Install WireGuard and create keys

Install WireGuard on the Ubuntu server:

sudo apt update
sudo apt install wireguard

Create the server keys with restrictive file permissions:

umask 077
wg genkey | tee server-private.key | wg pubkey > server-public.key

On an Ubuntu laptop, install the same package and create a separate pair. On another system, install the official WireGuard app first. Never copy a private key to the other peer.

After creating the keys, inspect the files before moving on:

ls -l *-private.key *-public.key
wc -c *-private.key *-public.key

The private files should only be readable by your user. Do not compare keys by printing the private value into a terminal recording or chat. Compare public keys instead. Delete this practice pair and create it again once, so key rotation feels like a normal operation rather than an emergency.