Add per-server Interface/KeyPair edit hardening and OPNsense config import

Redact the private key from the /servers/:id/keypair response body -
the UI never rendered it, but the raw key was still returned over the
wire (json:"private_key,omitempty" plus explicit clearing before the
JSON response).

Add a new import flow: an admin can upload an OPNsense config.xml,
preview the WireGuard servers/clients it defines (editable before
committing), and confirm to create the corresponding
Server/ServerSetting/Client records. Nothing is auto-applied - no
wg-quick/systemctl call happens, matching the existing manual "Apply"
step for regular server management.

Schema verified against OPNsense core (WireGuard has been in core
since 22.1, not a plugin) - see opnsense/parse.go for the confirmed
tag reference. Public keys are always re-derived from private keys
rather than trusted from the export; client public-key collisions
against existing store data are skipped and reported per-batch rather
than aborting the whole import.

Since OPNsense stores DNS/MTU per-server and keepalive per-client, but
this fork only had those app-wide (GlobalSetting), extended
ServerSetting with DNSServers/MTU and Client with PersistentKeepalive
as optional overrides that fall back to the global default when unset
- existing single-server behavior is unchanged when the override is
empty/zero. Manual UI editing of the per-client keepalive override
outside the import flow is left for a later pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019VjwLYRA87o8m9a9zztgs3

model/client.go

@@ -6,24 +6,28 @@ import (
 
 // Client model
 type Client struct {
-	ID              string    `json:"id"`
-	ServerID        string    `json:"server_id,omitempty"`
-	PrivateKey      string    `json:"private_key"`
-	PublicKey       string    `json:"public_key"`
-	PresharedKey    string    `json:"preshared_key"`
-	Name            string    `json:"name"`
-	TgUserid        string    `json:"telegram_userid"`
-	Email           string    `json:"email"`
-	SubnetRanges    []string  `json:"subnet_ranges,omitempty"`
-	AllocatedIPs    []string  `json:"allocated_ips"`
-	AllowedIPs      []string  `json:"allowed_ips"`
-	ExtraAllowedIPs []string  `json:"extra_allowed_ips"`
-	Endpoint        string    `json:"endpoint"`
-	AdditionalNotes string    `json:"additional_notes"`
-	UseServerDNS    bool      `json:"use_server_dns"`
-	Enabled         bool      `json:"enabled"`
-	CreatedAt       time.Time `json:"created_at"`
-	UpdatedAt       time.Time `json:"updated_at"`
+	ID              string   `json:"id"`
+	ServerID        string   `json:"server_id,omitempty"`
+	PrivateKey      string   `json:"private_key"`
+	PublicKey       string   `json:"public_key"`
+	PresharedKey    string   `json:"preshared_key"`
+	Name            string   `json:"name"`
+	TgUserid        string   `json:"telegram_userid"`
+	Email           string   `json:"email"`
+	SubnetRanges    []string `json:"subnet_ranges,omitempty"`
+	AllocatedIPs    []string `json:"allocated_ips"`
+	AllowedIPs      []string `json:"allowed_ips"`
+	ExtraAllowedIPs []string `json:"extra_allowed_ips"`
+	Endpoint        string   `json:"endpoint"`
+	AdditionalNotes string   `json:"additional_notes"`
+	UseServerDNS    bool     `json:"use_server_dns"`
+	// PersistentKeepalive is an optional per-client override of the
+	// app-wide GlobalSetting.PersistentKeepalive. 0 means "use the global
+	// default" (see handler.buildEffectiveSettings / util.BuildClientConfig).
+	PersistentKeepalive int       `json:"persistent_keepalive,omitempty"`
+	Enabled             bool      `json:"enabled"`
+	CreatedAt           time.Time `json:"created_at"`
+	UpdatedAt           time.Time `json:"updated_at"`
 }
 
 // ClientData includes the Client and extra data

model/server.go

@@ -14,7 +14,7 @@ type Server struct {
 
 // ServerKeypair model
 type ServerKeypair struct {
-	PrivateKey string    `json:"private_key"`
+	PrivateKey string    `json:"private_key,omitempty"`
 	PublicKey  string    `json:"public_key"`
 	UpdatedAt  time.Time `json:"updated_at"`
 }

model/setting.go

@@ -28,6 +28,11 @@ type ServerSetting struct {
 	// this server's WireGuard traffic should be allowed to forward to/from.
 	// Only used to generate the nftables ruleset preview; left empty means
 	// the preview only covers the WireGuard interface itself.
-	LanInterface string    `json:"lan_interface,omitempty"`
-	UpdatedAt    time.Time `json:"updated_at"`
+	LanInterface string `json:"lan_interface,omitempty"`
+	// DNSServers and MTU are optional per-server overrides of the app-wide
+	// GlobalSetting.DNSServers/GlobalSetting.MTU. Leave empty/zero to fall
+	// back to the global default (see handler.buildEffectiveSettings).
+	DNSServers []string  `json:"dns_servers,omitempty"`
+	MTU        int       `json:"mtu,omitempty"`
+	UpdatedAt  time.Time `json:"updated_at"`
 }