Add the first device

hubctl device add generates a new key pair. It prints the public configuration entry and writes the private key into the requested client profile. The CLI does not copy the private key into VPN Hub state, but the output file remains on the hub until you remove it.

Prerequisites

• A validated hub at /etc/vpn-hub/hub.yaml.
• A protected destination for the generated profile.
• A free host route inside hub.client_cidr that is not the network, broadcast, or hub.dns_address.

Generate and enroll

Run these commands in a root-capable SSH session on the hub:

sudo install -d -m 0700 /root/vpn-hub-profiles
sudo hubctl --config /etc/vpn-hub/hub.yaml device add laptop \
  --address 10.80.0.2/32 \
  --egress direct \
  --output /root/vpn-hub-profiles/laptop.conf

Append the printed entry to devices: in /etc/vpn-hub/hub.yaml, then:

sudoedit /etc/vpn-hub/hub.yaml
sudo hubctl --config /etc/vpn-hub/hub.yaml validate
sudo hubctl --config /etc/vpn-hub/hub.yaml deploy --confirm-within 5m

Expected result: a 0600 profile exists, validation reports one device, and deploy prints whether rollback was armed. A first-ever deploy cannot arm rollback because no prior revision exists.

Verify

sudo stat -c '%a' /root/vpn-hub-profiles/laptop.conf && sudo hubctl --config /etc/vpn-hub/hub.yaml device list

Expected: 600 and a row for laptop with 10.80.0.2/32 and direct

From a trusted workstation, copy the profile over the existing SSH trust path and remove the temporary hub copy:

export HUB_HOST=192.0.2.10
umask 077
scp root@"$HUB_HOST":/root/vpn-hub-profiles/laptop.conf ./laptop.conf
chmod 0600 ./laptop.conf
ssh root@"$HUB_HOST" 'rm -f /root/vpn-hub-profiles/laptop.conf && test ! -e /root/vpn-hub-profiles/laptop.conf'

Expected result: the workstation copy is 0600, and the final SSH command exits zero without output. SSH protects delivery in transit; protect the workstation and its backups because laptop.conf contains the live client private key. A lost or exposed profile must be reissued and the old device revoked.

Import the workstation copy into AmneziaWG, connect, and complete traffic verification before running sudo hubctl confirm on the hub.

Roll back

Run sudo hubctl rollback before the deadline, or let the timer expire. Remove the device entry and redeploy if it should no longer be admitted. Remove temporary hub copies even after a rollback; retain the workstation profile only as long as the device or its protected backup needs it.

Next

Verify traffic, DNS, and fail-closed behavior.