From bb72a0a3ee982860d1522308c682f76bcff62adf Mon Sep 17 00:00:00 2001 From: sysops Date: Sat, 11 Jul 2026 23:31:47 +0200 Subject: [PATCH] Rewrite README to be fork-only, drop all Docker/upstream content Removes the entire upstream-repo documentation section (Docker compose, Docker build/env vars, Docker Hub links, upstream repo links) - this fork is native-only, so those sections were dead weight and confusing. Fixes BIND_ADDRESS default in the env var table (was documented as 0.0.0.0:80, actual default in this fork's systemd unit is 0.0.0.0:5000). License now points at the local LICENSE file instead of the upstream repo. --- README.md | 300 ++++++++++++++++-------------------------------------- 1 file changed, 87 insertions(+), 213 deletions(-) diff --git a/README.md b/README.md index 7585520..5eb7fb3 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,9 @@ -![](https://github.com/ngoduykhanh/wireguard-ui/workflows/wireguard-ui%20build%20release/badge.svg) - # wireguard-ui-multi -Fork von [ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui), -Basis für eine native Multi-Server-Erweiterung (siehe `CLAUDE.md`). Läuft ohne -Docker direkt als systemd-Service. +Native Multi-Server-Verwaltungsoberfläche für WireGuard. Läuft ohne Docker +direkt als systemd-Service und verwaltet mehrere unabhängige WireGuard- +Server-Interfaces (eigener Name, Port, Private Key, Subnetz, Peers, +Einstellungen) über eine einzige Weboberfläche. ## Schnellinstallation (Einzeiler) @@ -23,14 +22,14 @@ automatisch gestartet). Danach: sudo systemctl enable --now wireguard-ui-multi.service ``` -UI standardmäßig unter `http://:5000` erreichbar. Default-Login -`admin`/`admin` — sofort ändern. +**UI-Port:** standardmäßig `http://:5000` (siehe `BIND_ADDRESS` in +`/etc/systemd/system/wireguard-ui-multi.service`, um Port/Bind-Adresse zu +ändern). Default-Login `admin`/`admin` — sofort ändern. ### Hardware-Anforderungen - Betrieb: 1 vCPU, 128-256 MB RAM reichen (reines Go-Binary, JSON-Dateidatenbank) -- Build aus Quellcode: Go-Toolchain + Node/yarn (Frontend-Assets), kein cgo/SQLite - mehr nötig, daher deutlich genügsamer als frühere from-scratch-Version +- Build aus Quellcode: Go-Toolchain + Node/yarn (Frontend-Assets), kein cgo/SQLite nötig ### Update @@ -51,126 +50,83 @@ sudo ./scripts/proxmox-install.sh --vmid 200 --hostname wireguard-ui-multi Legt privilegierten LXC an (CAP_NET_ADMIN + `/dev/net/tun` Passthrough nötig für WireGuard), installiert alles hinein. ---- +## Funktionen -# wireguard-ui (Original-Upstream-Dokumentation) +- Mehrere WireGuard-Server-Interfaces parallel verwalten, je mit eigenem + Namen, Interface, Port, Keypair, Subnetz und Peer-Liste +- Zugriffskontrolle pro Server: nicht-Admin-User sehen/verwalten nur die + ihnen zugewiesenen Server +- Peer-Verwaltung inkl. QR-Code, Config-Download, E-Mail/Telegram-Versand +- Web-UI mit Login/Session-Schutz, JSON-Datei-Datenbank (kein separater + Datenbankserver nötig) -A web user interface to manage your WireGuard setup. +## Umgebungsvariablen -## Features +| Variable | Beschreibung | Default | +|--------------------------------|---------------------------------------------------------------------------------------------------------------------------------|-------------------------------------| +| `BASE_PATH` | Subpfad, falls die App hinter einem Reverse Proxy unter einem Unterpfad läuft (z.B. `/wireguard`) | N/A | +| `BIND_ADDRESS` | Adresse:Port des Webinterfaces, oder `unix:///pfad/zur/datei.socket` für einen Unix-Socket | `0.0.0.0:5000` (siehe systemd-Unit) | +| `SESSION_SECRET` | Geheimer Schlüssel zur Verschlüsselung der Session-Cookies. Zufälligen Wert setzen | N/A | +| `SESSION_SECRET_FILE` | Optionaler Dateipfad für `SESSION_SECRET` | N/A | +| `SESSION_MAX_DURATION` | Max. Tage, die eine gemerkte Session erneuert wird | 90 | +| `SUBNET_RANGES` | Unterteilung von Adressbereichen: `Name:10.0.1.0/24; Name2:10.0.2.0/24` | N/A | +| `WGUI_USERNAME` | Login-Benutzername (nur zur DB-Initialisierung) | `admin` | +| `WGUI_PASSWORD` | Login-Passwort, wird automatisch gehasht (nur zur DB-Initialisierung) | `admin` | +| `WGUI_PASSWORD_FILE` | Optionaler Dateipfad für das Login-Passwort | N/A | +| `WGUI_PASSWORD_HASH` | Passwort-Hash statt Klartext-Passwort | N/A | +| `WGUI_PASSWORD_HASH_FILE` | Optionaler Dateipfad für den Passwort-Hash | N/A | +| `WGUI_ENDPOINT_ADDRESS` | Standard-Endpoint-Adresse für Clients (kann Port enthalten, z.B. bei NAT/Port-Forwarding) | automatisch ermittelte öffentliche IP | +| `WGUI_FAVICON_FILE_PATH` | Eigenes Favicon | eingebettetes WireGuard-Logo | +| `WGUI_DNS` | Standard-DNS-Server (kommagetrennt) | `1.1.1.1` | +| `WGUI_MTU` | Standard-MTU | `1450` | +| `WGUI_PERSISTENT_KEEPALIVE` | Standard Persistent Keepalive | `15` | +| `WGUI_FIREWALL_MARK` | Standard-Firewall-Mark | `0xca6c` (51820) | +| `WGUI_TABLE` | Standard-Table-Wert | `auto` | +| `WGUI_CONFIG_FILE_PATH` | Standard-Pfad der WireGuard-Config-Datei | `/etc/wireguard/wg0.conf` | +| `WGUI_LOG_LEVEL` | Log-Level: `DEBUG`, `INFO`, `WARN`, `ERROR`, `OFF` | `INFO` | +| `WG_CONF_TEMPLATE` | Eigenes `wg.conf`-Template (Datei), siehe `templates/wg.conf` in diesem Repo | N/A | +| `EMAIL_FROM_ADDRESS` | Absender-E-Mail-Adresse | N/A | +| `EMAIL_FROM_NAME` | Absendername | `WireGuard UI` | +| `SENDGRID_API_KEY` | SendGrid API-Key | N/A | +| `SENDGRID_API_KEY_FILE` | Optionaler Dateipfad für den SendGrid API-Key | N/A | +| `SMTP_HOSTNAME` | SMTP-Host | `127.0.0.1` | +| `SMTP_PORT` | SMTP-Port | `25` | +| `SMTP_USERNAME` | SMTP-Benutzername | N/A | +| `SMTP_PASSWORD` | SMTP-Passwort | N/A | +| `SMTP_PASSWORD_FILE` | Optionaler Dateipfad für das SMTP-Passwort | N/A | +| `SMTP_AUTH_TYPE` | `PLAIN`, `LOGIN`, `NONE` | `NONE` | +| `SMTP_ENCRYPTION` | `NONE`, `SSL`, `SSLTLS`, `TLS`, `STARTTLS` | `STARTTLS` | +| `SMTP_HELO` | Hostname für die HELO-Meldung | `localhost` | +| `TELEGRAM_TOKEN` | Telegram-Bot-Token zum Config-Versand | N/A | +| `TELEGRAM_ALLOW_CONF_REQUEST` | Erlaubt Clients, Configs per Bot-Nachricht anzufordern | `false` | +| `TELEGRAM_FLOOD_WAIT` | Minuten bis zur nächsten Config-Anfrage | `60` | -- Friendly UI -- Authentication -- Manage extra client information (name, email, etc.) -- Retrieve client config using QR code / file / email / Telegram +### Defaults für die Server-Konfiguration -![wireguard-ui 0.3.7](https://user-images.githubusercontent.com/37958026/177041280-e3e7ca16-d4cf-4e95-9920-68af15e780dd.png) +| Variable | Beschreibung | Default | +|------------------------------------|------------------------------------------------------|-----------------| +| `WGUI_SERVER_INTERFACE_ADDRESSES` | Standard-Interface-Adressen (kommagetrennt) | `10.252.1.0/24` | +| `WGUI_SERVER_LISTEN_PORT` | Standard-Listen-Port | `51820` | +| `WGUI_SERVER_POST_UP_SCRIPT` | Standard PostUp-Skript | N/A | +| `WGUI_SERVER_POST_DOWN_SCRIPT` | Standard PostDown-Skript | N/A | -## Run WireGuard-UI +### Defaults für neue Clients -> ⚠️The default username and password are `admin`. Please change it to secure your setup. +| Variable | Beschreibung | Default | +|------------------------------------------------|--------------------------------------------------------------------|-------------| +| `WGUI_DEFAULT_CLIENT_ALLOWED_IPS` | CIDRs für `Allowed IPs` (kommagetrennt) | `0.0.0.0/0` | +| `WGUI_DEFAULT_CLIENT_EXTRA_ALLOWED_IPS` | CIDRs für `Extra Allowed IPs` (kommagetrennt) | N/A | +| `WGUI_DEFAULT_CLIENT_USE_SERVER_DNS` | Bool (`0`/`1`/`true`/`false`/...) | `true` | +| `WGUI_DEFAULT_CLIENT_ENABLE_AFTER_CREATION` | Bool (`0`/`1`/`true`/`false`/...) | `true` | -### Using binary file +## Automatischer Neustart der WireGuard-Interfaces -Download the binary file from the release page and run it directly on the host machine +wireguard-ui-multi schreibt nur die Config-Dateien; das Neustarten der +WireGuard-Interfaces übernimmt systemd. Beispiel für ein Interface `wg0`: -``` -./wireguard-ui -``` +Datei `/etc/systemd/system/wgui.service`: -### Using docker compose - -The [examples/docker-compose](examples/docker-compose) folder contains example docker-compose files. -Choose the example which fits you the most, adjust the configuration for your needs, then run it like below: - -``` -docker-compose up -``` - -## Environment Variables - -| Variable | Description | Default | -|-------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------| -| `BASE_PATH` | Set this variable if you run wireguard-ui under a subpath of your reverse proxy virtual host (e.g. /wireguard) | N/A | -| `BIND_ADDRESS` | The addresses that can access to the web interface and the port, use unix:///abspath/to/file.socket for unix domain socket. | 0.0.0.0:80 | -| `SESSION_SECRET` | The secret key used to encrypt the session cookies. Set this to a random value | N/A | -| `SESSION_SECRET_FILE` | Optional filepath for the secret key used to encrypt the session cookies. Leave `SESSION_SECRET` blank to take effect | N/A | -| `SESSION_MAX_DURATION` | Max time in days a remembered session is refreshed and valid. Non-refreshed session is valid for 7 days max, regardless of this setting. | 90 | -| `SUBNET_RANGES` | The list of address subdivision ranges. Format: `SR Name:10.0.1.0/24; SR2:10.0.2.0/24,10.0.3.0/24` Each CIDR must be inside one of the server interfaces. | N/A | -| `WGUI_USERNAME` | The username for the login page. Used for db initialization only | `admin` | -| `WGUI_PASSWORD` | The password for the user on the login page. Will be hashed automatically. Used for db initialization only | `admin` | -| `WGUI_PASSWORD_FILE` | Optional filepath for the user login password. Will be hashed automatically. Used for db initialization only. Leave `WGUI_PASSWORD` blank to take effect | N/A | -| `WGUI_PASSWORD_HASH` | The password hash for the user on the login page. (alternative to `WGUI_PASSWORD`). Used for db initialization only | N/A | -| `WGUI_PASSWORD_HASH_FILE` | Optional filepath for the user login password hash. (alternative to `WGUI_PASSWORD_FILE`). Used for db initialization only. Leave `WGUI_PASSWORD_HASH` blank to take effect | N/A | -| `WGUI_ENDPOINT_ADDRESS` | The default endpoint address used in global settings where clients should connect to. The endpoint can contain a port as well, useful when you are listening internally on the `WGUI_SERVER_LISTEN_PORT` port, but you forward on another port (ex 9000). Ex: myvpn.dyndns.com:9000 | Resolved to your public ip address | -| `WGUI_FAVICON_FILE_PATH` | The file path used as website favicon | Embedded WireGuard logo | -| `WGUI_DNS` | The default DNS servers (comma-separated-list) used in the global settings | `1.1.1.1` | -| `WGUI_MTU` | The default MTU used in global settings | `1450` | -| `WGUI_PERSISTENT_KEEPALIVE` | The default persistent keepalive for WireGuard in global settings | `15` | -| `WGUI_FIREWALL_MARK` | The default WireGuard firewall mark | `0xca6c` (51820) | -| `WGUI_TABLE` | The default WireGuard table value settings | `auto` | -| `WGUI_CONFIG_FILE_PATH` | The default WireGuard config file path used in global settings | `/etc/wireguard/wg0.conf` | -| `WGUI_LOG_LEVEL` | The default log level. Possible values: `DEBUG`, `INFO`, `WARN`, `ERROR`, `OFF` | `INFO` | -| `WG_CONF_TEMPLATE` | The custom `wg.conf` config file template. Please refer to our [default template](https://github.com/ngoduykhanh/wireguard-ui/blob/master/templates/wg.conf) | N/A | -| `EMAIL_FROM_ADDRESS` | The sender email address | N/A | -| `EMAIL_FROM_NAME` | The sender name | `WireGuard UI` | -| `SENDGRID_API_KEY` | The SendGrid api key | N/A | -| `SENDGRID_API_KEY_FILE` | Optional filepath for the SendGrid api key. Leave `SENDGRID_API_KEY` blank to take effect | N/A | -| `SMTP_HOSTNAME` | The SMTP IP address or hostname | `127.0.0.1` | -| `SMTP_PORT` | The SMTP port | `25` | -| `SMTP_USERNAME` | The SMTP username | N/A | -| `SMTP_PASSWORD` | The SMTP user password | N/A | -| `SMTP_PASSWORD_FILE` | Optional filepath for the SMTP user password. Leave `SMTP_PASSWORD` blank to take effect | N/A | -| `SMTP_AUTH_TYPE` | The SMTP authentication type. Possible values: `PLAIN`, `LOGIN`, `NONE` | `NONE` | -| `SMTP_ENCRYPTION` | The encryption method. Possible values: `NONE`, `SSL`, `SSLTLS`, `TLS`, `STARTTLS` | `STARTTLS` | -| `SMTP_HELO` | Hostname to use for the HELO message. smtp-relay.gmail.com needs this set to anything but `localhost` | `localhost` | -| `TELEGRAM_TOKEN` | Telegram bot token for distributing configs to clients | N/A | -| `TELEGRAM_ALLOW_CONF_REQUEST` | Allow users to get configs from the bot by sending a message | `false` | -| `TELEGRAM_FLOOD_WAIT` | Time in minutes before the next conf request is processed | `60` | - -### Defaults for server configuration - -These environment variables are used to control the default server settings used when initializing the database. - -| Variable | Description | Default | -|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------| -| `WGUI_SERVER_INTERFACE_ADDRESSES` | The default interface addresses (comma-separated-list) for the WireGuard server configuration | `10.252.1.0/24` | -| `WGUI_SERVER_LISTEN_PORT` | The default server listen port | `51820` | -| `WGUI_SERVER_POST_UP_SCRIPT` | The default server post-up script | N/A | -| `WGUI_SERVER_POST_DOWN_SCRIPT` | The default server post-down script | N/A | - -### Defaults for new clients - -These environment variables are used to set the defaults used in `New Client` dialog. - -| Variable | Description | Default | -|---------------------------------------------|-------------------------------------------------------------------------------------------------|-------------| -| `WGUI_DEFAULT_CLIENT_ALLOWED_IPS` | Comma-separated-list of CIDRs for the `Allowed IPs` field. (default ) | `0.0.0.0/0` | -| `WGUI_DEFAULT_CLIENT_EXTRA_ALLOWED_IPS` | Comma-separated-list of CIDRs for the `Extra Allowed IPs` field. (default empty) | N/A | -| `WGUI_DEFAULT_CLIENT_USE_SERVER_DNS` | Boolean value [`0`, `f`, `F`, `false`, `False`, `FALSE`, `1`, `t`, `T`, `true`, `True`, `TRUE`] | `true` | -| `WGUI_DEFAULT_CLIENT_ENABLE_AFTER_CREATION` | Boolean value [`0`, `f`, `F`, `false`, `False`, `FALSE`, `1`, `t`, `T`, `true`, `True`, `TRUE`] | `true` | - -### Docker only - -These environment variables only apply to the docker container. - -| Variable | Description | Default | -|-----------------------|---------------------------------------------------------------|---------| -| `WGUI_MANAGE_START` | Start/stop WireGuard when the container is started/stopped | `false` | -| `WGUI_MANAGE_RESTART` | Auto restart WireGuard when we Apply Config changes in the UI | `false` | - -## Auto restart WireGuard daemon - -WireGuard-UI only takes care of configuration generation. You can use systemd to watch for the changes and restart the -service. Following is an example: - -### Using systemd - -Create `/etc/systemd/system/wgui.service` - -```bash -cd /etc/systemd/system/ -cat << EOF > wgui.service +```ini [Unit] Description=Restart WireGuard After=network.target @@ -181,14 +137,11 @@ ExecStart=/usr/bin/systemctl restart wg-quick@wg0.service [Install] RequiredBy=wgui.path -EOF ``` -Create `/etc/systemd/system/wgui.path` +Datei `/etc/systemd/system/wgui.path`: -```bash -cd /etc/systemd/system/ -cat << EOF > wgui.path +```ini [Unit] Description=Watch /etc/wireguard/wg0.conf for changes @@ -197,103 +150,24 @@ PathModified=/etc/wireguard/wg0.conf [Install] WantedBy=multi-user.target -EOF ``` -Apply it +Aktivieren: -```sh -systemctl enable wgui.{path,service} -systemctl start wgui.{path,service} +```bash +systemctl enable --now wgui.path wgui.service ``` -### Using openrc +Für weitere Server-Interfaces (z.B. `wg-home`, `wg-rz`) das gleiche Muster +mit angepasstem Interface-Namen wiederholen. -Create `/usr/local/bin/wgui` file and make it executable +## Build aus Quellcode -```sh -cd /usr/local/bin/ -cat << EOF > wgui -#!/bin/sh -wg-quick down wg0 -wg-quick up wg0 -EOF -chmod +x wgui +```bash +./prepare_assets.sh # Frontend-Assets bauen (benötigt yarn) +CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui . ``` -Create `/etc/init.d/wgui` file and make it executable +## Lizenz -```sh -cd /etc/init.d/ -cat << EOF > wgui -#!/sbin/openrc-run - -command=/sbin/inotifyd -command_args="/usr/local/bin/wgui /etc/wireguard/wg0.conf:w" -pidfile=/run/${RC_SVCNAME}.pid -command_background=yes -EOF -chmod +x wgui -``` - -Apply it - -```sh -rc-service wgui start -rc-update add wgui default -``` - -### Using Docker - -Set `WGUI_MANAGE_RESTART=true` to manage Wireguard interface restarts. -Using `WGUI_MANAGE_START=true` can also replace the function of `wg-quick@wg0` service, to start Wireguard at boot, by -running the container with `restart: unless-stopped`. These settings can also pick up changes to Wireguard Config File -Path, after restarting the container. Please make sure you have `--cap-add=NET_ADMIN` in your container config to make -this feature work. - -## Build - -### Build docker image - -Go to the project root directory and run the following command: - -```sh -docker build --build-arg=GIT_COMMIT=$(git rev-parse --short HEAD) -t wireguard-ui . -``` - -or - -```sh -docker compose build --build-arg=GIT_COMMIT=$(git rev-parse --short HEAD) -``` - -:information_source: A container image is available on [Docker Hub](https://hub.docker.com/r/ngoduykhanh/wireguard-ui) -which you can pull and use - -``` -docker pull ngoduykhanh/wireguard-ui -```` - -### Build binary file - -Prepare the assets directory - -```sh -./prepare_assets.sh -``` - -Then build your executable - -```sh -go build -o wireguard-ui -``` - -## License - -MIT. See [LICENSE](https://github.com/ngoduykhanh/wireguard-ui/blob/master/LICENSE). - -## Support - -If you like the project and want to support it, you can *buy me a coffee* ☕ - -Buy Me A Coffee +MIT, siehe [LICENSE](LICENSE).