Add wireguard-ui-multi core: multi-server DB, WireGuard manager, REST API, UI, installers
Implements the from-scratch multi-server WireGuard management fork per CLAUDE.md spec: sqlite schema (servers/peers/audit_log/users), Curve25519 key generation, per-interface config rendering + wg-quick/systemd control, nftables hook scaffolding, session+CSRF-protected REST API with QR code and config download endpoints, a minimal vanilla-JS web UI, legacy wg0.conf migration, and both a native installer and a Proxmox LXC provisioning script (with auto-detected latest Debian template). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
sysops
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
3d6608ef80
commit
3b3ffd8ebf
@@ -0,0 +1,367 @@
|
||||
Du bist ein Senior Go-Entwickler mit Erfahrung in Netzwerk-Engineering, WireGuard, Linux, nftables und Webanwendungen.
|
||||
|
||||
Aufgabe:
|
||||
Erstelle einen Fork von "wireguard-ui" mit dem Namen:
|
||||
|
||||
wireguard-ui-multi
|
||||
|
||||
Ziel:
|
||||
Eine native Multi-Server-Verwaltungsoberfläche für WireGuard, die ohne Docker betrieben werden kann und mehrere unabhängige WireGuard-Server-Interfaces verwaltet.
|
||||
|
||||
Hintergrund:
|
||||
Die aktuelle wireguard-ui Version verwaltet hauptsächlich eine einzelne WireGuard-Instanz. Die neue Version soll mehrere getrennte WireGuard-Server gleichzeitig verwalten können.
|
||||
|
||||
Primäre Zielplattform:
|
||||
- Linux
|
||||
- Proxmox LXC Container
|
||||
- Debian/Ubuntu
|
||||
- OpenWrt-kompatible Umgebung (optional)
|
||||
- Betrieb als natives Binary ohne Docker
|
||||
|
||||
Grundanforderungen:
|
||||
|
||||
1. Multi WireGuard Server Support
|
||||
|
||||
Die Anwendung muss mehrere WireGuard-Server verwalten können:
|
||||
|
||||
Beispiele:
|
||||
|
||||
Server:
|
||||
- WGhome
|
||||
Interface: wg-home
|
||||
Listen Port: 51822
|
||||
Tunnelnetz: 10.20.22.0/24
|
||||
|
||||
- WGrz
|
||||
Interface: wg-rz
|
||||
Listen Port: 51866
|
||||
Tunnelnetz: 10.20.66.0/24
|
||||
|
||||
- WGwinter
|
||||
Interface: wg-winter
|
||||
Listen Port: 51824
|
||||
|
||||
Jeder Server muss besitzen:
|
||||
- eigener Name
|
||||
- eigenes WireGuard Interface
|
||||
- eigener Port
|
||||
- eigener Private Key
|
||||
- eigene Address Range
|
||||
- eigene DNS Einstellungen
|
||||
- eigene MTU
|
||||
- eigener Status
|
||||
- eigene Peers
|
||||
|
||||
2. Datenmodell erweitern
|
||||
|
||||
Aktuelles Modell:
|
||||
Application
|
||||
└── WireGuard Server
|
||||
└── Peers
|
||||
|
||||
Neues Modell:
|
||||
|
||||
Application
|
||||
|
||||
├── Server
|
||||
│ ├── Interface
|
||||
│ ├── Config
|
||||
│ ├── Settings
|
||||
│ └── Peers
|
||||
│
|
||||
├── Server
|
||||
│ └── Peers
|
||||
│
|
||||
└── Server
|
||||
└── Peers
|
||||
|
||||
|
||||
Datenbank erweitern:
|
||||
|
||||
Tabelle:
|
||||
servers
|
||||
|
||||
Felder:
|
||||
- id
|
||||
- name
|
||||
- interface_name
|
||||
- listen_port
|
||||
- private_key
|
||||
- public_key
|
||||
- address_range
|
||||
- dns
|
||||
- mtu
|
||||
- enabled
|
||||
- created_at
|
||||
- updated_at
|
||||
|
||||
|
||||
Tabelle:
|
||||
peers
|
||||
|
||||
Felder:
|
||||
- id
|
||||
- server_id
|
||||
- name
|
||||
- email
|
||||
- public_key
|
||||
- private_key
|
||||
- preshared_key
|
||||
- allowed_ips
|
||||
- endpoint
|
||||
- persistent_keepalive
|
||||
- enabled
|
||||
|
||||
|
||||
3. WireGuard Verwaltung
|
||||
|
||||
Die Anwendung muss automatisch erzeugen:
|
||||
|
||||
/etc/wireguard/
|
||||
|
||||
Beispiel:
|
||||
|
||||
wg-home.conf
|
||||
wg-rz.conf
|
||||
wg-winter.conf
|
||||
|
||||
|
||||
Jede Config muss valides WireGuard Format besitzen:
|
||||
|
||||
[Interface]
|
||||
PrivateKey=
|
||||
Address=
|
||||
ListenPort=
|
||||
|
||||
[Peer]
|
||||
PublicKey=
|
||||
AllowedIPs=
|
||||
PersistentKeepalive=
|
||||
|
||||
|
||||
4. Service Management
|
||||
|
||||
Die Anwendung muss WireGuard Interfaces starten und stoppen können:
|
||||
|
||||
Beispiele:
|
||||
|
||||
wg-quick up wg-home
|
||||
wg-quick down wg-home
|
||||
|
||||
Unterstützung für:
|
||||
|
||||
systemd:
|
||||
wg-quick@wg-home.service
|
||||
|
||||
Optional:
|
||||
OpenWrt:
|
||||
uci / netifd Integration vorbereiten
|
||||
|
||||
|
||||
5. Webinterface
|
||||
|
||||
Erweitere die UI:
|
||||
|
||||
Dashboard:
|
||||
|
||||
Liste aller WireGuard Server:
|
||||
|
||||
------------------------------------------------
|
||||
Name Interface Port Status
|
||||
------------------------------------------------
|
||||
WGhome wg-home 51822 UP
|
||||
WGrz wg-rz 51866 UP
|
||||
Winter wg-winter 51824 DOWN
|
||||
------------------------------------------------
|
||||
|
||||
|
||||
Jeder Server bekommt eigene Verwaltung:
|
||||
|
||||
- Peers anzeigen
|
||||
- Peer hinzufügen
|
||||
- Peer löschen
|
||||
- QR-Code erzeugen
|
||||
- Config herunterladen
|
||||
- Server starten
|
||||
- Server stoppen
|
||||
- Server neu laden
|
||||
|
||||
|
||||
6. Peer Verwaltung
|
||||
|
||||
Pro Server:
|
||||
|
||||
Funktionen:
|
||||
|
||||
- neuen Client erstellen
|
||||
- Schlüssel automatisch erzeugen
|
||||
- QR-Code erzeugen
|
||||
- Konfiguration exportieren
|
||||
- Ablaufdatum optional
|
||||
- Beschreibung
|
||||
- Benutzername
|
||||
|
||||
|
||||
7. Backup / Restore
|
||||
|
||||
Implementieren:
|
||||
|
||||
Export:
|
||||
|
||||
- Datenbank
|
||||
- WireGuard Configs
|
||||
- Keys
|
||||
- Einstellungen
|
||||
|
||||
|
||||
Restore:
|
||||
- komplette Wiederherstellung
|
||||
|
||||
|
||||
8. API
|
||||
|
||||
REST API erweitern:
|
||||
|
||||
Beispiele:
|
||||
|
||||
GET
|
||||
/api/servers
|
||||
|
||||
POST
|
||||
/api/servers
|
||||
|
||||
GET
|
||||
/api/server/{id}/peers
|
||||
|
||||
POST
|
||||
/api/server/{id}/peer
|
||||
|
||||
DELETE
|
||||
/api/server/{id}/peer/{peerid}
|
||||
|
||||
|
||||
9. Sicherheit
|
||||
|
||||
Implementieren:
|
||||
|
||||
- Passwortschutz
|
||||
- Session Management
|
||||
- CSRF Schutz
|
||||
- keine Private Keys im Frontend anzeigen
|
||||
- Audit Log für Änderungen
|
||||
|
||||
|
||||
10. Firewall Integration
|
||||
|
||||
Vorbereitung für:
|
||||
|
||||
nftables
|
||||
|
||||
Beispiel:
|
||||
|
||||
Server WGhome:
|
||||
|
||||
INPUT:
|
||||
UDP 51822 ACCEPT
|
||||
|
||||
FORWARD:
|
||||
wg-home → lan
|
||||
|
||||
|
||||
Hooks:
|
||||
|
||||
/etc/wireguard-manager/hooks/
|
||||
|
||||
server-start
|
||||
server-stop
|
||||
peer-add
|
||||
peer-remove
|
||||
|
||||
|
||||
11. Deployment
|
||||
|
||||
Kein Docker.
|
||||
|
||||
Erstellen:
|
||||
|
||||
Binary:
|
||||
|
||||
wireguard-ui-multi
|
||||
|
||||
|
||||
Installationsstruktur:
|
||||
|
||||
/usr/local/bin/wireguard-ui-multi
|
||||
|
||||
/etc/wireguard-ui-multi/
|
||||
|
||||
/var/lib/wireguard-ui-multi/
|
||||
|
||||
|
||||
Systemd Service:
|
||||
|
||||
wireguard-ui-multi.service
|
||||
|
||||
|
||||
12. Codequalität
|
||||
|
||||
Anforderungen:
|
||||
|
||||
- Go aktuelle Version
|
||||
- saubere Package-Struktur
|
||||
- Unit Tests
|
||||
- Logging
|
||||
- Fehlerbehandlung
|
||||
- Dokumentation
|
||||
|
||||
|
||||
Projektstruktur:
|
||||
|
||||
cmd/
|
||||
└── wireguard-ui-multi
|
||||
|
||||
internal/
|
||||
|
||||
├── server/
|
||||
├── wireguard/
|
||||
├── database/
|
||||
├── api/
|
||||
├── firewall/
|
||||
└── ui/
|
||||
|
||||
|
||||
13. Migration
|
||||
|
||||
Erstelle eine Migration von einer bestehenden wireguard-ui Installation:
|
||||
|
||||
- bestehende wg0.conf erkennen
|
||||
- als ersten Server importieren
|
||||
- Peers übernehmen
|
||||
|
||||
|
||||
14. Dokumentation
|
||||
|
||||
Erstellen:
|
||||
|
||||
README.md
|
||||
|
||||
mit:
|
||||
|
||||
- Installation
|
||||
- Konfiguration
|
||||
- LXC Installation
|
||||
- Proxmox Hinweise
|
||||
- Backup
|
||||
- Migration
|
||||
|
||||
|
||||
Beginne mit:
|
||||
|
||||
1. Analyse der bestehenden wireguard-ui Architektur
|
||||
2. Vorschlag für Datenbankmigration
|
||||
3. Umsetzung der Server-Abstraktion
|
||||
4. Implementierung der Multi-Interface-Verwaltung
|
||||
5. Anpassung der UI
|
||||
6. Tests
|
||||
|
||||
Das Ergebnis soll ein produktiv nutzbarer Fork "wireguard-ui-multi" werden.
|
||||
@@ -0,0 +1,90 @@
|
||||
# wireguard-ui-multi – Dev Log
|
||||
|
||||
## 2026-07-10 02:11 – 02:33 (21m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
- 3d6608e first commit
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
## 2026-07-10 02:33 – 02:33 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
## 2026-07-10 02:33 – 02:33 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
## 2026-07-10 02:34 – 02:34 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
## 2026-07-10 02:37 – 02:37 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
## 2026-07-10 02:44 – 02:45 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
## 2026-07-10 02:45 – 02:46 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
## 2026-07-10 02:52 – 02:52 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** wireguard-ui-multi
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
|
||||
### Geänderte Dateien
|
||||
Keine Änderungen ermittelbar.
|
||||
|
||||
---
|
||||
@@ -0,0 +1,234 @@
|
||||
# wireguard-ui-multi
|
||||
|
||||
Native Multi-Server-Verwaltungsoberfläche für WireGuard — **ohne Docker**.
|
||||
Im Gegensatz zum ursprünglichen `wireguard-ui`, das genau eine WireGuard-Instanz
|
||||
verwaltet, kann `wireguard-ui-multi` mehrere unabhängige WireGuard-Interfaces
|
||||
gleichzeitig verwalten (z. B. `wg-home`, `wg-rz`, `wg-winter`), jedes mit
|
||||
eigenem Port, eigenem Adressbereich, eigenen Peers und eigenem Status.
|
||||
|
||||
Zielumgebungen: Debian/Ubuntu, Proxmox LXC Container, generisches Linux mit
|
||||
systemd. Betrieb als natives Go-Binary.
|
||||
|
||||
## Features
|
||||
|
||||
- **Multi-Server-Verwaltung**: beliebig viele WireGuard-Server, jeder mit
|
||||
eigenem Interface-Namen, Port, Private/Public Key, Adressbereich, DNS, MTU
|
||||
und Enabled/Disabled-Status (Tabelle `servers` in SQLite).
|
||||
- **Peer-Verwaltung pro Server**: Peers gehören zu genau einem Server
|
||||
(Fremdschlüssel `server_id`), inklusive Name, E-Mail, Public/Private/
|
||||
Preshared Key, Allowed IPs, Endpoint, Persistent Keepalive, Enabled-Status
|
||||
und optionalem Ablaufdatum (`expires_at`).
|
||||
- **Automatische Config-Erzeugung**: Server-Configs werden nach
|
||||
`/etc/wireguard/<interface>.conf` im Standard-`wg-quick`-Format geschrieben.
|
||||
- **Service-Steuerung**: Start/Stop/Reload je Interface über `wg-quick up`,
|
||||
`wg-quick down` und `wg syncconf` (Hot-Reload ohne Verbindungsabbruch),
|
||||
Status-Abfrage über `wg show`.
|
||||
- **QR-Code & Config-Download**: Peer-Konfiguration kann als `.conf`-Datei
|
||||
heruntergeladen oder als QR-Code (PNG) angezeigt werden — Private Keys
|
||||
verlassen den Server nur in dieser generierten Peer-Config, nie über die
|
||||
UI/JSON-API.
|
||||
- **REST-API** für Server- und Peer-Verwaltung (siehe unten) plus
|
||||
Web-Dashboard.
|
||||
- **Firewall-Vorbereitung**: optionale Lifecycle-Hook-Skripte
|
||||
(`server-start`, `server-stop`, `peer-add`, `peer-remove`) in
|
||||
`/etc/wireguard-manager/hooks/` sowie ein Generator für einen
|
||||
Vorschlags-nftables-Ruleset pro Server (Port freigeben, Forwarding
|
||||
Tunnel ↔ LAN-Interface).
|
||||
- **Audit Log**: Tabelle `audit_log` protokolliert Aktionen mit Akteur,
|
||||
Aktion, Ziel und Detail.
|
||||
- **Sitzungsbasierte Authentifizierung** mit CSRF-Schutz: jede mutierende
|
||||
Anfrage (POST/PUT/DELETE) benötigt einen gültigen Session-Cookie plus
|
||||
den Header `X-CSRF-Token`.
|
||||
- Optional HTTPS über `--tls-cert` / `--tls-key`.
|
||||
|
||||
## Installation
|
||||
|
||||
### 1. Aus dem Quellcode bauen
|
||||
|
||||
```bash
|
||||
go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi
|
||||
```
|
||||
|
||||
### 2. Installationsskript ausführen (als root)
|
||||
|
||||
```bash
|
||||
sudo ./scripts/install.sh
|
||||
```
|
||||
|
||||
Das Skript ist idempotent und:
|
||||
|
||||
- kopiert die Binary nach `/usr/local/bin/wireguard-ui-multi`
|
||||
- legt `/etc/wireguard-ui-multi`, `/var/lib/wireguard-ui-multi` und
|
||||
`/etc/wireguard-manager/hooks` an
|
||||
- installiert die systemd-Unit nach
|
||||
`/etc/systemd/system/wireguard-ui-multi.service`
|
||||
- setzt `chmod 0700` auf das Datenverzeichnis (dort liegt die SQLite-DB mit
|
||||
Passwort-Hashes)
|
||||
|
||||
**Wichtig:** Das Skript startet den Dienst nicht automatisch. Danach manuell
|
||||
aktivieren:
|
||||
|
||||
```bash
|
||||
sudo systemctl enable --now wireguard-ui-multi.service
|
||||
sudo systemctl status wireguard-ui-multi.service
|
||||
sudo journalctl -u wireguard-ui-multi.service -f
|
||||
```
|
||||
|
||||
## Konfiguration
|
||||
|
||||
Die Anwendung wird über Kommandozeilen-Flags konfiguriert (siehe
|
||||
`cmd/wireguard-ui-multi/main.go`):
|
||||
|
||||
| Flag | Default | Bedeutung |
|
||||
|----------------|-------------------------------------------------------|-------------------------------------------------------|
|
||||
| `--listen` | `:8443` | Listen-Adresse des Webservers |
|
||||
| `--db` | `/var/lib/wireguard-ui-multi/wireguard-ui-multi.db` | Pfad zur SQLite-Datenbankdatei |
|
||||
| `--config-dir` | `/etc/wireguard` | Zielverzeichnis für generierte `wg-quick`-Configs |
|
||||
| `--hooks-dir` | `/etc/wireguard-manager/hooks` | Verzeichnis mit optionalen Hook-Skripten |
|
||||
| `--lan-iface` | `eth0` | LAN-Interface für die vorgeschlagenen nftables-Forward-Regeln |
|
||||
| `--tls-cert` | (leer) | Pfad zum TLS-Zertifikat (aktiviert HTTPS zusammen mit `--tls-key`) |
|
||||
| `--tls-key` | (leer) | Pfad zum TLS-Private-Key |
|
||||
|
||||
Die in `systemd/wireguard-ui-multi.service` hinterlegte `ExecStart`-Zeile
|
||||
setzt `--db`, `--config-dir` und `--hooks-dir` bereits passend zur
|
||||
Installationsstruktur.
|
||||
|
||||
### Erststart / Admin-Passwort
|
||||
|
||||
Beim allerersten Start (leere `users`-Tabelle) wird automatisch ein
|
||||
`admin`-Benutzer mit einem zufällig erzeugten 32-stelligen Hex-Passwort
|
||||
angelegt. Das Klartext-Passwort wird **genau einmal** auf `stderr`
|
||||
ausgegeben (z. B. sichtbar via `journalctl -u wireguard-ui-multi.service`)
|
||||
und danach nur noch als bcrypt-Hash in der Datenbank gespeichert. Nach dem
|
||||
ersten Login sollte das Passwort umgehend geändert werden.
|
||||
|
||||
## LXC / Proxmox Hinweise
|
||||
|
||||
WireGuard benötigt Zugriff auf das `wireguard`-Kernelmodul des Hosts sowie
|
||||
`CAP_NET_ADMIN` und Zugriff auf `/dev/net/tun` im Container:
|
||||
|
||||
- Auf dem **Proxmox-Host** muss das `wireguard`-Kernelmodul geladen sein
|
||||
(`modprobe wireguard`; bei Bedarf `/etc/modules` ergänzen).
|
||||
- Der LXC-Container sollte entweder **privilegiert** betrieben werden, oder
|
||||
als unprivilegierter Container mit gezielten Lockerungen
|
||||
(`lxc.cap.drop` ohne `net_admin`, `lxc.cgroup2.devices.allow: c 10:200 rwm`
|
||||
für `/dev/net/tun`) konfiguriert werden. In der Praxis ist ein
|
||||
privilegierter Container für WireGuard-Hosting deutlich unkomplizierter.
|
||||
- `/dev/net/tun` muss im Container vorhanden und beschreibbar sein
|
||||
(`ls -l /dev/net/tun`); ggf. per Bind-Mount/`lxc.mount.entry` durchreichen.
|
||||
- Die systemd-Unit läuft als `root` mit `AmbientCapabilities=CAP_NET_ADMIN`,
|
||||
weil sie `wg-quick`, `systemctl` und `nft` aufruft — diese Tools benötigen
|
||||
in der Praxis root-Rechte im Container.
|
||||
- Läuft `nftables` bereits als eigener Dienst im Container/Host, sollte der
|
||||
von `wireguard-ui-multi` vorgeschlagene Ruleset (siehe unten) manuell in
|
||||
die bestehende Regelbasis integriert statt blind angewendet werden, um
|
||||
Konflikte mit vorhandenen Tabellen/Chains zu vermeiden.
|
||||
|
||||
## Server- & Peer-Verwaltung
|
||||
|
||||
**Server anlegen** (UI oder `POST /api/servers`): Name, Interface-Name
|
||||
(z. B. `wg-home`), Listen-Port, Adressbereich (z. B. `10.20.22.0/24`), DNS,
|
||||
MTU angeben. Private/Public Key werden serverseitig automatisch erzeugt.
|
||||
|
||||
**Server starten/stoppen/neuladen**: über die Dashboard-Buttons oder
|
||||
`POST /api/servers/{id}/start|stop|reload`. Start schreibt zunächst die
|
||||
`wg-quick`-Config nach `/etc/wireguard/<interface>.conf` und ruft dann
|
||||
`wg-quick up <interface>` auf; Reload nutzt `wg syncconf` für einen
|
||||
Hot-Reload ohne Tunnelabbruch.
|
||||
|
||||
**Peer hinzufügen** (UI oder `POST /api/server/{id}/peer`): Name, optional
|
||||
E-Mail/Beschreibung und Ablaufdatum angeben — Schlüsselpaar und Preshared
|
||||
Key werden automatisch generiert.
|
||||
|
||||
**Config/QR-Code abrufen**: `GET /api/server/{id}/peer/{peerid}/config`
|
||||
liefert die fertige `.conf`-Datei zum Download, `GET
|
||||
/api/server/{id}/peer/{peerid}/qrcode` liefert denselben Inhalt als
|
||||
PNG-QR-Code zum Scannen mit der WireGuard-App.
|
||||
|
||||
### REST-API-Übersicht
|
||||
|
||||
```
|
||||
POST /api/login
|
||||
POST /api/logout
|
||||
|
||||
GET /api/servers
|
||||
POST /api/servers
|
||||
GET /api/servers/{id}
|
||||
PUT /api/servers/{id}
|
||||
DELETE /api/servers/{id}
|
||||
POST /api/servers/{id}/start
|
||||
POST /api/servers/{id}/stop
|
||||
POST /api/servers/{id}/reload
|
||||
GET /api/servers/{id}/config
|
||||
|
||||
GET /api/server/{id}/peers
|
||||
POST /api/server/{id}/peer
|
||||
DELETE /api/server/{id}/peer/{peerid}
|
||||
GET /api/server/{id}/peer/{peerid}/config
|
||||
GET /api/server/{id}/peer/{peerid}/qrcode
|
||||
```
|
||||
|
||||
Alle Endpunkte außer `/api/login` erfordern einen gültigen Session-Cookie;
|
||||
mutierende Methoden (POST/PUT/DELETE) benötigen zusätzlich den Header
|
||||
`X-CSRF-Token` mit dem beim Login ausgegebenen Token.
|
||||
|
||||
## Backup / Restore
|
||||
|
||||
Ein automatisiertes Backup-/Restore-Werkzeug ist aktuell **nicht**
|
||||
implementiert. Für ein manuelles Backup genügt es, folgende Pfade zu
|
||||
sichern:
|
||||
|
||||
- die SQLite-Datenbank: `/var/lib/wireguard-ui-multi/wireguard-ui-multi.db`
|
||||
(enthält Server, Peers, Keys, Audit Log, Benutzer)
|
||||
- die generierten Interface-Configs: `/etc/wireguard/*.conf`
|
||||
- ggf. eigene Hook-Skripte: `/etc/wireguard-manager/hooks/`
|
||||
|
||||
Beispiel:
|
||||
|
||||
```bash
|
||||
sudo tar czf wireguard-ui-multi-backup-$(date +%F).tar.gz \
|
||||
/var/lib/wireguard-ui-multi/wireguard-ui-multi.db \
|
||||
/etc/wireguard/*.conf \
|
||||
/etc/wireguard-manager/hooks
|
||||
```
|
||||
|
||||
**Restore**: Dienst stoppen, Archiv an denselben Pfaden entpacken,
|
||||
Berechtigungen prüfen (`chmod 0700` auf das Datenverzeichnis) und Dienst
|
||||
wieder starten:
|
||||
|
||||
```bash
|
||||
sudo systemctl stop wireguard-ui-multi.service
|
||||
sudo tar xzf wireguard-ui-multi-backup-YYYY-MM-DD.tar.gz -C /
|
||||
sudo systemctl start wireguard-ui-multi.service
|
||||
```
|
||||
|
||||
## Migration von einer bestehenden wireguard-ui-Installation
|
||||
|
||||
Für den Umstieg von einer klassischen Single-Interface-Installation
|
||||
(`/etc/wireguard/wg0.conf`) ist ein Migrationswerkzeug vorgesehen, das eine
|
||||
bestehende `wg0.conf` einliest und als ersten verwalteten Server samt seiner
|
||||
Peers importiert. Damit lässt sich eine vorhandene WireGuard-Instanz
|
||||
übernehmen, ohne bestehende Clients neu konfigurieren zu müssen. Details zum
|
||||
genauen Ablauf und den Aufrufoptionen siehe die Implementierung im
|
||||
`wireguard`-Package des Repos, sobald verfügbar; grundsätzlich gilt: vor der
|
||||
Migration ein Backup der bestehenden `wg0.conf` anlegen.
|
||||
|
||||
## Sicherheitshinweise
|
||||
|
||||
- **Private Keys werden nie im Frontend/JSON angezeigt** — sie werden
|
||||
ausschließlich serverseitig in generierten `.conf`-Dateien bzw.
|
||||
QR-Codes für einzelne Peers ausgeliefert.
|
||||
- **HTTPS verwenden**: entweder direkt über `--tls-cert`/`--tls-key`, oder
|
||||
die Anwendung hinter einem Reverse Proxy (nginx, Caddy, Traefik) mit
|
||||
TLS-Terminierung betreiben. Ohne TLS gibt der Dienst beim Start eine
|
||||
deutliche Warnung aus.
|
||||
- **Standard-Admin-Passwort sofort ändern**: das beim Erststart einmalig
|
||||
ausgegebene zufällige Passwort sollte direkt nach dem ersten Login
|
||||
geändert werden.
|
||||
- Mutierende API-Aufrufe erfordern einen gültigen Session-Cookie **und**
|
||||
den CSRF-Header `X-CSRF-Token` — Clients/Skripte, die die API direkt
|
||||
ansprechen, müssen sich zunächst über `/api/login` anmelden und den
|
||||
zurückgegebenen Token mitführen.
|
||||
- Die Datenverzeichnisse (`/var/lib/wireguard-ui-multi`) sollten
|
||||
restriktive Berechtigungen (`0700`) behalten, da dort Schlüsselmaterial
|
||||
und Passwort-Hashes liegen.
|
||||
|
||||
@@ -0,0 +1,141 @@
|
||||
// Command wireguard-ui-multi runs the native multi-server WireGuard management UI.
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/signal"
|
||||
"path/filepath"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/api"
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/database"
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/firewall"
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/wireguard"
|
||||
)
|
||||
|
||||
func main() {
|
||||
var (
|
||||
listen = flag.String("listen", ":8443", "address to listen on")
|
||||
dbPath = flag.String("db", "/var/lib/wireguard-ui-multi/wireguard-ui-multi.db", "path to the sqlite database file")
|
||||
configDir = flag.String("config-dir", "/etc/wireguard", "directory where wg-quick interface configs are written")
|
||||
hooksDir = flag.String("hooks-dir", "/etc/wireguard-manager/hooks", "directory containing optional lifecycle hook scripts")
|
||||
lanIface = flag.String("lan-iface", "eth0", "LAN interface used for nftables forward rules")
|
||||
tlsCert = flag.String("tls-cert", "", "path to TLS certificate (optional; enables HTTPS together with -tls-key)")
|
||||
tlsKey = flag.String("tls-key", "", "path to TLS private key (optional; enables HTTPS together with -tls-cert)")
|
||||
)
|
||||
flag.Parse()
|
||||
|
||||
logger := slog.New(slog.NewTextHandler(os.Stdout, nil))
|
||||
|
||||
if err := run(logger, *listen, *dbPath, *configDir, *hooksDir, *lanIface, *tlsCert, *tlsKey); err != nil {
|
||||
logger.Error("fatal", "error", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
func run(logger *slog.Logger, listen, dbPath, configDir, hooksDir, lanIface, tlsCert, tlsKey string) error {
|
||||
// Wire package-level config before anything touches the filesystem/wg-quick.
|
||||
wireguard.ConfigDir = configDir
|
||||
firewall.HooksDir = hooksDir
|
||||
|
||||
if err := os.MkdirAll(filepath.Dir(dbPath), 0700); err != nil {
|
||||
return fmt.Errorf("create db directory: %w", err)
|
||||
}
|
||||
|
||||
db, err := database.Open(dbPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open database: %w", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
if err := ensureAdminUser(db, logger); err != nil {
|
||||
return fmt.Errorf("bootstrap admin user: %w", err)
|
||||
}
|
||||
|
||||
a := api.New(db, logger, lanIface)
|
||||
|
||||
srv := &http.Server{
|
||||
Addr: listen,
|
||||
Handler: a.Routes(),
|
||||
}
|
||||
|
||||
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
|
||||
defer stop()
|
||||
|
||||
serveErr := make(chan error, 1)
|
||||
go func() {
|
||||
useTLS := tlsCert != "" && tlsKey != ""
|
||||
if useTLS {
|
||||
logger.Info("starting HTTPS server", "listen", listen)
|
||||
serveErr <- srv.ListenAndServeTLS(tlsCert, tlsKey)
|
||||
} else {
|
||||
logger.Warn("starting plain HTTP server — TLS is strongly recommended in production; set -tls-cert and -tls-key", "listen", listen)
|
||||
serveErr <- srv.ListenAndServe()
|
||||
}
|
||||
}()
|
||||
|
||||
select {
|
||||
case err := <-serveErr:
|
||||
if err != nil && !errors.Is(err, http.ErrServerClosed) {
|
||||
return fmt.Errorf("serve: %w", err)
|
||||
}
|
||||
case <-ctx.Done():
|
||||
logger.Info("shutdown signal received, stopping server")
|
||||
shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancel()
|
||||
if err := srv.Shutdown(shutdownCtx); err != nil {
|
||||
return fmt.Errorf("graceful shutdown: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
logger.Info("server stopped")
|
||||
return nil
|
||||
}
|
||||
|
||||
// ensureAdminUser creates a default admin account with a random password on first
|
||||
// run (i.e. when the users table is empty). The plaintext password is printed
|
||||
// exactly once and never persisted — only its bcrypt hash is stored.
|
||||
func ensureAdminUser(db *database.DB, logger *slog.Logger) error {
|
||||
var count int
|
||||
if err := db.QueryRow(`SELECT COUNT(*) FROM users`).Scan(&count); err != nil {
|
||||
return fmt.Errorf("count users: %w", err)
|
||||
}
|
||||
if count > 0 {
|
||||
return nil
|
||||
}
|
||||
|
||||
passwordBytes := make([]byte, 16)
|
||||
if _, err := rand.Read(passwordBytes); err != nil {
|
||||
return fmt.Errorf("generate password: %w", err)
|
||||
}
|
||||
password := hex.EncodeToString(passwordBytes)
|
||||
|
||||
hash, err := api.HashPassword(password)
|
||||
if err != nil {
|
||||
return fmt.Errorf("hash password: %w", err)
|
||||
}
|
||||
|
||||
if _, err := db.Exec(`INSERT INTO users (username, password_hash) VALUES (?, ?)`, "admin", hash); err != nil {
|
||||
return fmt.Errorf("insert admin user: %w", err)
|
||||
}
|
||||
|
||||
fmt.Fprintln(os.Stderr, "================================================================")
|
||||
fmt.Fprintln(os.Stderr, " First run: created default admin account")
|
||||
fmt.Fprintln(os.Stderr, " username: admin")
|
||||
fmt.Fprintf(os.Stderr, " password: %s\n", password)
|
||||
fmt.Fprintln(os.Stderr, " This password is shown ONLY ONCE and is not stored anywhere in")
|
||||
fmt.Fprintln(os.Stderr, " plaintext. Log in and change it immediately.")
|
||||
fmt.Fprintln(os.Stderr, "================================================================")
|
||||
logger.Info("created default admin user; see above for the one-time password")
|
||||
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
module gitea.perlbach24.de/scripte/wireguard-ui-multi
|
||||
|
||||
go 1.22
|
||||
|
||||
require (
|
||||
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
|
||||
golang.org/x/crypto v0.24.0
|
||||
modernc.org/sqlite v1.30.1
|
||||
)
|
||||
@@ -0,0 +1,139 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"net/http"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
const sessionCookieName = "wgm_session"
|
||||
const csrfCookieName = "wgm_csrf"
|
||||
const sessionTTL = 12 * time.Hour
|
||||
|
||||
type session struct {
|
||||
username string
|
||||
csrf string
|
||||
expiresAt time.Time
|
||||
}
|
||||
|
||||
// SessionStore is a simple in-memory session store (single-process deployment).
|
||||
type SessionStore struct {
|
||||
mu sync.Mutex
|
||||
sessions map[string]*session
|
||||
}
|
||||
|
||||
func NewSessionStore() *SessionStore {
|
||||
return &SessionStore{sessions: make(map[string]*session)}
|
||||
}
|
||||
|
||||
func randomToken() (string, error) {
|
||||
b := make([]byte, 32)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(b), nil
|
||||
}
|
||||
|
||||
func (s *SessionStore) Create(username string) (sessionToken, csrfToken string, err error) {
|
||||
sessionToken, err = randomToken()
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
csrfToken, err = randomToken()
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
s.mu.Lock()
|
||||
s.sessions[sessionToken] = &session{
|
||||
username: username,
|
||||
csrf: csrfToken,
|
||||
expiresAt: time.Now().Add(sessionTTL),
|
||||
}
|
||||
s.mu.Unlock()
|
||||
return sessionToken, csrfToken, nil
|
||||
}
|
||||
|
||||
func (s *SessionStore) Get(token string) (*session, bool) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
sess, ok := s.sessions[token]
|
||||
if !ok || time.Now().After(sess.expiresAt) {
|
||||
delete(s.sessions, token)
|
||||
return nil, false
|
||||
}
|
||||
return sess, true
|
||||
}
|
||||
|
||||
func (s *SessionStore) Delete(token string) {
|
||||
s.mu.Lock()
|
||||
delete(s.sessions, token)
|
||||
s.mu.Unlock()
|
||||
}
|
||||
|
||||
// HashPassword bcrypt-hashes a plaintext password for storage.
|
||||
func HashPassword(pw string) (string, error) {
|
||||
b, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.DefaultCost)
|
||||
return string(b), err
|
||||
}
|
||||
|
||||
// CheckPassword compares a plaintext password against a stored bcrypt hash.
|
||||
func CheckPassword(hash, pw string) bool {
|
||||
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(pw)) == nil
|
||||
}
|
||||
|
||||
var ErrUnauthenticated = errors.New("unauthenticated")
|
||||
|
||||
// requireAuth resolves the session from the request cookie, or fails.
|
||||
func (a *API) requireAuth(r *http.Request) (*session, error) {
|
||||
c, err := r.Cookie(sessionCookieName)
|
||||
if err != nil {
|
||||
return nil, ErrUnauthenticated
|
||||
}
|
||||
sess, ok := a.sessions.Get(c.Value)
|
||||
if !ok {
|
||||
return nil, ErrUnauthenticated
|
||||
}
|
||||
return sess, nil
|
||||
}
|
||||
|
||||
// requireCSRF checks the X-CSRF-Token header against the session's csrf token,
|
||||
// mandatory for all state-changing (non-GET) requests.
|
||||
func requireCSRF(sess *session, r *http.Request) bool {
|
||||
if r.Method == http.MethodGet || r.Method == http.MethodHead {
|
||||
return true
|
||||
}
|
||||
token := r.Header.Get("X-CSRF-Token")
|
||||
return subtle.ConstantTimeCompare([]byte(token), []byte(sess.csrf)) == 1
|
||||
}
|
||||
|
||||
func setSessionCookies(w http.ResponseWriter, sessionToken, csrfToken string) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: sessionCookieName,
|
||||
Value: sessionToken,
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: true,
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
MaxAge: int(sessionTTL.Seconds()),
|
||||
})
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: csrfCookieName,
|
||||
Value: csrfToken,
|
||||
Path: "/",
|
||||
HttpOnly: false, // readable by frontend JS to echo back in X-CSRF-Token header
|
||||
Secure: true,
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
MaxAge: int(sessionTTL.Seconds()),
|
||||
})
|
||||
}
|
||||
|
||||
func clearSessionCookies(w http.ResponseWriter) {
|
||||
http.SetCookie(w, &http.Cookie{Name: sessionCookieName, Value: "", Path: "/", MaxAge: -1})
|
||||
http.SetCookie(w, &http.Cookie{Name: csrfCookieName, Value: "", Path: "/", MaxAge: -1})
|
||||
}
|
||||
@@ -0,0 +1,484 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"database/sql"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
qrcode "github.com/skip2/go-qrcode"
|
||||
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/firewall"
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/server"
|
||||
wg "gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/wireguard"
|
||||
)
|
||||
|
||||
func writeJSON(w http.ResponseWriter, status int, v any) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(status)
|
||||
_ = json.NewEncoder(w).Encode(v)
|
||||
}
|
||||
|
||||
func writeErr(w http.ResponseWriter, status int, msg string) {
|
||||
writeJSON(w, status, map[string]string{"error": msg})
|
||||
}
|
||||
|
||||
func idParam(r *http.Request, name string) (int64, error) {
|
||||
return strconv.ParseInt(r.PathValue(name), 10, 64)
|
||||
}
|
||||
|
||||
// --- Auth ---
|
||||
|
||||
type loginRequest struct {
|
||||
Username string `json:"username"`
|
||||
Password string `json:"password"`
|
||||
}
|
||||
|
||||
func (a *API) handleLogin(w http.ResponseWriter, r *http.Request) {
|
||||
var req loginRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
|
||||
var hash string
|
||||
err := a.db.QueryRow(`SELECT password_hash FROM users WHERE username = ?`, req.Username).Scan(&hash)
|
||||
if errors.Is(err, sql.ErrNoRows) || (err == nil && !CheckPassword(hash, req.Password)) {
|
||||
writeErr(w, http.StatusUnauthorized, "invalid credentials")
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "login failed")
|
||||
return
|
||||
}
|
||||
|
||||
sessionToken, csrfToken, err := a.sessions.Create(req.Username)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "could not create session")
|
||||
return
|
||||
}
|
||||
setSessionCookies(w, sessionToken, csrfToken)
|
||||
_ = a.db.LogAudit(req.Username, "login", "session", "")
|
||||
writeJSON(w, http.StatusOK, map[string]string{"csrf_token": csrfToken})
|
||||
}
|
||||
|
||||
func (a *API) handleLogout(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
if c, err := r.Cookie(sessionCookieName); err == nil {
|
||||
a.sessions.Delete(c.Value)
|
||||
}
|
||||
clearSessionCookies(w)
|
||||
_ = a.db.LogAudit(sess.username, "logout", "session", "")
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
|
||||
// --- Servers ---
|
||||
|
||||
func (a *API) handleListServers(w http.ResponseWriter, r *http.Request, _ *session) {
|
||||
servers, err := a.store.ListServers()
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
type serverStatus struct {
|
||||
*server.Server
|
||||
Status wg.Status `json:"status"`
|
||||
}
|
||||
out := make([]serverStatus, 0, len(servers))
|
||||
for _, s := range servers {
|
||||
out = append(out, serverStatus{Server: s, Status: wg.GetStatus(s.InterfaceName)})
|
||||
}
|
||||
writeJSON(w, http.StatusOK, out)
|
||||
}
|
||||
|
||||
type createServerRequest struct {
|
||||
Name string `json:"name"`
|
||||
InterfaceName string `json:"interface_name"`
|
||||
ListenPort int `json:"listen_port"`
|
||||
AddressRange string `json:"address_range"`
|
||||
DNS string `json:"dns"`
|
||||
MTU int `json:"mtu"`
|
||||
}
|
||||
|
||||
func (a *API) handleCreateServer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
var req createServerRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
if req.Name == "" || req.InterfaceName == "" || req.ListenPort == 0 || req.AddressRange == "" {
|
||||
writeErr(w, http.StatusBadRequest, "name, interface_name, listen_port, address_range required")
|
||||
return
|
||||
}
|
||||
if req.MTU == 0 {
|
||||
req.MTU = 1420
|
||||
}
|
||||
|
||||
priv, pub, err := wg.GenerateKeyPair()
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "key generation failed")
|
||||
return
|
||||
}
|
||||
|
||||
srv := &server.Server{
|
||||
Name: req.Name, InterfaceName: req.InterfaceName, ListenPort: req.ListenPort,
|
||||
PrivateKey: priv, PublicKey: pub, AddressRange: req.AddressRange,
|
||||
DNS: req.DNS, MTU: req.MTU, Enabled: true,
|
||||
}
|
||||
id, err := a.store.CreateServer(srv)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
srv.ID = id
|
||||
|
||||
if err := wg.WriteConfig(srv, nil); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "config write failed: "+err.Error())
|
||||
return
|
||||
}
|
||||
_ = a.db.LogAudit(sess.username, "server.create", req.Name, "")
|
||||
writeJSON(w, http.StatusCreated, srv)
|
||||
}
|
||||
|
||||
func (a *API) handleGetServer(w http.ResponseWriter, r *http.Request, _ *session) {
|
||||
id, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
srv, err := a.store.GetServer(id)
|
||||
if errors.Is(err, server.ErrNotFound) {
|
||||
writeErr(w, http.StatusNotFound, "server not found")
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, srv)
|
||||
}
|
||||
|
||||
func (a *API) handleUpdateServer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
id, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
srv, err := a.store.GetServer(id)
|
||||
if errors.Is(err, server.ErrNotFound) {
|
||||
writeErr(w, http.StatusNotFound, "server not found")
|
||||
return
|
||||
} else if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
var req createServerRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
srv.Name, srv.AddressRange, srv.DNS = req.Name, req.AddressRange, req.DNS
|
||||
if req.MTU > 0 {
|
||||
srv.MTU = req.MTU
|
||||
}
|
||||
if req.ListenPort > 0 {
|
||||
srv.ListenPort = req.ListenPort
|
||||
}
|
||||
if err := a.store.UpdateServer(srv); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
peers, _ := a.store.ListPeersByServer(srv.ID)
|
||||
if err := wg.WriteConfig(srv, peers); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "config write failed: "+err.Error())
|
||||
return
|
||||
}
|
||||
_ = a.db.LogAudit(sess.username, "server.update", srv.Name, "")
|
||||
writeJSON(w, http.StatusOK, srv)
|
||||
}
|
||||
|
||||
func (a *API) handleDeleteServer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
id, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
srv, err := a.store.GetServer(id)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusNotFound, "server not found")
|
||||
return
|
||||
}
|
||||
_ = wg.Down(srv.InterfaceName)
|
||||
if err := a.store.DeleteServer(id); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
_ = a.db.LogAudit(sess.username, "server.delete", srv.Name, "")
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
|
||||
func (a *API) handleStartServer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
a.serverAction(w, r, sess, "server.start", func(srv *server.Server) error {
|
||||
if err := wg.Up(srv.InterfaceName); err != nil {
|
||||
return err
|
||||
}
|
||||
return firewall.RunHook(firewall.HookServerStart, srv.InterfaceName)
|
||||
})
|
||||
}
|
||||
|
||||
func (a *API) handleStopServer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
a.serverAction(w, r, sess, "server.stop", func(srv *server.Server) error {
|
||||
if err := wg.Down(srv.InterfaceName); err != nil {
|
||||
return err
|
||||
}
|
||||
return firewall.RunHook(firewall.HookServerStop, srv.InterfaceName)
|
||||
})
|
||||
}
|
||||
|
||||
func (a *API) handleReloadServer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
a.serverAction(w, r, sess, "server.reload", func(srv *server.Server) error {
|
||||
peers, err := a.store.ListPeersByServer(srv.ID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := wg.WriteConfig(srv, peers); err != nil {
|
||||
return err
|
||||
}
|
||||
return wg.Reload(srv.InterfaceName, wg.ConfigPath(srv))
|
||||
})
|
||||
}
|
||||
|
||||
func (a *API) serverAction(w http.ResponseWriter, r *http.Request, sess *session, action string, fn func(*server.Server) error) {
|
||||
id, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
srv, err := a.store.GetServer(id)
|
||||
if errors.Is(err, server.ErrNotFound) {
|
||||
writeErr(w, http.StatusNotFound, "server not found")
|
||||
return
|
||||
} else if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
if err := fn(srv); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
_ = a.db.LogAudit(sess.username, action, srv.Name, "")
|
||||
writeJSON(w, http.StatusOK, map[string]string{"status": string(wg.GetStatus(srv.InterfaceName))})
|
||||
}
|
||||
|
||||
func (a *API) handleDownloadServerConfig(w http.ResponseWriter, r *http.Request, _ *session) {
|
||||
id, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
srv, err := a.store.GetServer(id)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusNotFound, "server not found")
|
||||
return
|
||||
}
|
||||
peers, err := a.store.ListPeersByServer(id)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "text/plain")
|
||||
w.Header().Set("Content-Disposition", "attachment; filename="+srv.InterfaceName+".conf")
|
||||
_, _ = w.Write([]byte(wg.RenderConfig(srv, peers)))
|
||||
}
|
||||
|
||||
// --- Peers ---
|
||||
|
||||
func (a *API) handleListPeers(w http.ResponseWriter, r *http.Request, _ *session) {
|
||||
id, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
peers, err := a.store.ListPeersByServer(id)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
// never expose private keys in listing responses
|
||||
type safePeer struct {
|
||||
*server.Peer
|
||||
}
|
||||
out := make([]map[string]any, 0, len(peers))
|
||||
for _, p := range peers {
|
||||
out = append(out, map[string]any{
|
||||
"id": p.ID, "server_id": p.ServerID, "name": p.Name, "email": p.Email,
|
||||
"public_key": p.PublicKey, "allowed_ips": p.AllowedIPs, "endpoint": p.Endpoint,
|
||||
"persistent_keepalive": p.PersistentKeepalive, "enabled": p.Enabled,
|
||||
"expires_at": p.ExpiresAt,
|
||||
})
|
||||
}
|
||||
writeJSON(w, http.StatusOK, out)
|
||||
}
|
||||
|
||||
type createPeerRequest struct {
|
||||
Name string `json:"name"`
|
||||
Email string `json:"email"`
|
||||
AllowedIPs string `json:"allowed_ips"`
|
||||
PersistentKeepalive int `json:"persistent_keepalive"`
|
||||
UsePresharedKey bool `json:"use_preshared_key"`
|
||||
}
|
||||
|
||||
func (a *API) handleCreatePeer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
serverID, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
srv, err := a.store.GetServer(serverID)
|
||||
if errors.Is(err, server.ErrNotFound) {
|
||||
writeErr(w, http.StatusNotFound, "server not found")
|
||||
return
|
||||
} else if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
var req createPeerRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid request body")
|
||||
return
|
||||
}
|
||||
if req.Name == "" || req.AllowedIPs == "" {
|
||||
writeErr(w, http.StatusBadRequest, "name and allowed_ips required")
|
||||
return
|
||||
}
|
||||
if req.PersistentKeepalive == 0 {
|
||||
req.PersistentKeepalive = 25
|
||||
}
|
||||
|
||||
priv, pub, err := wg.GenerateKeyPair()
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "key generation failed")
|
||||
return
|
||||
}
|
||||
var psk string
|
||||
if req.UsePresharedKey {
|
||||
psk, err = wg.GeneratePresharedKey()
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "psk generation failed")
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
p := &server.Peer{
|
||||
ServerID: serverID, Name: req.Name, Email: req.Email, PublicKey: pub, PrivateKey: priv,
|
||||
PresharedKey: psk, AllowedIPs: req.AllowedIPs, PersistentKeepalive: req.PersistentKeepalive,
|
||||
Enabled: true,
|
||||
}
|
||||
id, err := a.store.CreatePeer(p)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
p.ID = id
|
||||
|
||||
peers, _ := a.store.ListPeersByServer(serverID)
|
||||
if err := wg.WriteConfig(srv, peers); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "config write failed: "+err.Error())
|
||||
return
|
||||
}
|
||||
_ = firewall.RunHook(firewall.HookPeerAdd, srv.InterfaceName, p.PublicKey)
|
||||
_ = a.db.LogAudit(sess.username, "peer.create", p.Name, "server="+srv.Name)
|
||||
writeJSON(w, http.StatusCreated, p)
|
||||
}
|
||||
|
||||
func (a *API) handleDeletePeer(w http.ResponseWriter, r *http.Request, sess *session) {
|
||||
serverID, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid id")
|
||||
return
|
||||
}
|
||||
peerID, err := idParam(r, "peerid")
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusBadRequest, "invalid peer id")
|
||||
return
|
||||
}
|
||||
srv, err := a.store.GetServer(serverID)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusNotFound, "server not found")
|
||||
return
|
||||
}
|
||||
p, err := a.store.GetPeer(peerID)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusNotFound, "peer not found")
|
||||
return
|
||||
}
|
||||
if err := a.store.DeletePeer(peerID); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
peers, _ := a.store.ListPeersByServer(serverID)
|
||||
if err := wg.WriteConfig(srv, peers); err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, "config write failed: "+err.Error())
|
||||
return
|
||||
}
|
||||
_ = firewall.RunHook(firewall.HookPeerRemove, srv.InterfaceName, p.PublicKey)
|
||||
_ = a.db.LogAudit(sess.username, "peer.delete", p.Name, "server="+srv.Name)
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
|
||||
func (a *API) handleDownloadPeerConfig(w http.ResponseWriter, r *http.Request, _ *session) {
|
||||
srv, p, err := a.loadServerAndPeer(r)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusNotFound, err.Error())
|
||||
return
|
||||
}
|
||||
host := r.URL.Query().Get("host")
|
||||
if host == "" {
|
||||
host = r.Host
|
||||
}
|
||||
w.Header().Set("Content-Type", "text/plain")
|
||||
w.Header().Set("Content-Disposition", "attachment; filename="+p.Name+".conf")
|
||||
_, _ = w.Write([]byte(wg.RenderClientConfig(srv, p, host)))
|
||||
}
|
||||
|
||||
func (a *API) handlePeerQRCode(w http.ResponseWriter, r *http.Request, _ *session) {
|
||||
srv, p, err := a.loadServerAndPeer(r)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusNotFound, err.Error())
|
||||
return
|
||||
}
|
||||
host := r.URL.Query().Get("host")
|
||||
if host == "" {
|
||||
host = r.Host
|
||||
}
|
||||
png, err := qrcode.Encode(wg.RenderClientConfig(srv, p, host), qrcode.Medium, 256)
|
||||
if err != nil {
|
||||
writeErr(w, http.StatusInternalServerError, err.Error())
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "image/png")
|
||||
_, _ = w.Write(bytes.NewBuffer(png).Bytes())
|
||||
}
|
||||
|
||||
func (a *API) loadServerAndPeer(r *http.Request) (*server.Server, *server.Peer, error) {
|
||||
serverID, err := idParam(r, "id")
|
||||
if err != nil {
|
||||
return nil, nil, errors.New("invalid id")
|
||||
}
|
||||
peerID, err := idParam(r, "peerid")
|
||||
if err != nil {
|
||||
return nil, nil, errors.New("invalid peer id")
|
||||
}
|
||||
srv, err := a.store.GetServer(serverID)
|
||||
if err != nil {
|
||||
return nil, nil, errors.New("server not found")
|
||||
}
|
||||
p, err := a.store.GetPeer(peerID)
|
||||
if err != nil {
|
||||
return nil, nil, errors.New("peer not found")
|
||||
}
|
||||
return srv, p, nil
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"log/slog"
|
||||
"net/http"
|
||||
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/database"
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/server"
|
||||
)
|
||||
|
||||
// API holds shared dependencies for HTTP handlers.
|
||||
type API struct {
|
||||
db *database.DB
|
||||
store *server.Store
|
||||
sessions *SessionStore
|
||||
log *slog.Logger
|
||||
lanIface string
|
||||
}
|
||||
|
||||
func New(db *database.DB, log *slog.Logger, lanIface string) *API {
|
||||
return &API{
|
||||
db: db,
|
||||
store: server.NewStore(db),
|
||||
sessions: NewSessionStore(),
|
||||
log: log,
|
||||
lanIface: lanIface,
|
||||
}
|
||||
}
|
||||
|
||||
// Routes builds the full HTTP handler tree (API + UI), using Go 1.22 mux patterns.
|
||||
func (a *API) Routes() http.Handler {
|
||||
mux := http.NewServeMux()
|
||||
|
||||
// Auth
|
||||
mux.HandleFunc("POST /api/login", a.handleLogin)
|
||||
mux.HandleFunc("POST /api/logout", a.withAuth(a.handleLogout))
|
||||
|
||||
// Servers
|
||||
mux.HandleFunc("GET /api/servers", a.withAuth(a.handleListServers))
|
||||
mux.HandleFunc("POST /api/servers", a.withAuth(a.handleCreateServer))
|
||||
mux.HandleFunc("GET /api/servers/{id}", a.withAuth(a.handleGetServer))
|
||||
mux.HandleFunc("PUT /api/servers/{id}", a.withAuth(a.handleUpdateServer))
|
||||
mux.HandleFunc("DELETE /api/servers/{id}", a.withAuth(a.handleDeleteServer))
|
||||
mux.HandleFunc("POST /api/servers/{id}/start", a.withAuth(a.handleStartServer))
|
||||
mux.HandleFunc("POST /api/servers/{id}/stop", a.withAuth(a.handleStopServer))
|
||||
mux.HandleFunc("POST /api/servers/{id}/reload", a.withAuth(a.handleReloadServer))
|
||||
mux.HandleFunc("GET /api/servers/{id}/config", a.withAuth(a.handleDownloadServerConfig))
|
||||
|
||||
// Peers
|
||||
mux.HandleFunc("GET /api/server/{id}/peers", a.withAuth(a.handleListPeers))
|
||||
mux.HandleFunc("POST /api/server/{id}/peer", a.withAuth(a.handleCreatePeer))
|
||||
mux.HandleFunc("DELETE /api/server/{id}/peer/{peerid}", a.withAuth(a.handleDeletePeer))
|
||||
mux.HandleFunc("GET /api/server/{id}/peer/{peerid}/config", a.withAuth(a.handleDownloadPeerConfig))
|
||||
mux.HandleFunc("GET /api/server/{id}/peer/{peerid}/qrcode", a.withAuth(a.handlePeerQRCode))
|
||||
|
||||
// UI
|
||||
mux.HandleFunc("GET /", a.handleDashboard)
|
||||
mux.HandleFunc("GET /login", a.handleLoginPage)
|
||||
mux.HandleFunc("GET /servers/{id}", a.handleServerPage)
|
||||
mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("internal/ui/static"))))
|
||||
|
||||
return a.logMiddleware(mux)
|
||||
}
|
||||
|
||||
func (a *API) logMiddleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
a.log.Info("request", "method", r.Method, "path", r.URL.Path, "remote", r.RemoteAddr)
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
// withAuth enforces a valid session and, for mutating requests, a matching CSRF token.
|
||||
func (a *API) withAuth(next func(http.ResponseWriter, *http.Request, *session)) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
sess, err := a.requireAuth(r)
|
||||
if err != nil {
|
||||
http.Error(w, "unauthenticated", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
if !requireCSRF(sess, r) {
|
||||
http.Error(w, "invalid csrf token", http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
next(w, r, sess)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
)
|
||||
|
||||
const templatesDir = "internal/ui/templates"
|
||||
|
||||
// hasSession reports whether the request carries a valid, non-expired session cookie.
|
||||
func (a *API) hasSession(r *http.Request) bool {
|
||||
c, err := r.Cookie(sessionCookieName)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
_, ok := a.sessions.Get(c.Value)
|
||||
return ok
|
||||
}
|
||||
|
||||
func (a *API) handleDashboard(w http.ResponseWriter, r *http.Request) {
|
||||
if !a.hasSession(r) {
|
||||
http.Redirect(w, r, "/login", http.StatusFound)
|
||||
return
|
||||
}
|
||||
http.ServeFile(w, r, templatesDir+"/dashboard.html")
|
||||
}
|
||||
|
||||
func (a *API) handleLoginPage(w http.ResponseWriter, r *http.Request) {
|
||||
if a.hasSession(r) {
|
||||
http.Redirect(w, r, "/", http.StatusFound)
|
||||
return
|
||||
}
|
||||
http.ServeFile(w, r, templatesDir+"/login.html")
|
||||
}
|
||||
|
||||
func (a *API) handleServerPage(w http.ResponseWriter, r *http.Request) {
|
||||
if !a.hasSession(r) {
|
||||
http.Redirect(w, r, "/login", http.StatusFound)
|
||||
return
|
||||
}
|
||||
http.ServeFile(w, r, templatesDir+"/server.html")
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
package database
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"fmt"
|
||||
|
||||
_ "modernc.org/sqlite"
|
||||
)
|
||||
|
||||
// DB wraps the sqlite connection used by the whole application.
|
||||
type DB struct {
|
||||
*sql.DB
|
||||
}
|
||||
|
||||
const schema = `
|
||||
CREATE TABLE IF NOT EXISTS servers (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
name TEXT NOT NULL UNIQUE,
|
||||
interface_name TEXT NOT NULL UNIQUE,
|
||||
listen_port INTEGER NOT NULL,
|
||||
private_key TEXT NOT NULL,
|
||||
public_key TEXT NOT NULL,
|
||||
address_range TEXT NOT NULL,
|
||||
dns TEXT DEFAULT '',
|
||||
mtu INTEGER DEFAULT 1420,
|
||||
enabled INTEGER NOT NULL DEFAULT 1,
|
||||
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS peers (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
server_id INTEGER NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
|
||||
name TEXT NOT NULL,
|
||||
email TEXT DEFAULT '',
|
||||
public_key TEXT NOT NULL,
|
||||
private_key TEXT DEFAULT '',
|
||||
preshared_key TEXT DEFAULT '',
|
||||
allowed_ips TEXT NOT NULL,
|
||||
endpoint TEXT DEFAULT '',
|
||||
persistent_keepalive INTEGER DEFAULT 25,
|
||||
enabled INTEGER NOT NULL DEFAULT 1,
|
||||
expires_at DATETIME,
|
||||
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS audit_log (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
actor TEXT NOT NULL,
|
||||
action TEXT NOT NULL,
|
||||
target TEXT NOT NULL,
|
||||
detail TEXT DEFAULT '',
|
||||
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS users (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
username TEXT NOT NULL UNIQUE,
|
||||
password_hash TEXT NOT NULL,
|
||||
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_peers_server_id ON peers(server_id);
|
||||
`
|
||||
|
||||
// Open opens (creating if needed) the sqlite database at path and applies schema.
|
||||
func Open(path string) (*DB, error) {
|
||||
sqlDB, err := sql.Open("sqlite", path+"?_pragma=foreign_keys(1)")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("open sqlite: %w", err)
|
||||
}
|
||||
if _, err := sqlDB.Exec(schema); err != nil {
|
||||
sqlDB.Close()
|
||||
return nil, fmt.Errorf("apply schema: %w", err)
|
||||
}
|
||||
return &DB{sqlDB}, nil
|
||||
}
|
||||
|
||||
// LogAudit records an entry in the audit log.
|
||||
func (db *DB) LogAudit(actor, action, target, detail string) error {
|
||||
_, err := db.Exec(`INSERT INTO audit_log (actor, action, target, detail) VALUES (?, ?, ?, ?)`,
|
||||
actor, action, target, detail)
|
||||
return err
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
package firewall
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/server"
|
||||
)
|
||||
|
||||
// HooksDir holds optional user-defined shell scripts run around lifecycle events.
|
||||
var HooksDir = "/etc/wireguard-manager/hooks"
|
||||
|
||||
// HookEvent names the lifecycle points a hook script may exist for.
|
||||
type HookEvent string
|
||||
|
||||
const (
|
||||
HookServerStart HookEvent = "server-start"
|
||||
HookServerStop HookEvent = "server-stop"
|
||||
HookPeerAdd HookEvent = "peer-add"
|
||||
HookPeerRemove HookEvent = "peer-remove"
|
||||
)
|
||||
|
||||
// RunHook executes /etc/wireguard-manager/hooks/<event> if present and executable,
|
||||
// passing iface (and optionally peer pubkey) as arguments. Missing hook is not an error.
|
||||
func RunHook(event HookEvent, args ...string) error {
|
||||
path := filepath.Join(HooksDir, string(event))
|
||||
if _, err := os.Stat(path); err != nil {
|
||||
return nil // hook not installed, skip silently
|
||||
}
|
||||
cmd := exec.Command(path, args...)
|
||||
if out, err := cmd.CombinedOutput(); err != nil {
|
||||
return fmt.Errorf("hook %s: %w: %s", event, err, out)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// NFTRuleset renders a suggested nftables ruleset snippet for a server, allowing
|
||||
// its UDP listen port in and forwarding traffic between the tunnel and lanIface.
|
||||
func NFTRuleset(srv *server.Server, lanIface string) string {
|
||||
return fmt.Sprintf(`table inet wireguard_%s {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy accept;
|
||||
udp dport %d accept
|
||||
}
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy accept;
|
||||
iifname "%s" oifname "%s" accept
|
||||
iifname "%s" oifname "%s" accept
|
||||
}
|
||||
}
|
||||
`, srv.InterfaceName, srv.ListenPort, srv.InterfaceName, lanIface, lanIface, srv.InterfaceName)
|
||||
}
|
||||
|
||||
// ApplyRuleset writes the ruleset to a temp file and loads it with `nft -f`.
|
||||
func ApplyRuleset(srv *server.Server, lanIface string) error {
|
||||
tmp, err := os.CreateTemp("", "wgm-nft-*.conf")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.Remove(tmp.Name())
|
||||
|
||||
if _, err := tmp.WriteString(NFTRuleset(srv, lanIface)); err != nil {
|
||||
tmp.Close()
|
||||
return err
|
||||
}
|
||||
tmp.Close()
|
||||
|
||||
cmd := exec.Command("nft", "-f", tmp.Name())
|
||||
if out, err := cmd.CombinedOutput(); err != nil {
|
||||
return fmt.Errorf("nft -f: %w: %s", err, out)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,205 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"errors"
|
||||
"time"
|
||||
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/database"
|
||||
)
|
||||
|
||||
// Server represents a single, independent WireGuard interface.
|
||||
type Server struct {
|
||||
ID int64
|
||||
Name string
|
||||
InterfaceName string
|
||||
ListenPort int
|
||||
PrivateKey string
|
||||
PublicKey string
|
||||
AddressRange string
|
||||
DNS string
|
||||
MTU int
|
||||
Enabled bool
|
||||
CreatedAt time.Time
|
||||
UpdatedAt time.Time
|
||||
}
|
||||
|
||||
// Peer represents a WireGuard client belonging to a Server.
|
||||
type Peer struct {
|
||||
ID int64
|
||||
ServerID int64
|
||||
Name string
|
||||
Email string
|
||||
PublicKey string
|
||||
PrivateKey string
|
||||
PresharedKey string
|
||||
AllowedIPs string
|
||||
Endpoint string
|
||||
PersistentKeepalive int
|
||||
Enabled bool
|
||||
ExpiresAt *time.Time
|
||||
CreatedAt time.Time
|
||||
UpdatedAt time.Time
|
||||
}
|
||||
|
||||
var ErrNotFound = errors.New("not found")
|
||||
|
||||
// Store provides CRUD access to servers and peers.
|
||||
type Store struct {
|
||||
db *database.DB
|
||||
}
|
||||
|
||||
func NewStore(db *database.DB) *Store {
|
||||
return &Store{db: db}
|
||||
}
|
||||
|
||||
func (s *Store) CreateServer(srv *Server) (int64, error) {
|
||||
res, err := s.db.Exec(`INSERT INTO servers
|
||||
(name, interface_name, listen_port, private_key, public_key, address_range, dns, mtu, enabled)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
srv.Name, srv.InterfaceName, srv.ListenPort, srv.PrivateKey, srv.PublicKey,
|
||||
srv.AddressRange, srv.DNS, srv.MTU, boolToInt(srv.Enabled))
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return res.LastInsertId()
|
||||
}
|
||||
|
||||
func (s *Store) UpdateServer(srv *Server) error {
|
||||
_, err := s.db.Exec(`UPDATE servers SET
|
||||
name = ?, interface_name = ?, listen_port = ?, private_key = ?, public_key = ?,
|
||||
address_range = ?, dns = ?, mtu = ?, enabled = ?, updated_at = CURRENT_TIMESTAMP
|
||||
WHERE id = ?`,
|
||||
srv.Name, srv.InterfaceName, srv.ListenPort, srv.PrivateKey, srv.PublicKey,
|
||||
srv.AddressRange, srv.DNS, srv.MTU, boolToInt(srv.Enabled), srv.ID)
|
||||
return err
|
||||
}
|
||||
|
||||
func (s *Store) DeleteServer(id int64) error {
|
||||
_, err := s.db.Exec(`DELETE FROM servers WHERE id = ?`, id)
|
||||
return err
|
||||
}
|
||||
|
||||
func (s *Store) GetServer(id int64) (*Server, error) {
|
||||
row := s.db.QueryRow(`SELECT id, name, interface_name, listen_port, private_key, public_key,
|
||||
address_range, dns, mtu, enabled, created_at, updated_at FROM servers WHERE id = ?`, id)
|
||||
return scanServer(row)
|
||||
}
|
||||
|
||||
func (s *Store) ListServers() ([]*Server, error) {
|
||||
rows, err := s.db.Query(`SELECT id, name, interface_name, listen_port, private_key, public_key,
|
||||
address_range, dns, mtu, enabled, created_at, updated_at FROM servers ORDER BY name`)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []*Server
|
||||
for rows.Next() {
|
||||
srv, err := scanServerRows(rows)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, srv)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
func (s *Store) CreatePeer(p *Peer) (int64, error) {
|
||||
res, err := s.db.Exec(`INSERT INTO peers
|
||||
(server_id, name, email, public_key, private_key, preshared_key, allowed_ips, endpoint,
|
||||
persistent_keepalive, enabled, expires_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
p.ServerID, p.Name, p.Email, p.PublicKey, p.PrivateKey, p.PresharedKey, p.AllowedIPs,
|
||||
p.Endpoint, p.PersistentKeepalive, boolToInt(p.Enabled), p.ExpiresAt)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return res.LastInsertId()
|
||||
}
|
||||
|
||||
func (s *Store) UpdatePeer(p *Peer) error {
|
||||
_, err := s.db.Exec(`UPDATE peers SET
|
||||
name = ?, email = ?, public_key = ?, preshared_key = ?, allowed_ips = ?, endpoint = ?,
|
||||
persistent_keepalive = ?, enabled = ?, expires_at = ?, updated_at = CURRENT_TIMESTAMP
|
||||
WHERE id = ?`,
|
||||
p.Name, p.Email, p.PublicKey, p.PresharedKey, p.AllowedIPs, p.Endpoint,
|
||||
p.PersistentKeepalive, boolToInt(p.Enabled), p.ExpiresAt, p.ID)
|
||||
return err
|
||||
}
|
||||
|
||||
func (s *Store) DeletePeer(id int64) error {
|
||||
_, err := s.db.Exec(`DELETE FROM peers WHERE id = ?`, id)
|
||||
return err
|
||||
}
|
||||
|
||||
func (s *Store) GetPeer(id int64) (*Peer, error) {
|
||||
row := s.db.QueryRow(`SELECT id, server_id, name, email, public_key, private_key, preshared_key,
|
||||
allowed_ips, endpoint, persistent_keepalive, enabled, expires_at, created_at, updated_at
|
||||
FROM peers WHERE id = ?`, id)
|
||||
return scanPeer(row)
|
||||
}
|
||||
|
||||
func (s *Store) ListPeersByServer(serverID int64) ([]*Peer, error) {
|
||||
rows, err := s.db.Query(`SELECT id, server_id, name, email, public_key, private_key, preshared_key,
|
||||
allowed_ips, endpoint, persistent_keepalive, enabled, expires_at, created_at, updated_at
|
||||
FROM peers WHERE server_id = ? ORDER BY name`, serverID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []*Peer
|
||||
for rows.Next() {
|
||||
p, err := scanPeerRows(rows)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, p)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
type scanner interface {
|
||||
Scan(dest ...any) error
|
||||
}
|
||||
|
||||
func scanServer(row scanner) (*Server, error) {
|
||||
var srv Server
|
||||
var enabled int
|
||||
if err := row.Scan(&srv.ID, &srv.Name, &srv.InterfaceName, &srv.ListenPort, &srv.PrivateKey,
|
||||
&srv.PublicKey, &srv.AddressRange, &srv.DNS, &srv.MTU, &enabled, &srv.CreatedAt, &srv.UpdatedAt); err != nil {
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return nil, ErrNotFound
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
srv.Enabled = enabled != 0
|
||||
return &srv, nil
|
||||
}
|
||||
|
||||
func scanServerRows(rows *sql.Rows) (*Server, error) { return scanServer(rows) }
|
||||
|
||||
func scanPeer(row scanner) (*Peer, error) {
|
||||
var p Peer
|
||||
var enabled int
|
||||
if err := row.Scan(&p.ID, &p.ServerID, &p.Name, &p.Email, &p.PublicKey, &p.PrivateKey,
|
||||
&p.PresharedKey, &p.AllowedIPs, &p.Endpoint, &p.PersistentKeepalive, &enabled,
|
||||
&p.ExpiresAt, &p.CreatedAt, &p.UpdatedAt); err != nil {
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return nil, ErrNotFound
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
p.Enabled = enabled != 0
|
||||
return &p, nil
|
||||
}
|
||||
|
||||
func scanPeerRows(rows *sql.Rows) (*Peer, error) { return scanPeer(rows) }
|
||||
|
||||
func boolToInt(b bool) int {
|
||||
if b {
|
||||
return 1
|
||||
}
|
||||
return 0
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
function getCookie(name) {
|
||||
const match = document.cookie.match(new RegExp("(?:^|; )" + name + "=([^;]*)"));
|
||||
return match ? decodeURIComponent(match[1]) : "";
|
||||
}
|
||||
|
||||
async function apiFetch(url, options) {
|
||||
options = options || {};
|
||||
options.headers = options.headers || {};
|
||||
if (options.method && options.method !== "GET") {
|
||||
options.headers["X-CSRF-Token"] = getCookie("wgm_csrf");
|
||||
}
|
||||
const res = await fetch(url, options);
|
||||
if (res.status === 401) {
|
||||
window.location.href = "/login";
|
||||
throw new Error("unauthenticated");
|
||||
}
|
||||
return res;
|
||||
}
|
||||
|
||||
async function loadServers() {
|
||||
const tbody = document.querySelector("#servers tbody");
|
||||
tbody.innerHTML = "";
|
||||
const res = await apiFetch("/api/servers");
|
||||
if (!res.ok) return;
|
||||
const servers = await res.json();
|
||||
|
||||
for (const s of servers) {
|
||||
const tr = document.createElement("tr");
|
||||
|
||||
const nameTd = document.createElement("td");
|
||||
const link = document.createElement("a");
|
||||
link.href = "/servers/" + s.ID;
|
||||
link.textContent = s.Name;
|
||||
nameTd.appendChild(link);
|
||||
|
||||
const ifaceTd = document.createElement("td");
|
||||
ifaceTd.textContent = s.InterfaceName;
|
||||
|
||||
const portTd = document.createElement("td");
|
||||
portTd.textContent = s.ListenPort;
|
||||
|
||||
const statusTd = document.createElement("td");
|
||||
const badge = document.createElement("span");
|
||||
badge.className = "badge " + (s.status === "UP" ? "up" : "down");
|
||||
badge.textContent = s.status;
|
||||
statusTd.appendChild(badge);
|
||||
|
||||
const actionsTd = document.createElement("td");
|
||||
actionsTd.appendChild(makeActionButton("Start", () => serverAction(s.ID, "start")));
|
||||
actionsTd.appendChild(makeActionButton("Stop", () => serverAction(s.ID, "stop")));
|
||||
actionsTd.appendChild(makeActionButton("Reload", () => serverAction(s.ID, "reload")));
|
||||
|
||||
tr.appendChild(nameTd);
|
||||
tr.appendChild(ifaceTd);
|
||||
tr.appendChild(portTd);
|
||||
tr.appendChild(statusTd);
|
||||
tr.appendChild(actionsTd);
|
||||
tbody.appendChild(tr);
|
||||
}
|
||||
}
|
||||
|
||||
function makeActionButton(label, onClick) {
|
||||
const btn = document.createElement("button");
|
||||
btn.textContent = label;
|
||||
btn.className = "secondary";
|
||||
btn.addEventListener("click", onClick);
|
||||
return btn;
|
||||
}
|
||||
|
||||
async function serverAction(id, action) {
|
||||
await apiFetch("/api/servers/" + id + "/" + action, { method: "POST" });
|
||||
loadServers();
|
||||
}
|
||||
|
||||
document.getElementById("new-server").addEventListener("click", async () => {
|
||||
const name = prompt("Name des Servers (z.B. WGhome):");
|
||||
if (!name) return;
|
||||
const interfaceName = prompt("Interface (z.B. wg-home):");
|
||||
if (!interfaceName) return;
|
||||
const listenPort = parseInt(prompt("Listen Port (z.B. 51822):"), 10);
|
||||
if (!listenPort) return;
|
||||
const addressRange = prompt("Address Range (z.B. 10.20.22.0/24):");
|
||||
if (!addressRange) return;
|
||||
const dns = prompt("DNS (optional):") || "";
|
||||
|
||||
const res = await apiFetch("/api/servers", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
name: name,
|
||||
interface_name: interfaceName,
|
||||
listen_port: listenPort,
|
||||
address_range: addressRange,
|
||||
dns: dns,
|
||||
mtu: 1420,
|
||||
}),
|
||||
});
|
||||
if (!res.ok) {
|
||||
const data = await res.json().catch(() => ({}));
|
||||
alert(data.error || "Server konnte nicht erstellt werden.");
|
||||
return;
|
||||
}
|
||||
loadServers();
|
||||
});
|
||||
|
||||
loadServers();
|
||||
@@ -0,0 +1,25 @@
|
||||
document.getElementById("login-form").addEventListener("submit", async function (e) {
|
||||
e.preventDefault();
|
||||
const errEl = document.getElementById("login-error");
|
||||
errEl.textContent = "";
|
||||
|
||||
const form = e.target;
|
||||
const username = form.username.value;
|
||||
const password = form.password.value;
|
||||
|
||||
try {
|
||||
const res = await fetch("/api/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username, password }),
|
||||
});
|
||||
if (!res.ok) {
|
||||
const data = await res.json().catch(() => ({}));
|
||||
errEl.textContent = data.error || "Anmeldung fehlgeschlagen.";
|
||||
return;
|
||||
}
|
||||
window.location.href = "/";
|
||||
} catch (err) {
|
||||
errEl.textContent = "Verbindung fehlgeschlagen.";
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,173 @@
|
||||
function getCookie(name) {
|
||||
const match = document.cookie.match(new RegExp("(?:^|; )" + name + "=([^;]*)"));
|
||||
return match ? decodeURIComponent(match[1]) : "";
|
||||
}
|
||||
|
||||
async function apiFetch(url, options) {
|
||||
options = options || {};
|
||||
options.headers = options.headers || {};
|
||||
if (options.method && options.method !== "GET") {
|
||||
options.headers["X-CSRF-Token"] = getCookie("wgm_csrf");
|
||||
}
|
||||
const res = await fetch(url, options);
|
||||
if (res.status === 401) {
|
||||
window.location.href = "/login";
|
||||
throw new Error("unauthenticated");
|
||||
}
|
||||
return res;
|
||||
}
|
||||
|
||||
function serverIDFromPath() {
|
||||
const parts = window.location.pathname.split("/").filter(Boolean);
|
||||
return parts[1];
|
||||
}
|
||||
|
||||
const serverID = serverIDFromPath();
|
||||
const errEl = document.getElementById("server-error");
|
||||
|
||||
async function loadServer() {
|
||||
errEl.textContent = "";
|
||||
const res = await apiFetch("/api/servers/" + serverID);
|
||||
if (!res.ok) {
|
||||
const data = await res.json().catch(() => ({}));
|
||||
errEl.textContent = data.error || "Server konnte nicht geladen werden.";
|
||||
return;
|
||||
}
|
||||
const s = await res.json();
|
||||
document.getElementById("server-name").textContent = s.Name;
|
||||
document.getElementById("d-interface").textContent = s.InterfaceName;
|
||||
document.getElementById("d-port").textContent = s.ListenPort;
|
||||
document.getElementById("d-address").textContent = s.AddressRange;
|
||||
document.getElementById("d-dns").textContent = s.DNS || "-";
|
||||
document.getElementById("d-mtu").textContent = s.MTU;
|
||||
|
||||
const statusRes = await apiFetch("/api/servers");
|
||||
if (statusRes.ok) {
|
||||
const servers = await statusRes.json();
|
||||
const match = servers.find((x) => String(x.ID) === String(serverID));
|
||||
const statusTd = document.getElementById("d-status");
|
||||
statusTd.innerHTML = "";
|
||||
const badge = document.createElement("span");
|
||||
const status = match ? match.status : "DOWN";
|
||||
badge.className = "badge " + (status === "UP" ? "up" : "down");
|
||||
badge.textContent = status;
|
||||
statusTd.appendChild(badge);
|
||||
}
|
||||
}
|
||||
|
||||
async function loadPeers() {
|
||||
const tbody = document.querySelector("#peers tbody");
|
||||
tbody.innerHTML = "";
|
||||
const res = await apiFetch("/api/server/" + serverID + "/peers");
|
||||
if (!res.ok) return;
|
||||
const peers = await res.json();
|
||||
|
||||
for (const p of peers) {
|
||||
const tr = document.createElement("tr");
|
||||
|
||||
const nameTd = document.createElement("td");
|
||||
nameTd.textContent = p.name;
|
||||
|
||||
const emailTd = document.createElement("td");
|
||||
emailTd.textContent = p.email || "-";
|
||||
|
||||
const allowedTd = document.createElement("td");
|
||||
allowedTd.textContent = p.allowed_ips;
|
||||
|
||||
const enabledTd = document.createElement("td");
|
||||
enabledTd.textContent = p.enabled ? "Ja" : "Nein";
|
||||
|
||||
const actionsTd = document.createElement("td");
|
||||
|
||||
const qrBtn = document.createElement("button");
|
||||
qrBtn.textContent = "QR-Code";
|
||||
qrBtn.className = "secondary";
|
||||
qrBtn.addEventListener("click", () => showQRCode(p.id));
|
||||
actionsTd.appendChild(qrBtn);
|
||||
|
||||
const dlLink = document.createElement("a");
|
||||
dlLink.href = "/api/server/" + serverID + "/peer/" + p.id + "/config?host=" + encodeURIComponent(window.location.hostname);
|
||||
dlLink.textContent = "Config";
|
||||
dlLink.style.marginLeft = "0.5rem";
|
||||
actionsTd.appendChild(dlLink);
|
||||
|
||||
const delBtn = document.createElement("button");
|
||||
delBtn.textContent = "Löschen";
|
||||
delBtn.className = "danger";
|
||||
delBtn.addEventListener("click", () => deletePeer(p.id));
|
||||
actionsTd.appendChild(delBtn);
|
||||
|
||||
tr.appendChild(nameTd);
|
||||
tr.appendChild(emailTd);
|
||||
tr.appendChild(allowedTd);
|
||||
tr.appendChild(enabledTd);
|
||||
tr.appendChild(actionsTd);
|
||||
tbody.appendChild(tr);
|
||||
}
|
||||
}
|
||||
|
||||
function showQRCode(peerID) {
|
||||
const modal = document.getElementById("qrcode-modal");
|
||||
const img = document.getElementById("qrcode-img");
|
||||
img.src = "/api/server/" + serverID + "/peer/" + peerID + "/qrcode?host=" + encodeURIComponent(window.location.hostname) + "&t=" + Date.now();
|
||||
modal.classList.remove("hidden");
|
||||
}
|
||||
|
||||
document.getElementById("qrcode-close").addEventListener("click", () => {
|
||||
document.getElementById("qrcode-modal").classList.add("hidden");
|
||||
});
|
||||
|
||||
async function deletePeer(peerID) {
|
||||
if (!confirm("Peer wirklich löschen?")) return;
|
||||
await apiFetch("/api/server/" + serverID + "/peer/" + peerID, { method: "DELETE" });
|
||||
loadPeers();
|
||||
}
|
||||
|
||||
document.getElementById("btn-start").addEventListener("click", async () => {
|
||||
await apiFetch("/api/servers/" + serverID + "/start", { method: "POST" });
|
||||
loadServer();
|
||||
});
|
||||
|
||||
document.getElementById("btn-stop").addEventListener("click", async () => {
|
||||
await apiFetch("/api/servers/" + serverID + "/stop", { method: "POST" });
|
||||
loadServer();
|
||||
});
|
||||
|
||||
document.getElementById("btn-reload").addEventListener("click", async () => {
|
||||
await apiFetch("/api/servers/" + serverID + "/reload", { method: "POST" });
|
||||
loadServer();
|
||||
});
|
||||
|
||||
document.getElementById("btn-download").addEventListener("click", () => {
|
||||
window.location.href = "/api/servers/" + serverID + "/config";
|
||||
});
|
||||
|
||||
document.getElementById("peer-form").addEventListener("submit", async (e) => {
|
||||
e.preventDefault();
|
||||
const errP = document.getElementById("peer-error");
|
||||
errP.textContent = "";
|
||||
const form = e.target;
|
||||
const body = {
|
||||
name: form.name.value,
|
||||
email: form.email.value,
|
||||
allowed_ips: form.allowed_ips.value,
|
||||
persistent_keepalive: parseInt(form.persistent_keepalive.value, 10) || 25,
|
||||
use_preshared_key: form.use_preshared_key.checked,
|
||||
};
|
||||
const res = await apiFetch("/api/server/" + serverID + "/peer", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
if (!res.ok) {
|
||||
const data = await res.json().catch(() => ({}));
|
||||
errP.textContent = data.error || "Peer konnte nicht erstellt werden.";
|
||||
return;
|
||||
}
|
||||
form.reset();
|
||||
form.persistent_keepalive.value = 25;
|
||||
loadPeers();
|
||||
});
|
||||
|
||||
loadServer();
|
||||
loadPeers();
|
||||
@@ -0,0 +1,209 @@
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
}
|
||||
|
||||
body {
|
||||
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Arial, sans-serif;
|
||||
max-width: 960px;
|
||||
margin: 2rem auto;
|
||||
padding: 0 1rem;
|
||||
color: #1c1c1c;
|
||||
background: #fafafa;
|
||||
}
|
||||
|
||||
h1, h2 {
|
||||
color: #222;
|
||||
}
|
||||
|
||||
a {
|
||||
color: #2563eb;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
a:hover {
|
||||
text-decoration: underline;
|
||||
}
|
||||
|
||||
table {
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
margin: 1rem 0;
|
||||
background: #fff;
|
||||
}
|
||||
|
||||
table.details {
|
||||
width: auto;
|
||||
min-width: 320px;
|
||||
}
|
||||
|
||||
th, td {
|
||||
text-align: left;
|
||||
padding: 0.5rem 0.75rem;
|
||||
border-bottom: 1px solid #e2e2e2;
|
||||
}
|
||||
|
||||
thead th {
|
||||
background: #f0f0f0;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
tbody tr:hover {
|
||||
background: #f7f7f7;
|
||||
}
|
||||
|
||||
button {
|
||||
cursor: pointer;
|
||||
background: #2563eb;
|
||||
color: #fff;
|
||||
border: none;
|
||||
border-radius: 4px;
|
||||
padding: 0.4rem 0.8rem;
|
||||
margin: 0.15rem;
|
||||
font-size: 0.9rem;
|
||||
}
|
||||
|
||||
button:hover {
|
||||
background: #1d4ed8;
|
||||
}
|
||||
|
||||
button.danger {
|
||||
background: #dc2626;
|
||||
}
|
||||
|
||||
button.danger:hover {
|
||||
background: #b91c1c;
|
||||
}
|
||||
|
||||
button.secondary {
|
||||
background: #6b7280;
|
||||
}
|
||||
|
||||
button.secondary:hover {
|
||||
background: #4b5563;
|
||||
}
|
||||
|
||||
.actions {
|
||||
margin: 1rem 0;
|
||||
}
|
||||
|
||||
form {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 0.5rem;
|
||||
align-items: center;
|
||||
background: #fff;
|
||||
padding: 1rem;
|
||||
border: 1px solid #e2e2e2;
|
||||
border-radius: 6px;
|
||||
max-width: 480px;
|
||||
}
|
||||
|
||||
form#login-form {
|
||||
flex-direction: column;
|
||||
align-items: stretch;
|
||||
max-width: 320px;
|
||||
margin: 3rem auto;
|
||||
}
|
||||
|
||||
input[type="text"],
|
||||
input[type="email"],
|
||||
input[type="password"],
|
||||
input[type="number"] {
|
||||
padding: 0.4rem 0.6rem;
|
||||
border: 1px solid #ccc;
|
||||
border-radius: 4px;
|
||||
font-size: 0.9rem;
|
||||
}
|
||||
|
||||
label {
|
||||
font-size: 0.9rem;
|
||||
}
|
||||
|
||||
.error {
|
||||
color: #dc2626;
|
||||
font-size: 0.9rem;
|
||||
min-height: 1.2em;
|
||||
}
|
||||
|
||||
.badge {
|
||||
display: inline-block;
|
||||
padding: 0.15rem 0.6rem;
|
||||
border-radius: 999px;
|
||||
font-size: 0.8rem;
|
||||
font-weight: 600;
|
||||
color: #fff;
|
||||
}
|
||||
|
||||
.badge.up {
|
||||
background: #16a34a;
|
||||
}
|
||||
|
||||
.badge.down {
|
||||
background: #dc2626;
|
||||
}
|
||||
|
||||
.modal {
|
||||
position: fixed;
|
||||
top: 0;
|
||||
left: 0;
|
||||
right: 0;
|
||||
bottom: 0;
|
||||
background: rgba(0, 0, 0, 0.5);
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
}
|
||||
|
||||
.modal.hidden {
|
||||
display: none;
|
||||
}
|
||||
|
||||
.modal-content {
|
||||
background: #fff;
|
||||
padding: 1rem;
|
||||
border-radius: 6px;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.modal-content img {
|
||||
display: block;
|
||||
margin-top: 0.5rem;
|
||||
max-width: 320px;
|
||||
}
|
||||
|
||||
@media (prefers-color-scheme: dark) {
|
||||
body {
|
||||
background: #17181a;
|
||||
color: #e6e6e6;
|
||||
}
|
||||
|
||||
h1, h2 {
|
||||
color: #f2f2f2;
|
||||
}
|
||||
|
||||
table, form {
|
||||
background: #212226;
|
||||
}
|
||||
|
||||
thead th {
|
||||
background: #2a2b30;
|
||||
}
|
||||
|
||||
th, td {
|
||||
border-bottom: 1px solid #33343a;
|
||||
}
|
||||
|
||||
tbody tr:hover {
|
||||
background: #26272c;
|
||||
}
|
||||
|
||||
input {
|
||||
background: #1b1c1f;
|
||||
color: #e6e6e6;
|
||||
border: 1px solid #3a3b41;
|
||||
}
|
||||
|
||||
.modal-content {
|
||||
background: #212226;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
<!doctype html>
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>wireguard-ui-multi — Dashboard</title>
|
||||
<link rel="stylesheet" href="/static/style.css">
|
||||
</head>
|
||||
<body>
|
||||
<h1>WireGuard Server</h1>
|
||||
<table id="servers">
|
||||
<thead>
|
||||
<tr><th>Name</th><th>Interface</th><th>Port</th><th>Status</th><th>Aktionen</th></tr>
|
||||
</thead>
|
||||
<tbody></tbody>
|
||||
</table>
|
||||
<button id="new-server">Neuer Server</button>
|
||||
<script src="/static/app.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,18 @@
|
||||
<!doctype html>
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>wireguard-ui-multi — Login</title>
|
||||
<link rel="stylesheet" href="/static/style.css">
|
||||
</head>
|
||||
<body>
|
||||
<form id="login-form">
|
||||
<h1>Anmelden</h1>
|
||||
<input type="text" name="username" placeholder="Benutzername" required>
|
||||
<input type="password" name="password" placeholder="Passwort" required>
|
||||
<button type="submit">Login</button>
|
||||
<p id="login-error" class="error"></p>
|
||||
</form>
|
||||
<script src="/static/login.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,60 @@
|
||||
<!doctype html>
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>wireguard-ui-multi — Server</title>
|
||||
<link rel="stylesheet" href="/static/style.css">
|
||||
</head>
|
||||
<body>
|
||||
<p><a href="/">← Zurück zum Dashboard</a></p>
|
||||
|
||||
<h1 id="server-name">Server</h1>
|
||||
<p id="server-error" class="error"></p>
|
||||
|
||||
<table class="details">
|
||||
<tbody>
|
||||
<tr><th>Interface</th><td id="d-interface"></td></tr>
|
||||
<tr><th>Port</th><td id="d-port"></td></tr>
|
||||
<tr><th>Address Range</th><td id="d-address"></td></tr>
|
||||
<tr><th>DNS</th><td id="d-dns"></td></tr>
|
||||
<tr><th>MTU</th><td id="d-mtu"></td></tr>
|
||||
<tr><th>Status</th><td id="d-status"></td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div class="actions">
|
||||
<button id="btn-start">Start</button>
|
||||
<button id="btn-stop">Stop</button>
|
||||
<button id="btn-reload">Neu laden</button>
|
||||
<button id="btn-download">Config herunterladen</button>
|
||||
</div>
|
||||
|
||||
<h2>Peers</h2>
|
||||
<table id="peers">
|
||||
<thead>
|
||||
<tr><th>Name</th><th>Email</th><th>Allowed IPs</th><th>Aktiv</th><th>Aktionen</th></tr>
|
||||
</thead>
|
||||
<tbody></tbody>
|
||||
</table>
|
||||
|
||||
<h2>Neuen Peer hinzufügen</h2>
|
||||
<form id="peer-form">
|
||||
<input type="text" name="name" placeholder="Name" required>
|
||||
<input type="email" name="email" placeholder="Email">
|
||||
<input type="text" name="allowed_ips" placeholder="Allowed IPs, z.B. 10.20.22.5/32" required>
|
||||
<input type="number" name="persistent_keepalive" placeholder="Persistent Keepalive (s)" value="25">
|
||||
<label><input type="checkbox" name="use_preshared_key"> Preshared Key verwenden</label>
|
||||
<button type="submit">Peer hinzufügen</button>
|
||||
<p id="peer-error" class="error"></p>
|
||||
</form>
|
||||
|
||||
<div id="qrcode-modal" class="modal hidden">
|
||||
<div class="modal-content">
|
||||
<button id="qrcode-close">Schließen</button>
|
||||
<img id="qrcode-img" alt="QR Code">
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script src="/static/server.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,86 @@
|
||||
package wireguard
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/server"
|
||||
)
|
||||
|
||||
// ConfigDir is where per-interface wgX.conf files are written, e.g. /etc/wireguard.
|
||||
var ConfigDir = "/etc/wireguard"
|
||||
|
||||
// RenderConfig builds the wg-quick compatible config text for a server and its peers.
|
||||
func RenderConfig(srv *server.Server, peers []*server.Peer) string {
|
||||
var b strings.Builder
|
||||
|
||||
fmt.Fprintf(&b, "[Interface]\n")
|
||||
fmt.Fprintf(&b, "PrivateKey = %s\n", srv.PrivateKey)
|
||||
fmt.Fprintf(&b, "Address = %s\n", srv.AddressRange)
|
||||
fmt.Fprintf(&b, "ListenPort = %d\n", srv.ListenPort)
|
||||
if srv.MTU > 0 {
|
||||
fmt.Fprintf(&b, "MTU = %d\n", srv.MTU)
|
||||
}
|
||||
if srv.DNS != "" {
|
||||
fmt.Fprintf(&b, "DNS = %s\n", srv.DNS)
|
||||
}
|
||||
|
||||
for _, p := range peers {
|
||||
if !p.Enabled {
|
||||
continue
|
||||
}
|
||||
b.WriteString("\n[Peer]\n")
|
||||
fmt.Fprintf(&b, "# %s\n", p.Name)
|
||||
fmt.Fprintf(&b, "PublicKey = %s\n", p.PublicKey)
|
||||
if p.PresharedKey != "" {
|
||||
fmt.Fprintf(&b, "PresharedKey = %s\n", p.PresharedKey)
|
||||
}
|
||||
fmt.Fprintf(&b, "AllowedIPs = %s\n", p.AllowedIPs)
|
||||
if p.PersistentKeepalive > 0 {
|
||||
fmt.Fprintf(&b, "PersistentKeepalive = %d\n", p.PersistentKeepalive)
|
||||
}
|
||||
}
|
||||
|
||||
return b.String()
|
||||
}
|
||||
|
||||
// RenderClientConfig builds the config a peer/client would use to connect to srv.
|
||||
func RenderClientConfig(srv *server.Server, p *server.Peer, endpointHost string) string {
|
||||
var b strings.Builder
|
||||
|
||||
b.WriteString("[Interface]\n")
|
||||
fmt.Fprintf(&b, "PrivateKey = %s\n", p.PrivateKey)
|
||||
fmt.Fprintf(&b, "Address = %s\n", p.AllowedIPs)
|
||||
if srv.DNS != "" {
|
||||
fmt.Fprintf(&b, "DNS = %s\n", srv.DNS)
|
||||
}
|
||||
|
||||
b.WriteString("\n[Peer]\n")
|
||||
fmt.Fprintf(&b, "PublicKey = %s\n", srv.PublicKey)
|
||||
if p.PresharedKey != "" {
|
||||
fmt.Fprintf(&b, "PresharedKey = %s\n", p.PresharedKey)
|
||||
}
|
||||
fmt.Fprintf(&b, "Endpoint = %s:%d\n", endpointHost, srv.ListenPort)
|
||||
fmt.Fprintf(&b, "AllowedIPs = 0.0.0.0/0, ::/0\n")
|
||||
if p.PersistentKeepalive > 0 {
|
||||
fmt.Fprintf(&b, "PersistentKeepalive = %d\n", p.PersistentKeepalive)
|
||||
}
|
||||
|
||||
return b.String()
|
||||
}
|
||||
|
||||
// WriteConfig writes the rendered server config to ConfigDir/<interface>.conf with 0600 perms.
|
||||
func WriteConfig(srv *server.Server, peers []*server.Peer) error {
|
||||
if err := os.MkdirAll(ConfigDir, 0700); err != nil {
|
||||
return err
|
||||
}
|
||||
path := filepath.Join(ConfigDir, srv.InterfaceName+".conf")
|
||||
return os.WriteFile(path, []byte(RenderConfig(srv, peers)), 0600)
|
||||
}
|
||||
|
||||
// ConfigPath returns the on-disk path for a server's config file.
|
||||
func ConfigPath(srv *server.Server) string {
|
||||
return filepath.Join(ConfigDir, srv.InterfaceName+".conf")
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
package wireguard
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
|
||||
"golang.org/x/crypto/curve25519"
|
||||
)
|
||||
|
||||
// GenerateKeyPair creates a new WireGuard-compatible Curve25519 key pair,
|
||||
// base64-encoded like `wg genkey` / `wg pubkey`.
|
||||
func GenerateKeyPair() (privateKey, publicKey string, err error) {
|
||||
var priv [32]byte
|
||||
if _, err := rand.Read(priv[:]); err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
// Clamp per RFC 7748 / WireGuard convention.
|
||||
priv[0] &= 248
|
||||
priv[31] &= 127
|
||||
priv[31] |= 64
|
||||
|
||||
var pub [32]byte
|
||||
curve25519.ScalarBaseMult(&pub, &priv)
|
||||
|
||||
return base64.StdEncoding.EncodeToString(priv[:]), base64.StdEncoding.EncodeToString(pub[:]), nil
|
||||
}
|
||||
|
||||
// PublicFromPrivate derives the public key for an existing base64 private key.
|
||||
func PublicFromPrivate(privateKeyB64 string) (string, error) {
|
||||
privBytes, err := base64.StdEncoding.DecodeString(privateKeyB64)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
var priv, pub [32]byte
|
||||
copy(priv[:], privBytes)
|
||||
curve25519.ScalarBaseMult(&pub, &priv)
|
||||
return base64.StdEncoding.EncodeToString(pub[:]), nil
|
||||
}
|
||||
|
||||
// GeneratePresharedKey creates a random base64 preshared key.
|
||||
func GeneratePresharedKey() (string, error) {
|
||||
var key [32]byte
|
||||
if _, err := rand.Read(key[:]); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return base64.StdEncoding.EncodeToString(key[:]), nil
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
package wireguard
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os/exec"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// Status of a WireGuard interface.
|
||||
type Status string
|
||||
|
||||
const (
|
||||
StatusUp Status = "UP"
|
||||
StatusDown Status = "DOWN"
|
||||
)
|
||||
|
||||
// Up brings up the given interface via wg-quick.
|
||||
func Up(iface string) error {
|
||||
return run("wg-quick", "up", iface)
|
||||
}
|
||||
|
||||
// Down brings down the given interface via wg-quick.
|
||||
func Down(iface string) error {
|
||||
return run("wg-quick", "down", iface)
|
||||
}
|
||||
|
||||
// Reload applies config changes to a running interface without a full restart,
|
||||
// using `wg syncconf` against a stripped config (wg-quick strip).
|
||||
func Reload(iface, confPath string) error {
|
||||
strip := exec.Command("wg-quick", "strip", confPath)
|
||||
stripped, err := strip.Output()
|
||||
if err != nil {
|
||||
return fmt.Errorf("wg-quick strip: %w", err)
|
||||
}
|
||||
sync := exec.Command("wg", "syncconf", iface, "/dev/stdin")
|
||||
sync.Stdin = strings.NewReader(string(stripped))
|
||||
if out, err := sync.CombinedOutput(); err != nil {
|
||||
return fmt.Errorf("wg syncconf: %w: %s", err, out)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// IsUp checks whether the interface currently exists / is up.
|
||||
func IsUp(iface string) bool {
|
||||
cmd := exec.Command("wg", "show", iface)
|
||||
return cmd.Run() == nil
|
||||
}
|
||||
|
||||
func GetStatus(iface string) Status {
|
||||
if IsUp(iface) {
|
||||
return StatusUp
|
||||
}
|
||||
return StatusDown
|
||||
}
|
||||
|
||||
// EnableService enables and starts the systemd wg-quick@<iface>.service unit.
|
||||
func EnableService(iface string) error {
|
||||
if err := run("systemctl", "enable", "wg-quick@"+iface); err != nil {
|
||||
return err
|
||||
}
|
||||
return run("systemctl", "start", "wg-quick@"+iface)
|
||||
}
|
||||
|
||||
// DisableService stops and disables the systemd wg-quick@<iface>.service unit.
|
||||
func DisableService(iface string) error {
|
||||
if err := run("systemctl", "stop", "wg-quick@"+iface); err != nil {
|
||||
return err
|
||||
}
|
||||
return run("systemctl", "disable", "wg-quick@"+iface)
|
||||
}
|
||||
|
||||
func run(name string, args ...string) error {
|
||||
cmd := exec.Command(name, args...)
|
||||
if out, err := cmd.CombinedOutput(); err != nil {
|
||||
return fmt.Errorf("%s %s: %w: %s", name, strings.Join(args, " "), err, out)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,203 @@
|
||||
package wireguard
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"gitea.perlbach24.de/scripte/wireguard-ui-multi/internal/server"
|
||||
)
|
||||
|
||||
// ParsedLegacyConfig is the parsed result of a legacy wg-quick style config file.
|
||||
type ParsedLegacyConfig struct {
|
||||
PrivateKey string
|
||||
Address string // e.g. "10.10.0.1/24" (used as AddressRange for the new Server)
|
||||
ListenPort int
|
||||
DNS string
|
||||
MTU int
|
||||
Peers []ParsedLegacyPeer
|
||||
}
|
||||
|
||||
// ParsedLegacyPeer is a single [Peer] section from a legacy config.
|
||||
type ParsedLegacyPeer struct {
|
||||
Name string
|
||||
PublicKey string
|
||||
PresharedKey string
|
||||
AllowedIPs string
|
||||
Endpoint string
|
||||
PersistentKeepalive int
|
||||
}
|
||||
|
||||
// ParseLegacyConfig reads and parses a wg-quick INI-style config file (e.g. /etc/wireguard/wg0.conf).
|
||||
func ParseLegacyConfig(path string) (*ParsedLegacyConfig, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
cfg := &ParsedLegacyConfig{}
|
||||
var curSection string
|
||||
var curPeer *ParsedLegacyPeer
|
||||
|
||||
// pendingName holds a comment found on the line(s) immediately before a
|
||||
// "[Peer]" header, e.g. "# client-laptop". wg-quick has no native peer
|
||||
// name field, so this is the only place a human-readable name can come
|
||||
// from; it's consumed (and reset) as soon as the next [Peer] section starts.
|
||||
var pendingName string
|
||||
|
||||
scanner := bufio.NewScanner(f)
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if line == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
if strings.HasPrefix(line, "#") || strings.HasPrefix(line, ";") {
|
||||
pendingName = strings.TrimSpace(strings.TrimLeft(line, "#;"))
|
||||
continue
|
||||
}
|
||||
|
||||
// Strip inline comments.
|
||||
if idx := strings.IndexAny(line, "#;"); idx >= 0 {
|
||||
line = strings.TrimSpace(line[:idx])
|
||||
if line == "" {
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
if strings.HasPrefix(line, "[") && strings.HasSuffix(line, "]") {
|
||||
section := strings.ToLower(strings.TrimSpace(line[1 : len(line)-1]))
|
||||
switch section {
|
||||
case "interface":
|
||||
curSection = "interface"
|
||||
curPeer = nil
|
||||
case "peer":
|
||||
curSection = "peer"
|
||||
cfg.Peers = append(cfg.Peers, ParsedLegacyPeer{Name: pendingName})
|
||||
curPeer = &cfg.Peers[len(cfg.Peers)-1]
|
||||
default:
|
||||
curSection = ""
|
||||
curPeer = nil
|
||||
}
|
||||
pendingName = ""
|
||||
continue
|
||||
}
|
||||
|
||||
key, value, ok := splitKV(line)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
|
||||
switch curSection {
|
||||
case "interface":
|
||||
switch {
|
||||
case strings.EqualFold(key, "PrivateKey"):
|
||||
cfg.PrivateKey = value
|
||||
case strings.EqualFold(key, "Address"):
|
||||
cfg.Address = value
|
||||
case strings.EqualFold(key, "ListenPort"):
|
||||
cfg.ListenPort, _ = strconv.Atoi(value)
|
||||
case strings.EqualFold(key, "DNS"):
|
||||
cfg.DNS = value
|
||||
case strings.EqualFold(key, "MTU"):
|
||||
cfg.MTU, _ = strconv.Atoi(value)
|
||||
}
|
||||
case "peer":
|
||||
if curPeer == nil {
|
||||
continue
|
||||
}
|
||||
switch {
|
||||
case strings.EqualFold(key, "PublicKey"):
|
||||
curPeer.PublicKey = value
|
||||
case strings.EqualFold(key, "PresharedKey"):
|
||||
curPeer.PresharedKey = value
|
||||
case strings.EqualFold(key, "AllowedIPs"):
|
||||
curPeer.AllowedIPs = value
|
||||
case strings.EqualFold(key, "Endpoint"):
|
||||
curPeer.Endpoint = value
|
||||
case strings.EqualFold(key, "PersistentKeepalive"):
|
||||
curPeer.PersistentKeepalive, _ = strconv.Atoi(value)
|
||||
}
|
||||
}
|
||||
}
|
||||
if err := scanner.Err(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func splitKV(line string) (key, value string, ok bool) {
|
||||
idx := strings.Index(line, "=")
|
||||
if idx < 0 {
|
||||
return "", "", false
|
||||
}
|
||||
key = strings.TrimSpace(line[:idx])
|
||||
value = strings.TrimSpace(line[idx+1:])
|
||||
if key == "" {
|
||||
return "", "", false
|
||||
}
|
||||
return key, value, true
|
||||
}
|
||||
|
||||
// ImportLegacyServer parses legacyConfPath and creates a corresponding Server + its Peers
|
||||
// in the given store, using serverName and interfaceName for the new Server record.
|
||||
// Returns the new server's ID.
|
||||
func ImportLegacyServer(store *server.Store, legacyConfPath, serverName, interfaceName string) (int64, error) {
|
||||
parsed, err := ParseLegacyConfig(legacyConfPath)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("parse legacy config %q: %w", legacyConfPath, err)
|
||||
}
|
||||
|
||||
pubKey, err := PublicFromPrivate(parsed.PrivateKey)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("derive public key: %w", err)
|
||||
}
|
||||
|
||||
mtu := parsed.MTU
|
||||
if mtu == 0 {
|
||||
mtu = 1420
|
||||
}
|
||||
|
||||
srv := &server.Server{
|
||||
Name: serverName,
|
||||
InterfaceName: interfaceName,
|
||||
ListenPort: parsed.ListenPort,
|
||||
PrivateKey: parsed.PrivateKey,
|
||||
PublicKey: pubKey,
|
||||
AddressRange: parsed.Address,
|
||||
DNS: parsed.DNS,
|
||||
MTU: mtu,
|
||||
Enabled: true,
|
||||
}
|
||||
|
||||
serverID, err := store.CreateServer(srv)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("create server: %w", err)
|
||||
}
|
||||
|
||||
for i, pp := range parsed.Peers {
|
||||
name := pp.Name
|
||||
if name == "" {
|
||||
name = fmt.Sprintf("peer-%d", i+1)
|
||||
}
|
||||
peer := &server.Peer{
|
||||
ServerID: serverID,
|
||||
Name: name,
|
||||
PublicKey: pp.PublicKey,
|
||||
PresharedKey: pp.PresharedKey,
|
||||
AllowedIPs: pp.AllowedIPs,
|
||||
Endpoint: pp.Endpoint,
|
||||
PersistentKeepalive: pp.PersistentKeepalive,
|
||||
Enabled: true,
|
||||
}
|
||||
if _, err := store.CreatePeer(peer); err != nil {
|
||||
return serverID, fmt.Errorf("create peer %q (index %d): %w", name, i, err)
|
||||
}
|
||||
}
|
||||
|
||||
return serverID, nil
|
||||
}
|
||||
Executable
+57
@@ -0,0 +1,57 @@
|
||||
#!/usr/bin/env bash
|
||||
# Idempotent installer for wireguard-ui-multi. Expects the binary to already be
|
||||
# built at ./wireguard-ui-multi (run `go build ./cmd/wireguard-ui-multi` first).
|
||||
set -euo pipefail
|
||||
|
||||
BIN_SRC="./wireguard-ui-multi"
|
||||
BIN_DST="/usr/local/bin/wireguard-ui-multi"
|
||||
CONFIG_DIR="/etc/wireguard-ui-multi"
|
||||
DATA_DIR="/var/lib/wireguard-ui-multi"
|
||||
HOOKS_DIR="/etc/wireguard-manager/hooks"
|
||||
SERVICE_SRC="systemd/wireguard-ui-multi.service"
|
||||
SERVICE_DST="/etc/systemd/system/wireguard-ui-multi.service"
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
echo "This installer must be run as root (it writes to /usr/local/bin, /etc, /var/lib)." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "$BIN_SRC" ]]; then
|
||||
if [[ -d "./cmd/wireguard-ui-multi" ]] && command -v go >/dev/null 2>&1; then
|
||||
echo "Binary not found, building from source with 'go build'..."
|
||||
go build -o "$BIN_SRC" ./cmd/wireguard-ui-multi
|
||||
else
|
||||
echo "Binary not found at $BIN_SRC and cannot build (need Go toolchain + source). Build it first, e.g.:" >&2
|
||||
echo " go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "Creating directories..."
|
||||
mkdir -p /usr/local/bin
|
||||
mkdir -p "$CONFIG_DIR"
|
||||
mkdir -p "$DATA_DIR"
|
||||
mkdir -p "$HOOKS_DIR"
|
||||
|
||||
echo "Installing binary to $BIN_DST..."
|
||||
cp "$BIN_SRC" "$BIN_DST"
|
||||
chmod 0755 "$BIN_DST"
|
||||
|
||||
echo "Installing systemd unit to $SERVICE_DST..."
|
||||
cp "$SERVICE_SRC" "$SERVICE_DST"
|
||||
systemctl daemon-reload
|
||||
|
||||
# The database holds bcrypt password hashes; keep the directory private.
|
||||
echo "Restricting permissions on $DATA_DIR (0700)..."
|
||||
chmod 0700 "$DATA_DIR"
|
||||
|
||||
echo
|
||||
echo "Installation complete."
|
||||
echo "This script does NOT start the service automatically. To enable and start it, run:"
|
||||
echo
|
||||
echo " systemctl enable --now wireguard-ui-multi.service"
|
||||
echo
|
||||
echo "Then check status with:"
|
||||
echo
|
||||
echo " systemctl status wireguard-ui-multi.service"
|
||||
echo " journalctl -u wireguard-ui-multi.service -f"
|
||||
Executable
+177
@@ -0,0 +1,177 @@
|
||||
#!/usr/bin/env bash
|
||||
# Runs on a Proxmox VE host. Creates a privileged LXC container prepared for
|
||||
# WireGuard (kernel module + /dev/net/tun + CAP_NET_ADMIN + nftables), copies
|
||||
# this repo into it, and runs scripts/install.sh inside the container.
|
||||
#
|
||||
# Privileged container is required: WireGuard needs CAP_NET_ADMIN and access
|
||||
# to /dev/net/tun, which unprivileged LXC containers cannot reliably get.
|
||||
set -euo pipefail
|
||||
|
||||
usage() {
|
||||
cat >&2 <<EOF
|
||||
Usage: $0 --vmid <id> --hostname <name> [options]
|
||||
|
||||
Required:
|
||||
--vmid <id> numeric LXC container ID (e.g. 200)
|
||||
--hostname <name> container hostname (e.g. wireguard-ui-multi)
|
||||
|
||||
Options:
|
||||
--storage <name> Proxmox storage for rootfs (default: local-lvm)
|
||||
--template <path> LXC template volid (default: auto-detect + download newest debian-* template)
|
||||
--bridge <name> network bridge (default: vmbr0)
|
||||
--ip <cidr|dhcp> static CIDR (e.g. 10.0.0.50/24) or "dhcp" (default: dhcp)
|
||||
--gw <ip> gateway IP, required if --ip is a static CIDR
|
||||
--disk <GB> rootfs size in GB (default: 4)
|
||||
--memory <MB> RAM in MB (default: 512)
|
||||
--cores <n> CPU cores (default: 1)
|
||||
--repo-src <path> path to this repo on the Proxmox host (default: script's own repo root)
|
||||
--start start the container after creation (default: created but stopped, then started to run the installer, left running)
|
||||
EOF
|
||||
exit 1
|
||||
}
|
||||
|
||||
VMID=""
|
||||
HOSTNAME=""
|
||||
STORAGE="local-lvm"
|
||||
TEMPLATE=""
|
||||
BRIDGE="vmbr0"
|
||||
IP="dhcp"
|
||||
GW=""
|
||||
DISK="4"
|
||||
MEMORY="512"
|
||||
CORES="1"
|
||||
REPO_SRC=""
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--vmid) VMID="$2"; shift 2 ;;
|
||||
--hostname) HOSTNAME="$2"; shift 2 ;;
|
||||
--storage) STORAGE="$2"; shift 2 ;;
|
||||
--template) TEMPLATE="$2"; shift 2 ;;
|
||||
--bridge) BRIDGE="$2"; shift 2 ;;
|
||||
--ip) IP="$2"; shift 2 ;;
|
||||
--gw) GW="$2"; shift 2 ;;
|
||||
--disk) DISK="$2"; shift 2 ;;
|
||||
--memory) MEMORY="$2"; shift 2 ;;
|
||||
--cores) CORES="$2"; shift 2 ;;
|
||||
--repo-src) REPO_SRC="$2"; shift 2 ;;
|
||||
-h|--help) usage ;;
|
||||
*) echo "Unknown option: $1" >&2; usage ;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[ -z "$VMID" || -z "$HOSTNAME" ]] && usage
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
echo "Must run as root on the Proxmox host." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! command -v pct >/dev/null 2>&1; then
|
||||
echo "pct not found - this script must run on a Proxmox VE host." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z "$REPO_SRC" ]]; then
|
||||
REPO_SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
fi
|
||||
|
||||
if [[ -z "$TEMPLATE" ]]; then
|
||||
echo "No --template given, looking up newest debian-* template..."
|
||||
pveam update >/dev/null
|
||||
TEMPLATE_FILE="$(pveam available --section system \
|
||||
| awk '{print $2}' \
|
||||
| grep -E '^debian-[0-9]+-standard_' \
|
||||
| sort -V \
|
||||
| tail -n1)"
|
||||
if [[ -z "$TEMPLATE_FILE" ]]; then
|
||||
echo "Could not find any debian-* template via 'pveam available'." >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! pveam list "$STORAGE" | grep -q "$TEMPLATE_FILE"; then
|
||||
echo "Downloading $TEMPLATE_FILE to storage $STORAGE..."
|
||||
pveam download "$STORAGE" "$TEMPLATE_FILE"
|
||||
fi
|
||||
TEMPLATE="${STORAGE}:vztmpl/${TEMPLATE_FILE}"
|
||||
echo "Using template: $TEMPLATE"
|
||||
fi
|
||||
|
||||
NET_CONFIG="name=eth0,bridge=${BRIDGE},firewall=1"
|
||||
if [[ "$IP" == "dhcp" ]]; then
|
||||
NET_CONFIG="${NET_CONFIG},ip=dhcp"
|
||||
else
|
||||
if [[ -z "$GW" ]]; then
|
||||
echo "--gw is required when --ip is a static CIDR." >&2
|
||||
exit 1
|
||||
fi
|
||||
NET_CONFIG="${NET_CONFIG},ip=${IP},gw=${GW}"
|
||||
fi
|
||||
|
||||
echo "Creating privileged LXC $VMID ($HOSTNAME)..."
|
||||
pct create "$VMID" "$TEMPLATE" \
|
||||
--hostname "$HOSTNAME" \
|
||||
--storage "$STORAGE" \
|
||||
--rootfs "${STORAGE}:${DISK}" \
|
||||
--memory "$MEMORY" \
|
||||
--cores "$CORES" \
|
||||
--net0 "$NET_CONFIG" \
|
||||
--unprivileged 0 \
|
||||
--features "nesting=1,keyctl=1" \
|
||||
--onboot 1
|
||||
|
||||
echo "Enabling /dev/net/tun and WireGuard kernel module passthrough..."
|
||||
CONF="/etc/pve/lxc/${VMID}.conf"
|
||||
{
|
||||
echo "lxc.cgroup2.devices.allow: c 10:200 rwm"
|
||||
echo "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file"
|
||||
} >> "$CONF"
|
||||
|
||||
echo "Starting container..."
|
||||
pct start "$VMID"
|
||||
sleep 5
|
||||
|
||||
echo "Installing base dependencies inside container (Go, git, wireguard-tools, nftables)..."
|
||||
pct exec "$VMID" -- bash -c "
|
||||
set -e
|
||||
apt-get update
|
||||
apt-get install -y wireguard-tools nftables curl ca-certificates git
|
||||
if ! command -v go >/dev/null 2>&1; then
|
||||
ARCH=\$(dpkg --print-architecture)
|
||||
curl -fsSL https://go.dev/dl/go1.22.5.linux-\${ARCH}.tar.gz -o /tmp/go.tar.gz
|
||||
tar -C /usr/local -xzf /tmp/go.tar.gz
|
||||
ln -sf /usr/local/go/bin/go /usr/local/bin/go
|
||||
rm -f /tmp/go.tar.gz
|
||||
fi
|
||||
"
|
||||
|
||||
echo "Copying repo into container..."
|
||||
TMP_TAR="$(mktemp)"
|
||||
tar -C "$REPO_SRC" -czf "$TMP_TAR" --exclude=.git .
|
||||
pct push "$VMID" "$TMP_TAR" /tmp/wireguard-ui-multi.tar.gz
|
||||
rm -f "$TMP_TAR"
|
||||
|
||||
pct exec "$VMID" -- bash -c "
|
||||
set -e
|
||||
mkdir -p /opt/wireguard-ui-multi-src
|
||||
tar -C /opt/wireguard-ui-multi-src -xzf /tmp/wireguard-ui-multi.tar.gz
|
||||
rm -f /tmp/wireguard-ui-multi.tar.gz
|
||||
"
|
||||
|
||||
echo "Running native installer inside container..."
|
||||
pct exec "$VMID" -- bash -c "
|
||||
set -e
|
||||
cd /opt/wireguard-ui-multi-src
|
||||
go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi
|
||||
bash scripts/install.sh
|
||||
"
|
||||
|
||||
echo
|
||||
echo "Container $VMID ($HOSTNAME) is set up. wireguard-ui-multi is installed but not started."
|
||||
echo "To enable and start it inside the container, run:"
|
||||
echo
|
||||
echo " pct exec $VMID -- systemctl enable --now wireguard-ui-multi.service"
|
||||
echo
|
||||
echo "Then check status with:"
|
||||
echo
|
||||
echo " pct exec $VMID -- systemctl status wireguard-ui-multi.service"
|
||||
echo " pct exec $VMID -- journalctl -u wireguard-ui-multi.service -f"
|
||||
@@ -0,0 +1,22 @@
|
||||
[Unit]
|
||||
Description=wireguard-ui-multi - native multi-server WireGuard management UI
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
# Runs as root because it shells out to wg-quick, systemctl and nft, which
|
||||
# require CAP_NET_ADMIN (and in practice broad privileges for systemctl unit
|
||||
# management). AmbientCapabilities is set as defense-in-depth in case this
|
||||
# unit is ever adapted to run as a non-root user with File capabilities on
|
||||
# the binary instead.
|
||||
User=root
|
||||
Group=root
|
||||
AmbientCapabilities=CAP_NET_ADMIN
|
||||
ExecStart=/usr/local/bin/wireguard-ui-multi --db /var/lib/wireguard-ui-multi/wireguard-ui-multi.db --config-dir /etc/wireguard --hooks-dir /etc/wireguard-manager/hooks
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
WorkingDirectory=/var/lib/wireguard-ui-multi
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Reference in New Issue
Block a user