chore!(amneziawg): refactor to be separate from wireguard

- amneziawg is now a VPN protocol and no longer a Wireguard implementation
- Use it with VPN_TYPE=amneziawg
- document AMNEZIAWG_* options in Dockerfile
- document amneziawg support in readme
- separate amneziawg settings and code from wireguard
- re-use code from wireguard whenever possible

internal/configuration/settings/amneziawg.go

@@ -12,33 +12,42 @@ import (
 )
 
 type AmneziaWg struct {
-	JunkPacketCount *uint16 `json:"junk_packet_count"`
-	JunkPacketMin   *uint16 `json:"junk_packet_min"`
-	JunkPacketMax   *uint16 `json:"junk_packet_max"`
-	PaddingS1       *uint16 `json:"padding_s1"`
-	PaddingS2       *uint16 `json:"padding_s2"`
-	PaddingS3       *uint16 `json:"padding_s3"`
-	PaddingS4       *uint16 `json:"padding_s4"`
-	HeaderH1        *string `json:"header_h1"`
-	HeaderH2        *string `json:"header_h2"`
-	HeaderH3        *string `json:"header_h3"`
-	HeaderH4        *string `json:"header_h4"`
-	InitPacketI1    *string `json:"init_packet_i1"`
-	InitPacketI2    *string `json:"init_packet_i2"`
-	InitPacketI3    *string `json:"init_packet_i3"`
-	InitPacketI4    *string `json:"init_packet_i4"`
-	InitPacketI5    *string `json:"init_packet_i5"`
+	// Wireguard contains the configuration for Wireguard, given
+	// AmneziaWg is based on Wireguard
+	Wireguard       Wireguard `json:"wireguard"`
+	JunkPacketCount *uint16   `json:"junk_packet_count"`
+	JunkPacketMin   *uint16   `json:"junk_packet_min"`
+	JunkPacketMax   *uint16   `json:"junk_packet_max"`
+	PaddingS1       *uint16   `json:"padding_s1"`
+	PaddingS2       *uint16   `json:"padding_s2"`
+	PaddingS3       *uint16   `json:"padding_s3"`
+	PaddingS4       *uint16   `json:"padding_s4"`
+	HeaderH1        *string   `json:"header_h1"`
+	HeaderH2        *string   `json:"header_h2"`
+	HeaderH3        *string   `json:"header_h3"`
+	HeaderH4        *string   `json:"header_h4"`
+	InitPacketI1    *string   `json:"init_packet_i1"`
+	InitPacketI2    *string   `json:"init_packet_i2"`
+	InitPacketI3    *string   `json:"init_packet_i3"`
+	InitPacketI4    *string   `json:"init_packet_i4"`
+	InitPacketI5    *string   `json:"init_packet_i5"`
 }
 
-func (s *AmneziaWg) read(r *reader.Reader) (err error) {
+func (a *AmneziaWg) read(r *reader.Reader) (err error) {
+	const amneziawg = true
+	err = a.Wireguard.read(r, amneziawg)
+	if err != nil {
+		return err // do not wrap this error
+	}
+
 	uint16Fields := map[string]**uint16{
-		"AMNEZIAWG_JC":   &s.JunkPacketCount,
-		"AMNEZIAWG_JMIN": &s.JunkPacketMin,
-		"AMNEZIAWG_JMAX": &s.JunkPacketMax,
-		"AMNEZIAWG_S1":   &s.PaddingS1,
-		"AMNEZIAWG_S2":   &s.PaddingS2,
-		"AMNEZIAWG_S3":   &s.PaddingS3,
-		"AMNEZIAWG_S4":   &s.PaddingS4,
+		"AMNEZIAWG_JC":   &a.JunkPacketCount,
+		"AMNEZIAWG_JMIN": &a.JunkPacketMin,
+		"AMNEZIAWG_JMAX": &a.JunkPacketMax,
+		"AMNEZIAWG_S1":   &a.PaddingS1,
+		"AMNEZIAWG_S2":   &a.PaddingS2,
+		"AMNEZIAWG_S3":   &a.PaddingS3,
+		"AMNEZIAWG_S4":   &a.PaddingS4,
 	}
 	for key, dst := range uint16Fields {
 		*dst, err = r.Uint16Ptr(key)
@@ -47,15 +56,15 @@ func (s *AmneziaWg) read(r *reader.Reader) (err error) {
 		}
 	}
 	stringFields := map[string]**string{
-		"AMNEZIAWG_H1": &s.HeaderH1,
-		"AMNEZIAWG_H2": &s.HeaderH2,
-		"AMNEZIAWG_H3": &s.HeaderH3,
-		"AMNEZIAWG_H4": &s.HeaderH4,
-		"AMNEZIAWG_I1": &s.InitPacketI1,
-		"AMNEZIAWG_I2": &s.InitPacketI2,
-		"AMNEZIAWG_I3": &s.InitPacketI3,
-		"AMNEZIAWG_I4": &s.InitPacketI4,
-		"AMNEZIAWG_I5": &s.InitPacketI5,
+		"AMNEZIAWG_H1": &a.HeaderH1,
+		"AMNEZIAWG_H2": &a.HeaderH2,
+		"AMNEZIAWG_H3": &a.HeaderH3,
+		"AMNEZIAWG_H4": &a.HeaderH4,
+		"AMNEZIAWG_I1": &a.InitPacketI1,
+		"AMNEZIAWG_I2": &a.InitPacketI2,
+		"AMNEZIAWG_I3": &a.InitPacketI3,
+		"AMNEZIAWG_I4": &a.InitPacketI4,
+		"AMNEZIAWG_I5": &a.InitPacketI5,
 	}
 	opt := reader.ForceLowercase(false)
 	for key, dst := range stringFields {
@@ -64,80 +73,84 @@ func (s *AmneziaWg) read(r *reader.Reader) (err error) {
 	return nil
 }
 
-func (s AmneziaWg) copy() (copied AmneziaWg) {
+func (a AmneziaWg) copy() (copied AmneziaWg) {
 	return AmneziaWg{
-		JunkPacketCount: gosettings.CopyPointer(s.JunkPacketCount),
-		JunkPacketMin:   gosettings.CopyPointer(s.JunkPacketMin),
-		JunkPacketMax:   gosettings.CopyPointer(s.JunkPacketMax),
-		PaddingS1:       gosettings.CopyPointer(s.PaddingS1),
-		PaddingS2:       gosettings.CopyPointer(s.PaddingS2),
-		PaddingS3:       gosettings.CopyPointer(s.PaddingS3),
-		PaddingS4:       gosettings.CopyPointer(s.PaddingS4),
-		HeaderH1:        gosettings.CopyPointer(s.HeaderH1),
-		HeaderH2:        gosettings.CopyPointer(s.HeaderH2),
-		HeaderH3:        gosettings.CopyPointer(s.HeaderH3),
-		HeaderH4:        gosettings.CopyPointer(s.HeaderH4),
-		InitPacketI1:    gosettings.CopyPointer(s.InitPacketI1),
-		InitPacketI2:    gosettings.CopyPointer(s.InitPacketI2),
-		InitPacketI3:    gosettings.CopyPointer(s.InitPacketI3),
-		InitPacketI4:    gosettings.CopyPointer(s.InitPacketI4),
-		InitPacketI5:    gosettings.CopyPointer(s.InitPacketI5),
+		Wireguard:       a.Wireguard.copy(),
+		JunkPacketCount: gosettings.CopyPointer(a.JunkPacketCount),
+		JunkPacketMin:   gosettings.CopyPointer(a.JunkPacketMin),
+		JunkPacketMax:   gosettings.CopyPointer(a.JunkPacketMax),
+		PaddingS1:       gosettings.CopyPointer(a.PaddingS1),
+		PaddingS2:       gosettings.CopyPointer(a.PaddingS2),
+		PaddingS3:       gosettings.CopyPointer(a.PaddingS3),
+		PaddingS4:       gosettings.CopyPointer(a.PaddingS4),
+		HeaderH1:        gosettings.CopyPointer(a.HeaderH1),
+		HeaderH2:        gosettings.CopyPointer(a.HeaderH2),
+		HeaderH3:        gosettings.CopyPointer(a.HeaderH3),
+		HeaderH4:        gosettings.CopyPointer(a.HeaderH4),
+		InitPacketI1:    gosettings.CopyPointer(a.InitPacketI1),
+		InitPacketI2:    gosettings.CopyPointer(a.InitPacketI2),
+		InitPacketI3:    gosettings.CopyPointer(a.InitPacketI3),
+		InitPacketI4:    gosettings.CopyPointer(a.InitPacketI4),
+		InitPacketI5:    gosettings.CopyPointer(a.InitPacketI5),
 	}
 }
 
-//nolint:dupl
-func (s *AmneziaWg) overrideWith(other AmneziaWg) {
-	s.JunkPacketCount = gosettings.OverrideWithPointer(s.JunkPacketCount, other.JunkPacketCount)
-	s.JunkPacketMin = gosettings.OverrideWithPointer(s.JunkPacketMin, other.JunkPacketMin)
-	s.JunkPacketMax = gosettings.OverrideWithPointer(s.JunkPacketMax, other.JunkPacketMax)
-	s.PaddingS1 = gosettings.OverrideWithPointer(s.PaddingS1, other.PaddingS1)
-	s.PaddingS2 = gosettings.OverrideWithPointer(s.PaddingS2, other.PaddingS2)
-	s.PaddingS3 = gosettings.OverrideWithPointer(s.PaddingS3, other.PaddingS3)
-	s.PaddingS4 = gosettings.OverrideWithPointer(s.PaddingS4, other.PaddingS4)
-	s.HeaderH1 = gosettings.OverrideWithPointer(s.HeaderH1, other.HeaderH1)
-	s.HeaderH2 = gosettings.OverrideWithPointer(s.HeaderH2, other.HeaderH2)
-	s.HeaderH3 = gosettings.OverrideWithPointer(s.HeaderH3, other.HeaderH3)
-	s.HeaderH4 = gosettings.OverrideWithPointer(s.HeaderH4, other.HeaderH4)
-	s.InitPacketI1 = gosettings.OverrideWithPointer(s.InitPacketI1, other.InitPacketI1)
-	s.InitPacketI2 = gosettings.OverrideWithPointer(s.InitPacketI2, other.InitPacketI2)
-	s.InitPacketI3 = gosettings.OverrideWithPointer(s.InitPacketI3, other.InitPacketI3)
-	s.InitPacketI4 = gosettings.OverrideWithPointer(s.InitPacketI4, other.InitPacketI4)
-	s.InitPacketI5 = gosettings.OverrideWithPointer(s.InitPacketI5, other.InitPacketI5)
+func (a *AmneziaWg) overrideWith(other AmneziaWg) {
+	a.Wireguard.overrideWith(other.Wireguard)
+	a.JunkPacketCount = gosettings.OverrideWithPointer(a.JunkPacketCount, other.JunkPacketCount)
+	a.JunkPacketMin = gosettings.OverrideWithPointer(a.JunkPacketMin, other.JunkPacketMin)
+	a.JunkPacketMax = gosettings.OverrideWithPointer(a.JunkPacketMax, other.JunkPacketMax)
+	a.PaddingS1 = gosettings.OverrideWithPointer(a.PaddingS1, other.PaddingS1)
+	a.PaddingS2 = gosettings.OverrideWithPointer(a.PaddingS2, other.PaddingS2)
+	a.PaddingS3 = gosettings.OverrideWithPointer(a.PaddingS3, other.PaddingS3)
+	a.PaddingS4 = gosettings.OverrideWithPointer(a.PaddingS4, other.PaddingS4)
+	a.HeaderH1 = gosettings.OverrideWithPointer(a.HeaderH1, other.HeaderH1)
+	a.HeaderH2 = gosettings.OverrideWithPointer(a.HeaderH2, other.HeaderH2)
+	a.HeaderH3 = gosettings.OverrideWithPointer(a.HeaderH3, other.HeaderH3)
+	a.HeaderH4 = gosettings.OverrideWithPointer(a.HeaderH4, other.HeaderH4)
+	a.InitPacketI1 = gosettings.OverrideWithPointer(a.InitPacketI1, other.InitPacketI1)
+	a.InitPacketI2 = gosettings.OverrideWithPointer(a.InitPacketI2, other.InitPacketI2)
+	a.InitPacketI3 = gosettings.OverrideWithPointer(a.InitPacketI3, other.InitPacketI3)
+	a.InitPacketI4 = gosettings.OverrideWithPointer(a.InitPacketI4, other.InitPacketI4)
+	a.InitPacketI5 = gosettings.OverrideWithPointer(a.InitPacketI5, other.InitPacketI5)
 }
 
-func (s *AmneziaWg) setDefaults() {
-	s.JunkPacketCount = gosettings.DefaultPointer(s.JunkPacketCount, 0)
-	s.JunkPacketMin = gosettings.DefaultPointer(s.JunkPacketMin, 0)
-	s.JunkPacketMax = gosettings.DefaultPointer(s.JunkPacketMax, 0)
-	s.PaddingS1 = gosettings.DefaultPointer(s.PaddingS1, 0)
-	s.PaddingS2 = gosettings.DefaultPointer(s.PaddingS2, 0)
-	s.PaddingS3 = gosettings.DefaultPointer(s.PaddingS3, 0)
-	s.PaddingS4 = gosettings.DefaultPointer(s.PaddingS4, 0)
-	s.HeaderH1 = gosettings.DefaultPointer(s.HeaderH1, "")
-	s.HeaderH2 = gosettings.DefaultPointer(s.HeaderH2, "")
-	s.HeaderH3 = gosettings.DefaultPointer(s.HeaderH3, "")
-	s.HeaderH4 = gosettings.DefaultPointer(s.HeaderH4, "")
-	s.InitPacketI1 = gosettings.DefaultPointer(s.InitPacketI1, "")
-	s.InitPacketI2 = gosettings.DefaultPointer(s.InitPacketI2, "")
-	s.InitPacketI3 = gosettings.DefaultPointer(s.InitPacketI3, "")
-	s.InitPacketI4 = gosettings.DefaultPointer(s.InitPacketI4, "")
-	s.InitPacketI5 = gosettings.DefaultPointer(s.InitPacketI5, "")
+func (a *AmneziaWg) setDefaults(vpnProvider string) {
+	a.Wireguard.setDefaults(vpnProvider)
+	a.Wireguard.Implementation = "userspace" // unused except in logs
+	a.JunkPacketCount = gosettings.DefaultPointer(a.JunkPacketCount, 0)
+	a.JunkPacketMin = gosettings.DefaultPointer(a.JunkPacketMin, 0)
+	a.JunkPacketMax = gosettings.DefaultPointer(a.JunkPacketMax, 0)
+	a.PaddingS1 = gosettings.DefaultPointer(a.PaddingS1, 0)
+	a.PaddingS2 = gosettings.DefaultPointer(a.PaddingS2, 0)
+	a.PaddingS3 = gosettings.DefaultPointer(a.PaddingS3, 0)
+	a.PaddingS4 = gosettings.DefaultPointer(a.PaddingS4, 0)
+	a.HeaderH1 = gosettings.DefaultPointer(a.HeaderH1, "")
+	a.HeaderH2 = gosettings.DefaultPointer(a.HeaderH2, "")
+	a.HeaderH3 = gosettings.DefaultPointer(a.HeaderH3, "")
+	a.HeaderH4 = gosettings.DefaultPointer(a.HeaderH4, "")
+	a.InitPacketI1 = gosettings.DefaultPointer(a.InitPacketI1, "")
+	a.InitPacketI2 = gosettings.DefaultPointer(a.InitPacketI2, "")
+	a.InitPacketI3 = gosettings.DefaultPointer(a.InitPacketI3, "")
+	a.InitPacketI4 = gosettings.DefaultPointer(a.InitPacketI4, "")
+	a.InitPacketI5 = gosettings.DefaultPointer(a.InitPacketI5, "")
 }
 
-func (s AmneziaWg) toLinesNode() (node *gotree.Node) {
-	node = gotree.New("Amneziawg parameters:")
+func (a AmneziaWg) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("AmneziaWG settings:")
+	node.AppendNode(a.Wireguard.toLinesNode())
 
 	uintFields := []struct {
 		key string
 		val *uint16
 	}{
-		{"jc", s.JunkPacketCount},
-		{"jmin", s.JunkPacketMin},
-		{"jmax", s.JunkPacketMax},
-		{"s1", s.PaddingS1},
-		{"s2", s.PaddingS2},
-		{"s3", s.PaddingS3},
-		{"s4", s.PaddingS4},
+		{"JC", a.JunkPacketCount},
+		{"JMIN", a.JunkPacketMin},
+		{"JMAX", a.JunkPacketMax},
+		{"S1", a.PaddingS1},
+		{"S2", a.PaddingS2},
+		{"S3", a.PaddingS3},
+		{"S4", a.PaddingS4},
 	}
 	for _, f := range uintFields {
 		node.Appendf("%s: %d", f.key, *f.val)
@@ -147,15 +160,15 @@ func (s AmneziaWg) toLinesNode() (node *gotree.Node) {
 		key string
 		val *string
 	}{
-		{"h1", s.HeaderH1},
-		{"h2", s.HeaderH2},
-		{"h3", s.HeaderH3},
-		{"h4", s.HeaderH4},
-		{"i1", s.InitPacketI1},
-		{"i2", s.InitPacketI2},
-		{"i3", s.InitPacketI3},
-		{"i4", s.InitPacketI4},
-		{"i5", s.InitPacketI5},
+		{"H1", a.HeaderH1},
+		{"H2", a.HeaderH2},
+		{"H3", a.HeaderH3},
+		{"H4", a.HeaderH4},
+		{"I1", a.InitPacketI1},
+		{"I2", a.InitPacketI2},
+		{"I3", a.InitPacketI3},
+		{"I4", a.InitPacketI4},
+		{"I5", a.InitPacketI5},
 	}
 	for _, f := range stringFields {
 		node.Appendf("%s: %s", f.key, *f.val)
@@ -165,33 +178,40 @@ func (s AmneziaWg) toLinesNode() (node *gotree.Node) {
 }
 
 var (
-	ErrJunkPacketBounds       = errors.New("junk packet minimum must be lower than or equal to maximum")
-	ErrJunkPacketMinMaxNotSet = errors.New("junk packet min and max must be set when junk packet count is set")
-	ErrJunkPacketCountNotSet  = errors.New("junk packet count must be set when junk packet min or max is set")
-	ErrHeaderRangeMalformed   = errors.New("header range is malformed")
+	ErrAmenziawgImplementationNotValid = errors.New("AmneziaWG implementation is not valid")
+	ErrJunkPacketBounds                = errors.New("junk packet minimum must be lower than or equal to maximum")
+	ErrJunkPacketMinMaxNotSet          = errors.New("junk packet min and max must be set when junk packet count is set")
+	ErrJunkPacketCountNotSet           = errors.New("junk packet count must be set when junk packet min or max is set")
+	ErrHeaderRangeMalformed            = errors.New("header range is malformed")
 )
 
-func (s AmneziaWg) validate() error {
-	if *s.JunkPacketCount == 0 {
-		if *s.JunkPacketMin != 0 || *s.JunkPacketMax != 0 {
+func (a AmneziaWg) validate(vpnProvider string, ipv6Supported bool) error {
+	const amneziaWG = true
+	err := a.Wireguard.validate(vpnProvider, ipv6Supported, amneziaWG)
+	if err != nil {
+		return fmt.Errorf("wireguard settings: %w", err)
+	}
+
+	if *a.JunkPacketCount == 0 {
+		if *a.JunkPacketMin != 0 || *a.JunkPacketMax != 0 {
 			return fmt.Errorf("%w: jc=%d and jmin=%d and jmax=%d",
-				ErrJunkPacketCountNotSet, s.JunkPacketCount, *s.JunkPacketMin, *s.JunkPacketMax)
+				ErrJunkPacketCountNotSet, a.JunkPacketCount, *a.JunkPacketMin, *a.JunkPacketMax)
 		}
 	} else {
-		if *s.JunkPacketMin == 0 || *s.JunkPacketMax == 0 {
+		if *a.JunkPacketMin == 0 || *a.JunkPacketMax == 0 {
 			return fmt.Errorf("%w: jc=%d and jmin=%d and jmax=%d",
-				ErrJunkPacketMinMaxNotSet, s.JunkPacketCount, *s.JunkPacketMin, *s.JunkPacketMax)
-		} else if *s.JunkPacketMin > *s.JunkPacketMax {
+				ErrJunkPacketMinMaxNotSet, a.JunkPacketCount, *a.JunkPacketMin, *a.JunkPacketMax)
+		} else if *a.JunkPacketMin > *a.JunkPacketMax {
 			return fmt.Errorf("%w: jmin=%d and jmax=%d",
-				ErrJunkPacketBounds, *s.JunkPacketMin, *s.JunkPacketMax)
+				ErrJunkPacketBounds, *a.JunkPacketMin, *a.JunkPacketMax)
 		}
 	}
 
 	nameToHeaderRange := map[string]string{
-		"h1": *s.HeaderH1,
-		"h2": *s.HeaderH2,
-		"h3": *s.HeaderH3,
-		"h4": *s.HeaderH4,
+		"h1": *a.HeaderH1,
+		"h2": *a.HeaderH2,
+		"h3": *a.HeaderH3,
+		"h4": *a.HeaderH4,
 	}
 	for name, headerRange := range nameToHeaderRange {
 		if headerRange == "" {

internal/configuration/settings/openvpn.go

@@ -268,8 +268,6 @@ func (o *OpenVPN) copy() (copied OpenVPN) {
 // overrideWith overrides fields of the receiver
 // settings object with any field set in the other
 // settings.
-//
-//nolint:dupl
 func (o *OpenVPN) overrideWith(other OpenVPN) {
 	o.Version = gosettings.OverrideWithComparable(o.Version, other.Version)
 	o.User = gosettings.OverrideWithPointer(o.User, other.User)

internal/configuration/settings/provider.go

@@ -30,7 +30,10 @@ type Provider struct {
 func (p *Provider) validate(vpnType string, filterChoicesGetter FilterChoicesGetter, warner Warner) (err error) {
 	// Validate Name
 	var validNames []string
-	if vpnType == vpn.OpenVPN {
+	switch vpnType {
+	case vpn.AmneziaWg:
+		validNames = []string{providers.Custom}
+	case vpn.OpenVPN:
 		validNames = providers.AllWithCustom()
 		validNames = append(validNames, "pia") // Retro-compatibility
 		// Remove Mullvad since it no longer supports OpenVPN as of January 15th, 2026
@@ -38,7 +41,7 @@ func (p *Provider) validate(vpnType string, filterChoicesGetter FilterChoicesGet
 		validNames[mullvadIndex], validNames[len(validNames)-1] = validNames[len(validNames)-1], validNames[mullvadIndex]
 		validNames = validNames[:len(validNames)-1]
 		sort.Strings(validNames)
-	} else { // Wireguard
+	case vpn.Wireguard:
 		validNames = []string{
 			providers.Airvpn,
 			providers.Custom,
@@ -52,7 +55,7 @@ func (p *Provider) validate(vpnType string, filterChoicesGetter FilterChoicesGet
 		}
 	}
 	if err = validate.IsOneOf(p.Name, validNames...); err != nil {
-		return fmt.Errorf("%w for Wireguard: %w", ErrVPNProviderNameNotValid, err)
+		return fmt.Errorf("%w for %s: %w", ErrVPNProviderNameNotValid, vpnType, err)
 	}
 
 	err = p.ServerSelection.validate(p.Name, filterChoicesGetter, warner)

internal/configuration/settings/serverselection.go

@@ -87,7 +87,7 @@ func (ss *ServerSelection) validate(vpnServiceProvider string,
 	filterChoicesGetter FilterChoicesGetter, warner Warner,
 ) (err error) {
 	switch ss.VPN {
-	case vpn.OpenVPN, vpn.Wireguard:
+	case vpn.AmneziaWg, vpn.OpenVPN, vpn.Wireguard:
 	default:
 		return fmt.Errorf("%w: %s", ErrVPNTypeNotValid, ss.VPN)
 	}

internal/configuration/settings/vpn.go

@@ -16,6 +16,7 @@ type VPN struct {
 	// empty string in the internal state.
 	Type      string    `json:"type"`
 	Provider  Provider  `json:"provider"`
+	AmneziaWg AmneziaWg `json:"amneziawg"`
 	OpenVPN   OpenVPN   `json:"openvpn"`
 	Wireguard Wireguard `json:"wireguard"`
 	PMTUD     PMTUD     `json:"pmtud"`
@@ -29,10 +30,12 @@ type VPN struct {
 	DownCommand *string `json:"down_command"`
 }
 
+// Validate validates VPN settings, using the filter choices getter (aka servers data storage),
+// and if IPv6 is supported or not.
 // TODO v4 remove pointer for receiver (because of Surfshark).
 func (v *VPN) Validate(filterChoicesGetter FilterChoicesGetter, ipv6Supported bool, warner Warner) (err error) {
 	// Validate Type
-	validVPNTypes := []string{vpn.OpenVPN, vpn.Wireguard}
+	validVPNTypes := []string{vpn.AmneziaWg, vpn.OpenVPN, vpn.Wireguard}
 	if err = validate.IsOneOf(v.Type, validVPNTypes...); err != nil {
 		return fmt.Errorf("%w: %w", ErrVPNTypeNotValid, err)
 	}
@@ -42,13 +45,20 @@ func (v *VPN) Validate(filterChoicesGetter FilterChoicesGetter, ipv6Supported bo
 		return fmt.Errorf("provider settings: %w", err)
 	}
 
-	if v.Type == vpn.OpenVPN {
+	switch v.Type {
+	case vpn.AmneziaWg:
+		err = v.AmneziaWg.validate(v.Provider.Name, ipv6Supported)
+		if err != nil {
+			return fmt.Errorf("AmneziaWG settings: %w", err)
+		}
+	case vpn.OpenVPN:
 		err := v.OpenVPN.validate(v.Provider.Name)
 		if err != nil {
 			return fmt.Errorf("OpenVPN settings: %w", err)
 		}
-	} else {
-		err := v.Wireguard.validate(v.Provider.Name, ipv6Supported)
+	case vpn.Wireguard:
+		const amneziawg = false
+		err := v.Wireguard.validate(v.Provider.Name, ipv6Supported, amneziawg)
 		if err != nil {
 			return fmt.Errorf("Wireguard settings: %w", err)
 		}
@@ -66,6 +76,7 @@ func (v *VPN) Copy() (copied VPN) {
 	return VPN{
 		Type:        v.Type,
 		Provider:    v.Provider.copy(),
+		AmneziaWg:   v.AmneziaWg.copy(),
 		OpenVPN:     v.OpenVPN.copy(),
 		Wireguard:   v.Wireguard.copy(),
 		PMTUD:       v.PMTUD.copy(),
@@ -77,6 +88,7 @@ func (v *VPN) Copy() (copied VPN) {
 func (v *VPN) OverrideWith(other VPN) {
 	v.Type = gosettings.OverrideWithComparable(v.Type, other.Type)
 	v.Provider.overrideWith(other.Provider)
+	v.AmneziaWg.overrideWith(other.AmneziaWg)
 	v.OpenVPN.overrideWith(other.OpenVPN)
 	v.Wireguard.overrideWith(other.Wireguard)
 	v.PMTUD.overrideWith(other.PMTUD)
@@ -87,6 +99,7 @@ func (v *VPN) OverrideWith(other VPN) {
 func (v *VPN) setDefaults() {
 	v.Type = gosettings.DefaultComparable(v.Type, vpn.OpenVPN)
 	v.Provider.setDefaults()
+	v.AmneziaWg.setDefaults(v.Provider.Name)
 	v.OpenVPN.setDefaults(v.Provider.Name)
 	v.Wireguard.setDefaults(v.Provider.Name)
 	v.PMTUD.setDefaults()
@@ -103,9 +116,12 @@ func (v VPN) toLinesNode() (node *gotree.Node) {
 
 	node.AppendNode(v.Provider.toLinesNode())
 
-	if v.Type == vpn.OpenVPN {
+	switch v.Type {
+	case vpn.AmneziaWg:
+		node.AppendNode(v.AmneziaWg.toLinesNode())
+	case vpn.OpenVPN:
 		node.AppendNode(v.OpenVPN.toLinesNode())
-	} else {
+	case vpn.Wireguard:
 		node.AppendNode(v.Wireguard.toLinesNode())
 	}
 	node.AppendNode(v.PMTUD.toLinesNode())
@@ -128,12 +144,18 @@ func (v *VPN) read(r *reader.Reader) (err error) {
 		return fmt.Errorf("VPN provider: %w", err)
 	}
 
+	err = v.AmneziaWg.read(r)
+	if err != nil {
+		return fmt.Errorf("AmneziaWG: %w", err)
+	}
+
 	err = v.OpenVPN.read(r)
 	if err != nil {
 		return fmt.Errorf("OpenVPN: %w", err)
 	}
 
-	err = v.Wireguard.read(r)
+	const amneziawg = false
+	err = v.Wireguard.read(r, amneziawg)
 	if err != nil {
 		return fmt.Errorf("wireguard: %w", err)
 	}

internal/configuration/settings/wireguard.go

@@ -7,7 +7,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
 	"github.com/qdm12/gluetun/internal/constants/providers"
 	"github.com/qdm12/gosettings"
 	"github.com/qdm12/gosettings/reader"
@@ -42,34 +41,17 @@ type Wireguard struct {
 	// 0 indicating to use PMTUD.
 	MTU *uint32 `json:"mtu"`
 	// Implementation is the Wireguard implementation to use.
-	// It can be "auto", "userspace", "kernelspace" or "amneziawg".
+	// It can be "auto", "userspace" or "kernelspace".
 	// It defaults to "auto" and cannot be the empty string
 	// in the internal state.
 	Implementation string `json:"implementation"`
-	// AmneziaWG contains obfuscation parameters
-	AmneziaWG AmneziaWg `json:"amneziawg"`
 }
 
 var regexpInterfaceName = regexp.MustCompile(`^[a-zA-Z0-9_]+$`)
 
 // Validate validates Wireguard settings.
-// It should only be ran if the VPN type chosen is Wireguard.
-func (w Wireguard) validate(vpnProvider string, ipv6Supported bool) (err error) {
-	if !helpers.IsOneOf(vpnProvider,
-		providers.Airvpn,
-		providers.Custom,
-		providers.Fastestvpn,
-		providers.Ivpn,
-		providers.Mullvad,
-		providers.Nordvpn,
-		providers.Protonvpn,
-		providers.Surfshark,
-		providers.Windscribe,
-	) {
-		// do not validate for VPN provider not supporting Wireguard
-		return nil
-	}
-
+// It should only be ran if the VPN type chosen is Wireguard or AmneziaWg.
+func (w Wireguard) validate(vpnProvider string, ipv6Supported, amneziawg bool) (err error) {
 	// Validate PrivateKey
 	if *w.PrivateKey == "" {
 		return fmt.Errorf("%w", ErrWireguardPrivateKeyNotSet)
@@ -138,14 +120,11 @@ func (w Wireguard) validate(vpnProvider string, ipv6Supported bool) (err error)
 			ErrWireguardInterfaceNotValid, w.Interface, regexpInterfaceName)
 	}
 
-	validImplementations := []string{"auto", "userspace", "kernelspace", "amneziawg"}
-	if err := validate.IsOneOf(w.Implementation, validImplementations...); err != nil {
-		return fmt.Errorf("%w: %w", ErrWireguardImplementationNotValid, err)
-	}
-
-	err = w.AmneziaWG.validate()
-	if err != nil {
-		return fmt.Errorf("amneziawg settings: %w", err)
+	if !amneziawg { // amneziawg should have its own Implementation field and ignore this one
+		validImplementations := []string{"auto", "userspace", "kernelspace"}
+		if err := validate.IsOneOf(w.Implementation, validImplementations...); err != nil {
+			return fmt.Errorf("%w: %w", ErrWireguardImplementationNotValid, err)
+		}
 	}
 
 	return nil
@@ -161,7 +140,6 @@ func (w *Wireguard) copy() (copied Wireguard) {
 		Interface:                   w.Interface,
 		MTU:                         w.MTU,
 		Implementation:              w.Implementation,
-		AmneziaWG:                   w.AmneziaWG.copy(),
 	}
 }
 
@@ -175,7 +153,6 @@ func (w *Wireguard) overrideWith(other Wireguard) {
 	w.Interface = gosettings.OverrideWithComparable(w.Interface, other.Interface)
 	w.MTU = gosettings.OverrideWithComparable(w.MTU, other.MTU)
 	w.Implementation = gosettings.OverrideWithComparable(w.Implementation, other.Implementation)
-	w.AmneziaWG.overrideWith(other.AmneziaWG)
 }
 
 func (w *Wireguard) setDefaults(vpnProvider string) {
@@ -200,7 +177,6 @@ func (w *Wireguard) setDefaults(vpnProvider string) {
 	w.Interface = gosettings.DefaultComparable(w.Interface, "wg0")
 	w.MTU = gosettings.DefaultPointer(w.MTU, 0)
 	w.Implementation = gosettings.DefaultComparable(w.Implementation, "auto")
-	w.AmneziaWG.setDefaults()
 }
 
 func (w Wireguard) String() string {
@@ -242,29 +218,27 @@ func (w Wireguard) toLinesNode() (node *gotree.Node) {
 	}
 
 	if w.Implementation != "auto" {
-		implNode := node.Appendf("Implementation: %s", w.Implementation)
-
-		if w.Implementation == "amneziawg" {
-			implNode.AppendNode(w.AmneziaWG.toLinesNode())
-		}
+		node.Appendf("Implementation: %s", w.Implementation)
 	}
 
 	return node
 }
 
-func (w *Wireguard) read(r *reader.Reader) (err error) {
-	w.PrivateKey = r.Get("WIREGUARD_PRIVATE_KEY", reader.ForceLowercase(false))
-	w.PreSharedKey = r.Get("WIREGUARD_PRESHARED_KEY", reader.ForceLowercase(false))
+func (w *Wireguard) read(r *reader.Reader, amneziaWG bool) (err error) {
+	prefix := "WIREGUARD"
+	if amneziaWG {
+		prefix = "AMNEZIAWG"
+	}
+	w.PrivateKey = r.Get(prefix+"_PRIVATE_KEY", reader.ForceLowercase(false))
+	w.PreSharedKey = r.Get(prefix+"_PRESHARED_KEY", reader.ForceLowercase(false))
 	w.Interface = r.String("VPN_INTERFACE",
-		reader.RetroKeys("WIREGUARD_INTERFACE"), reader.ForceLowercase(false))
-	w.Implementation = r.String("WIREGUARD_IMPLEMENTATION")
+		reader.RetroKeys(prefix+"_INTERFACE"), reader.ForceLowercase(false))
 
-	err = w.AmneziaWG.read(r)
-	if err != nil {
-		return err
+	if !amneziaWG {
+		w.Implementation = r.String("WIREGUARD_IMPLEMENTATION")
 	}
 
-	addressStrings := r.CSV("WIREGUARD_ADDRESSES", reader.RetroKeys("WIREGUARD_ADDRESS"))
+	addressStrings := r.CSV(prefix+"_ADDRESSES", reader.RetroKeys(prefix+"_ADDRESS"))
 	// WARNING: do not initialize w.Addresses to an empty slice
 	// or the defaults for nordvpn will not work.
 	for _, addressString := range addressStrings {
@@ -279,17 +253,17 @@ func (w *Wireguard) read(r *reader.Reader) (err error) {
 		w.Addresses = append(w.Addresses, address)
 	}
 
-	w.AllowedIPs, err = r.CSVNetipPrefixes("WIREGUARD_ALLOWED_IPS")
+	w.AllowedIPs, err = r.CSVNetipPrefixes(prefix + "_ALLOWED_IPS")
 	if err != nil {
 		return err // already wrapped
 	}
 
-	w.PersistentKeepaliveInterval, err = r.DurationPtr("WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL")
+	w.PersistentKeepaliveInterval, err = r.DurationPtr(prefix + "_PERSISTENT_KEEPALIVE_INTERVAL")
 	if err != nil {
 		return err
 	}
 
-	w.MTU, err = r.Uint32Ptr("WIREGUARD_MTU")
+	w.MTU, err = r.Uint32Ptr(prefix + "_MTU")
 	if err != nil {
 		return err
 	}

internal/configuration/sources/files/amneziawg.go

@@ -0,0 +1,84 @@
+package files
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"gopkg.in/ini.v1"
+)
+
+func (s *Source) lazyLoadAmneziawgConf() AmneziawgConfig {
+	if s.cached.amneziawgLoaded {
+		return s.cached.amneziawgConf
+	}
+
+	s.cached.amneziawgLoaded = true
+	var err error
+	s.cached.amneziawgConf, err = ParseAmneziawgConf(filepath.Join(s.rootDirectory, "amneziawg", "awg0.conf"))
+	if err != nil {
+		s.warner.Warnf("skipping Amneziawg config: %s", err)
+	}
+	return s.cached.amneziawgConf
+}
+
+type AmneziawgConfig struct {
+	Wireguard WireguardConfig
+	Jc        *string
+	Jmin      *string
+	Jmax      *string
+	S1        *string
+	S2        *string
+	S3        *string
+	S4        *string
+	H1        *string
+	H2        *string
+	H3        *string
+	H4        *string
+	I1        *string
+	I2        *string
+	I3        *string
+	I4        *string
+	I5        *string
+}
+
+func ParseAmneziawgConf(path string) (config AmneziawgConfig, err error) {
+	iniFile, err := ini.InsensitiveLoad(path)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return AmneziawgConfig{}, nil
+		}
+		return AmneziawgConfig{}, fmt.Errorf("loading ini from reader: %w", err)
+	}
+
+	config.Wireguard, err = ParseWireguardConf(path)
+	if err != nil {
+		return AmneziawgConfig{}, err
+	}
+
+	interfaceSection, err := iniFile.GetSection("Interface")
+	if err != nil {
+		// can never happen
+		return AmneziawgConfig{}, fmt.Errorf("getting interface section: %w", err)
+	}
+
+	config.Jc = getINIKeyFromSection(interfaceSection, "Jc")
+	config.Jmin = getINIKeyFromSection(interfaceSection, "Jmin")
+	config.Jmax = getINIKeyFromSection(interfaceSection, "Jmax")
+	config.S1 = getINIKeyFromSection(interfaceSection, "S1")
+	config.S2 = getINIKeyFromSection(interfaceSection, "S2")
+	config.S3 = getINIKeyFromSection(interfaceSection, "S3")
+	config.S4 = getINIKeyFromSection(interfaceSection, "S4")
+	config.H1 = getINIKeyFromSection(interfaceSection, "H1")
+	config.H2 = getINIKeyFromSection(interfaceSection, "H2")
+	config.H3 = getINIKeyFromSection(interfaceSection, "H3")
+	config.H4 = getINIKeyFromSection(interfaceSection, "H4")
+	config.I1 = getINIKeyFromSection(interfaceSection, "I1")
+	config.I2 = getINIKeyFromSection(interfaceSection, "I2")
+	config.I3 = getINIKeyFromSection(interfaceSection, "I3")
+	config.I4 = getINIKeyFromSection(interfaceSection, "I4")
+	config.I5 = getINIKeyFromSection(interfaceSection, "I5")
+
+	return config, nil
+}

internal/configuration/sources/files/amneziawg_test.go

@@ -0,0 +1,82 @@
+package files
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_Source_ParseAmneziawgConf(t *testing.T) {
+	t.Parallel()
+
+	t.Run("no_file", func(t *testing.T) {
+		t.Parallel()
+
+		noFile := filepath.Join(t.TempDir(), "doesnotexist")
+		wireguard, err := ParseAmneziawgConf(noFile)
+		assert.Equal(t, AmneziawgConfig{}, wireguard)
+		assert.NoError(t, err)
+	})
+
+	testCases := map[string]struct {
+		fileContent string
+		amneziawg   AmneziawgConfig
+		errMessage  string
+	}{
+		"ini_load_error": {
+			fileContent: "invalid",
+			errMessage:  "loading ini from reader: key-value delimiter not found: invalid",
+		},
+		"empty_file": {
+			errMessage: `getting interface section: section "interface" does not exist`,
+		},
+		"success": {
+			fileContent: `
+[Interface]
+PrivateKey = QOlCgyA/Sn/c/+YNTIEohrjm8IZV+OZ2AUFIoX20sk8=
+Address = 10.38.22.35/32
+DNS = 193.138.218.74
+Jc = 4
+H1 = 721391205
+I1 = <b 0x1234>
+
+[Peer]
+PresharedKey = YJ680VN+dGrdsWNjSFqZ6vvwuiNhbq502ZL3G7Q3o3g=
+`,
+			amneziawg: AmneziawgConfig{
+				Wireguard: WireguardConfig{
+					PrivateKey:   ptrTo("QOlCgyA/Sn/c/+YNTIEohrjm8IZV+OZ2AUFIoX20sk8="),
+					PreSharedKey: ptrTo("YJ680VN+dGrdsWNjSFqZ6vvwuiNhbq502ZL3G7Q3o3g="),
+					Addresses:    ptrTo("10.38.22.35/32"),
+				},
+				Jc: ptrTo("4"),
+				H1: ptrTo("721391205"),
+				I1: ptrTo("<b 0x1234>"),
+			},
+		},
+	}
+
+	for testName, testCase := range testCases {
+		t.Run(testName, func(t *testing.T) {
+			t.Parallel()
+
+			configFile := filepath.Join(t.TempDir(), "awg.conf")
+			const permission = fs.FileMode(0o600)
+			err := os.WriteFile(configFile, []byte(testCase.fileContent), permission)
+			require.NoError(t, err)
+
+			wireguard, err := ParseAmneziawgConf(configFile)
+
+			assert.Equal(t, testCase.amneziawg, wireguard)
+			if testCase.errMessage != "" {
+				assert.EqualError(t, err, testCase.errMessage)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

internal/configuration/sources/files/reader.go

@@ -13,6 +13,8 @@ type Source struct {
 	cached        struct {
 		wireguardLoaded bool
 		wireguardConf   WireguardConfig
+		amneziawgLoaded bool
+		amneziawgConf   AmneziawgConfig
 	}
 }
 
@@ -69,38 +71,11 @@ func (s *Source) Get(key string) (value string, isSet bool) {
 		return strPtrToStringIsSet(s.lazyLoadWireguardConf().EndpointIP)
 	case "wireguard_endpoint_port":
 		return strPtrToStringIsSet(s.lazyLoadWireguardConf().EndpointPort)
-	case "wireguard_jc":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.Jc)
-	case "wireguard_jmin":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.Jmin)
-	case "wireguard_jmax":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.Jmax)
-	case "wireguard_s1":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S1)
-	case "wireguard_s2":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S2)
-	case "wireguard_s3":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S3)
-	case "wireguard_s4":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S4)
-	case "wireguard_h1":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H1)
-	case "wireguard_h2":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H2)
-	case "wireguard_h3":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H3)
-	case "wireguard_h4":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H4)
-	case "wireguard_i1":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I1)
-	case "wireguard_i2":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I2)
-	case "wireguard_i3":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I3)
-	case "wireguard_i4":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I4)
-	case "wireguard_i5":
-		return strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I5)
+	}
+
+	value, isSet, matched := s.getAmneziawgKey(key)
+	if matched {
+		return value, isSet
 	}
 
 	value, isSet, err := ReadFromFile(path)
@@ -110,6 +85,58 @@ func (s *Source) Get(key string) (value string, isSet bool) {
 	return value, isSet
 }
 
+func (s *Source) getAmneziawgKey(key string) (value string, isSet, matched bool) {
+	switch key {
+	case "amnezia_private_key":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.PrivateKey)
+	case "amnezia_preshared_key":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.PreSharedKey)
+	case "amnezia_addresses":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.Addresses)
+	case "amnezia_public_key":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.PublicKey)
+	case "amnezia_endpoint_ip":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.EndpointIP)
+	case "amnezia_endpoint_port":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.EndpointPort)
+	case "amnezia_jc":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Jc)
+	case "amnezia_jmin":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Jmin)
+	case "amnezia_jmax":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Jmax)
+	case "amnezia_s1":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S1)
+	case "amnezia_s2":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S2)
+	case "amnezia_s3":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S3)
+	case "amnezia_s4":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S4)
+	case "amnezia_h1":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H1)
+	case "amnezia_h2":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H2)
+	case "amnezia_h3":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H3)
+	case "amnezia_h4":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H4)
+	case "amnezia_i1":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I1)
+	case "amnezia_i2":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I2)
+	case "amnezia_i3":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I3)
+	case "amnezia_i4":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I4)
+	case "amnezia_i5":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I5)
+	default:
+		return "", false, false
+	}
+	return value, isSet, true
+}
+
 func (s *Source) KeyTransform(key string) string {
 	switch key {
 	// TODO v4 remove these irregular cases

internal/configuration/sources/files/wireguard.go

@@ -25,54 +25,13 @@ func (s *Source) lazyLoadWireguardConf() WireguardConfig {
 	return s.cached.wireguardConf
 }
 
-type amneziaWgConfig struct {
-	Jc   *string
-	Jmin *string
-	Jmax *string
-	S1   *string
-	S2   *string
-	S3   *string
-	S4   *string
-	H1   *string
-	H2   *string
-	H3   *string
-	H4   *string
-	I1   *string
-	I2   *string
-	I3   *string
-	I4   *string
-	I5   *string
-}
-
-func parseWireguardAmneziaInterfaceSection(interfaceSection *ini.Section) amneziaWgConfig {
-	return amneziaWgConfig{
-		Jc:   getINIKeyFromSection(interfaceSection, "Jc"),
-		Jmin: getINIKeyFromSection(interfaceSection, "Jmin"),
-		Jmax: getINIKeyFromSection(interfaceSection, "Jmax"),
-		S1:   getINIKeyFromSection(interfaceSection, "S1"),
-		S2:   getINIKeyFromSection(interfaceSection, "S2"),
-		S3:   getINIKeyFromSection(interfaceSection, "S3"),
-		S4:   getINIKeyFromSection(interfaceSection, "S4"),
-		H1:   getINIKeyFromSection(interfaceSection, "H1"),
-		H2:   getINIKeyFromSection(interfaceSection, "H2"),
-		H3:   getINIKeyFromSection(interfaceSection, "H3"),
-		H4:   getINIKeyFromSection(interfaceSection, "H4"),
-		I1:   getINIKeyFromSection(interfaceSection, "I1"),
-		I2:   getINIKeyFromSection(interfaceSection, "I2"),
-		I3:   getINIKeyFromSection(interfaceSection, "I3"),
-		I4:   getINIKeyFromSection(interfaceSection, "I4"),
-		I5:   getINIKeyFromSection(interfaceSection, "I5"),
-	}
-}
-
 type WireguardConfig struct {
-	PrivateKey    *string
-	PreSharedKey  *string
-	Addresses     *string
-	PublicKey     *string
-	EndpointIP    *string
-	EndpointPort  *string
-	AmneziaParams amneziaWgConfig
+	PrivateKey   *string
+	PreSharedKey *string
+	Addresses    *string
+	PublicKey    *string
+	EndpointIP   *string
+	EndpointPort *string
 }
 
 var regexINISectionNotExist = regexp.MustCompile(`^section ".+" does not exist$`)
@@ -89,7 +48,6 @@ func ParseWireguardConf(path string) (config WireguardConfig, err error) {
 	interfaceSection, err := iniFile.GetSection("Interface")
 	if err == nil {
 		config.PrivateKey, config.Addresses = parseWireguardInterfaceSection(interfaceSection)
-		config.AmneziaParams = parseWireguardAmneziaInterfaceSection(interfaceSection)
 	} else if !regexINISectionNotExist.MatchString(err.Error()) {
 		// can never happen
 		return WireguardConfig{}, fmt.Errorf("getting interface section: %w", err)

internal/configuration/sources/files/wireguard_test.go

@@ -97,10 +97,9 @@ func Test_parseWireguardInterfaceSection(t *testing.T) {
 	t.Parallel()
 
 	testCases := map[string]struct {
-		iniData       string
-		privateKey    *string
-		addresses     *string
-		amneziaParams amneziaWgConfig
+		iniData    string
+		privateKey *string
+		addresses  *string
 	}{
 		"no_fields": {
 			iniData: `[Interface]`,
@@ -116,17 +115,9 @@ PrivateKey = x
 [Interface]
 PrivateKey = QOlCgyA/Sn/c/+YNTIEohrjm8IZV+OZ2AUFIoX20sk8=
 Address = 10.38.22.35/32
-Jc = 4
-H1 = 721391205
-I1 = <b 0x1234>
 `,
 			privateKey: ptrTo("QOlCgyA/Sn/c/+YNTIEohrjm8IZV+OZ2AUFIoX20sk8="),
 			addresses:  ptrTo("10.38.22.35/32"),
-			amneziaParams: amneziaWgConfig{
-				Jc: ptrTo("4"),
-				H1: ptrTo("721391205"),
-				I1: ptrTo("<b 0x1234>"),
-			},
 		},
 	}
 
@@ -140,11 +131,9 @@ I1 = <b 0x1234>
 			require.NoError(t, err)
 
 			privateKey, addresses := parseWireguardInterfaceSection(iniSection)
-			amneziaWgConfig := parseWireguardAmneziaInterfaceSection(iniSection)
 
 			assert.Equal(t, testCase.privateKey, privateKey)
 			assert.Equal(t, testCase.addresses, addresses)
-			assert.Equal(t, testCase.amneziaParams, amneziaWgConfig)
 		})
 	}
 }

internal/configuration/sources/secrets/amneziawg.go

@@ -0,0 +1,27 @@
+package secrets
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/qdm12/gluetun/internal/configuration/sources/files"
+)
+
+func (s *Source) lazyLoadAmneziawgConf() files.AmneziawgConfig {
+	if s.cached.amneziawgLoaded {
+		return s.cached.amneziawgConf
+	}
+
+	path := os.Getenv("AMNEZIAWG_CONF_SECRETFILE")
+	if path == "" {
+		path = filepath.Join(s.rootDirectory, "amneziawg", "awg0.conf")
+	}
+
+	s.cached.amneziawgLoaded = true
+	var err error
+	s.cached.amneziawgConf, err = files.ParseAmneziawgConf(path)
+	if err != nil {
+		s.warner.Warnf("skipping Amneziawg config: %s", err)
+	}
+	return s.cached.amneziawgConf
+}

internal/configuration/sources/secrets/reader.go

@@ -15,6 +15,8 @@ type Source struct {
 	cached        struct {
 		wireguardLoaded bool
 		wireguardConf   files.WireguardConfig
+		amneziawgLoaded bool
+		amneziawgConf   files.AmneziawgConfig
 	}
 }
 
@@ -60,26 +62,26 @@ func (s *Source) Get(key string) (value string, isSet bool) {
 			s.warner.Warnf("skipping %s: parsing PEM: %s", path, err)
 		}
 		return value, isSet
-	case "wireguard_private_key":
+	case "wireguard_private_key", "amneziawg_private_key":
 		privateKey := s.lazyLoadWireguardConf().PrivateKey
 		if privateKey != nil {
 			return *privateKey, true
 		} // else continue to read from individual secret file
-	case "wireguard_preshared_key":
+	case "wireguard_preshared_key", "amneziawg_preshared_key":
 		preSharedKey := s.lazyLoadWireguardConf().PreSharedKey
 		if preSharedKey != nil {
 			return *preSharedKey, true
 		} // else continue to read from individual secret file
-	case "wireguard_addresses":
+	case "wireguard_addresses", "amneziawg_addresses":
 		addresses := s.lazyLoadWireguardConf().Addresses
 		if addresses != nil {
 			return *addresses, true
 		} // else continue to read from individual secret file
-	case "wireguard_public_key":
+	case "wireguard_public_key", "amneziawg_public_key":
 		return strPtrToStringIsSet(s.lazyLoadWireguardConf().PublicKey)
-	case "wireguard_endpoint_ip":
+	case "wireguard_endpoint_ip", "amneziawg_endpoint_ip":
 		return strPtrToStringIsSet(s.lazyLoadWireguardConf().EndpointIP)
-	case "wireguard_endpoint_port":
+	case "wireguard_endpoint_port", "amneziawg_endpoint_port":
 		return strPtrToStringIsSet(s.lazyLoadWireguardConf().EndpointPort)
 	}
 
@@ -112,38 +114,50 @@ func (s *Source) KeyTransform(key string) string {
 
 func (s *Source) getAmneziaWg(key string) (value string, isSet, matched bool) {
 	switch key {
-	case "wireguard_jc":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.Jc)
-	case "wireguard_jmin":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.Jmin)
-	case "wireguard_jmax":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.Jmax)
-	case "wireguard_s1":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S1)
-	case "wireguard_s2":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S2)
-	case "wireguard_s3":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S3)
-	case "wireguard_s4":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.S4)
-	case "wireguard_h1":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H1)
-	case "wireguard_h2":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H2)
-	case "wireguard_h3":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H3)
-	case "wireguard_h4":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.H4)
-	case "wireguard_i1":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I1)
-	case "wireguard_i2":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I2)
-	case "wireguard_i3":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I3)
-	case "wireguard_i4":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I4)
-	case "wireguard_i5":
-		value, isSet = strPtrToStringIsSet(s.lazyLoadWireguardConf().AmneziaParams.I5)
+	case "amneziawg_private_key":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.PrivateKey)
+	case "amneziawg_preshared_key":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.PreSharedKey)
+	case "wireguard_addresses", "amneziawg_addresses":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.Addresses)
+	case "wireguard_public_key", "amneziawg_public_key":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.PublicKey)
+	case "wireguard_endpoint_ip", "amneziawg_endpoint_ip":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.EndpointIP)
+	case "wireguard_endpoint_port", "amneziawg_endpoint_port":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Wireguard.EndpointPort)
+	case "amneziawg_jc":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Jc)
+	case "amneziawg_jmin":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Jmin)
+	case "amneziawg_jmax":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().Jmax)
+	case "amneziawg_s1":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S1)
+	case "amneziawg_s2":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S2)
+	case "amneziawg_s3":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S3)
+	case "amneziawg_s4":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().S4)
+	case "amneziawg_h1":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H1)
+	case "amneziawg_h2":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H2)
+	case "amneziawg_h3":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H3)
+	case "amneziawg_h4":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().H4)
+	case "amneziawg_i1":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I1)
+	case "amneziawg_i2":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I2)
+	case "amneziawg_i3":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I3)
+	case "amneziawg_i4":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I4)
+	case "amneziawg_i5":
+		value, isSet = strPtrToStringIsSet(s.lazyLoadAmneziawgConf().I5)
 	default:
 		return "", false, false
 	}