# DietPi 10.8 adds WireGuard management tool and named software IDs

> **Key takeaway:** DietPi 10.8 introduces dietpi-wireguard for managing VPN servers and clients, replaces numeric software IDs with descriptive names, and hardens HAProxy with unprivileged worker processes.

**Published:** 2026-10-21T22:47:27+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/dietpi-108-adds-wireguard-management-tool-and-named-software.html 

## Summary
DietPi 10.8, a lightweight Debian-based distribution for SBCs and servers, adds dietpi-wireguard for interactive or command-line WireGuard VPN management including QR code client configs and IPv6 forwarding. The dietpi-software utility now supports descriptive identifiers like 'nodered' alongside legacy numeric IDs. HAProxy is now delivered as a prebuilt DEB package with hardened defaults including a dedicated unprivileged account and systemd sandboxing. Several networking bugs in Wi-Fi hotspot and static interface configuration are also fixed.

## What's new in DietPi 10.8
- **dietpi-wireguard**: New utility for managing WireGuard servers/clients via TUI menu or CLI; supports QR code display of client configs, IPv6 forwarding and NAT66 for new servers, and works with existing /etc/wireguard configurations
- **Named software IDs**: dietpi-software accepts descriptive identifiers (e.g., `nodered` instead of `122`) for install, search, and automation; numeric IDs remain valid; existing configs auto-migrated
- **HAProxy packaging change**: Now provided as DEB from DietPi's APT repo instead of compiled from source; `apt upgrade` handles future updates
- **HAProxy hardening**: Worker processes run under dedicated `haproxy` unprivileged account; additional systemd sandboxing restrictions added; existing config files preserved
- **Networking fixes**: Static interfaces configurable without default gateway; Docker/container virtual interfaces hidden from dietpi-network menu; Wi-Fi hotspot settings no longer revert unexpectedly; wpa_supplicant no longer incorrectly starts in hotspot mode; improved default gateway conflict detection and stricter validation for IP, prefix, and DNS parameters
- **Other changes**: dietpi-config time sync timeout adjustable (default 60s); hostname setting moved to network section; Immich thumbnail and ML startup fixes; Immich ML drops Debian Bookworm/Forky support due to Python requirements

## Why it matters
The WireGuard management tool lowers the barrier for self-hosted VPN deployment on resource-constrained devices, a common DietPi use case. Named software IDs improve script readability and maintainability for automation users.