Repository navigation
Defguard #2111
Description
Name of the Script
Defguard
Script Type
CT (LXC Container)
Does this script support arm64?
arm64 supported
📋 Script Details
Defguard is a WireGuard VPN server combined with an identity provider: user enrollment, MFA, OpenID Connect SSO and per-user access control, managed from a web UI. This installs the Core service.
- Stack: official
.deb(binarymode,defguard-*-<arch>-unknown-linux-gnu.deb) +PG_VERSION="17" setup_postgresql/setup_postgresql_db. - The .deb ships everything — system user,
/etc/defguard/core.confand the systemd unit. Itspostinstenables and starts the service immediately, so the script writes the DB credentials intocore.confafterwards and restarts. - Config: DB creds from
PG_DB_PASS, plus a generatedDEFGUARD_DEFAULT_ADMIN_PASSWORD,DEFGUARD_URL, andDEFGUARD_COOKIE_INSECURE=trueso the UI works over plain HTTP. Ports 8000 (HTTP) / 50055 (gRPC). - Note:
DEFGUARD_SECRET_KEYis deprecated in 2.x — the secret now lives in the DB settings, so nothing to seed. - Note: Core only. VPN traffic needs a separate Defguard Gateway connecting back to :50055.
- Update path backs up and restores
core.confaround the.debupgrade.
Activity
MickLesk commentedon Aug 3, 2026
Correction: the note above about the Gateway was incomplete. Defguard 2.x Core also needs an Edge component before its setup wizard can be completed — step 7 "Edge Component Adoption" probes it over gRPC and blocks until it answers.
Edge is the
defguard-proxypackage (no separate repo — seeDefGuard/deployment→terraform2.0/modules/edge/setup.sh). Split out into its own script and issue so Core and Edge can live in separate containers, which is also how upstream deploys it (Edge faces users, Core stays internal).json/defguard.jsonnow carries a warning pointing atct/defguard-edge.sh.github-actions commentedon Aug 3, 2026
The Defguard script is ready for testing:
Default credentials:
Username: admin
The generated admin password is stored as DEFGUARD_DEFAULT_ADMIN_PASSWORD in /etc/defguard/core.conf. Log in as 'admin' at http://:8000 and change it.
Defguard 2.x needs an Edge component before the setup wizard can be completed. It is installed in this same container, so in the wizard step 'Edge Component Adoption' enter 127.0.0.1:50051. Ports do not collide: Core uses 8000/50055, Edge uses 8080/8443/50051.
DEFGUARD_COOKIE_INSECURE=true is set so the web UI works over plain HTTP. When you put Defguard behind a TLS reverse proxy, remove that line and set DEFGUARD_URL to the public https URL, then restart the service.
VPN traffic is handled by a third component, the Defguard Gateway, installed on the machine that terminates the tunnels. It connects back to the gRPC port 50055 on this container - see the upstream documentation.
Installed from the official Defguard apt repository (apt.defguard.net, component release-2.0), so updates go through apt. Data lives in the local PostgreSQL database 'defguard', not in /opt.
To run Edge on a separate host instead (upstream's segmented layout, with Edge in a DMZ and Core internal), install the defguard-proxy package from the same apt repository there and copy the proxy.toml block from install/defguard-install.sh, then point the wizard at that host's IP:50051.
Note: This is not in the official repo yet—it's just a dev version! After merging into ProxmoxVE, it will need to be recreated.
Discord testing thread: https://discord.com/channels/1302816934508630047/1533821782916858067
github-actions commentedon Aug 29, 2026
A PR has been created for defguard: community-scripts/ProxmoxVE#16871
michelroegl-brunner commentedon Aug 30, 2026
Merged with #16871 in ProxmoxVE