Wireguard Client Addition without restart

I am building a Wireguard VPN network, in which I want to add and remove peers on the server without restarting the service or losing connections with existing peers. Tried searching for the results, but I found nothing that can suit my needs (all the solutions will cause a few second freeze or will require clients to redo handshake with server). Is it possible to implement this with Wireguard and if yes, how?

If wireguard is started by systemd, there is a command to ask wireguard to reload the configuration:

systemctl reload wg-quick@wg0

Should reload the configuration for the wg0 adapter without restarting the service, and without disrupting current connections.

You can use wg conjointly with wg-quick. wg is a lower-level command, actually the one used by wg-quick to really do WireGuard-specific configuration on the interface (along various ip xxx commands for the base networking parts).

Its subcommand wg syncconf used conjointly with wg-quick strip is intended to update settings without disruption for current peer communication with changed settings in the configuration file as documented in wg-quick and wg's manpages:

Use strip to output a configuration file with all wg-quick(8)-specific options removed, suitable for use with wg(8).

The strip command is useful for reloading configuration files without disrupting active sessions:

# wg syncconf wgnet0 <(wg-quick strip wgnet0)

syncconf <interface> <configuration-filename>

Like setconf, but reads back the existing configuration first and only makes changes that are explicitly different between the configuration file and the interface. This is much less efficient than setconf, but has the benefit of not disrupting current peer sessions. The contents of must be in the format described by CONFIGURATION FILE FORMAT below.

So to repeat the example, if the configuration for interface wg0, usually used with wg-quick is in /etc/wireguard/wg0.conf (or any other Distribution-specific place) and a [Peer] section was just added (resp. removed) to this file, to make this peer available (resp. not available anymore) without disrupting communication with already configured peers, then run as root in a bash shell:

wg syncconf wg0 <(wg-quick strip wg0)

Some parts will have to be completed manually, since they are not handled by wg, as described in wg-quick's CONFIGURATION section: additional routes, iptables rules...