Network Manager Sidebar

Network Manager Sidebar is a GTK4/libadwaita front-end for NetworkManager on Wayland compositors supporting layer-shell. It opens as a right-side sidebar and can be toggled from the command line, key bindings, application launchers, or Waybar.

The application provides wired connection status, Wi-Fi management, access to NetworkManager VPN and WireGuard profiles, and connection details. It also supports AmneziaWG tunnels through a separate privileged service.

Installation

Install the nm-sidebar^AUR package.

A Wayland compositor with layer-shell support is required. Configure and start NetworkManager as described in NetworkManager#Enable NetworkManager. For NetworkManager permissions, see NetworkManager#Set up PolicyKit permissions.

AmneziaWG requires additional dependencies and authorization; see #AmneziaWG.

Usage

To toggle the sidebar, run:

$ nm-sidebar

This is equivalent to nm-sidebar --toggle.

Use nm-sidebar --show to show the sidebar, nm-sidebar --hide to hide it, and nm-sidebar --quit to exit the application.

The --toggle and --show commands start the application if it is not already running. The --hide, --quit, and --reload-css commands require a running instance.

To preload the application at session startup without displaying the sidebar, add the following command to the compositor's startup configuration:

$ nm-sidebar --background

If an instance is already running, --background does not change its visibility.

Run nm-sidebar --help for the available command-line options.

VPN and WireGuard

The VPN section lists saved NetworkManager VPN and WireGuard profiles.

Use the import button to select a local configuration file. The application opens it in nm-connection-editor, which detects WireGuard configurations and VPN formats supported by the installed NetworkManager VPN plugins. Use + → VPN/WireGuard to create a profile and Edit to edit a saved profile.

Plugin-based VPN connections require the corresponding NetworkManager plugin; see NetworkManager#VPN support.

WireGuard is managed through NetworkManager's native support. It requires kernel support, but does not require a VPN plugin, wg-quick, or the AmneziaWG service. NetworkManager imports supported settings without executing wg-quick command hooks.

Import AmneziaWG configurations through the separate AmneziaWG section described below.

AmneziaWG

AmneziaWG profiles and tunnels are managed by a privileged service installed with nm-sidebar^AUR, independently of NetworkManager.

Dependencies

Install amneziawg-tools^AUR, which provides awg and awg-quick.

A compatible AmneziaWG tunnel backend is also required. Available implementations include amneziawg-dkms^AUR for the kernel implementation and amneziawg-go^AUR for the userspace implementation. When using the DKMS package, install the headers for the target kernel; see Dynamic Kernel Module Support#Installation.

The sidebar uses awg-quick from the system executable directories. Copies installed under /usr/local/ are not used.

Profiles containing DNS= require a configured systemd-resolved service or a supported resolvconf installation, such as openresolv.

Firewall inspection requires utilities for the relevant backends, such as nft, iptables-save, and ip6tables-save. See nftables and iptables.

Authorization

Access to the AmneziaWG service is denied by default. The sidebar hides the AmneziaWG section until a local polkit rule grants access. The application does not prompt for an administrator password.

Create the following root-owned file with permissions 0644, replacing YOUR_USER with the login name of the user to authorize:

/etc/polkit-1/rules.d/49-nm-sidebar-amneziawg.rules

polkit.addRule(function(action, subject) {
    if (action.id == "dev.relz.NmSidebar.manage-amneziawg" &&
        subject.user == "YOUR_USER" &&
        subject.local &&
        subject.active) {
        return polkit.Result.YES;
    }
});

This rule allows the specified user to list and manage AmneziaWG profiles and tunnels from an active local session.

Polkit reloads rules automatically, and the sidebar updates authorization without a restart.

This authorization is separate from NetworkManager permissions and is not required for WireGuard profiles managed by NetworkManager.

Importing profiles

Use the import button in the AmneziaWG section to select a local .conf file. Imported profiles are stored in /etc/amnezia/amneziawg/ and can be connected, disconnected, replaced, or removed from the sidebar.

Import files must be regular local files no larger than 1 MiB. Symbolic links are not accepted.

Configurations containing user-defined command hooks (PreUp, PostUp, PreDown, or PostDown) or domain-only DNS= values are not supported.

Tips and tricks

Waybar integration

Add an on-click entry to the desired Waybar module:

{
    "on-click": "nm-sidebar --toggle"
}

When launched from Waybar, the application uses WAYBAR_OUTPUT_NAME to select the output.

Selecting an output

Set NM_SIDEBAR_OUTPUT to the monitor connector name to select an output explicitly. For example:

$ NM_SIDEBAR_OUTPUT=eDP-1 nm-sidebar --toggle

Replace eDP-1 with the desired connector name. NM_SIDEBAR_OUTPUT takes precedence over WAYBAR_OUTPUT_NAME.

Custom styles

Place CSS overrides in $XDG_CONFIG_HOME/nm-sidebar/nm-sidebar.css, which defaults to ~/.config/nm-sidebar/nm-sidebar.css.

With the application running, reload the stylesheet:

$ nm-sidebar --reload-css