WireGuard VPN Manager

Quote from Reddirt

Ahem. I vaguely recall this issue during early beta tests or am I dreaming it?

Could be, at boot connman-vpnd caught PIA wireguard config file mid-write ("does not contain any configuration that can be provisioned!"), creating a half-second window where both the addon and the LibreELEC settings service were racing for connman resources. On some specific hardware that window caused the permanent hang.

Two fixes are now in place for next v1.5.4:

1. Cold boot connect gate — automatic VPN provisioning waits for a platform-specific settle time after service start before triggering the connection. This removes the startup overlap entirely.
2. Atomic config writes (PIA only) — WireGuard configs are now written via temp-file + atomic rename. connman-vpnd will never see a truncated/empty file again, eliminating the "not provisionable" error.

Quote from rivmar

Hi, I have Librelec and installed Wireguard Manager 1.5.3. I'd like to activate it with Proton. I downloaded the file .conf and renamed it .config. I added it to IMPORT Config. Everything is fine. When I click on Wireguard, it tries to connect but fails. This is the file:

Code

[provider_wireguard]
Type = WireGuard
Name = Custom_Proton_CH
Host = 138.199.6.178
DNS = 10.2.0.1, 2a07:b944::2:1
WireGuard.Address = 10.2.0.2/32, 2a07:b944::2:2/128
WireGuard.ListenPort = 51820
WireGuard.MTU = 1420
WireGuard.PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
#CH-FREE#3
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
WireGuard.AllowedIPs = 0.0.0.0/0, ::/0
WireGuard.EndpointPort = 138.199.6.178:51820
WireGuard.PersistentKeepalive = 25

Display More

Can someone help me understand what I'm doing wrong? Thanks in advance.

Try this config:

[provider_wireguard]
Type = WireGuard
Name = Custom_Proton_CH
Host = 138.199.6.178
DNS = 10.2.0.1
WireGuard.Address = 10.2.0.2/32
WireGuard.ListenPort = 51820
WireGuard.MTU = 1420
WireGuard.PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
#CH-FREE#3
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
WireGuard.AllowedIPs = 0.0.0.0/0, ::/0
WireGuard.EndpointPort = 51820
WireGuard.PersistentKeepalive = 25

I need to see the log if it still fails. To post logs to this forum, copy and paste the following into SSH:

grep -i "service.wireguard.manager" /storage/.kodi/temp/kodi.log | pastebinit

And post that URL here. How to post a log (wiki)

1. Enable debugging in Settings>System Settings>Logging
2. Restart Kodi
3. Replicate the problem
4. Generate a log URL (do not post/upload logs to the forum)
5. Use "Settings > LibreELEC > System > Paste system logs" or run "pastekodi" over SSH, then post the URL link

Also read our wiki https://github.com/BrodjagaRatnik…rd.manager/wiki

Salute.

Hello rivmar

I can see the issue you're encountering. The error curl: (60) SSL certificate problem: certificate is not yet valid indicates that your LibreELEC device's system clock is likely incorrect (set to a date in the past), causing pastebinit (which uses curl) to fail when trying to verify the SSL certificate of the paste service.

Here is how to fix this and successfully get your log URL:

LibreELEC devices often lose time if they don't have NTP configured correctly.

1. Connect via SSH to your LibreELEC device.

2. Run the following command to check the current time:

   Shell session

   date

3. If the date shown is in the past, this confirms the issue.
4. Adjust the date/time to match your actual current time forcing an NTP sync:

ntpd -q -p pool.ntp.org

Once the time is corrected, try running the grep command again:

grep -i "service.wireguard.manager" /storage/.kodi/temp/kodi.log | pastebinit

Let me know if fixing the time resolves the pastebinit error, or feel free to do this:

cat ~/.kodi/temp/kodi.log | grep -iE "service.wireguard.manager" | nc termbin.com 9999

Termbin does not use HTTPS — it runs over a plain TCP connection on port 9999 via netcat. Therefore, no SSL certificate verification is required, which completely bypasses the error ‘curl: (60) certificate is not yet valid’. The error message “certificate is not yet valid” almost certainly indicates that the system clock on the device is incorrect. This doesn’t matter for Termbin, but it’s still a good idea to check it using the `date` command, as an incorrect clock can also cause problems with other HTTPS connections.

Salute.

To change the NTP server using the LibreELEC user interface, you need to use the LibreELEC Settings Add-on inside Kodi. Here are the step-by-step instructions:

1. Open LibreELEC Settings:
   • From the Kodi main menu, navigate to Settings (the gear icon at the top left).
   • Click on LibreELEC (usually located at the bottom or under the system category).
2. Navigate to the Network Tab:
   • Scroll down the left-hand menu and select Network.
3. Change the Timeserver:
   • On the right side, scroll down to the Network Services section.
   • Click on Timeserver #1 (or Timeserver #2/3 if you want backups).
   • A virtual keyboard will pop up.
   • You will see three slots available:
     1. Timeserver #1: 0.pool.ntp.org (or pool.ntp.org)
     2. Timeserver #2: 1.pool.ntp.org
     3. Timeserver #3: 2.pool.ntp.org
   • Click OK or Done.
4. Save and Apply:
   • The system will automatically save the changes and attempt to sync the time using the new server.

Salute.