Repository: EmbarkStudios/wireguard-ui
Branch: main
Commit: 12fba36a5589
Files: 46
Total size: 123.5 KB
Directory structure:
gitextract_yyoo015_/
├── .github/
│ ├── CODEOWNERS
│ ├── ISSUE_TEMPLATE/
│ │ ├── bug_report.md
│ │ └── feature_request.md
│ └── workflows/
│ ├── pull_request.yaml
│ ├── push_master.yaml
│ └── release.yaml
├── .gitignore
├── CHANGELOG.md
├── CODE_OF_CONDUCT.md
├── CONTRIBUTING.md
├── Dockerfile
├── Dockerfile.debug
├── LICENSE-APACHE
├── LICENSE-MIT
├── Makefile
├── README.md
├── UserSpace.Dockerfile
├── config.go
├── doc/
│ ├── auth-google-sso.md
│ └── auth-shibboleth-sso.md
├── docker-compose.userspace.yml
├── docker-compose.yml
├── go.mod
├── go.sum
├── main.go
├── server.go
├── ui/
│ ├── .babelrc
│ ├── .gitignore
│ ├── .prettierrc
│ ├── jest.config.js
│ ├── package.json
│ ├── src/
│ │ ├── About.svelte
│ │ ├── App.svelte
│ │ ├── Client.svelte
│ │ ├── Clients.svelte
│ │ ├── EditClient.svelte
│ │ ├── Nav.svelte
│ │ ├── NavLink.svelte
│ │ ├── NewClient.svelte
│ │ ├── index.ejs
│ │ ├── index.js
│ │ ├── main.js
│ │ └── style.scss
│ ├── theme/
│ │ └── _smui-theme.scss
│ └── webpack.config.js
└── wg-go-ui.sh
================================================
FILE CONTENTS
================================================
================================================
FILE: .github/CODEOWNERS
================================================
* @suom1
================================================
FILE: .github/ISSUE_TEMPLATE/bug_report.md
================================================
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: bug
assignees: ''
---
**Describe the bug**
A clear and concise description of what the bug is.
**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Device:**
- OS: [e.g. iOS]
- Browser [e.g. chrome, safari]
- Version [e.g. 22]
**Additional context**
Add any other context about the problem here.
================================================
FILE: .github/ISSUE_TEMPLATE/feature_request.md
================================================
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: enhancement
assignees: ''
---
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.
================================================
FILE: .github/workflows/pull_request.yaml
================================================
name: PR
on:
push:
branches-ignore: main
pull_request:
branches:
- main
jobs:
review:
name: Code Review
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
with:
node-version: '14'
- uses: actions/setup-go@v2
with:
go-version: '1.17'
- name: npm install and build
run: |
npm install --prefix ui
npm run --prefix ui build
- name: Check styling error
run: go install golang.org/x/lint/golint@latest; golint -set_exit_status main.go server.go config.go
- name: Check missing error check
run: go install github.com/kisielk/errcheck@latest; errcheck ./...
- name: Check suspicious constructs (1)
run: go install honnef.co/go/tools/cmd/staticcheck@latest; staticcheck -checks all,-ST1003,-U1000,-ST1005,-SA9002 ./... # have to disable ST1003,U1000,ST1005 due to the generated code
- name: Check suspicious constructs (2)
run: go vet ./...
- name: Check security issues with gosec
run: go install github.com/securego/gosec/cmd/gosec@latest; gosec ./... # https://github.com/securego/gosec
build:
name: Build wg-ui
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
with:
node-version: '14'
- uses: actions/setup-go@v2
with:
go-version: '1.17'
- name: Build binary
run: make build
- name: Check binary
run: file bin/wireguard-ui
- name: Cleanup
run: rm -rf bin/
================================================
FILE: .github/workflows/push_master.yaml
================================================
name: Main
on:
push:
branches:
- main
jobs:
docker-build:
name: Docker Main
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: docker/setup-qemu-action@v1
- uses: docker/setup-buildx-action@v1
- uses: docker/login-action@v1
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- uses: actions/cache@v2
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-buildx-${{ github.sha }}
restore-keys: |
${{ runner.os }}-buildx-
- name: Build and push
uses: docker/build-push-action@v2
with:
context: .
file: ./Dockerfile
platforms: linux/amd64,linux/arm64,linux/arm/v7
push: true
tags: embarkstudios/wireguard-ui:latest
cache-from: type=local,src=/tmp/.buildx-cache
cache-to: type=local,dest=/tmp/.buildx-cache
docker-userspace:
name: Docker UserSpace
runs-on: ubuntu-latest
needs: docker-build
steps:
- uses: actions/checkout@v2
- uses: docker/setup-qemu-action@v1
- uses: docker/setup-buildx-action@v1
- uses: docker/login-action@v1
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- uses: actions/cache@v2
with:
path: /tmp/.buildx-cache-userspace
key: ${{ runner.os }}-buildx-${{ github.sha }}
restore-keys: |
${{ runner.os }}-buildx-
- name: Build and push
uses: docker/build-push-action@v2
with:
context: .
file: ./UserSpace.Dockerfile
platforms: linux/amd64,linux/arm64,linux/arm/v7
push: true
tags: embarkstudios/wireguard-ui:userspace
cache-from: type=local,src=/tmp/.buildx-cache-userspace
cache-to: type=local,dest=/tmp/.buildx-cache-userspace
docker-debug:
name: Docker Debug
runs-on: ubuntu-latest
needs: [docker-build, docker-userspace]
steps:
- uses: actions/checkout@v2
- uses: docker/setup-qemu-action@v1
- uses: docker/setup-buildx-action@v1
- uses: docker/login-action@v1
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- uses: actions/cache@v2
with:
path: /tmp/.buildx-cache-debug
key: ${{ runner.os }}-buildx-${{ github.sha }}
restore-keys: |
${{ runner.os }}-buildx-
- name: Build and push
uses: docker/build-push-action@v2
with:
context: .
file: ./Dockerfile.debug
platforms: linux/amd64,linux/arm64,linux/arm/v7
push: true
tags: embarkstudios/wireguard-ui:debug
cache-from: type=local,src=/tmp/.buildx-cache-debug
cache-to: type=local,dest=/tmp/.buildx-cache-debug
================================================
FILE: .github/workflows/release.yaml
================================================
name: Release
on:
push:
branches:
- main
tags:
- v*
jobs:
release-docker:
name: Docker
if: startsWith(github.ref, 'refs/tags/')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: docker/setup-qemu-action@v1
- uses: docker/setup-buildx-action@v1
- uses: docker/login-action@v1
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Set environment variable for version tag
run: echo "WG-UI-VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
- name: Build and push
uses: docker/build-push-action@v2
with:
context: .
file: ./Dockerfile
platforms: linux/amd64,linux/arm64,linux/arm/v7
push: true
tags: embarkstudios/wireguard-ui:${{ env.WG-UI-VERSION }}
- name: Clear
if: always()
run: |
rm -f ${HOME}/.docker/config.json
release-binary:
name: Binary
if: startsWith(github.ref, 'refs/tags/')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
with:
node-verison: '14'
- uses: actions/setup-go@v2
with:
go-version: '1.17'
- name: Build UI
run: |
make ui
- name: Build wg-ui for Linux (AMD64)
run: |
name=wg-ui
target=linux-amd64
release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
release_tar="$release_name.tar.gz"
env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o "$release_name"
tar czvf "$release_tar" "$release_name"
echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
rm "$release_name"
- name: Build wg-ui for Linux (ARMv5)
run: |
name=wg-ui
target=linux-armv5
release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
release_tar="$release_name.tar.gz"
env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 go build -o "$release_name"
tar czvf "$release_tar" "$release_name"
echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
rm "$release_name"
- name: Build wg-ui for Linux (ARMv6)
run: |
name=wg-ui
target=linux-armv6
release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
release_tar="$release_name.tar.gz"
env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -o "$release_name"
tar czvf "$release_tar" "$release_name"
echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
rm "$release_name"
- name: Build wg-ui for Linux (ARMv7)
run: |
name=wg-ui
target=linux-armv7
release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
release_tar="$release_name.tar.gz"
env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -o "$release_name"
tar czvf "$release_tar" "$release_name"
echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
rm "$release_name"
- name: Build wg-ui for Linux (ARM64)
run: |
name=wg-ui
target=linux-arm64
release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
release_tar="$release_name.tar.gz"
env CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -o "$release_name"
tar czvf "$release_tar" "$release_name"
echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
rm "$release_name"
- name: List content
run: |
ls -lah wg-ui*
- name: GitHub Release
uses: softprops/action-gh-release@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
draft: true
files: "wg-ui-*"
================================================
FILE: .gitignore
================================================
.DS_Store
/wireguard-ui
/bindata.go
ui/public/bundle.*
node_modules
bin
.idea
dist
================================================
FILE: CHANGELOG.md
================================================
# Changelog
All notable changes to this project will be documented in this file.
<!-- next-header -->
## [Unreleased]
## [v1.3.1] - 2023-02-23
### Fixes
- [PR#179](https://github.com/EmbarkStudios/wg-ui/pull/179) Add locks to all functions touching the config
### Changes
- [PR#163](https://github.com/EmbarkStudios/wg-ui/pull/163) Add support for user/pass authentication. Thanks to [@snowzach](https://github.com/snowzach)!
- [PR#149](https://github.com/EmbarkStudios/wg-ui/pull/149) Revert name back to wireguard-ui
- [PR#148](https://github.com/EmbarkStudios/wg-ui/pull/148) Update dependencies and golang to 1.17
## [v1.3.0] - 2021-09-07
### Added
- [PR#141](https://github.com/EmbarkStudios/wg-ui/pull/141) Added support for additional allowed IPs. Thanks to [@gertdreyer](https://github.com/gertdreyer)!
- [PR#140](https://github.com/EmbarkStudios/wg-ui/pull/140) Optional generation Preshared Key when creating a new client. Thanks to [@gertdreyer](https://github.com/gertdreyer)!
## [v1.2.1] - 2021-07-27
### Fixes
- [PR#139](https://github.com/EmbarkStudios/wg-ui/pull/139) Fix for versioned docker releases.
## [v1.2.0] - 2021-07-26
### Added
- [PR#113](https://github.com/EmbarkStudios/wg-ui/pull/113) Adding AWS ALB-specific header for username. Thanks to [@justnom](https://github.com/justnom)!
- [PR#86](https://github.com/EmbarkStudios/wg-ui/pull/86) User sapce image for Docker. Thanks to [@m0ssc0de](https://github.com/m0ssc0de)!
- [PR#80](https://github.com/EmbarkStudios/wg-ui/pull/80) Shibboleth SP documentation. Thanks to [@theseal](https://github.com/theseal)!
- [PR#79](https://github.com/EmbarkStudios/wg-ui/pull/79) Google SSO documentation.
### Fixes
- [PR#136](https://github.com/EmbarkStudios/wg-ui/pull/136) Prevent full reload of wireguard interface. Thanks to [@gertdreyer](https://github.com/gertdreyer)!
- [PR#135](https://github.com/EmbarkStudios/wg-ui/pull/135) Remove external dependencies for embedding assets. Thanks to [@thomasf](https://github.com/thomasf)!
- [PR#114](https://github.com/EmbarkStudios/wg-ui/pull/114) Add docker-compose example. Thanks to [@ilyazzz](https://github.com/ilyazzz)!
- [PR#70](https://github.com/EmbarkStudios/wg-ui/pull/70) Disable CGO. Thanks to [@condemil](https://github.com/condemil)!
## [v1.1.0] - 2020-05-06
### Added
- [PR#49](https://github.com/EmbarkStudios/wg-ui/pull/49) Set name and label at creation of client. Thanks to [@spetzreborn](https://github.com/spetzreborn)!
- [PR#47](https://github.com/EmbarkStudios/wg-ui/pull/47) Add limit in how many configurations each user may have. Thanks to [@spetzreborn](https://github.com/spetzreborn)!
- [PR#44](https://github.com/EmbarkStudios/wg-ui/pull/44) Add timestamp to config. Thanks to [@spetzreborn](https://github.com/spetzreborn)!
- [PR#41](https://github.com/EmbarkStudios/wg-ui/pull/41) Add `--no-nat` flag to disable NAT, NAT remains on by default.
### Fixed
- [PR#57](https://github.com/EmbarkStudios/wg-ui/pull/57) Fix gosec issues. Thanks to [@Sohalt](https://github.com/Sohalt)!
- [PR#50](https://github.com/EmbarkStudios/wg-ui/pull/50) Update documentation for configuration. Thanks to [@Sohalt](https://github.com/Sohalt)!
- [PR#35](https://github.com/EmbarkStudios/wg-ui/pull/35) Avoid "async race" with new client POST. Thanks to [@sclem](https://github.com/sclem)!
- [PR#31](https://github.com/EmbarkStudios/wg-ui/pull/31) Only enable IP forwarding if it is disabled. Thanks to [@eest](https://github.com/eest)!
### Changed
- Name of project changed from `wireguard-ui` to `wg-ui`
## [v1.0.0] - 2019-10-12
### Added
- This is the initial release of wireguard-ui
<!-- next-url -->
[Unreleased]: https://github.com/EmbarkStudios/wg-ui/compare/v1.3.0...HEAD
[v1.3.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.2.1...v1.3.0
[v1.2.1]: https://github.com/EmbarkStudios/wg-ui/compare/v1.2.0...v1.2.1
[v1.2.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.1.0...v1.2.0
[v1.1.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.0.0...v1.1.0
[v1.0.0]: https://github.com/EmbarkStudios/wg-ui/releases/tag/v1.0.0
================================================
FILE: CODE_OF_CONDUCT.md
================================================
# Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as
contributors and maintainers pledge to making participation in our project and
our community a harassment-free experience for everyone, regardless of age, body
size, disability, ethnicity, sex characteristics, gender identity and expression,
level of experience, education, socio-economic status, nationality, personal
appearance, race, religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment
include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or
advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic
address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a
professional setting
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable
behavior and are expected to take appropriate and fair corrective action in
response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or
reject comments, commits, code, wiki edits, issues, and other contributions
that are not aligned to this Code of Conduct, or to ban temporarily or
permanently any contributor for other behaviors that they deem inappropriate,
threatening, offensive, or harmful.
## Scope
This Code of Conduct applies both within project spaces and in public spaces
when an individual is representing the project or its community. Examples of
representing a project or community include using an official project e-mail
address, posting via an official social media account, or acting as an appointed
representative at an online or offline event. Representation of a project may be
further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at opensource@embark-studios.com. All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
[homepage]: https://www.contributor-covenant.org
For answers to common questions about this code of conduct, see
https://www.contributor-covenant.org/faq
================================================
FILE: CONTRIBUTING.md
================================================
# Embark Contributor Guidelines
Welcome! This project is created by the team at [Embark Studios](https://embark.games). We're glad you're interested in contributing! We welcome contributions from people of all backgrounds who are interested in making great software with us.
At Embark, we aspire to empower everyone to create interactive experiences. To do this, we're exploring and pushing the boundaries of new technologies, and sharing our learnings with the open source community.
If you have ideas for collaboration, email us at opensource@embark-studios.com.
We're also hiring full-time engineers to work with us in Stockholm! Check out our current job postings [here](https://embark.games/careers).
## Issues
### Feature Requests
If you have ideas or how to improve our projects, you can suggest features by opening a GitHub issue. Make sure to include details about the feature or change, and describe any uses cases it would enable.
Feature requests will be tagged as `enhancement` and their status will be updated in the comments of the issue.
### Bugs
When reporting a bug or unexpected behaviour in a project, make sure your issue descibes steps to reproduce the behaviour, including the platform you were using, what steps you took, and any error messages.
Reproducible bugs will be tagged as `bug` and their status will be updated in the comments of the issue.
### Wontfix
Issues will be closed and tagged as `wontfix` if we decide that we do not wish to implement it, usually due to being misaligned with the project vision or out of scope. We will comment on the issue with more detailed reasoning.
## Contribution Workflow
### Open Issues
If you're ready to contribute, start by looking at our open issues tagged as [`help wanted`](../../issues?q=is%3Aopen+is%3Aissue+label%3A"help+wanted") or [`good first issue`](../../issues?q=is%3Aopen+is%3Aissue+label%3A"good+first+issue").
You can comment on the issue to let others know you're interested in working on it or to ask questions.
### Making Changes
1. Fork the repository.
2. Create a new feature branch.
3. Make your changes. Ensure that there are no build errors by running the project with your changes locally.
4. Open a pull request with a name and description of what you did. You can read more about working with pull requests on GitHub [here](https://help.github.com/en/articles/creating-a-pull-request-from-a-fork).
5. A maintainer will review your pull request and may ask you to make changes.
## Code Guidelines
### Rust
You can read about our standards and recommendations for working with Rust [here](https://github.com/EmbarkStudios/rust-ecosystem/blob/master/guidelines.md).
### Python
We recommend following [PEP8 conventions](https://www.python.org/dev/peps/pep-0008/) when working with Python modules.
## Licensing
Unless otherwise specified, all Embark open source projects are licensed under a dual MIT OR Apache-2.0 license, allowing licensees to chose either at their option. You can read more in each project's respective README.
## Code of Conduct
Please note that our projects are released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md) to ensure that they are welcoming places for everyone to contribute. By participating in any Embark open source project, you agree to abide by these terms.
================================================
FILE: Dockerfile
================================================
FROM docker.io/node:12 AS ui
WORKDIR /ui
COPY ui/package.json ui/package-lock.json /ui/
RUN npm install
COPY ui .
RUN npm run build
FROM docker.io/golang:latest AS build
WORKDIR /wg
COPY go.mod .
COPY go.sum .
RUN go mod download
COPY . .
COPY --from=ui /ui/dist ui/dist
RUN go install .
FROM gcr.io/distroless/base
COPY --from=build /go/bin/wireguard-ui /
ENTRYPOINT [ "/wireguard-ui" ]
================================================
FILE: Dockerfile.debug
================================================
FROM embarkstudios/wireguard-ui AS latest
FROM ubuntu:20.04
RUN apt-get update -y && \
apt-get install -y software-properties-common iptables curl iproute2 ifupdown iputils-ping && \
echo resolvconf resolvconf/linkify-resolvconf boolean false | debconf-set-selections && \
echo "REPORT_ABSENT_SYMLINK=no" >> /etc/default/resolvconf && \
apt-get install resolvconf
RUN apt-get install -qy --no-install-recommends wireguard
COPY --from=latest /wireguard-ui /
ENTRYPOINT [ "/wireguard-ui" ]
================================================
FILE: LICENSE-APACHE
================================================
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
================================================
FILE: LICENSE-MIT
================================================
Copyright (c) 2019 Embark Studios
Permission is hereby granted, free of charge, to any
person obtaining a copy of this software and associated
documentation files (the "Software"), to deal in the
Software without restriction, including without
limitation the rights to use, copy, modify, merge,
publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software
is furnished to do so, subject to the following
conditions:
The above copyright notice and this permission notice
shall be included in all copies or substantial portions
of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
================================================
FILE: Makefile
================================================
# Parameters
GOCMD=go
GOBUILD=$(GOCMD) build
GOCLEAN=$(GOCMD) clean
GOGET=$(GOCMD) get
BINARY_NAME=wireguard-ui
.PHONY: build container ui
all: build
clean:
$(GOCLEAN)
rm -rf bin
rm -rf ui/node_modules ui/dist
ui:
cd ui && npm install && npm run build
build: ui
CGO_ENABLED=0 $(GOBUILD) -o bin/$(BINARY_NAME) -v
build-amd64: ui
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GOBUILD) -o bin/$(BINARY_NAME)-amd64 -v
build-armv5: ui
CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 $(GOBUILD) -o bin/$(BINARY_NAME)-armv5 -v
build-armv6: ui
CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 $(GOBUILD) -o bin/$(BINARY_NAME)-armv6 -v
build-armv7: ui
CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o bin/$(BINARY_NAME)-armv7 -v
build-armv8: ui
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GOBUILD) -o bin/$(BINARY_NAME)-armv8 -v
container:
docker build -t wireguard-ui .
run-dev:
sudo ./bin/$(BINARY_NAME) --log-level=debug --dev-ui-server=http://localhost:5000
run-dev-ui:
cd ui && npm run dev
================================================
FILE: README.md
================================================
# WG UI
[](https://github.com/EmbarkStudios)
[](CODE_OF_CONDUCT.md)
A basic, self-contained management service for [WireGuard](https://wireguard.com) with a self-serve web UI.
Current stable release: [v1.3.0](https://github.com/EmbarkStudios/wg-ui/releases/tag/v1.3.0)
## Features
* Self-serve and web based
* QR-Code for convenient mobile client configuration
* Optional multi-user support behind an authenticating proxy
* Simple authentication support
* Zero external dependencies - just a single binary using the wireguard kernel module
* Binary and container deployment
## Running
The easiest way to run wg-ui is using the container image. To test it, run:
```docker run --rm -it --privileged --entrypoint "/wireguard-ui" -v /tmp/wireguard-ui:/data -p 8080:8080 embarkstudios/wireguard-ui:latest --data-dir=/data --log-level=debug```
When running in production, we recommend using the latest release as opposed to `latest`.
Important to know is that you need to have WireGuard installed on the machine in order for this to work, as this is 'just' a UI to manage WireGuard configs.
### Configuration
You can configure wg-ui using commandline flags or environment variables.
To see all available flags run:
```
docker run --rm -it embarkstudios/wireguard-ui:latest -h
./wireguard-ui -h
```
You can alternatively specify each flag through an environment variable of the form `WIREGUARD_UI_<FLAG_NAME>`, where `<FLAG_NAME>` is replaced with the flag name transformed to `CONSTANT_CASE`, e.g.
```docker run --rm -it embarkstudios/wireguard-ui:latest --log-level=debug```
and
```docker run --rm -it -e WIREGUARD_UI_LOG_LEVEL=debug embarkstudios/wireguard-ui:latest```
are the same.
### Authentication
You can configure basic authentication using the flags/environment variables `--auth-basic-user=<user>` and `--auth-basic-pass=<bcrypt hash>` The password is
a bcrypt hash that you can generate yourself using the docker container:
```
$ docker run -it embarkstudios/wireguard-ui:latest passwd mySecretPass
INFO[0001] Password Hash: $2a$14$D2jsPnpJixC0U0lyaGUd0OatV7QGzQ08yKV.gsmITVZgNevfZXj36
```
## Docker images
There are two ways to run wg-ui today, you can run it with kernel module installed on your host which is the best way to do it if you want performance.
```
docker pull embarkstudios/wireguard-ui:latest
```
If you however do not have the possibility or interest in having kernel module loaded on your host, there is now a solution for that using a docker image based on wireguard-go. Keep in mind that this runs in userspace and not in kernel module.
```
docker pull embarkstudios/wireguard-ui:userspace
```
Both images are built for `linux/amd64`, `linux/arm64` and `linux/arm/v7`. If you would need it for any other platform you can build wg-ui binaries with help from the documentation.
## Install without Docker
You need to have WireGuard installed on the machine running `wg-ui`.
Unless you use the userspace version with docker you're required to have WireGuard installed on your host machine.
A few installation guides:
[Ubuntu 20.04 LTS](https://www.cyberciti.biz/faq/ubuntu-20-04-set-up-wireguard-vpn-server/)
[CentOS 8](https://www.cyberciti.biz/faq/centos-8-set-up-wireguard-vpn-server/)
[Debian 10](https://www.cyberciti.biz/faq/debian-10-set-up-wireguard-vpn-server/)
### Go installation (Debian)
Install latest version of Go from (https://golang.org/dl/)
```
sudo tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz
```
### Setup environment
Bash: ~/.bash_profile
ZSH: ~/.zshrc
```
export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin
export GOPATH=$HOME/go
```
### Install LTS version of nodejs for frontend.
```
sudo apt-get install curl software-properties-common
curl -sL https://deb.nodesource.com/setup_12.x | sudo bash -
sudo apt-get install nodejs
```
### Fetch wg-ui
```
git clone https://github.com/EmbarkStudios/wg-ui.git && cd wg-ui
```
### Build binary with ui
```
make build
```
### Crosscompiling
```
make build-amd64
```
```
make build-armv5
```
```
make build-armv6
```
```
make build-armv7
```
### Build step by step
```
make ui
make build
```
## Developing
### Start frontend server
```
npm install --prefix=ui
npm run --prefix=ui dev
```
### Use frontend server when running the server
```
make build
sudo ./bin/wireguard-ui --log-level=debug --dev-ui-server http://localhost:5000
```
## Contributing
We welcome community contributions to this project.
Please read our [Contributor Guide](CONTRIBUTING.md) for more information on how to get started.
## License
Licensed under either of
* Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
* MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
at your option.
================================================
FILE: UserSpace.Dockerfile
================================================
FROM docker.io/node:12 AS ui
WORKDIR /ui
COPY ui/package.json ui/package-lock.json /ui/
RUN npm install
COPY ui .
RUN npm run build
FROM docker.io/golang:latest AS build
WORKDIR /wg
COPY go.mod .
COPY go.sum .
RUN go mod download
COPY . .
COPY --from=ui /ui/dist ui/dist
RUN go install .
FROM docker.io/golang:latest AS wg_go_build
WORKDIR /wg-go
RUN git init
RUN git remote add origin https://git.zx2c4.com/wireguard-go
RUN git fetch
RUN git checkout tags/0.0.20210424 -b build
RUN make
FROM alpine:latest
RUN apk add libc6-compat --no-cache
COPY ./wg-go-ui.sh /
COPY --from=build /go/bin/wireguard-ui /
COPY --from=wg_go_build /wg-go/wireguard-go /
ENTRYPOINT [ "/wg-go-ui.sh" ]
================================================
FILE: config.go
================================================
package main
import (
"encoding/json"
"io/ioutil"
"net"
"os"
"path/filepath"
"time"
log "github.com/sirupsen/logrus"
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
)
// ServerConfig contains the reference to users, keys and where on disk the config is stored
type ServerConfig struct {
configPath string
PrivateKey string
PublicKey string
Users map[string]*UserConfig
}
// UserConfig represents a user and it's clients
type UserConfig struct {
Name string
Clients map[string]*ClientConfig
}
// ClientConfig represents a single client for a user
type ClientConfig struct {
Name string
PrivateKey string
PublicKey string
PresharedKey string
IP net.IP
AllowedIPs []*net.IPNet
MTU int
Notes string
Created string
Modified string
}
// NewClient provides fields that should not be saved however is neccesary on creation of a new client
type NewClient struct {
ClientConfig
GeneratePSK bool
}
// NewServerConfig creates and returns a reference to a new ServerConfig
func NewServerConfig(cfgPath string) *ServerConfig {
key, err := wgtypes.GeneratePrivateKey()
if err != nil {
log.Fatal(err)
}
cfg := &ServerConfig{
configPath: cfgPath,
PrivateKey: key.String(),
PublicKey: key.PublicKey().String(),
Users: make(map[string]*UserConfig),
}
f, err := os.Open(filepath.Clean(cfgPath))
if err == nil {
if err = json.NewDecoder(f).Decode(cfg); err != nil {
log.Fatal(err)
}
log.Debug("Read server config from file: ", cfgPath)
} else if os.IsNotExist(err) {
log.Debug("No config found. Creating new: ", cfgPath)
err = cfg.Write()
}
if err != nil {
log.Fatal(err)
}
configWriteRequired := false
// Set default MTU if MTU is not set (migration from old config)
migrationMTU := *wgPeerMtu
if err := verifyLinkMTU(migrationMTU); err != nil {
log.WithError(err).Warnf("Invalid peer MTU, migration MTU is set to %d", wgDefaultMtu)
migrationMTU = wgDefaultMtu
}
for _, user := range cfg.Users {
for _, client := range user.Clients {
if client.MTU == 0 {
client.MTU = migrationMTU
configWriteRequired = true
}
}
}
if configWriteRequired {
err = cfg.Write()
if err != nil {
log.Fatal(err)
}
}
return cfg
}
// Write writes the ServerConfig to the path specified in the config
func (cfg *ServerConfig) Write() error {
data, err := json.MarshalIndent(cfg, "", " ")
if err != nil {
return err
}
return ioutil.WriteFile(cfg.configPath, data, 0600)
}
// GetUserConfig returns a UserConfig for a specific user
func (cfg *ServerConfig) GetUserConfig(user string) *UserConfig {
c, ok := cfg.Users[user]
if !ok {
log.WithField("user", user).Info("No such user. Creating one.")
c = &UserConfig{
Name: user,
Clients: make(map[string]*ClientConfig),
}
cfg.Users[user] = c
}
return c
}
// NewClientConfig initiates a new client, returning a reference to the new config
func NewClientConfig(Name string, ip net.IP, mtu int, Notes string, generatePSK bool) *ClientConfig {
key, err := wgtypes.GeneratePrivateKey()
if err != nil {
log.Fatal(err)
}
psk := ""
if generatePSK {
pskey, err := wgtypes.GenerateKey()
if err != nil {
log.Fatal(err)
}
psk = pskey.String()
}
cfg := ClientConfig{
Name: Name,
PrivateKey: key.String(),
PublicKey: key.PublicKey().String(),
IP: ip,
MTU: mtu,
PresharedKey: psk,
Notes: Notes,
Created: time.Now().Format(time.RFC3339),
Modified: time.Now().Format(time.RFC3339),
}
return &cfg
}
================================================
FILE: doc/auth-google-sso.md
================================================
# Google SSO Implementation
This is a short documentation on how you can setup wg-ui and Google OAuth.
There are a few different projects on GitHub related to SSO and OAuth2, the most popular just now is [oauth2-proxy/oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy) but we at Embark Studios opted to use [buzzfeed/sso](https://github.com/buzzfeed/sso). This was done before the growth of oauth2-proxy.
## SSO Proxy & Auth
When setting up [buzzfeed/sso](https://github.com/buzzfeed/sso) we followed the quickstart documentation provided by the project found [here](https://github.com/buzzfeed/sso/blob/master/docs/quickstart.md).
In our setup we use the binaries provided by releases, and not a docker based solution.
## Systemd
Below is two simple services to keep both `sso-auth` and `sso-proxy` running.
As you can notice we use environment files instead of parameters for the binaries.
```
[Unit]
Description=sso-auth
After=network.target
[Service]
Type=simple
Restart=always
EnvironmentFile=/path/to/sso-auth.env
ExecStart=/path/to/sso-auth
[Install]
WantedBy=multi-user.target
```
```
SESSION_COOKIE_SECURE=true
SESSION_COOKIE_HTTPONLY=true
SESSION_COOKIE_DOMAIN=.domain.com
SESSION_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
SESSION_COOKIE_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
CLIENT_PROXY_ID=<shared with proxy's environment file>
CLIENT_PROXY_SECRET=<shared with proxy's environment file>
SERVER_SCHEME=https
SERVER_HOST=sso.domain.com
SERVER_PORT=8000
AUTHORIZE_EMAIL_DOMAINS=domain.com
AUTHORIZE_PROXY_DOMAINS=domain.com
PROVIDER_DOMAIN_CLIENT_ID=123456789000-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com
PROVIDER_DOMAIN_CLIENT_SECRET=XXXXXXXXXXXXXXXXXXXXXXXX
PROVIDER_DOMAIN_TYPE=google
PROVIDER_DOMAIN_SLUG=google
VIRTUAL_HOST=sso.domain.com
CLUSTER=sso
STATSD_HOST=127.0.0.1
STATSD_PORT=8125
```
```
[Unit]
Description=sso-proxy
After=network.target
[Service]
Type=simple
Restart=always
EnvironmentFile=/path/to/sso-proxy.env
ExecStart=/path/to/sso-proxy
[Install]
WantedBy=multi-user.target
```
```
DEFAULT_ALLOWED_EMAIL_DOMAINS=domain.com
UPSTREAM_CONFIGS=/path/to/upstream_configs.yaml
PROVIDER_URL=https://sso.domain.com
PROVIDER_URL_INTERNAL=http://localhost:8000
CLIENT_ID=<shared with auth's environment file>
CLIENT_SECRET=<shared with auth's environment file>
COOKIE_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
COOKIE_SECURE=true
VIRTUAL_HOST=*.domain.com
CLUSTER=sso
STATSD_HOST=127.0.0.1
STATSD_PORT=8125
```
You will also need a yaml file which defines backend service (wg-ui) which is defined in sso-proxy.env as `UPSTREAM_CONFIGS`
```
- service: wg-ui
default:
from: vpn.domain.com
to: http://localhost:8080/
```
## nginx
We use nginx for all HTTP(S) to endusers, below you can find an example for configuration.
```
server {
listen 443 http2;
listen [::]:443 http2;
server_name vpn.domain.com;
ssl on;
ssl_certificate /path/to/domain.com.bundle.crt;
ssl_certificate_key /path/to/domain.com.key;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://localhost:4180;
}
}
server {
listen 443 http2;
listen [::]:443 http2;
server_name sso.domain.com;
ssl on;
ssl_certificate /path/to/domain.com.bundle.crt;
ssl_certificate_key /path/to/domain.com.key;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://localhost:8000;
}
}
```
================================================
FILE: doc/auth-shibboleth-sso.md
================================================
# Shibboleth SP Implementation
This is a short documentation on how you can setup wg-ui with Shibboleth SP (and apache)
as auth proxy
The documentation will not cover how to configure `shibd` or the IdP part of this integration.
The [upstream documentation](https://wiki.shibboleth.net/confluence/) or
[SWAMIDs
documentation](https://wiki.sunet.se/display/SWAMID/SAML+WebSSO+Service+Provider+Best+Current+Practice)
could point you in the right direction.
## SSO Proxy & Auth
This example uses
[eduPersonPrincipalName](https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonPrincipalName)
(or eppn as Shibboleth calls it) as the primary key to identify users. Make
sure that it is released from the IdP to the SP as a SAML attribute. The
attributes(s) are then forward/proxied as request header to the application.
The only thing that needs to be configured in the WG UI end is that the
application needs to be started with the `--auth-user-header` flag set to
`eppn`.
### The `apache` configuration
```
<VirtualHost *:443>
<LocationMatch "/">
AuthType Shibboleth
Require shib-attr entitlement ~ ^urn:mace:swami.se:gmai:vpn:user$
ShibRequireSessionWith idp.example.com
ShibUseHeaders On
</LocationMatch>
SSLCertificateFile /path/to/vpn.example.com.pem
SSLCertificateKeyFile /path/to/vpn.example.com.key
SSLCertificateChainFile /path/to/CA.crt
ProxyPass "/" "http://127.0.0.1:8080/"
ProxyPassReverse "/" "http://127.0.0.1:8080/"
</VirtualHost>
```
#### Configuration in depth
```
Require shib-attr entitlement ~ ^urn:mace:swami.se:gmai:su-vpn:user$
```
By default apache and shibd lets everyone through and since WG UI has no
knowlege about the user in beforehand we release another
([eduPersonEntitlement](https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonEntitlement) (or entitlement as Shibboleth calls it))
from the IdP to the SP and require a specific value on the user in order to be
allowed to use the service.
```
ShibUseHeaders On
```
This enables `shibd` to publish SAML attributes to the application (in this case
proxy) through request headers.
================================================
FILE: docker-compose.userspace.yml
================================================
version: "3.7"
services:
app:
image: embarkstudios/wireguard-ui:userspace
privileged: true
network_mode: "host"
volumes:
- /opt/wireguard-ui:/data
environment:
- WIREGUARD_UI_LISTEN_ADDRESS=:8080
- WIREGUARD_UI_LOG_LEVEL=debug
- WIREGUARD_UI_DATA_DIR=/data
- WIREGUARD_UI_WG_ENDPOINT=your-andpoint-address:51820
- WIREGUARD_UI_CLIENT_IP_RANGE=192.168.10.1/24
# - WIREGUARD_UI_WG_DNS=192.168.10.1
- WIREGUARD_UI_NAT=true
- WIREGUARD_UI_NAT_DEVICE=eth0
# - WIREGUARD_UI_WG_DEVICE_NAME=wg1
restart: always
================================================
FILE: docker-compose.yml
================================================
version: "3.7"
services:
app:
image: embarkstudios/wireguard-ui:latest
entrypoint: "/wireguard-ui"
privileged: true
network_mode: "host"
volumes:
- /opt/wireguard-ui:/data
environment:
- WIREGUARD_UI_LISTEN_ADDRESS=:8080
- WIREGUARD_UI_LOG_LEVEL=debug
- WIREGUARD_UI_DATA_DIR=/data
- WIREGUARD_UI_WG_ENDPOINT=your-andpoint-address:51820
- WIREGUARD_UI_CLIENT_IP_RANGE=192.168.10.0/24
# - WIREGUARD_UI_WG_DNS=192.168.10.0
- WIREGUARD_UI_NAT=true
- WIREGUARD_UI_NAT_DEVICE=eth0
# - WIREGUARD_UI_WG_DEVICE_NAME=wg0
restart: always
================================================
FILE: go.mod
================================================
module github.com/embarkstudios/wireguard-ui
go 1.17
require (
github.com/fujiwara/go-amzn-oidc v0.0.2
github.com/google/nftables v0.0.0-20210916140115-16a134723a96
github.com/julienschmidt/httprouter v1.3.0
github.com/sirupsen/logrus v1.8.1
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
github.com/vishvananda/netlink v1.1.0
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815
gopkg.in/alecthomas/kingpin.v2 v2.2.6
)
require (
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a // indirect
github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
github.com/google/go-cmp v0.5.6 // indirect
github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
github.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d // indirect
github.com/konsorten/go-windows-terminal-sequences v1.0.3 // indirect
github.com/mdlayher/genetlink v1.0.0 // indirect
github.com/mdlayher/netlink v1.4.1 // indirect
github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/shogo82148/go-retry v1.1.1 // indirect
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect
golang.org/x/net v0.0.0-20211008194852-3b03d305991f // indirect
golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac // indirect
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
golang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326 // indirect
)
================================================
FILE: go.sum
================================================
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2cI+DC1Mbh0TJxzA3RcLoMsFw+aXw7E=
github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a h1:E/8AP5dFtMhl5KPJz66Kt9G0n+7Sn41Fy1wv9/jHOrc=
github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
github.com/cilium/ebpf v0.5.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
github.com/fujiwara/go-amzn-oidc v0.0.2 h1:BcniaR2fJFik2koEK6Vm80Kk/vg6uoGTyckNwuGKO48=
github.com/fujiwara/go-amzn-oidc v0.0.2/go.mod h1:8dyKYVF6NzSbcIBDB8HAu1RB+RcA1kMBh6o5g5hQ3Ao=
github.com/fujiwara/go-amzn-oidc v0.0.3 h1:K00bR4JM8100Tn7/14c9OR36n27YTOy10YgihiBlTq0=
github.com/fujiwara/go-amzn-oidc v0.0.3/go.mod h1:K+wcevZcCVOFD2Sh5FAwq+lAkaz9huLnTQO7T4tJwRI=
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/nftables v0.0.0-20200316075819-7127d9d22474 h1:D6bN82zzK92ywYsE+Zjca7EHZCRZbcNTU3At7WdxQ+c=
github.com/google/nftables v0.0.0-20200316075819-7127d9d22474/go.mod h1:cfspEyr/Ap+JDIITA+N9a0ernqG0qZ4W1aqMRgDZa1g=
github.com/google/nftables v0.0.0-20210916140115-16a134723a96 h1:bCm0Cf+suMHiri9F+ss5n5W0AVas85K5Z0Hekgpe7N0=
github.com/google/nftables v0.0.0-20210916140115-16a134723a96/go.mod h1:cfspEyr/Ap+JDIITA+N9a0ernqG0qZ4W1aqMRgDZa1g=
github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 h1:uhL5Gw7BINiiPAo24A2sxkcDI0Jt/sqp1v5xQCniEFA=
github.com/josharian/native v0.0.0-20200817173448-b6b71def0850/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=
github.com/jsimonetti/rtnetlink v0.0.0-20201009170750-9c6f07d100c1/go.mod h1:hqoO/u39cqLeBLebZ8fWdE96O7FxrAsRYhnVOdgHxok=
github.com/jsimonetti/rtnetlink v0.0.0-20201216134343-bde56ed16391/go.mod h1:cR77jAZG3Y3bsb8hF6fHJbFoyFukLFOkQ98S0pQz3xw=
github.com/jsimonetti/rtnetlink v0.0.0-20201220180245-69540ac93943/go.mod h1:z4c53zj6Eex712ROyh8WI0ihysb5j2ROyV42iNogmAs=
github.com/jsimonetti/rtnetlink v0.0.0-20210122163228-8d122574c736/go.mod h1:ZXpIyOK59ZnN7J0BV99cZUPmsqDRZ3eq5X+st7u/oSA=
github.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b h1:c3NTyLNozICy8B4mlMXemD3z/gXgQzVXZS/HqT+i3do=
github.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b/go.mod h1:8w9Rh8m+aHZIG69YPGGem1i5VzoyRC8nw2kA8B+ik5U=
github.com/jsimonetti/rtnetlink v0.0.0-20210525051524-4cc836578190/go.mod h1:NmKSdU4VGSiv1bMsdqNALI4RSvvjtz65tTMCnD05qLo=
github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
github.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d h1:MFX8DxRnKMY/2M3H61iSsVbo/n3h0MWGmWNN1UViOU0=
github.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d/go.mod h1:QHb4k4cr1fQikUahfcRVPcEXiUgFsdIstGqlurL0XL4=
github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
github.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43 h1:WgyLFv10Ov49JAQI/ZLUkCZ7VJS3r74hwFIGXJsgZlY=
github.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43/go.mod h1:+t7E0lkKfbBsebllff1xdTmyJt8lH37niI6kwFk9OTo=
github.com/mdlayher/genetlink v1.0.0 h1:OoHN1OdyEIkScEmRgxLEe2M9U8ClMytqA5niynLtfj0=
github.com/mdlayher/genetlink v1.0.0/go.mod h1:0rJ0h4itni50A86M2kHcgS85ttZazNt7a8H2a2cw0Gc=
github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
github.com/mdlayher/netlink v0.0.0-20191009155606-de872b0d824b/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
github.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZmb2XgV7o=
github.com/mdlayher/netlink v1.2.0/go.mod h1:kwVW1io0AZy9A1E2YYgaD4Cj+C+GPkU6klXCMzIJ9p8=
github.com/mdlayher/netlink v1.2.1/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
github.com/mdlayher/netlink v1.2.2-0.20210123213345-5cc92139ae3e/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
github.com/mdlayher/netlink v1.3.0/go.mod h1:xK/BssKuwcRXHrtN04UBkwQ6dY9VviGGuriDdoPSWys=
github.com/mdlayher/netlink v1.4.0 h1:n3ARR+Fm0dDv37dj5wSWZXDKcy+U0zwcXS3zKMnSiT0=
github.com/mdlayher/netlink v1.4.0/go.mod h1:dRJi5IABcZpBD2A3D0Mv/AiX8I9uDEu5oGkAVrekmf8=
github.com/mdlayher/netlink v1.4.1 h1:I154BCU+mKlIf7BgcAJB2r7QjveNPty6uNY1g9ChVfI=
github.com/mdlayher/netlink v1.4.1/go.mod h1:e4/KuJ+s8UhfUpO9z00/fDZZmhSrs+oxyqAS9cNgn6Q=
github.com/mdlayher/socket v0.0.0-20210307095302-262dc9984e00/go.mod h1:GAFlyu4/XV68LkQKYzKhIo/WW7j3Zi0YRAz/BOoanUc=
github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267 h1:Sii9ha8FHgdPEO3XW1rQ6SdUs8qNBERc64/v2tUyvis=
github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267/go.mod h1:nFZ1EtZYK8Gi/k6QNu7z7CgO20i/4ExeQswwWuPmG/g=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
github.com/onsi/ginkgo v1.14.2/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
github.com/shogo82148/go-retry v1.0.0 h1:c487Qe+QYUffpUpPxrUN5fGJq6WVHSzGS4N3MNuR2OU=
github.com/shogo82148/go-retry v1.0.0/go.mod h1:5jiw5yPWW6K+pMyimtNoaQSDD08RMEsJbhDwFrui5rc=
github.com/shogo82148/go-retry v1.1.1 h1:BfUEVHTNDSjYxoRPC+c/ht5Sy6qdwl+0kFhhubeh4Fo=
github.com/shogo82148/go-retry v1.1.1/go.mod h1:TPSFDcc2rlx2D/yfhi8BBOlsHhVBjjJoMvxG7iFHUbI=
github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
github.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe h1:mjAZxE1nh8yvuwhGHpdDqdhtNu2dgbpk93TwoXuk5so=
github.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f h1:p4VB7kIXpOQvVn1ZaTIVp+3vuYAXFe3OJEvjbUYJLaA=
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
golang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e h1:8foAy0aoO5GkqCvAEJ4VC4P3zksTg4X4aJCDpZzmgQI=
golang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 h1:7I4JAnoQBe7ZtJcBaYHi5UtiO8tQHbUSXxL+pnGRANg=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20191028085509-fe3aa8a45271/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
golang.org/x/net v0.0.0-20201006153459-a7d1128ccaa0/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210504132125-bbd867fde50d h1:nTDGCTeAu2LhcsHTRzjyIUbZHCJ4QePArsm27Hka0UM=
golang.org/x/net v0.0.0-20210504132125-bbd867fde50d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20210927181540-4e4d966f7476/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20211008194852-3b03d305991f h1:1scJEYZBaF48BaG6tYbtxmLcXqwYGSfGcMoStTqkkIw=
golang.org/x/net v0.0.0-20211008194852-3b03d305991f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191029155521-f43be2a4598c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201118182958-a01c418693c7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201218084310-7d0127a74742/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210110051926-789bb1bd4061/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210123111255-9b0068b26619/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210309040221-94ec62e08169/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210503173754-0981d6026fa6 h1:cdsMqa2nXzqlgs183pHxtvoVwU7CyzaCTAUOg94af4c=
golang.org/x/sys v0.0.0-20210503173754-0981d6026fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210525143221-35b2ab0089ea/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac h1:oN6lz7iLW/YC7un8pq+9bOLyXrprv2+DKfkJY+2LJJw=
golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.zx2c4.com/wireguard v0.0.0-20210427022245-097af6e1351b/go.mod h1:a057zjmoc00UN7gVkaJt2sXVK523kMJcogDTEvPIasg=
golang.zx2c4.com/wireguard v0.0.0-20210624150102-15b24b6179e0 h1:qINUmOnDCCF7i14oomDDkGmlda7BSDTGfge77/aqdfk=
golang.zx2c4.com/wireguard v0.0.0-20210624150102-15b24b6179e0/go.mod h1:laHzsbfMhGSobUmruXWAyMKKHSqvIcrqZJMyHD+/3O8=
golang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326 h1:4yQQ5d6U5ozGB6n/WSDZa6B0XpPTmoQMtMDMoiZr4n0=
golang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326/go.mod h1:SDoazCvdy7RDjBPNEMBwrXhomlmtG7svs8mgwWEqtVI=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20210506160403-92e472f520a5 h1:LpEwXnbN4q2EIPkqbG9KHBUrducJYDOOdL+eMcJAlFo=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20210506160403-92e472f520a5/go.mod h1:+1XihzyZUBJcSc5WO9SwNA7v26puQwOEDwanaxfNXPQ=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815 h1:avmQJRd/MfOtK7TRnf0Bi2o6W05ZaPhP1upcDCgvTTs=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815/go.mod h1:G0zJhHaavrPDNb/ygHzf4uju6nSlKMi4f1E5RCT3WpE=
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
================================================
FILE: main.go
================================================
package main
import (
"strings"
log "github.com/sirupsen/logrus"
"golang.org/x/crypto/bcrypt"
"gopkg.in/alecthomas/kingpin.v2"
)
var (
logLevel = kingpin.Flag("log-level", "The level of logging").Default("info").Enum("debug", "info", "warn", "error", "panic", "fatal")
)
func main() {
kingpin.HelpFlag.Short('h')
kingpin.CommandLine.DefaultEnvars()
kingpin.Command("server", "Start server.").Default()
passwdCmd := kingpin.Command("passwd", "Generate password hash.")
passwdCmdPassword := passwdCmd.Arg("password", "The password to hash").Required().String()
cmd := kingpin.Parse()
switch strings.ToLower(*logLevel) {
case "debug":
log.SetLevel(log.DebugLevel)
case "warn":
log.SetLevel(log.WarnLevel)
case "error":
log.SetLevel(log.ErrorLevel)
case "panic":
log.SetLevel(log.PanicLevel)
default:
log.SetLevel(log.InfoLevel)
}
switch cmd {
case "passwd":
bytes, err := bcrypt.GenerateFromPassword([]byte(*passwdCmdPassword), 14)
if err != nil {
log.Fatalf("generate password error: %v", err)
}
log.Infof("Password Hash: %s", string(bytes))
return
case "server":
log.Info("Starting")
server := NewServer()
err := server.Start()
if err != nil {
log.Fatal(err)
}
default:
log.Fatal("Unknown command")
}
}
================================================
FILE: server.go
================================================
package main
import (
"context"
"embed"
"encoding/json"
"fmt"
"io/fs"
"io/ioutil"
"net"
"net/http"
"net/http/httputil"
"net/url"
"os"
"path"
"regexp"
"strconv"
"strings"
"sync"
"time"
validator "github.com/fujiwara/go-amzn-oidc/validator"
"github.com/google/nftables"
"github.com/google/nftables/expr"
"github.com/julienschmidt/httprouter"
log "github.com/sirupsen/logrus"
"github.com/skip2/go-qrcode"
"github.com/vishvananda/netlink"
"github.com/vishvananda/netns"
"golang.org/x/crypto/bcrypt"
"golang.zx2c4.com/wireguard/wgctrl"
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
"gopkg.in/alecthomas/kingpin.v2"
)
const (
wgDefaultMtu = 1420
)
var (
dataDir = kingpin.Flag("data-dir", "Directory used for storage").Default("/var/lib/wireguard-ui").String()
listenAddr = kingpin.Flag("listen-address", "Address to listen to").Default(":8080").String()
natEnabled = kingpin.Flag("nat", "Whether NAT is enabled or not").Default("true").Bool()
natLink = kingpin.Flag("nat-device", "Network interface to masquerade").Default("wlp2s0").String()
clientIPRange = kingpin.Flag("client-ip-range", "Client IP CIDR").Default("172.31.255.0/24").String()
authUserHeader = kingpin.Flag("auth-user-header", "Header containing username").Default("X-Forwarded-User").String()
authBasicUser = kingpin.Flag("auth-basic-user", "Basic auth static username").Default("").String()
authBasicPass = kingpin.Flag("auth-basic-pass", "Basic auth static password").Default("").String()
maxNumberClientConfig = kingpin.Flag("max-number-client-config", "Max number of configs an client can use. 0 is unlimited").Default("0").Int()
wgLinkName = kingpin.Flag("wg-device-name", "WireGuard network device name").Default("wg0").String()
wgListenPort = kingpin.Flag("wg-listen-port", "WireGuard UDP port to listen to").Default("51820").Int()
wgEndpoint = kingpin.Flag("wg-endpoint", "WireGuard endpoint address").Default("127.0.0.1:51820").String()
wgAllowedIPs = kingpin.Flag("wg-allowed-ips", "WireGuard client allowed ips").Default("0.0.0.0/0").Strings()
wgDNS = kingpin.Flag("wg-dns", "WireGuard client DNS server (optional)").Default("").String()
wgKeepAlive = kingpin.Flag("wg-keepalive", "WireGuard Keepalive for peers, defined in seconds (optional)").Default("").String()
wgServerMtu = kingpin.Flag("wg-server-mtu", "WireGuard server MTU").Default("1420").Int()
wgPeerMtu = kingpin.Flag("wg-peer-mtu", "WireGuard default peer MTU").Default(strconv.Itoa(wgDefaultMtu)).Int()
devUIServer = kingpin.Flag("dev-ui-server", "Developer mode: If specified, proxy all static assets to this endpoint").String()
filenameRe = regexp.MustCompile("[^a-zA-Z0-9]+")
)
type contextKey string
const key = contextKey("user")
// Server is the running server
type Server struct {
serverConfigPath string
mutex sync.RWMutex
Config *ServerConfig
ipAddr net.IP
clientIPRange *net.IPNet
assets http.Handler
}
type wgLink struct {
attrs *netlink.LinkAttrs
}
func (w *wgLink) Attrs() *netlink.LinkAttrs {
return w.attrs
}
func (w *wgLink) Type() string {
return "wireguard"
}
func ifname(n string) []byte {
b := make([]byte, 16)
copy(b, []byte(n+"\x00"))
return b
}
//go:embed ui/dist
var assetsFS embed.FS
// NewServer returns an instance of Server which contains both the webserver and the reference to Wireguard
func NewServer() *Server {
ipAddr, ipNet, err := net.ParseCIDR(*clientIPRange)
if err != nil {
log.Fatal(err)
}
log.Debugf("ipAddr: %s ipNet: %s", ipAddr, ipNet)
err = os.MkdirAll(*dataDir, 0700)
if err != nil {
log.WithError(err).Fatalf("Error initializing data directory: %s", *dataDir)
}
cfgPath := path.Join(*dataDir, "config.json")
config := NewServerConfig(cfgPath)
log.Debug("Configuration loaded with public key: ", config.PublicKey)
var fsys fs.FS = assetsFS
if f, err := fs.Sub(fsys, "ui/dist"); err != nil {
log.Error(fmt.Errorf("ui/dist does not exist in fs :%w", err))
} else {
fsys = f
}
fmt.Println(fs.Glob(fsys, "*"))
assets := http.FileServer(http.FS(fsys))
s := Server{
serverConfigPath: cfgPath,
Config: config,
ipAddr: ipAddr,
clientIPRange: ipNet,
assets: assets,
}
log.Debug("Server initialized: ", *dataDir)
return &s
}
func (s *Server) enableIPForward() error {
p := "/proc/sys/net/ipv4/ip_forward"
content, err := ioutil.ReadFile(p)
if err != nil {
return err
}
if string(content) == "0\n" {
log.Info("Enabling sys.net.ipv4.ip_forward")
return ioutil.WriteFile(p, []byte("1"), 0600)
}
return nil
}
func (s *Server) initInterface() error {
attrs := netlink.NewLinkAttrs()
attrs.Name = *wgLinkName
link := wgLink{
attrs: &attrs,
}
log.Debug("Adding wireguard device: ", *wgLinkName)
err := netlink.LinkAdd(&link)
if os.IsExist(err) {
log.Infof("WireGuard interface %s already exists. Reusing.", *wgLinkName)
} else if err != nil {
return err
}
log.Debug("Adding ip address to wireguard device: ", s.clientIPRange)
addr, _ := netlink.ParseAddr(*clientIPRange)
err = netlink.AddrAdd(&link, addr)
if os.IsExist(err) {
log.Infof("WireGuard interface %s already has the requested address: ", s.clientIPRange)
} else if err != nil {
return err
}
log.Debug("Setting link MTU: ", *wgServerMtu)
err = netlink.LinkSetMTU(&link, *wgServerMtu)
if err != nil {
log.Error("Error setting link MTU: ", *wgLinkName)
return err
}
log.Debug("Bringing up wireguard device: ", *wgLinkName)
err = netlink.LinkSetUp(&link)
if err != nil {
log.Error("Error bringing up device: ", *wgLinkName)
return err
}
if *natEnabled {
log.Debug("Adding NAT / IP masquerading using nftables")
ns, err := netns.Get()
if err != nil {
return err
}
conn := nftables.Conn{NetNS: int(ns)}
log.Debug("Flushing nftable rulesets")
conn.FlushRuleset()
log.Debug("Setting up nftable rules for ip masquerading")
nat := conn.AddTable(&nftables.Table{
Family: nftables.TableFamilyIPv4,
Name: "nat",
})
conn.AddChain(&nftables.Chain{
Name: "prerouting",
Table: nat,
Type: nftables.ChainTypeNAT,
Hooknum: nftables.ChainHookPrerouting,
Priority: nftables.ChainPriorityFilter,
})
post := conn.AddChain(&nftables.Chain{
Name: "postrouting",
Table: nat,
Type: nftables.ChainTypeNAT,
Hooknum: nftables.ChainHookPostrouting,
Priority: nftables.ChainPriorityNATSource,
})
conn.AddRule(&nftables.Rule{
Table: nat,
Chain: post,
Exprs: []expr.Any{
&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
&expr.Cmp{
Op: expr.CmpOpEq,
Register: 1,
Data: ifname(*natLink),
},
&expr.Masq{},
},
})
if err := conn.Flush(); err != nil {
return err
}
}
return nil
}
func (s *Server) allocateIP() net.IP {
allocated := make(map[string]bool)
allocated[s.ipAddr.String()] = true
for _, cfg := range s.Config.Users {
for _, dev := range cfg.Clients {
allocated[dev.IP.String()] = true
}
}
for ip := s.ipAddr.Mask(s.clientIPRange.Mask); s.clientIPRange.Contains(ip); {
for i := len(ip) - 1; i >= 0; i-- {
ip[i]++
if ip[i] > 0 {
break
}
}
if !allocated[ip.String()] {
log.Debug("Allocated IP: ", ip)
return ip
}
}
log.Fatal("Unable to allocate IP. Address range exhausted")
return nil
}
func (s *Server) reconfigure() {
log.Debug("Reconfiguring")
err := s.Config.Write()
if err != nil {
log.Fatal(err)
}
err = s.configureWireGuard()
if err != nil {
log.Fatal(err)
}
}
func (s *Server) configureWireGuard() error {
log.Debugf("Reconfiguring wireguard interface %s", *wgLinkName)
wg, err := wgctrl.New()
if err != nil {
return err
}
log.Debug("Adding wireguard private key")
key, err := wgtypes.ParseKey(s.Config.PrivateKey)
if err != nil {
return err
}
log.Debugf("Getting current Wireguard config")
currentdev, err := wg.Device(*wgLinkName)
if err != nil {
return err
}
currentpeers := currentdev.Peers
diffpeers := make([]wgtypes.PeerConfig, 0)
peers := make([]wgtypes.PeerConfig, 0)
for user, cfg := range s.Config.Users {
for id, dev := range cfg.Clients {
pubKey, err := wgtypes.ParseKey(dev.PublicKey)
if err != nil {
return err
}
psk, _ := wgtypes.ParseKey(dev.PresharedKey)
allowedIPs := make([]net.IPNet, 1+len(dev.AllowedIPs))
allowedIPs[0] = *netlink.NewIPNet(dev.IP)
for i, cidr := range dev.AllowedIPs {
allowedIPs[1+i] = *cidr
}
peer := wgtypes.PeerConfig{
PublicKey: pubKey,
ReplaceAllowedIPs: true,
AllowedIPs: allowedIPs,
PresharedKey: &psk,
}
log.WithFields(log.Fields{"user": user, "client": id, "key": dev.PublicKey, "allowedIPs": peer.AllowedIPs}).Debug("Adding wireguard peer")
peers = append(peers, peer)
}
}
// Determine peers updated and to be removed from WireGuard
for _, i := range currentpeers {
found := false
for _, j := range peers {
if i.PublicKey == j.PublicKey {
found = true
j.UpdateOnly = true
diffpeers = append(diffpeers, j)
break
}
}
if !found {
peertoremove := wgtypes.PeerConfig{
PublicKey: i.PublicKey,
Remove: true,
}
diffpeers = append(diffpeers, peertoremove)
}
}
// Determine peers to be added to WireGuard
for _, i := range peers {
found := false
for _, j := range currentpeers {
if i.PublicKey == j.PublicKey {
found = true
break
}
}
if !found {
diffpeers = append(diffpeers, i)
}
}
cfg := wgtypes.Config{
PrivateKey: &key,
ListenPort: wgListenPort,
ReplacePeers: false,
Peers: diffpeers,
}
err = wg.ConfigureDevice(*wgLinkName, cfg)
if err != nil {
return err
}
return nil
}
func verifyLinkMTU(mtu int) error {
if mtu < 1280 || mtu > 1500 {
return fmt.Errorf("MTU must be between 1280 and 1500")
}
return nil
}
// Start configures wiregard and initiates the interfaces as well as starts the webserver to accept clients
func (s *Server) Start() error {
err := s.enableIPForward()
if err != nil {
return err
}
err = s.initInterface()
if err != nil {
return err
}
err = s.configureWireGuard()
if err != nil {
return err
}
router := httprouter.New()
router.GET("/api/v1/whoami", s.WhoAmI)
router.GET("/api/v1/users/:user/clients/:client", s.withAuth(s.GetClient))
router.PUT("/api/v1/users/:user/clients/:client", s.withAuth(s.EditClient))
router.DELETE("/api/v1/users/:user/clients/:client", s.withAuth(s.DeleteClient))
router.GET("/api/v1/users/:user/clients", s.withAuth(s.GetClients))
router.POST("/api/v1/users/:user/clients", s.withAuth(s.CreateClient))
if *devUIServer != "" {
log.Debug("Serving static assets proxying from development server: ", *devUIServer)
devProxy := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
url, _ := url.Parse(*devUIServer)
if strings.HasPrefix(r.URL.Path, "/client/") || r.URL.Path == "/about" {
r.URL.Path = "/"
}
proxy := httputil.NewSingleHostReverseProxy(url)
r.URL.Host = url.Host
r.URL.Scheme = url.Scheme
r.Header.Set("X-Forwarded-Host", r.Header.Get("Host"))
r.Host = url.Host
proxy.ServeHTTP(w, r)
})
router.NotFound = devProxy
} else {
log.Debug("Serving static assets embedded in binary")
router.GET("/about", s.Index)
router.GET("/client/:client", s.Index)
router.NotFound = s.assets
}
log.WithField("listenAddr", *listenAddr).Info("Starting server")
return http.ListenAndServe(*listenAddr, s.basicAuth(s.userFromHeader(router)))
}
func (s *Server) basicAuth(handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// If we specified a user, require auth
if *authBasicUser != "" {
u, p, ok := r.BasicAuth()
if !ok || u != *authBasicUser || bcrypt.CompareHashAndPassword([]byte(*authBasicPass), []byte(p)) != nil {
w.Header().Set("WWW-Authenticate", `Basic realm="restricted", charset="UTF-8"`)
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
}
handler.ServeHTTP(w, r)
})
}
func (s *Server) userFromHeader(handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
user := r.Header.Get(*authUserHeader)
if user == "" {
log.Debug("Unauthenticated request")
user = "anonymous"
}
if *authUserHeader == "X-Goog-Authenticated-User-Email" {
user = strings.TrimPrefix(user, "accounts.google.com:")
}
// AWS ALB-specific JWT header (https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html)
if *authUserHeader == "x-amzn-oidc-data" {
claims, err := validator.Validate(user)
if err != nil {
log.Debug("Unauthenticated request")
user = "anonymous"
} else {
user = claims.Email()
}
}
cookie := http.Cookie{
Name: "wguser",
Value: user,
Path: "/",
}
http.SetCookie(w, &cookie)
ctx := context.WithValue(r.Context(), key, user)
handler.ServeHTTP(w, r.WithContext(ctx))
})
}
func (s *Server) withAuth(handler httprouter.Handle) httprouter.Handle {
return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
log.Debug("Auth required")
user := r.Context().Value(key)
if user == nil {
log.Error("Error getting username from request context")
w.WriteHeader(http.StatusInternalServerError)
return
}
if user != ps.ByName("user") {
log.WithField("user", user).WithField("path", r.URL.Path).Warn("Unauthorized access")
w.WriteHeader(http.StatusUnauthorized)
return
}
handler(w, r, ps)
}
}
// WhoAmI returns the identity of the current user
func (s *Server) WhoAmI(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
user := r.Context().Value(key).(string)
log.Debug(user)
err := json.NewEncoder(w).Encode(struct{ User string }{user})
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
}
}
// GetClients returns a list of all clients for the current user
func (s *Server) GetClients(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
s.mutex.RLock()
defer s.mutex.RUnlock()
user := r.Context().Value(key).(string)
log.Debug(user)
clients := map[string]*ClientConfig{}
userConfig := s.Config.Users[user]
if userConfig != nil {
clients = userConfig.Clients
}
err := json.NewEncoder(w).Encode(clients)
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
}
}
// Index returns the single-page app
func (s *Server) Index(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
log.Debug("Serving single-page app from URL: ", r.URL)
r.URL.Path = "/"
s.assets.ServeHTTP(w, r)
}
// GetClient returns a specific client for the current user
func (s *Server) GetClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
s.mutex.RLock()
defer s.mutex.RUnlock()
user := r.Context().Value(key).(string)
usercfg := s.Config.Users[user]
if usercfg == nil {
w.WriteHeader(http.StatusNotFound)
return
}
client := usercfg.Clients[ps.ByName("client")]
if client == nil {
w.WriteHeader(http.StatusNotFound)
return
}
interfaceConfig := []string{
"[Interface]",
"Address = " + client.IP.String(),
"PrivateKey = " + client.PrivateKey,
}
if *wgDNS != "" {
interfaceConfig = append(interfaceConfig, "DNS = "+*wgDNS)
}
if client.MTU != wgDefaultMtu {
interfaceConfig = append(interfaceConfig, fmt.Sprintf("MTU = %d", client.MTU))
}
peerConfig := []string{
"[Peer]",
"PublicKey = " + s.Config.PublicKey,
"AllowedIPs = " + strings.Join(*wgAllowedIPs, ","),
"Endpoint = " + *wgEndpoint,
}
if *wgKeepAlive != "" {
peerConfig = append(peerConfig, "PersistentKeepalive = "+*wgKeepAlive)
}
if client.PresharedKey != "" {
peerConfig = append(peerConfig, "PresharedKey = "+client.PresharedKey)
}
clientConfig := strings.Join(interfaceConfig[:], "\n") + "\n\n" + strings.Join(peerConfig[:], "\n") + "\n"
format := r.URL.Query().Get("format")
if format == "qrcode" {
png, err := qrcode.Encode(clientConfig, qrcode.Medium, 220)
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
return
}
w.Header().Set("Content-Type", "image/png")
w.WriteHeader(http.StatusOK)
_, err = w.Write(png)
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
return
}
return
}
if format == "config" {
filename := fmt.Sprintf("%s.conf", filenameRe.ReplaceAllString(client.Name, "_"))
w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
w.Header().Set("Content-Type", "application/config")
w.WriteHeader(http.StatusOK)
_, err := fmt.Fprint(w, clientConfig)
if err != nil {
w.WriteHeader(http.StatusInternalServerError)
}
return
}
err := json.NewEncoder(w).Encode(client)
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
return
}
}
// EditClient edits the specific client passed by the current user
func (s *Server) EditClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
s.mutex.Lock()
defer s.mutex.Unlock()
user := r.Context().Value(key).(string)
usercfg := s.Config.Users[user]
if usercfg == nil {
w.WriteHeader(http.StatusNotFound)
return
}
client := usercfg.Clients[ps.ByName("client")]
if client == nil {
w.WriteHeader(http.StatusNotFound)
return
}
cfg := ClientConfig{}
if err := json.NewDecoder(r.Body).Decode(&cfg); err != nil {
log.Warn("Error parsing request: ", err)
w.WriteHeader(http.StatusBadRequest)
return
}
log.Debugf("EditClient: %#v", cfg)
if cfg.Name != "" {
client.Name = cfg.Name
}
if cfg.Notes != "" {
client.Notes = cfg.Notes
}
if err := verifyLinkMTU(cfg.MTU); err == nil {
client.MTU = cfg.MTU
}
client.PresharedKey = cfg.PresharedKey
client.Modified = time.Now().Format(time.RFC3339)
if len(cfg.AllowedIPs) != 0 {
client.AllowedIPs = cfg.AllowedIPs
}
s.reconfigure()
w.WriteHeader(http.StatusOK)
if err := json.NewEncoder(w).Encode(client); err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
return
}
}
// DeleteClient deletes the specified client for the current user
func (s *Server) DeleteClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
s.mutex.Lock()
defer s.mutex.Unlock()
user := r.Context().Value(key).(string)
usercfg := s.Config.Users[user]
if usercfg == nil {
w.WriteHeader(http.StatusNotFound)
return
}
client := ps.ByName("client")
if usercfg.Clients[client] == nil {
w.WriteHeader(http.StatusNotFound)
return
}
delete(usercfg.Clients, client)
s.reconfigure()
log.WithField("user", user).Debug("Deleted client: ", client)
w.WriteHeader(http.StatusOK)
}
// CreateClient creates a new client for the current user
func (s *Server) CreateClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
s.mutex.Lock()
defer s.mutex.Unlock()
user := r.Context().Value(key).(string)
log.WithField("user", user).Debug("CreateClient")
c := s.Config.GetUserConfig(user)
log.Debugf("user config: %#v", c)
if *maxNumberClientConfig > 0 {
if len(c.Clients) >= *maxNumberClientConfig {
log.Error(fmt.Errorf("user %q have too many configs", c.Name))
e := struct {
Error string
}{
Error: "Max number of configs: " + strconv.Itoa(*maxNumberClientConfig),
}
w.WriteHeader(http.StatusBadRequest)
err := json.NewEncoder(w).Encode(e)
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
return
}
return
}
}
decoder := json.NewDecoder(r.Body)
newclient := &NewClient{}
err := decoder.Decode(&newclient)
if err != nil {
log.Warn("Error parsing request: ", err)
w.WriteHeader(http.StatusBadRequest)
return
}
if newclient.Name == "" {
log.Debugf("No clientName:using default: \"Unnamed Client\"")
newclient.Name = "Unnamed Client"
}
if err := verifyLinkMTU(newclient.MTU); err != nil {
log.Debugf("Invalid new client MTU: %d", newclient.MTU)
if err := verifyLinkMTU(*wgPeerMtu); err != nil {
log.Debugf("Invalid peer MTU: %d", *wgPeerMtu)
newclient.MTU = wgDefaultMtu
} else {
newclient.MTU = *wgPeerMtu
}
}
i := 0
for k := range c.Clients {
n, err := strconv.Atoi(k)
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
return
}
if n > i {
i = n
}
}
i = i + 1
ip := s.allocateIP()
client := NewClientConfig(newclient.Name, ip, newclient.MTU, newclient.Notes, newclient.GeneratePSK)
c.Clients[strconv.Itoa(i)] = client
s.reconfigure()
err = json.NewEncoder(w).Encode(client)
if err != nil {
log.Error(err)
w.WriteHeader(http.StatusInternalServerError)
return
}
}
================================================
FILE: ui/.babelrc
================================================
{
"presets": [
["@babel/preset-env", {
"targets": {
"node": "current"
}
}]
]
}
================================================
FILE: ui/.gitignore
================================================
node_modules
.idea
================================================
FILE: ui/.prettierrc
================================================
{
"singleQuote": false,
"printWidth": 120,
"useTabs": false,
"tabWidth": 4,
"jsxBracketSameLine": true,
"semi": true,
"bracketSpacing": false,
"arrowParens": "always"
}
================================================
FILE: ui/jest.config.js
================================================
// For a detailed explanation regarding each configuration property, visit:
// https://jestjs.io/docs/en/configuration.html
module.exports = {
// All imported modules in your tests should be mocked automatically
// automock: false,
// Stop running tests after `n` failures
// bail: 0,
// Respect "browser" field in package.json when resolving modules
// browser: false,
// The directory where Jest should store its cached dependency information
// cacheDirectory: "/tmp/jest_rs",
// Automatically clear mock calls and instances between every test
// clearMocks: false,
// Indicates whether the coverage information should be collected while executing the test
// collectCoverage: false,
// An array of glob patterns indicating a set of files for which coverage information should be collected
// collectCoverageFrom: null,
// The directory where Jest should output its coverage files
// coverageDirectory: null,
// An array of regexp pattern strings used to skip coverage collection
// coveragePathIgnorePatterns: [
// "/node_modules/"
// ],
// A list of reporter names that Jest uses when writing coverage reports
// coverageReporters: [
// "json",
// "text",
// "lcov",
// "clover"
// ],
// An object that configures minimum threshold enforcement for coverage results
// coverageThreshold: null,
// A path to a custom dependency extractor
// dependencyExtractor: null,
// Make calling deprecated APIs throw helpful error messages
// errorOnDeprecated: false,
// Force coverage collection from ignored files using an array of glob patterns
// forceCoverageMatch: [],
// A path to a module which exports an async function that is triggered once before all test suites
// globalSetup: null,
// A path to a module which exports an async function that is triggered once after all test suites
// globalTeardown: null,
// A set of global variables that need to be available in all test environments
// globals: {},
// The maximum amount of workers used to run your tests. Can be specified as % or a number. E.g. maxWorkers: 10% will use 10% of your CPU amount + 1 as the maximum worker number. maxWorkers: 2 will use a maximum of 2 workers.
// maxWorkers: "50%",
// An array of directory names to be searched recursively up from the requiring module's location
// moduleDirectories: [
// "node_modules"
// ],
// An array of file extensions your modules use
// moduleFileExtensions: [
// "js",
// "json",
// "jsx",
// "ts",
// "tsx",
// "node"
// ],
// A map from regular expressions to module names that allow to stub out resources with a single module
// moduleNameMapper: {},
// An array of regexp pattern strings, matched against all module paths before considered 'visible' to the module loader
// modulePathIgnorePatterns: [],
// Activates notifications for test results
// notify: false,
// An enum that specifies notification mode. Requires { notify: true }
// notifyMode: "failure-change",
// A preset that is used as a base for Jest's configuration
// preset: null,
// Run tests from one or more projects
// projects: null,
// Use this configuration option to add custom reporters to Jest
// reporters: undefined,
// Automatically reset mock state between every test
// resetMocks: false,
// Reset the module registry before running each individual test
// resetModules: false,
// A path to a custom resolver
// resolver: null,
// Automatically restore mock state between every test
// restoreMocks: false,
// The root directory that Jest should scan for tests and modules within
// rootDir: null,
// A list of paths to directories that Jest should use to search for files in
// roots: [
// "<rootDir>"
// ],
// Allows you to use a custom runner instead of Jest's default test runner
// runner: "jest-runner",
// The paths to modules that run some code to configure or set up the testing environment before each test
// setupFiles: [],
// A list of paths to modules that run some code to configure or set up the testing framework before each test
// setupFilesAfterEnv: [],
// A list of paths to snapshot serializer modules Jest should use for snapshot testing
// snapshotSerializers: [],
// The test environment that will be used for testing
testEnvironment: "node"
// Options that will be passed to the testEnvironment
// testEnvironmentOptions: {},
// Adds a location field to test results
// testLocationInResults: false,
// The glob patterns Jest uses to detect test files
// testMatch: [
// "**/__tests__/**/*.[jt]s?(x)",
// "**/?(*.)+(spec|test).[tj]s?(x)"
// ],
// An array of regexp pattern strings that are matched against all test paths, matched tests are skipped
// testPathIgnorePatterns: [
// "/node_modules/"
// ],
// The regexp pattern or array of patterns that Jest uses to detect test files
// testRegex: [],
// This option allows the use of a custom results processor
// testResultsProcessor: null,
// This option allows use of a custom test runner
// testRunner: "jasmine2",
// This option sets the URL for the jsdom environment. It is reflected in properties such as location.href
// testURL: "http://localhost",
// Setting this value to "fake" allows the use of fake timers for functions such as "setTimeout"
// timers: "real",
// A map from regular expressions to paths to transformers
// transform: null,
// An array of regexp pattern strings that are matched against all source file paths, matched files will skip transformation
// transformIgnorePatterns: [
// "/node_modules/"
// ],
// An array of regexp pattern strings that are matched against all modules before the module loader will automatically return a mock for them
// unmockedModulePathPatterns: undefined,
// Indicates whether each individual test should be reported during the run
// verbose: null,
// An array of regexp patterns that are matched against all source file paths before re-running tests in watch mode
// watchPathIgnorePatterns: [],
// Whether to use watchman for file crawling
// watchman: true,
};
================================================
FILE: ui/package.json
================================================
{
"name": "wireguard-ui",
"version": "1.0.0",
"description": "WireGuard VPN web UI",
"main": "index.js",
"scripts": {
"dev": "webpack-dev-server --mode=development --open --port 5000",
"build": "cross-env NODE_ENV=production webpack --mode=production --progress",
"test": "jest",
"prettier": "prettier --check ./src/**/*.{js,css,json,md}"
},
"author": "Daniel Lundin <daniel.lundin@embark-studios.com>",
"license": "ISC",
"dependencies": {
"cookie-universal": "^2.0.16"
},
"devDependencies": {
"@babel/cli": "^7.12.10",
"@babel/core": "^7.11.6",
"@babel/preset-env": "^7.11.5",
"@material/typography": "^3.1.0",
"@smui/button": "^1.0.0",
"@smui/dialog": "^1.0.0",
"@smui/fab": "^1.0.0",
"@smui/form-field": "^1.0.0",
"@smui/icon-button": "^1.0.0",
"@smui/paper": "^1.0.0",
"@smui/switch": "^1.0.0",
"@smui/textfield": "^1.0.0",
"@smui/top-app-bar": "^1.0.0",
"babel-jest": "^24.9.0",
"babel-loader": "^8.1.0",
"clean-webpack-plugin": "^3.0.0",
"cross-env": "^6.0.3",
"css-loader": "^3.6.0",
"html-webpack-plugin": "^3.2.0",
"husky": "^3.1.0",
"jest": "^24.9.0",
"lint-staged": "^9.5.0",
"mini-css-extract-plugin": "^0.8.2",
"node-sass": "^4.14.1",
"prettier": "^1.19.1",
"sass-loader": "^8.0.2",
"style-loader": "^1.2.1",
"svelte": "^3.25.0",
"svelte-loader": "^2.13.6",
"svelte-routing": "1.4.0",
"webpack": "^4.44.1",
"webpack-cli": "^3.3.12",
"webpack-dev-server": "^3.11.0"
},
"husky": {
"hooks": {
"pre-commit": "lint-staged"
}
},
"lint-staged": {
"*.{js,css,json,md}": [
"prettier --write",
"git add"
]
}
}
================================================
FILE: ui/src/About.svelte
================================================
<h1>About</h1>
<p>
WG UI is an <a href="https://www.embark-studios.com/">Embark Studios</a> Open Source project.
</p>
<p>
For contributions and feedback, please see the
<a href="https://github.com/EmbarkStudios/wg-ui">GitHub project</a>.
</p>
<h2>License</h2>
<p>
WG UI is licensed under <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>
</p>
<p>Copyright © 2021, Embark Studios AB</p>
================================================
FILE: ui/src/App.svelte
================================================
<svelte:head>
<title>WireGuard VPN</title>
</svelte:head>
<script>
import { onMount } from 'svelte';
import { Router, Link, Route } from "svelte-routing";
import About from "./About.svelte";
import Clients from "./Clients.svelte";
import EditClient from "./EditClient.svelte";
import Nav from "./Nav.svelte";
import NewClient from "./NewClient.svelte";
import Cookie from "cookie-universal";
const cookies = Cookie();
export let user = cookies.get("wguser", { fromRes: true}) || "anonymous";
export let url = "";
</script>
<style>
main {
/* max-width: 960px;
margin-left: auto;
margin-right: auto;
*/
}
footer {
margin-top: 3em;
border-top: 1px solid #ddd;
text-align: center;
background: #f7f7f7;
}
</style>
<div class="mdc-typography">
<Router url="{url}">
<Nav user="{user}" />
<main role="main" class="container">
<div>
<Route path="client/:clientId" component="{EditClient}" />
<Route path="newclient/" component="{NewClient}" />
<Route path="about" component="{About}" />
<Route path="/"><Clients user="{user}" /></Route>
</div>
</main>
</Router>
<footer>
<p>
Powered by <a href="https://github.com/EmbarkStudios/wg-ui">WG UI</a>.
</p>
<p>
Copyright © 2021 <a href="https://embark-studios.com">Embark Studios</a>.
</p>
</footer>
</div>
================================================
FILE: ui/src/Client.svelte
================================================
<script>
import Button, {Group, GroupItem, Label} from '@smui/button';
import IconButton, {Icon} from '@smui/icon-button';
import Paper, {Title, Subtitle, Content} from '@smui/paper';
import { link,navigate } from "svelte-routing";
export let client;
export let user;
let clientId = client[0];
let dev = client[1];
var hash = 0;
for (var i = 0; i < dev.PrivateKey.length; i++) {
hash = dev.PrivateKey.charCodeAt(i) + ((hash << 5) - hash);
}
const color = "hsl(" + (hash % 360) + ",50%,95%)";
function onEdit() {
navigate("/client/" + clientId, { replace: true });
}
</script>
<style>
@media screen and (max-width: 800px) {
img {
display: none;
}
}
img {
margin-right: 40px;
border: 1px solid #ccc;
}
.download {
margin-top: 2em;
}
</style>
<Paper elevation="8" style="background-color: {color}; margin: 2em 0;" class="card">
<div class="float-right">
<IconButton class="float-right material-icons" on:click={onEdit}>edit</IconButton>
</div>
<img src="/api/v1/users/{user}/clients/{clientId}?format=qrcode" class="qrcode float-right" alt="Mobile client config"/>
<i class="material-icons" aria-hidden="true">devices</i>
<h3 class="mdc-typography--headline5">
{dev.Name}</h3>
<dl>
<dt>IP</dt>
<dd>{dev.IP}</dd>
<dt>Public Key</dt>
<dd>{dev.PublicKey}</dd>
</dl>
<div class="download">
<Button href="/api/v1/users/{user}/clients/{clientId}?format=config" variant="raised"><Label>Download Config</Label></Button>
</div>
</Paper>
================================================
FILE: ui/src/Clients.svelte
================================================
<script>
import Fab, {Label, Icon} from '@smui/fab';
import { onMount } from 'svelte';
import Client from './Client.svelte';
import { link,navigate } from "svelte-routing";
export let user;
let clientsUrl = "/api/v1/users/" + user + "/clients";
let clients = [];
async function getClients() {
const res = await fetch(clientsUrl);
clients = Object.entries(await res.json());
console.log("Fetched clients", clients);
}
function onCreateNewClient() {
navigate("/newclient", { replace: true });
}
onMount(getClients);
</script>
<style>
.newClient {
float: right;
}
h2 small {
display: block;
clear: left;
color: #ccc;
}
.content {}
.row {
display: flex;
flex-direction: row;
flex-wrap: wrap;
width: 100%;
}
.col {
display: flex;
flex-direction: column;
flex-basis: 100%;
flex: 1;
margin-left: 2em;
}
.help {
flex-basis: 10%;
}
h2 {
margin: 0;
padding: 0;
}
</style>
<div class="content">
<div class="row">
<div class="col">
<h2 class="mdc-typography--headline2">My VPN Clients<small class="mdc-typography--headline5">({user})</small></h2>
</div>
<div class="col help">
<h3>Instructions</h3>
<ol>
<li><a href="https://www.wireguard.com/install/">Install WireGuard</a></li>
<li>Download your WireGuard config</li>
<li>Connect to the VPN server</li>
</ol>
</div>
</div>
</div>
{#each clients as dev}
<Client user={user} client={dev}/>
{/each}
<div class="newClient">
<Fab color="primary" on:click={onCreateNewClient}><Icon class="material-icons">add</Icon></Fab>
</div>
================================================
FILE: ui/src/EditClient.svelte
================================================
<script>
import Fab, {Label, Icon} from '@smui/fab';
import Dialog, {Actions, InitialFocus} from '@smui/dialog';
import Textfield, {Input, Textarea} from '@smui/textfield';
import HelperText from '@smui/textfield/helper-text/index';
import Button, {Group, GroupItem} from '@smui/button';
import Paper, {Title, Subtitle, Content} from '@smui/paper';
import Cookie from "cookie-universal";
import { onMount } from 'svelte';
import { link, navigate } from "svelte-routing";
export let clientId;
const user = Cookie().get("wguser", { fromRes: true});
const clientUrl = `/api/v1/users/` + user + `/clients/` + clientId;
let client = {};
let clientName = "";
let clientNotes = "";
let allowedIPsText = "";
let deleteDialog;
function CIDRsubnetToNETIPMask(cidrmask){
let bitmask = "".padStart(cidrmask,"1").padEnd(32,"0");
return btoa(String.fromCharCode(
parseInt(bitmask.slice(0,8),2),
parseInt(bitmask.slice(8,16),2),
parseInt(bitmask.slice(16,24),2),
parseInt(bitmask.slice(24,32),2)))
}
function NETIPMaskToCIDRSubnet(bitmaskb64){
let bitmask = atob(bitmaskb64).split("").map((x) => x.charCodeAt(0).toString(2).padStart(8,0)).join("");
console.log(bitmask);
let cidrmask = bitmask.lastIndexOf("1");
return cidrmask == -1 ? 0 : cidrmask + 1
}
function convertTextCIDRsToNETIP(allowedIPsText){
if (allowedIPsText.length == 0) {
return null;
}
return allowedIPsText.split('\n').map(cidr => {
if (cidr.length == 0){
return null
}else if (cidr.indexOf('/') != -1){
let cidrsplit = cidr.split('/');
return {IP: cidrsplit[0], Mask: CIDRsubnetToNETIPMask(parseInt(cidrsplit[1]))}
}else{
return {IP: cidr, Mask: btoa(32)}
}
}).filter(x => !!x);
}
function convertNETIPToTextCIDRs(netIPs){
return netIPs.map(netip => netip.IP+ "/"+ NETIPMaskToCIDRSubnet(netip.Mask)).join("\n")
}
async function getClient() {
const res = await fetch(clientUrl);
client = await res.json();
clientName = client.Name;
clientNotes = client.Notes;
allowedIPsText = convertNETIPToTextCIDRs(client.AllowedIPs)
console.log("Fetched client", client);
}
async function handleSubmit(event) {
client.Name = clientName;
client.Notes = clientNotes;
client.AllowedIPs = convertTextCIDRsToNETIP(allowedIPsText);
const res = await fetch(clientUrl, {
method: "PUT",
headers: {
"Content-Type": "application/json",
},
body: JSON.stringify(client),
});
client = await res.json();
navigate("/", { replace: true });
console.log("Saved changes", res);
}
function handleBackClick(event) {
navigate("/", { replace: true });
}
async function deleteHandler(e) {
switch (e.detail.action) {
case 'delete':
const res = await fetch(clientUrl, {
method: "DELETE",
});
await res;
navigate("/", { replace: true });
break;
default:
break;
}
}
onMount(getClient);
</script>
<style>
.back {
position: fixed;
left: 10px;
top: 70px;
}
</style>
<div class="back">
<Fab color="primary" on:click={handleBackClick}><Icon class="material-icons">arrow_back</Icon></Fab>
</div>
<h3 class="mdc-typography--headline3">Client Properties <small class="text-muted">({client.Name})</small></h3>
<div class="container">
<form on:submit|preventDefault={handleSubmit}>
<div class="margins">
<Textfield input$id="name" bind:value={clientName} variant="outlined" label="Client Name" input$aria-controls="client-name" input$aria-describedby="client-name-help" />
<HelperText id="client-name-help">Friendly name of client / device</HelperText>
</div>
<div class="margins">
<Textfield input$id="notes" fullwidth textarea bind:value={clientNotes} label="Label" input$aria-controls="client-notes" input$aria-describedby="client-notes-help" />
<HelperText id="client-notes-help">Notes about the client.</HelperText>
</div>
<div class="margins">
<Textfield
input$id="allowedIps"
fullwidth
textarea
bind:value={allowedIPsText}
label="Allowed IPs"
input$aria-controls="client-allowedIps"
input$aria-describedby="client-allowedIps"
/>
<HelperText id="client-notes-help"
>Additional allowed CIDR blocks accessible via the client separated by a newline</HelperText
>
</div>
<Button variant="raised"><Label>Save Changes</Label></Button>
</form>
</div>
<div class="container">
<h3 class="mdc-typography--headline5">Additional Properties</h3>
<dl>
<dt>IP Address</dt>
<dd>{client.IP}</dd>
<dt>Private Key</dt>
<dd>{client.PrivateKey}</dd>
<dt>Public Key</dt>
<dd>{client.PublicKey}</dd>
<dt>Preshared Key</dt>
<dd>{client.PresharedKey}</dd>
</dl>
</div>
<div class="container">
<h3 class="mdc-typography--headline4">Danger Zone</h3>
<Dialog bind:this={deleteDialog} aria-labelledby="delete-title" aria-describedby="delete-content" on:MDCDialog:closed={deleteHandler}>
<div class="container">
<Title id="delete-title">Delete Client Config</Title>
<Content id="delete-content">
Are you sure you want to delete this client configuration?
</Content>
<Actions>
<Button action="none">
<Label>No</Label>
</Button>
<Button action="delete" default use={[InitialFocus]}>
<Label>Yes</Label>
</Button>
</Actions>
</div>
</Dialog>
<Button id="delete" variant="raised" on:click={() => deleteDialog.open()}><Label>Delete Client Config</Label></Button>
</div>
================================================
FILE: ui/src/Nav.svelte
================================================
<script>
import TopAppBar, {Row, Section, Title} from "@smui/top-app-bar";
import { Router, Link, Route } from "svelte-routing";
import About from "./About.svelte";
import Clients from "./Clients.svelte";
import NavLink from "./NavLink.svelte";
export let user;
</script>
<style>
@media screen and (max-width: 800px) {
.user {
display: none;
}
}
</style>
<TopAppBar variant="static" color="primary">
<Row>
<Section>
<Title>WireGuard VPN</Title>
</Section>
<Section align="end" toolbar>
<small class="user">Logged in as {user}</small>
</Section>
</Row>
</TopAppBar>
================================================
FILE: ui/src/NavLink.svelte
================================================
<script>
import { Link } from "svelte-routing";
export let to = "";
function getProps({ location, href, isPartiallyCurrent, isCurrent }) {
const isActive = href === "/" ? isCurrent : isPartiallyCurrent || isCurrent;
// The object returned here is spread on the anchor element's attributes
if (isActive) {
return { class: "nav-link active" };
}
return { class: "nav-link" };
}
</script>
<Link to="{to}" getProps="{getProps}">
<slot />
</Link>
================================================
FILE: ui/src/NewClient.svelte
================================================
<script>
import Fab, {Label, Icon} from '@smui/fab';
import Dialog, {Actions, InitialFocus} from '@smui/dialog';
import Textfield, {Input, Textarea} from '@smui/textfield';
import HelperText from '@smui/textfield/helper-text/index';
import Button, {Group, GroupItem} from '@smui/button';
import Paper, {Title, Subtitle, Content} from '@smui/paper';
import Switch from '@smui/switch';
import FormField from '@smui/form-field'
import Cookie from "cookie-universal";
import { onMount } from 'svelte';
import { link, navigate } from "svelte-routing";
const user = Cookie().get("wguser", { fromRes: true});
let clientsUrl = "/api/v1/users/" + user + "/clients";
let client = {};
let clientName = "";
let clientNotes = "";
let generatePSK = false;
let deleteDialog;
async function handleSubmit(event) {
client.Name = clientName;
client.Notes = clientNotes;
client.generatePSK = generatePSK;
const res = await fetch(clientsUrl, {
method: "POST",
headers: {
"Content-Type": "application/json",
},
body: JSON.stringify(client),
})
.then(response => {
return response.json();
})
.then(data => {
if (typeof data.Error != "undefined") {
console.log(data.Error);
alert(data.Error);
} else {
console.log("New client added", data);
}
});
navigate("/", { replace: true });
};
function handleBackClick(event) {
navigate("/", { replace: true });
}
</script>
<style>
.back {
position: fixed;
left: 10px;
top: 70px;
}
</style>
<div class="back">
<Fab color="primary" on:click={handleBackClick}><Icon class="material-icons">arrow_back</Icon></Fab>
</div>
<h3 class="mdc-typography--headline3"><small>Create New Device Configuration</small></h3>
<div class="container">
<form on:submit|preventDefault={handleSubmit}>
<div class="margins">
<Textfield input$id="name" bind:value={clientName} variant="outlined" label="Client Name" input$aria-controls="client-name" input$aria-describedby="client-name-help" />
<HelperText id="client-name-help">Friendly name of client / device</HelperText>
</div>
<div class="margins">
<Textfield input$id="notes" fullwidth textarea bind:value={clientNotes} label="Label" input$aria-controls="client-notes" input$aria-describedby="client-notes-help" />
<HelperText id="client-notes-help">Notes about the client.</HelperText>
</div>
<div class="margins">
<FormField style="margin-bottom: 2em;">
<Switch bind:checked={generatePSK} />
<span slot="label">Generate a Pre-shared Key</span>
</FormField>
</div>
<Button variant="raised"><Label>Create</Label></Button>
</form>
</div>
================================================
FILE: ui/src/index.ejs
================================================
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport"
content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title><%= htmlWebpackPlugin.options.title %></title>
<link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700">
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto+Mono">
</head>
<body>
</body>
</html>
================================================
FILE: ui/src/index.js
================================================
import "./style.scss";
import App from "./App.svelte";
const app = new App({
target: document.body,
props: {
name: "WireGuard VPN"
}
});
export default app;
================================================
FILE: ui/src/main.js
================================================
import App from './App.svelte';
new App({
target: document.body,
// hydrate: true,
});
================================================
FILE: ui/src/style.scss
================================================
@import "@material/typography/mdc-typography";
.container {
padding: 30px;
}
body {
margin: 0;
padding: 0;
}
.float-right {
float: right;
}
dl {
display: flex;
flex-flow: row wrap;
}
dt {
flex-basis: 20%;
font-weight: bold;
text-align: right;
}
dd {
flex-basis: 70%;
flex-grow: 1;
margin-left: 0.5em;
overflow: hidden;
}
================================================
FILE: ui/theme/_smui-theme.scss
================================================
// Nothing here. Just use the default theme.
================================================
FILE: ui/webpack.config.js
================================================
const {CleanWebpackPlugin} = require("clean-webpack-plugin");
const HtmlWebpackPlugin = require("html-webpack-plugin");
const MiniCssExtractPlugin = require("mini-css-extract-plugin");
const path = require("path");
const webpack = require("webpack");
const packageJSON = require("./package.json");
const mode = process.env.NODE_ENV || "development";
const prod = mode === "production";
const devOverrides = {
devServer: {
historyApiFallback: true
}
};
const prodOverrides = {
optimization: {
minimize: true,
splitChunks: {
chunks: "all"
}
}
};
let envOverride = prod ? prodOverrides : devOverrides;
module.exports = {
mode,
entry: "./src/index.js",
resolve: {
alias: {
svelte: path.resolve("node_modules", "svelte")
},
extensions: [".mjs", ".js", ".svelte"],
mainFields: ["svelte", "browser", "module", "main"]
},
devtool: prod
? "source-map" // For development
: "#eval-source-map",
output: {
publicPath: "/",
path: __dirname + "/dist",
filename: "[name].js",
chunkFilename: "[name].[id].js"
},
module: {
rules: [
{
test: /\.js$/,
exclude: /(node_modules)/,
use: {
loader: "babel-loader"
}
},
{
test: /\.s?css$/,
use: [
/**
* MiniCssExtractPlugin doesn't support HMR.
* For developing, use 'style-loader' instead.
* */
prod ? MiniCssExtractPlugin.loader : "style-loader",
"css-loader",
{
loader: "sass-loader",
options: {
sassOptions: {
includePaths: ["./theme", "./node_modules"]
}
}
}
]
},
{
test: /\.svelte$/,
use: {
loader: "svelte-loader",
options: {
emitCss: true,
hotReload: true
}
}
}
]
},
plugins: [
new webpack.ProgressPlugin(),
new webpack.EnvironmentPlugin({
NODE_ENV: mode,
DEBUG: !prod
}),
new CleanWebpackPlugin(),
new HtmlWebpackPlugin({
title: packageJSON.name,
hash: true,
filename: "./index.html", //relative to root of the application
template: "./src/index.ejs",
favicon: "assets/favicon.png"
}),
new MiniCssExtractPlugin({
filename: "[name].css"
})
],
...envOverride
};
================================================
FILE: wg-go-ui.sh
================================================
#!/bin/sh
set -eux
# need `SYS_ADMIN` and `NET_ADMIN` capabilities.
mkdir -p /dev/net
TUNFILE=/dev/net/tun
[ ! -c $TUNFILE ] && mknod $TUNFILE c 10 200
# Start the first process
./wireguard-go ${WIREGUARD_UI_WG_DEVICE_NAME:-wg0}
status=$?
if [ $status -ne 0 ]; then
echo "Failed to start wireguard-go: $status"
exit $status
fi
# Start the second process
./wireguard-ui $@
status=$?
if [ $status -ne 0 ]; then
echo "Failed to start wireguard-ui: $status"
exit $status
fi
# Naive check runs checks once a minute to see if either of the processes exited.
# This illustrates part of the heavy lifting you need to do if you want to run
# more than one service in a container. The container exits with an error
# if it detects that either of the processes has exited.
# Otherwise it loops forever, waking up every 60 seconds
while sleep 60; do
ps aux |grep wireguard-go |grep -q -v grep
PROCESS_1_STATUS=$?
ps aux |grep wireguard-ui |grep -q -v grep
PROCESS_2_STATUS=$?
# If the greps above find anything, they exit with 0 status
# If they are not both 0, then something is wrong
if [ $PROCESS_1_STATUS -ne 0 -o $PROCESS_2_STATUS -ne 0 ]; then
echo "One of the processes has already exited."
exit 1
fi
done
gitextract_yyoo015_/ ├── .github/ │ ├── CODEOWNERS │ ├── ISSUE_TEMPLATE/ │ │ ├── bug_report.md │ │ └── feature_request.md │ └── workflows/ │ ├── pull_request.yaml │ ├── push_master.yaml │ └── release.yaml ├── .gitignore ├── CHANGELOG.md ├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── Dockerfile ├── Dockerfile.debug ├── LICENSE-APACHE ├── LICENSE-MIT ├── Makefile ├── README.md ├── UserSpace.Dockerfile ├── config.go ├── doc/ │ ├── auth-google-sso.md │ └── auth-shibboleth-sso.md ├── docker-compose.userspace.yml ├── docker-compose.yml ├── go.mod ├── go.sum ├── main.go ├── server.go ├── ui/ │ ├── .babelrc │ ├── .gitignore │ ├── .prettierrc │ ├── jest.config.js │ ├── package.json │ ├── src/ │ │ ├── About.svelte │ │ ├── App.svelte │ │ ├── Client.svelte │ │ ├── Clients.svelte │ │ ├── EditClient.svelte │ │ ├── Nav.svelte │ │ ├── NavLink.svelte │ │ ├── NewClient.svelte │ │ ├── index.ejs │ │ ├── index.js │ │ ├── main.js │ │ └── style.scss │ ├── theme/ │ │ └── _smui-theme.scss │ └── webpack.config.js └── wg-go-ui.sh
SYMBOL INDEX (35 symbols across 3 files)
FILE: config.go
type ServerConfig (line 16) | type ServerConfig struct
method Write (line 107) | func (cfg *ServerConfig) Write() error {
method GetUserConfig (line 116) | func (cfg *ServerConfig) GetUserConfig(user string) *UserConfig {
type UserConfig (line 24) | type UserConfig struct
type ClientConfig (line 30) | type ClientConfig struct
type NewClient (line 44) | type NewClient struct
function NewServerConfig (line 50) | func NewServerConfig(cfgPath string) *ServerConfig {
function NewClientConfig (line 130) | func NewClientConfig(Name string, ip net.IP, mtu int, Notes string, gene...
FILE: main.go
function main (line 15) | func main() {
FILE: server.go
constant wgDefaultMtu (line 37) | wgDefaultMtu = 1420
type contextKey (line 66) | type contextKey
constant key (line 68) | key = contextKey("user")
type Server (line 71) | type Server struct
method enableIPForward (line 141) | func (s *Server) enableIPForward() error {
method initInterface (line 157) | func (s *Server) initInterface() error {
method allocateIP (line 253) | func (s *Server) allocateIP() net.IP {
method reconfigure (line 280) | func (s *Server) reconfigure() {
method configureWireGuard (line 294) | func (s *Server) configureWireGuard() error {
method Start (line 399) | func (s *Server) Start() error {
method basicAuth (line 450) | func (s *Server) basicAuth(handler http.Handler) http.Handler {
method userFromHeader (line 468) | func (s *Server) userFromHeader(handler http.Handler) http.Handler {
method withAuth (line 503) | func (s *Server) withAuth(handler httprouter.Handle) httprouter.Handle {
method WhoAmI (line 525) | func (s *Server) WhoAmI(w http.ResponseWriter, r *http.Request, ps htt...
method GetClients (line 536) | func (s *Server) GetClients(w http.ResponseWriter, r *http.Request, ps...
method Index (line 555) | func (s *Server) Index(w http.ResponseWriter, r *http.Request, _ httpr...
method GetClient (line 562) | func (s *Server) GetClient(w http.ResponseWriter, r *http.Request, ps ...
method EditClient (line 647) | func (s *Server) EditClient(w http.ResponseWriter, r *http.Request, ps...
method DeleteClient (line 703) | func (s *Server) DeleteClient(w http.ResponseWriter, r *http.Request, ...
method CreateClient (line 728) | func (s *Server) CreateClient(w http.ResponseWriter, r *http.Request, ...
type wgLink (line 80) | type wgLink struct
method Attrs (line 84) | func (w *wgLink) Attrs() *netlink.LinkAttrs {
method Type (line 88) | func (w *wgLink) Type() string {
function ifname (line 92) | func ifname(n string) []byte {
function NewServer (line 102) | func NewServer() *Server {
function verifyLinkMTU (line 391) | func verifyLinkMTU(mtu int) error {
Condensed preview — 46 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (135K chars).
[
{
"path": ".github/CODEOWNERS",
"chars": 9,
"preview": "* @suom1\n"
},
{
"path": ".github/ISSUE_TEMPLATE/bug_report.md",
"chars": 621,
"preview": "---\nname: Bug report\nabout: Create a report to help us improve\ntitle: ''\nlabels: bug\nassignees: ''\n\n---\n\n**Describe the "
},
{
"path": ".github/ISSUE_TEMPLATE/feature_request.md",
"chars": 604,
"preview": "---\nname: Feature request\nabout: Suggest an idea for this project\ntitle: ''\nlabels: enhancement\nassignees: ''\n\n---\n\n**Is"
},
{
"path": ".github/workflows/pull_request.yaml",
"chars": 1570,
"preview": "name: PR\non:\n push:\n branches-ignore: main\n pull_request:\n branches:\n - main\n\njobs:\n review:\n name: Cod"
},
{
"path": ".github/workflows/push_master.yaml",
"chars": 2979,
"preview": "name: Main\n\non:\n push:\n branches:\n - main\n\njobs:\n docker-build:\n name: Docker Main\n runs-on: ubuntu-late"
},
{
"path": ".github/workflows/release.yaml",
"chars": 3893,
"preview": "name: Release\n\non:\n push:\n branches:\n - main\n tags:\n - v*\n\njobs:\n release-docker:\n name: Docker\n "
},
{
"path": ".gitignore",
"chars": 83,
"preview": ".DS_Store\n/wireguard-ui\n/bindata.go\nui/public/bundle.*\nnode_modules\nbin\n.idea\ndist\n"
},
{
"path": "CHANGELOG.md",
"chars": 4078,
"preview": "# Changelog\nAll notable changes to this project will be documented in this file.\n\n<!-- next-header -->\n## [Unreleased]\n\n"
},
{
"path": "CODE_OF_CONDUCT.md",
"chars": 3361,
"preview": "# Contributor Covenant Code of Conduct\n\n## Our Pledge\n\nIn the interest of fostering an open and welcoming environment, w"
},
{
"path": "CONTRIBUTING.md",
"chars": 3331,
"preview": "# Embark Contributor Guidelines\n\nWelcome! This project is created by the team at [Embark Studios](https://embark.games)."
},
{
"path": "Dockerfile",
"chars": 390,
"preview": "FROM docker.io/node:12 AS ui\nWORKDIR /ui\nCOPY ui/package.json ui/package-lock.json /ui/\nRUN npm install\nCOPY ui .\nRUN np"
},
{
"path": "Dockerfile.debug",
"chars": 505,
"preview": "FROM embarkstudios/wireguard-ui AS latest\n\nFROM ubuntu:20.04\nRUN apt-get update -y && \\\n apt-get install -y software-"
},
{
"path": "LICENSE-APACHE",
"chars": 10850,
"preview": " Apache License\n Version 2.0, January 2004\n http"
},
{
"path": "LICENSE-MIT",
"chars": 1058,
"preview": "Copyright (c) 2019 Embark Studios\n\nPermission is hereby granted, free of charge, to any\nperson obtaining a copy of this "
},
{
"path": "Makefile",
"chars": 1009,
"preview": "# Parameters\nGOCMD=go\nGOBUILD=$(GOCMD) build\nGOCLEAN=$(GOCMD) clean\nGOGET=$(GOCMD) get\nBINARY_NAME=wireguard-ui\n\n.PHONY:"
},
{
"path": "README.md",
"chars": 5131,
"preview": "# WG UI\n\n[![Embark]("
},
{
"path": "UserSpace.Dockerfile",
"chars": 684,
"preview": "FROM docker.io/node:12 AS ui\nWORKDIR /ui\nCOPY ui/package.json ui/package-lock.json /ui/\nRUN npm install\nCOPY ui .\nRUN np"
},
{
"path": "config.go",
"chars": 3577,
"preview": "package main\n\nimport (\n\t\"encoding/json\"\n\t\"io/ioutil\"\n\t\"net\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"time\"\n\n\tlog \"github.com/sirupsen/lo"
},
{
"path": "doc/auth-google-sso.md",
"chars": 3791,
"preview": "# Google SSO Implementation\n\nThis is a short documentation on how you can setup wg-ui and Google OAuth. \n\nThere are a fe"
},
{
"path": "doc/auth-shibboleth-sso.md",
"chars": 2239,
"preview": "# Shibboleth SP Implementation\n\nThis is a short documentation on how you can setup wg-ui with Shibboleth SP (and apache)"
},
{
"path": "docker-compose.userspace.yml",
"chars": 589,
"preview": "version: \"3.7\"\n\nservices:\n app:\n image: embarkstudios/wireguard-ui:userspace\n privileged: true\n network_mode: "
},
{
"path": "docker-compose.yml",
"chars": 618,
"preview": "version: \"3.7\"\n\nservices:\n app:\n image: embarkstudios/wireguard-ui:latest\n entrypoint: \"/wireguard-ui\"\n privil"
},
{
"path": "go.mod",
"chars": 1686,
"preview": "module github.com/embarkstudios/wireguard-ui\n\ngo 1.17\n\nrequire (\n\tgithub.com/fujiwara/go-amzn-oidc v0.0.2\n\tgithub.com/go"
},
{
"path": "go.sum",
"chars": 22602,
"preview": "github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=\ngithub"
},
{
"path": "main.go",
"chars": 1270,
"preview": "package main\n\nimport (\n\t\"strings\"\n\n\tlog \"github.com/sirupsen/logrus\"\n\t\"golang.org/x/crypto/bcrypt\"\n\t\"gopkg.in/alecthomas"
},
{
"path": "server.go",
"chars": 20857,
"preview": "package main\n\nimport (\n\t\"context\"\n\t\"embed\"\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"io/fs\"\n\t\"io/ioutil\"\n\t\"net\"\n\t\"net/http\"\n\t\"net/http/h"
},
{
"path": "ui/.babelrc",
"chars": 110,
"preview": "{\n \"presets\": [\n [\"@babel/preset-env\", {\n \"targets\": {\n \"node\": \"current\"\n }\n }]\n ]\n}"
},
{
"path": "ui/.gitignore",
"chars": 19,
"preview": "node_modules\n.idea\n"
},
{
"path": "ui/.prettierrc",
"chars": 184,
"preview": "{\n \"singleQuote\": false,\n \"printWidth\": 120,\n \"useTabs\": false,\n \"tabWidth\": 4,\n \"jsxBracketSameLine\": true,\n \"sem"
},
{
"path": "ui/jest.config.js",
"chars": 6518,
"preview": "// For a detailed explanation regarding each configuration property, visit:\n// https://jestjs.io/docs/en/configuration.h"
},
{
"path": "ui/package.json",
"chars": 1949,
"preview": "{\n \"name\": \"wireguard-ui\",\n \"version\": \"1.0.0\",\n \"description\": \"WireGuard VPN web UI\",\n \"main\": \"index.js\","
},
{
"path": "ui/src/About.svelte",
"chars": 433,
"preview": "<h1>About</h1>\n\n<p>\nWG UI is an <a href=\"https://www.embark-studios.com/\">Embark Studios</a> Open Source project.\n</p>\n\n"
},
{
"path": "ui/src/App.svelte",
"chars": 1387,
"preview": "<svelte:head>\n <title>WireGuard VPN</title>\n</svelte:head>\n\n<script>\n import { onMount } from 'svelte';\n import { Rou"
},
{
"path": "ui/src/Client.svelte",
"chars": 1559,
"preview": "<script>\n import Button, {Group, GroupItem, Label} from '@smui/button';\n import IconButton, {Icon} from '@smui/icon-bu"
},
{
"path": "ui/src/Clients.svelte",
"chars": 1655,
"preview": "<script>\n import Fab, {Label, Icon} from '@smui/fab';\n import { onMount } from 'svelte';\n import Client from './Clien"
},
{
"path": "ui/src/EditClient.svelte",
"chars": 5816,
"preview": "<script>\n import Fab, {Label, Icon} from '@smui/fab';\n import Dialog, {Actions, InitialFocus} from '@smui/dialog';\n i"
},
{
"path": "ui/src/Nav.svelte",
"chars": 630,
"preview": "<script>\n import TopAppBar, {Row, Section, Title} from \"@smui/top-app-bar\";\n import { Router, Link, Route } from \"svel"
},
{
"path": "ui/src/NavLink.svelte",
"chars": 480,
"preview": "<script>\n import { Link } from \"svelte-routing\";\n export let to = \"\";\n\n function getProps({ location, href, isPartial"
},
{
"path": "ui/src/NewClient.svelte",
"chars": 2822,
"preview": "<script>\n import Fab, {Label, Icon} from '@smui/fab';\n import Dialog, {Actions, InitialFocus} from '@smui/dialog';\n i"
},
{
"path": "ui/src/index.ejs",
"chars": 615,
"preview": "<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"UTF-8\">\n <meta name=\"viewport\"\n content=\"width=device-width"
},
{
"path": "ui/src/index.js",
"chars": 179,
"preview": "import \"./style.scss\";\nimport App from \"./App.svelte\";\n\nconst app = new App({\n target: document.body,\n props: {\n "
},
{
"path": "ui/src/main.js",
"chars": 93,
"preview": "import App from './App.svelte';\n\nnew App({\n target: document.body,\n // hydrate: true,\n});\n\n"
},
{
"path": "ui/src/style.scss",
"chars": 354,
"preview": "@import \"@material/typography/mdc-typography\";\n\n.container {\n padding: 30px;\n}\n\nbody {\n margin: 0;\n padding: 0;\n}\n\n.f"
},
{
"path": "ui/theme/_smui-theme.scss",
"chars": 44,
"preview": "// Nothing here. Just use the default theme."
},
{
"path": "ui/webpack.config.js",
"chars": 2957,
"preview": "const {CleanWebpackPlugin} = require(\"clean-webpack-plugin\");\nconst HtmlWebpackPlugin = require(\"html-webpack-plugin\");\n"
},
{
"path": "wg-go-ui.sh",
"chars": 1239,
"preview": "#!/bin/sh\n\nset -eux\n\n# need `SYS_ADMIN` and `NET_ADMIN` capabilities.\nmkdir -p /dev/net\nTUNFILE=/dev/net/tun\n[ ! -c $TUN"
}
]
About this extraction
This page contains the full source code of the EmbarkStudios/wireguard-ui GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 46 files (123.5 KB), approximately 41.0k tokens, and a symbol index with 35 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.