Directory Structure
/etc/wireguard/wgctl/
├── core/
│   ├── core.sh              — bootstrap, module/command loader
│   ├── context.sh           — path constants (ctx:: functions)
│   ├── utils.sh             — shared utilities
│   ├── json.sh              — Python helper wrappers (json:: functions)
│   ├── json_helper.py       — all Python data functions
│   ├── fmt.sh               — date/number formatting
│   ├── fmt_helper.py        — Python formatting helpers
│   ├── ui.sh                — display primitives (ui:: functions)
│   ├── log.sh               — logging functions (log:: functions)
│   ├── flag.sh              — flag parsing
│   ├── module.sh            — module loader
│   ├── command.sh           — command loader
│   └── color.module.sh      — color helpers (color:: functions)
├── modules/
│   ├── config.module.sh     — config reading/defaults
│   ├── peers.module.sh      — peer queries, status, formatting
│   ├── firewall.module.sh   — iptables wrappers (fw:: functions)
│   ├── keys.module.sh       — key generation/reading
│   ├── ip.module.sh         — IP allocation, validation
│   ├── monitor.module.sh    — endpoint cache, watchlist, events
│   ├── rule.module.sh       — rule resolution with inheritance
│   ├── group.module.sh      — group queries
│   ├── block.module.sh      — block state management
│   └── net.module.sh        — service registry, annotations
├── commands/
│   ├── add.command.sh
│   ├── remove.command.sh
│   ├── rename.command.sh
│   ├── list.command.sh
│   ├── inspect.command.sh
│   ├── block.command.sh
│   ├── unblock.command.sh
│   ├── rule.command.sh
│   ├── group.command.sh
│   ├── net.command.sh
│   ├── fw.command.sh
│   ├── audit.command.sh
│   ├── watch.command.sh
│   ├── logs.command.sh
│   ├── config.command.sh
│   ├── qr.command.sh
│   ├── service.command.sh
│   ├── shell.command.sh
│   └── test.command.sh
└── install/

/etc/wireguard/.wgctl/
├── wgctl.conf                        — config overrides
├── rules/                            — assignable rule files
│   ├── user.rule
│   ├── guest.rule
│   ├── admin.rule
│   ├── zephyr.rule                   — example per-user rule
│   └── base/                         — base rules (not directly assignable)
│       ├── no-nginx.rule
│       ├── no-proxmox.rule
│       ├── no-truenas.rule
│       ├── no-lan.rule
│       ├── dns-restricted.rule
│       └── moonlight-02.rule
├── groups/                           — group definition files
│   ├── family.group
│   ├── arctic.group
│   └── test.group
├── blocks/                           — per-peer block state (JSON)
│   └── phone-test.block
├── meta/                             — per-peer metadata
│   └── phone-nuno.meta
├── services.json                     — network services registry
└── daemon/
    ├── events.log                    — WireGuard events (JSONL)
    ├── fw_events.log                 — firewall drops (JSONL, via ulogd2)
    ├── watchlist.json                — blocked peer IPs for monitor
    ├── endpoint_cache.json           — cached real endpoints
    ├── transfer_cache.json           — activity delta cache
    └── wgctl-monitor.py              — scapy packet capture daemon