From e5c0a5888f84c435ea0dd76f5bc2b1e693234e07 Mon Sep 17 00:00:00 2001
From: sysops <sysops@LenovoT14Gen5>
Date: Fri, 10 Jul 2026 18:38:02 +0200
Subject: [PATCH] Adapt installers to upstream wireguard-ui build (Go+embed,
 yarn assets)

Upstream builds a single static binary (main.go at repo root, no
cmd/... subpackage) that go:embeds templates/ and assets/ at compile
time, and uses a relative ./db directory (jsondb) instead of SQLite -
so WorkingDirectory in the systemd unit now matters for the DB path,
not for template/static serving like before.

Frontend assets (admin-lte, jquery plugins) need yarn + prepare_assets.sh
before go build, so all installers now also install nodejs/npm/yarn and
run prepare_assets.sh when assets/dist is missing or package.json changed.

Binary is now literally named "wireguard-ui" (matches upstream), listens
on 0.0.0.0:5000 by default. systemd unit rewritten accordingly with
WorkingDirectory=/var/lib/wireguard-ui-multi.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 README.md                          | 55 ++++++++++++++++++++++-
 bootstrap.sh                       | 39 +++++++++++------
 scripts/install.sh                 | 70 +++++++++++++++---------------
 scripts/proxmox-install.sh         | 10 +++--
 systemd/wireguard-ui-multi.service | 21 +++++++++
 update.sh                          | 19 ++++++--
 6 files changed, 156 insertions(+), 58 deletions(-)
 create mode 100644 systemd/wireguard-ui-multi.service

diff --git a/README.md b/README.md
index 74c446e..7585520 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,59 @@
 ![](https://github.com/ngoduykhanh/wireguard-ui/workflows/wireguard-ui%20build%20release/badge.svg)
 
-# wireguard-ui
+# wireguard-ui-multi
+
+Fork von [ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui),
+Basis für eine native Multi-Server-Erweiterung (siehe `CLAUDE.md`). Läuft ohne
+Docker direkt als systemd-Service.
+
+## Schnellinstallation (Einzeiler)
+
+Auf einem frischen Debian/Ubuntu-Host (als root):
+
+```bash
+curl -fsSL https://gitea.perlbach24.de/scripte/wireguard-ui-multi/raw/branch/main/bootstrap.sh | bash
+```
+
+Installiert Abhängigkeiten (Go, Node/yarn, wireguard-tools, nftables), baut
+Frontend-Assets + Binary, installiert nach `/usr/local/bin/wireguard-ui` und
+richtet den systemd-Service `wireguard-ui-multi.service` ein (nicht
+automatisch gestartet). Danach:
+
+```bash
+sudo systemctl enable --now wireguard-ui-multi.service
+```
+
+UI standardmäßig unter `http://<host>:5000` erreichbar. Default-Login
+`admin`/`admin` — sofort ändern.
+
+### Hardware-Anforderungen
+
+- Betrieb: 1 vCPU, 128-256 MB RAM reichen (reines Go-Binary, JSON-Dateidatenbank)
+- Build aus Quellcode: Go-Toolchain + Node/yarn (Frontend-Assets), kein cgo/SQLite
+  mehr nötig, daher deutlich genügsamer als frühere from-scratch-Version
+
+### Update
+
+```bash
+cd /opt/wireguard-ui-multi-src
+sudo ./update.sh
+```
+
+Holt neuesten Code, baut Frontend-Assets neu (falls `package.json` sich
+geändert hat) und Binary, installiert neu, startet den Dienst neu.
+
+### Proxmox LXC
+
+```bash
+sudo ./scripts/proxmox-install.sh --vmid 200 --hostname wireguard-ui-multi
+```
+
+Legt privilegierten LXC an (CAP_NET_ADMIN + `/dev/net/tun` Passthrough nötig
+für WireGuard), installiert alles hinein.
+
+---
+
+# wireguard-ui (Original-Upstream-Dokumentation)
 
 A web user interface to manage your WireGuard setup.
 
diff --git a/bootstrap.sh b/bootstrap.sh
index 65e43f9..ac53a02 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
-# One-shot bootstrap installer for wireguard-ui-multi.
-# Downloads source, builds it, and runs the native installer - end to end,
-# no pre-existing checkout required.
+# One-shot bootstrap installer for wireguard-ui-multi (fork of
+# ngoduykhanh/wireguard-ui). Downloads source, builds frontend assets +
+# Go binary, and runs the native installer - end to end, no pre-existing
+# checkout required.
 #
 # Usage (on target Debian/Ubuntu host, as root):
-#   curl -fsSL https://gitea.perlbach24.de/scripte/wireguard-ui-multi/raw/branch/main/scripts/bootstrap.sh | bash
+#   curl -fsSL https://gitea.perlbach24.de/scripte/wireguard-ui-multi/raw/branch/main/bootstrap.sh | bash
 # or:
 #   bash bootstrap.sh [--ref main] [--src-dir /opt/wireguard-ui-multi-src]
 set -euo pipefail
@@ -36,10 +37,15 @@ if [[ "$(id -u)" -ne 0 ]]; then
 	exit 1
 fi
 
-echo "Installing base dependencies (git, wireguard-tools, nftables, curl, ca-certificates)..."
+echo "Installing base dependencies (git, wireguard-tools, nftables, curl, ca-certificates, nodejs, npm)..."
 export DEBIAN_FRONTEND=noninteractive
 apt-get update
-apt-get install -y git wireguard-tools nftables curl ca-certificates
+apt-get install -y git wireguard-tools nftables curl ca-certificates nodejs npm
+
+if ! command -v yarn >/dev/null 2>&1; then
+	echo "Installing yarn..."
+	npm install -g yarn
+fi
 
 export PATH="/usr/local/go/bin:/usr/local/bin:$PATH"
 ARCH="$(dpkg --print-architecture)"
@@ -58,15 +64,15 @@ cd "$SRC_DIR"
 
 BIN_READY=0
 if [[ "$SKIP_RELEASE" -eq 0 ]]; then
-	RELEASE_ASSET_URL="${RELEASE_BASE_URL}/${REF}/wireguard-ui-multi-linux-${ARCH}"
+	RELEASE_ASSET_URL="${RELEASE_BASE_URL}/${REF}/wireguard-ui-linux-${ARCH}"
 	echo "Trying prebuilt release binary: $RELEASE_ASSET_URL"
-	if curl -fsSL "$RELEASE_ASSET_URL" -o wireguard-ui-multi.tmp; then
-		mv wireguard-ui-multi.tmp wireguard-ui-multi
-		chmod 0755 wireguard-ui-multi
+	if curl -fsSL "$RELEASE_ASSET_URL" -o wireguard-ui.tmp; then
+		mv wireguard-ui.tmp wireguard-ui
+		chmod 0755 wireguard-ui
 		BIN_READY=1
-		echo "Using prebuilt release binary (skipped local Go build)."
+		echo "Using prebuilt release binary (skipped local build)."
 	else
-		rm -f wireguard-ui-multi.tmp
+		rm -f wireguard-ui.tmp
 		echo "No prebuilt release binary available, building from source instead."
 	fi
 fi
@@ -91,9 +97,14 @@ if [[ "$BIN_READY" -eq 0 ]]; then
 		exit 1
 	fi
 
-	echo "Building wireguard-ui-multi from source..."
+	if [[ ! -d assets/dist ]]; then
+		echo "Building frontend assets (yarn)..."
+		bash prepare_assets.sh
+	fi
+
+	echo "Building wireguard-ui from source..."
 	go mod tidy
-	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui-multi ./cmd/wireguard-ui-multi
+	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui .
 fi
 
 echo "Running native installer..."
diff --git a/scripts/install.sh b/scripts/install.sh
index 2bdd216..b132066 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -1,18 +1,14 @@
 #!/usr/bin/env bash
-# Idempotent installer for wireguard-ui-multi. Expects the binary to already be
-# built at ./wireguard-ui-multi (run `go build ./cmd/wireguard-ui-multi` first).
+# Idempotent installer for wireguard-ui (upstream ngoduykhanh/wireguard-ui
+# fork). Expects to run from a checkout of this repo. Builds the frontend
+# assets + Go binary if not already built, then installs everything.
 set -euo pipefail
 
-export PATH="/usr/local/go/bin:/usr/local/bin:$PATH"
-
-BIN_SRC="./wireguard-ui-multi"
-BIN_DST="/usr/local/bin/wireguard-ui-multi"
-CONFIG_DIR="/etc/wireguard-ui-multi"
-DATA_DIR="/var/lib/wireguard-ui-multi"
-HOOKS_DIR="/etc/wireguard-manager/hooks"
-UI_SRC="internal/ui"
-UI_DST="/usr/local/share/wireguard-ui-multi/ui"
-SERVICE_SRC="systemd/wireguard-ui-multi.service"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BIN_NAME="wireguard-ui"
+BIN_DST="/usr/local/bin/wireguard-ui"
+INSTALL_DIR="/var/lib/wireguard-ui-multi"
+SERVICE_SRC="$REPO_ROOT/systemd/wireguard-ui-multi.service"
 SERVICE_DST="/etc/systemd/system/wireguard-ui-multi.service"
 
 if [[ "$(id -u)" -ne 0 ]]; then
@@ -20,47 +16,47 @@ if [[ "$(id -u)" -ne 0 ]]; then
 	exit 1
 fi
 
-if [[ ! -f "$BIN_SRC" ]]; then
-	if [[ -d "./cmd/wireguard-ui-multi" ]] && command -v go >/dev/null 2>&1; then
-		echo "Binary not found, building from source with 'go build'..."
-		go mod tidy
-		CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o "$BIN_SRC" ./cmd/wireguard-ui-multi
-	else
-		echo "Binary not found at $BIN_SRC and cannot build (need Go toolchain + source). Build it first, e.g.:" >&2
-		echo "  go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi" >&2
+export PATH="/usr/local/go/bin:/usr/local/bin:$PATH"
+
+cd "$REPO_ROOT"
+
+if [[ ! -d assets/dist ]]; then
+	echo "Frontend assets not built yet, running prepare_assets.sh..."
+	if ! command -v yarn >/dev/null 2>&1; then
+		echo "yarn not found. Install Node.js + yarn first, e.g.:" >&2
+		echo "  apt-get install -y nodejs npm && npm install -g yarn" >&2
 		exit 1
 	fi
+	bash prepare_assets.sh
 fi
 
-if [[ -d /usr/local/go/bin ]] && [[ ! -f /etc/profile.d/go-path.sh ]]; then
-	echo "Persisting Go on PATH for future shells (/etc/profile.d/go-path.sh)..."
-	echo 'export PATH="/usr/local/go/bin:$PATH"' > /etc/profile.d/go-path.sh
-	chmod 0644 /etc/profile.d/go-path.sh
+if [[ ! -f "$BIN_NAME" ]]; then
+	if ! command -v go >/dev/null 2>&1; then
+		echo "go not found. Install Go first (see bootstrap.sh) or build manually:" >&2
+		echo "  go build -o $BIN_NAME ." >&2
+		exit 1
+	fi
+	echo "Building $BIN_NAME..."
+	go mod tidy
+	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o "$BIN_NAME" .
 fi
 
 echo "Creating directories..."
 mkdir -p /usr/local/bin
-mkdir -p "$CONFIG_DIR"
-mkdir -p "$DATA_DIR"
-mkdir -p "$HOOKS_DIR"
+mkdir -p "$INSTALL_DIR/db"
 
 echo "Installing binary to $BIN_DST..."
-cp "$BIN_SRC" "${BIN_DST}.new"
+cp "$BIN_NAME" "${BIN_DST}.new"
 chmod 0755 "${BIN_DST}.new"
 mv -f "${BIN_DST}.new" "$BIN_DST"
 
-echo "Installing UI assets to $UI_DST..."
-mkdir -p "$(dirname "$UI_DST")"
-rm -rf "$UI_DST"
-cp -r "$UI_SRC" "$UI_DST"
-
 echo "Installing systemd unit to $SERVICE_DST..."
 cp "$SERVICE_SRC" "$SERVICE_DST"
 systemctl daemon-reload
 
-# The database holds bcrypt password hashes; keep the directory private.
-echo "Restricting permissions on $DATA_DIR (0700)..."
-chmod 0700 "$DATA_DIR"
+# The jsondb store holds session secrets and password hashes; keep it private.
+echo "Restricting permissions on $INSTALL_DIR (0700)..."
+chmod 0700 "$INSTALL_DIR"
 
 echo
 echo "Installation complete."
@@ -72,3 +68,5 @@ echo "Then check status with:"
 echo
 echo "  systemctl status wireguard-ui-multi.service"
 echo "  journalctl -u wireguard-ui-multi.service -f"
+echo
+echo "Default UI: http://<host>:5000 (see WGUI_BIND_ADDRESS in the systemd unit to change)"
diff --git a/scripts/proxmox-install.sh b/scripts/proxmox-install.sh
index 902e09b..fb53883 100755
--- a/scripts/proxmox-install.sh
+++ b/scripts/proxmox-install.sh
@@ -130,11 +130,14 @@ echo "Starting container..."
 pct start "$VMID"
 sleep 5
 
-echo "Installing base dependencies inside container (Go, git, wireguard-tools, nftables)..."
+echo "Installing base dependencies inside container (Go, Node/yarn, git, wireguard-tools, nftables)..."
 pct exec "$VMID" -- bash -c "
 	set -e
 	apt-get update
-	apt-get install -y wireguard-tools nftables curl ca-certificates git
+	apt-get install -y wireguard-tools nftables curl ca-certificates git nodejs npm
+	if ! command -v yarn >/dev/null 2>&1; then
+		npm install -g yarn
+	fi
 	if ! command -v go >/dev/null 2>&1; then
 		ARCH=\$(dpkg --print-architecture)
 		curl -fsSL https://go.dev/dl/go1.22.5.linux-\${ARCH}.tar.gz -o /tmp/go.tar.gz
@@ -160,9 +163,8 @@ pct exec "$VMID" -- bash -c "
 echo "Running native installer inside container..."
 pct exec "$VMID" -- bash -c "
 	set -e
+	export PATH=/usr/local/go/bin:/usr/local/bin:\$PATH
 	cd /opt/wireguard-ui-multi-src
-	go mod tidy
-	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui-multi ./cmd/wireguard-ui-multi
 	bash scripts/install.sh
 "
 
diff --git a/systemd/wireguard-ui-multi.service b/systemd/wireguard-ui-multi.service
new file mode 100644
index 0000000..cbcc995
--- /dev/null
+++ b/systemd/wireguard-ui-multi.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=wireguard-ui - WireGuard management UI
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Runs as root because it shells out to wg-quick / wg, which need
+# CAP_NET_ADMIN in practice (and wg-quick itself needs broad privileges).
+User=root
+Group=root
+AmbientCapabilities=CAP_NET_ADMIN
+# wireguard-ui reads/writes ./db relative to the working directory.
+WorkingDirectory=/var/lib/wireguard-ui-multi
+Environment=BIND_ADDRESS=0.0.0.0:5000
+ExecStart=/usr/local/bin/wireguard-ui
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
diff --git a/update.sh b/update.sh
index 1bb820f..714f25c 100755
--- a/update.sh
+++ b/update.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Updates an existing wireguard-ui-multi installation: pulls the latest
-# source, rebuilds, reinstalls the binary/unit, and restarts the service.
+# source, rebuilds frontend assets + binary if needed, reinstalls, and
+# restarts the service.
 #
 # Usage (as root):
 #   cd /opt/wireguard-ui-multi-src && ./update.sh
@@ -40,9 +41,11 @@ fi
 echo "Fetching latest $REF..."
 git -C "$SRC_DIR" fetch --depth 1 origin "$REF"
 BEFORE="$(git -C "$SRC_DIR" rev-parse HEAD)"
+PREV_PACKAGE_JSON_HASH="$(sha256sum "$SRC_DIR/package.json" 2>/dev/null | awk '{print $1}')"
 git -C "$SRC_DIR" checkout "$REF"
 git -C "$SRC_DIR" reset --hard "origin/$REF"
 AFTER="$(git -C "$SRC_DIR" rev-parse HEAD)"
+NEW_PACKAGE_JSON_HASH="$(sha256sum "$SRC_DIR/package.json" 2>/dev/null | awk '{print $1}')"
 
 if [[ "$BEFORE" == "$AFTER" ]]; then
 	echo "Already up to date ($AFTER)."
@@ -50,10 +53,20 @@ else
 	echo "Updated $BEFORE -> $AFTER"
 fi
 
-echo "Rebuilding..."
 cd "$SRC_DIR"
+
+if [[ "$PREV_PACKAGE_JSON_HASH" != "$NEW_PACKAGE_JSON_HASH" ]] || [[ ! -d assets/dist ]]; then
+	echo "Frontend dependencies changed (or assets missing), rebuilding assets..."
+	if ! command -v yarn >/dev/null 2>&1; then
+		echo "yarn not found; install nodejs/npm/yarn first (see bootstrap.sh)." >&2
+		exit 1
+	fi
+	bash prepare_assets.sh
+fi
+
+echo "Rebuilding binary..."
 go mod tidy
-CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui-multi ./cmd/wireguard-ui-multi
+CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui .
 
 echo "Reinstalling..."
 bash scripts/install.sh