TunnelFleet generates a cloud-init script tailored to your server and passes it to your cloud provider when the VM is created. WireGuard is installed, configured, and running before you even see the IP address.
SSH session per server
Every new server requires opening a terminal, SSHing in, and running commands manually.
Manual package management
Installing WireGuard varies by distro. Getting the right packages and versions requires attention.
Error-prone key generation
Generating WireGuard keypairs, setting correct file permissions, and configuring the interface manually is tedious and easy to get wrong.
Not repeatable at scale
What works for one server needs to be repeated for each new server. Scripting this yourself introduces another maintenance burden.
cloud-init is the industry-standard way to initialise cloud VMs. Every major Linux cloud image supports it. TunnelFleet generates a cloud-init YAML document for each server and passes it as user-data when the Droplet is created.
On first boot, cloud-init runs the script before the server is reachable via SSH. By the time TunnelFleet polls for the server's IP and status, WireGuard is already installed, keys are generated, and the interface is up.
Below is a simplified representation. The actual script includes error handling, version pinning, and TunnelFleet callback endpoints.
TunnelFleet's cloud-init approach is designed with security as a first consideration.
The WireGuard private key is generated on the VM during cloud-init. It is never transmitted to TunnelFleet or stored off-server.
cloud-init scripts run exactly once. Rebooting the server does not re-run the provisioning script.
The cloud-init template used by TunnelFleet is documented. You can review exactly what runs on your server before deploying.
TunnelFleet never needs SSH access to your servers. Provisioning happens via the cloud provider API and cloud-init.
cloud-init is an industry-standard tool for initialising cloud VMs at first boot. It reads a YAML configuration file (user-data) provided by the cloud provider API and executes it during the VM's first startup. It's supported by Ubuntu, Debian, CentOS/RHEL, and most cloud images.
Yes. TunnelFleet's cloud-init template is published in our documentation. You can review the exact commands that run on your server before you deploy anything.
No. cloud-init runs once, during the first boot. Subsequent reboots do not re-run the user-data script unless you explicitly reset cloud-init state.
If cloud-init fails during provisioning, TunnelFleet will detect the server is not reporting as healthy and flag it in the dashboard. cloud-init logs are available at /var/log/cloud-init-output.log on the server.
No. cloud-init is supported by almost every major cloud provider: DigitalOcean, AWS (EC2), Hetzner, Vultr, and more. When TunnelFleet adds support for additional providers, the same cloud-init approach will be used.
No SSH. No manual configuration. TunnelFleet generates the script and your server does the rest.