Can't get wag up and running

[this-username-has-been-taken]

Hello!

I have never used wag before and got in trouble with running it for the first time.
I am using a clean Debian 12 server with iptables and wireguard packages installed.
Steps I took to run wag:

1. Installed iptables, wireguard
2. Created wg0.conf in /etc/wireguard:

[Interface]
Address = 172.17.20.1/24
ListenPort = 44441
PrivateKey = CA1MWt2pYrGu9Tf/NqtXLVjaB2/gB8hoxU26ySGBvk0=

3. Downloaded wag, copied it to /opt/wag, made it executable.
4. Generated the following config:

{
    "NumberProxies": 1,
    "Proxied": false,
    "HelpMail": "support@somedomain.org",
    "Lockout": 5,
    "ExternalAddress": "vpn.somedomain.org",
    "MaxSessionLifetimeMinutes": 1440,
    "SessionInactivityTimeoutMinutes": 60,
    "ManagementUI": {
        "ListenAddress": ":4433",
        "Enabled": true,
        "Debug": true
    },
    "Webserver": {
        "Public": {
            "ListenAddress": ":8080"
        },
        "Tunnel": {
            "Port": "443"
        }
    },
    "Authenticators": {
        "Issuer": "SomeCompany",
        "Methods": [
            "totp"
        ],
        "DomainURL": "somedomain.org"
    },
    "Wireguard": {
        "DevName": "wg0",
        "ListenPort": 44441,
        "PrivateKey": "CA1MWt2pYrGu9Tf/NqtXLVjaB2/gB8hoxU26ySGBvk0=",
        "Address": "172.19.20.1/24",
        "MTU": 0,
        "ServerPersistentKeepAlive": 0
    },
    "DatabaseLocation": "devices.db",
    "Acls": {
        "Policies": {
            "*": {
                "Mfa": [
                     "172.17.17.1/24",
                     "172.17.18.1/24",
                     "172.17.19.1/24"
                ],
                "Allow": [
                    "google.com"
                ]
            }
        }
    }
}

Now if I run ./wag start - the only thing I get is:

2024/11/06 15:13:34 no listen url was specified for the etcd cluster TLS manager, new wag servers will not be able to join

And nothing else happens: no more logs are produced, no interface is set up.

I appreciate any advice how to get wag up and running.

[NHAS]

Your config doesn't define the clustering section.

Clustering": {
"ClusterState": "new",
"ETCDLogLevel": "error",
"Witness": false,
"TLSManagerListenURL": "https://127.0.0.1:3434"
},

[this-username-has-been-taken]

Thank you!
It worked! The gen-config command didn't put anything in this section - so I thought it could be omitted.

[NHAS]

Ah I apologise for that. I have been working on some rather large changes in wag and haven't kept the gen config up to date.

[this-username-has-been-taken]

No worries! It is impossible to do all the tasks at the same time!
Thank you very much for the quick answer!

Side question if possible: how would you recommend to secure management GUI if not with ssh-tunnel? I.e. if GUI listens to a real IP/hostname