diff --git a/internal/server/helper.go b/internal/server/helper.go
index ce91e90..52cbc66 100644
--- a/internal/server/helper.go
+++ b/internal/server/helper.go
@@ -4,6 +4,8 @@ import (
 	"crypto/md5"
 	"errors"
 	"fmt"
+	"io/ioutil"
+	"syscall"
 	"time"
 
 	"github.com/h44z/wg-portal/internal/common"
@@ -123,7 +125,7 @@ func (s *Server) CreateUser(user User) error {
 		return err
 	}
 
-	return nil
+	return s.WriteWireGuardConfigFile()
 }
 
 func (s *Server) UpdateUser(user User, updateTime time.Time) error {
@@ -148,7 +150,7 @@ func (s *Server) UpdateUser(user User, updateTime time.Time) error {
 		return err
 	}
 
-	return nil
+	return s.WriteWireGuardConfigFile()
 }
 
 func (s *Server) DeleteUser(user User) error {
@@ -162,7 +164,7 @@ func (s *Server) DeleteUser(user User) error {
 		return err
 	}
 
-	return nil
+	return s.WriteWireGuardConfigFile()
 }
 
 func (s *Server) RestoreWireGuardInterface() error {
@@ -178,3 +180,22 @@ func (s *Server) RestoreWireGuardInterface() error {
 
 	return nil
 }
+
+func (s *Server) WriteWireGuardConfigFile() error {
+	if s.config.WG.WireGuardConfig == "" {
+		return nil // writing disabled
+	}
+	if err := syscall.Access(s.config.WG.WireGuardConfig, syscall.O_RDWR); err != nil {
+		return err
+	}
+
+	device := s.users.GetDevice()
+	cfg, err := device.GetDeviceConfigFile(s.users.GetActiveUsers())
+	if err != nil {
+		return err
+	}
+	if err := ioutil.WriteFile(s.config.WG.WireGuardConfig, cfg, 0644); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/internal/wireguard/config.go b/internal/wireguard/config.go
index d44afd3..adbeaf7 100644
--- a/internal/wireguard/config.go
+++ b/internal/wireguard/config.go
@@ -1,5 +1,6 @@
 package wireguard
 
 type Config struct {
-	DeviceName string `yaml:"device" envconfig:"WG_DEVICE"`
+	DeviceName      string `yaml:"device" envconfig:"WG_DEVICE"`
+	WireGuardConfig string `yaml:"configFile" envconfig:"WG_CONFIG_FILE"` // optional, if set, updates will be written to this file
 }