major version, the card says ‘This major version requires a manual WireGuard migration.’ and the ‘Update’ button is disabled, so the dashboard offers no update at all, even if a newer release exists in your current major version. You can still request that newer version through POST /api/v1/sites/{uuid}/wireguard/update (see Update through the Public API or MCP). Downgrades are not supported.

Step 3: Confirm the update

A dialog asks you to confirm, for example ‘Update WireGuard from 15.2.1 to 15.5.0? VPN connections will be briefly interrupted.’ Click ‘Update’ to start it, or ‘Cancel’ to keep the current version.

Step 4: Check the result

The update runs in the background, and the page refreshes its status every few seconds. When it finishes, ‘Current Version’ shows the new version, the page shows ‘Up to Date’, and the ‘Recent Updates’ list shows the version with the status ‘Completed’.

The ‘Recent Updates’ list keeps your last 10 WireGuard updates. A row can show ‘Pending’, ‘Running’, ‘Completed’, ‘Failed’ or ‘Stopped’. Only one update can run for a site at a time.

What happens during an update

xCloud keeps your VPN clients and settings safe during the update:

1. It downloads the new wg-easy image first, while WireGuard keeps running.
2. It saves a copy of the site’s Docker Compose file.
3. It stops WireGuard, takes a snapshot of the client data, and starts the new version. VPN connections are interrupted from this point until the new version is up.
4. It waits for the new container to report healthy. If it does not, xCloud restores the previous version and the saved client data, and the update shows ‘Failed’ in ‘Recent Updates’. WireGuard runs on the previous version again, and you can retry later or contact support.

Update through the Public API or MCP

The same update is available to scripts and AI agents. With an xCloud API token, check the versions with GET /api/v1/sites/{uuid}/wireguard/updates and start an update with POST /api/v1/sites/{uuid}/wireguard/update:

curl -X POST "https://app.xcloud.host/api/v1/sites/YOUR_SITE_UUID/wireguard/update" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"version": "15.5.0"}'

The request answers 202 with a task_uuid while the update runs. It applies the same rules as the dashboard: a stable version within your current major version, no downgrades and one update at a time. Reading the versions needs the read:sites scope, and starting an update needs write:sites. MCP clients get the same two actions as tools. See the xCloud API reference for the full request and response format.

Frequently asked questions

Does updating WireGuard in xCloud remove my VPN clients?

No. xCloud saves a copy of the client data and the Docker Compose file before it starts the new version. Existing clients and configuration are preserved, and if the new version does not become healthy, xCloud restores the previous version and the saved client data.

Why is the Update button disabled for a new WireGuard version?

xCloud only installs stable updates within the major version you already run, and the dashboard compares against the single latest wg-easy release. When the latest release is a new major version, the card shows ‘This major version requires a manual WireGuard migration.’ and the dashboard offers no update, even if a newer release exists in your current major version. You can still request a newer version in the same major through POST /api/v1/sites/{uuid}/wireguard/update.

Can I update WireGuard through the xCloud Public API or MCP?

Yes. GET /api/v1/sites/{uuid}/wireguard/updates returns the installed and latest stable versions, and POST /api/v1/sites/{uuid}/wireguard/update with a version starts the same tracked update. MCP clients use the matching tools. Your token needs access to the site and your team role needs permission to manage site updates.

If you run into any issues while updating WireGuard, feel free to reach out to our support team.