Linux headless host guide

Quickest path: download quick-setup.sh from the download page together with the binary for your architecture, then run one command:

This installs the binary, saves your relay config, sets up a hardened systemd service, and starts the first share — all in one step. Prefer to do it by hand instead? Grab the binary from the release page and run:

For an unattended box, four steps get you a systemd service, a permanent code, and the web UI.

1. Save the relay config

2. Run the first share once in the foreground, with a permanent code

Connect once from a remote to verify, then Ctrl-C — this stops the process but keeps the share configured, which is exactly what the service resumes on every start.

3. Install and start the service

4. Verify

A tiny status/control page served by the daemon itself — status, the connection code in big type, and a Share/Stop button. Two ways to reach it from another machine.

Loopback bind + SSH forward (recommended)

Then browse http://localhost:8787 — no token needed, SSH is the auth.

LAN bind + bearer token

Install with --web 0.0.0.0:8787 instead — the first non-loopback install prints a bearer token once. This binds a plain-HTTP page to the LAN, so prefer the SSH-forward path where possible.

sudo duowire status [--json]— live state via the daemon's socket.

sudo duowire stop — stop sharing; the service keeps running idle.

Upgrade the binary: stop the service, replace /usr/local/bin/duowire, start it again — state and the share are untouched.

Relay migrated or re-keyed? sudo duowire setup 'NEW_CONFIG_STRING' routes through the running daemon automatically.

State lives in /var/lib/duowire for the system service (or ~/.config/duowire for a per-user service), directory 0700, files 0600. Linux has no DPAPI equivalent, so — like /etc/wireguard/*.conf — these are plaintext protected by file permissions rather than encrypted at rest.