[ { "path": ".github/CODEOWNERS", "content": "* @suom1\n" }, { "path": ".github/ISSUE_TEMPLATE/bug_report.md", "content": "---\nname: Bug report\nabout: Create a report to help us improve\ntitle: ''\nlabels: bug\nassignees: ''\n\n---\n\n**Describe the bug**\nA clear and concise description of what the bug is.\n\n**To Reproduce**\nSteps to reproduce the behavior:\n1. Go to '...'\n2. Click on '....'\n3. Scroll down to '....'\n4. See error\n\n**Expected behavior**\nA clear and concise description of what you expected to happen.\n\n**Screenshots**\nIf applicable, add screenshots to help explain your problem.\n\n**Device:**\n - OS: [e.g. iOS]\n - Browser [e.g. chrome, safari]\n - Version [e.g. 22]\n\n**Additional context**\nAdd any other context about the problem here.\n" }, { "path": ".github/ISSUE_TEMPLATE/feature_request.md", "content": "---\nname: Feature request\nabout: Suggest an idea for this project\ntitle: ''\nlabels: enhancement\nassignees: ''\n\n---\n\n**Is your feature request related to a problem? Please describe.**\nA clear and concise description of what the problem is. Ex. I'm always frustrated when [...]\n\n**Describe the solution you'd like**\nA clear and concise description of what you want to happen.\n\n**Describe alternatives you've considered**\nA clear and concise description of any alternative solutions or features you've considered.\n\n**Additional context**\nAdd any other context or screenshots about the feature request here.\n" }, { "path": ".github/workflows/pull_request.yaml", "content": "name: PR\non:\n push:\n branches-ignore: main\n pull_request:\n branches:\n - main\n\njobs:\n review:\n name: Code Review\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n - uses: actions/setup-node@v2\n with:\n node-version: '14'\n - uses: actions/setup-go@v2\n with:\n go-version: '1.17'\n\n - name: npm install and build\n run: |\n npm install --prefix ui\n npm run --prefix ui build\n\n - name: Check styling error\n run: go install golang.org/x/lint/golint@latest; golint -set_exit_status main.go server.go config.go\n\n - name: Check missing error check\n run: go install github.com/kisielk/errcheck@latest; errcheck ./...\n\n - name: Check suspicious constructs (1)\n run: go install honnef.co/go/tools/cmd/staticcheck@latest; staticcheck -checks all,-ST1003,-U1000,-ST1005,-SA9002 ./... # have to disable ST1003,U1000,ST1005 due to the generated code\n\n - name: Check suspicious constructs (2)\n run: go vet ./...\n\n - name: Check security issues with gosec\n run: go install github.com/securego/gosec/cmd/gosec@latest; gosec ./... # https://github.com/securego/gosec\n\n build:\n name: Build wg-ui\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n - uses: actions/setup-node@v2\n with:\n node-version: '14'\n - uses: actions/setup-go@v2\n with:\n go-version: '1.17'\n\n - name: Build binary\n run: make build\n\n - name: Check binary\n run: file bin/wireguard-ui\n\n - name: Cleanup\n run: rm -rf bin/\n" }, { "path": ".github/workflows/push_master.yaml", "content": "name: Main\n\non:\n push:\n branches:\n - main\n\njobs:\n docker-build:\n name: Docker Main\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n - uses: docker/setup-qemu-action@v1\n - uses: docker/setup-buildx-action@v1\n - uses: docker/login-action@v1\n with:\n username: ${{ secrets.DOCKER_USERNAME }}\n password: ${{ secrets.DOCKER_PASSWORD }}\n - uses: actions/cache@v2\n with:\n path: /tmp/.buildx-cache\n key: ${{ runner.os }}-buildx-${{ github.sha }}\n restore-keys: |\n ${{ runner.os }}-buildx-\n\n - name: Build and push\n uses: docker/build-push-action@v2\n with:\n context: .\n file: ./Dockerfile\n platforms: linux/amd64,linux/arm64,linux/arm/v7\n push: true\n tags: embarkstudios/wireguard-ui:latest\n cache-from: type=local,src=/tmp/.buildx-cache\n cache-to: type=local,dest=/tmp/.buildx-cache\n\n docker-userspace:\n name: Docker UserSpace\n runs-on: ubuntu-latest\n needs: docker-build\n steps:\n - uses: actions/checkout@v2\n - uses: docker/setup-qemu-action@v1\n - uses: docker/setup-buildx-action@v1\n - uses: docker/login-action@v1\n with:\n username: ${{ secrets.DOCKER_USERNAME }}\n password: ${{ secrets.DOCKER_PASSWORD }}\n - uses: actions/cache@v2\n with:\n path: /tmp/.buildx-cache-userspace\n key: ${{ runner.os }}-buildx-${{ github.sha }}\n restore-keys: |\n ${{ runner.os }}-buildx-\n\n - name: Build and push\n uses: docker/build-push-action@v2\n with:\n context: .\n file: ./UserSpace.Dockerfile\n platforms: linux/amd64,linux/arm64,linux/arm/v7\n push: true\n tags: embarkstudios/wireguard-ui:userspace\n cache-from: type=local,src=/tmp/.buildx-cache-userspace\n cache-to: type=local,dest=/tmp/.buildx-cache-userspace\n\n docker-debug:\n name: Docker Debug\n runs-on: ubuntu-latest\n needs: [docker-build, docker-userspace]\n steps:\n - uses: actions/checkout@v2\n - uses: docker/setup-qemu-action@v1\n - uses: docker/setup-buildx-action@v1\n - uses: docker/login-action@v1\n with:\n username: ${{ secrets.DOCKER_USERNAME }}\n password: ${{ secrets.DOCKER_PASSWORD }}\n - uses: actions/cache@v2\n with:\n path: /tmp/.buildx-cache-debug\n key: ${{ runner.os }}-buildx-${{ github.sha }}\n restore-keys: |\n ${{ runner.os }}-buildx-\n\n - name: Build and push\n uses: docker/build-push-action@v2\n with:\n context: .\n file: ./Dockerfile.debug\n platforms: linux/amd64,linux/arm64,linux/arm/v7\n push: true\n tags: embarkstudios/wireguard-ui:debug\n cache-from: type=local,src=/tmp/.buildx-cache-debug\n cache-to: type=local,dest=/tmp/.buildx-cache-debug\n" }, { "path": ".github/workflows/release.yaml", "content": "name: Release\n\non:\n push:\n branches:\n - main\n tags:\n - v*\n\njobs:\n release-docker:\n name: Docker\n if: startsWith(github.ref, 'refs/tags/')\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n - uses: docker/setup-qemu-action@v1\n - uses: docker/setup-buildx-action@v1\n - uses: docker/login-action@v1\n with:\n username: ${{ secrets.DOCKER_USERNAME }}\n password: ${{ secrets.DOCKER_PASSWORD }}\n\n - name: Set environment variable for version tag\n run: echo \"WG-UI-VERSION=${GITHUB_REF#refs/tags/v}\" >> $GITHUB_ENV\n\n - name: Build and push\n uses: docker/build-push-action@v2\n with:\n context: .\n file: ./Dockerfile\n platforms: linux/amd64,linux/arm64,linux/arm/v7\n push: true\n tags: embarkstudios/wireguard-ui:${{ env.WG-UI-VERSION }}\n\n - name: Clear\n if: always()\n run: |\n rm -f ${HOME}/.docker/config.json\n\n release-binary:\n name: Binary\n if: startsWith(github.ref, 'refs/tags/')\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n - uses: actions/setup-node@v2\n with:\n node-verison: '14'\n - uses: actions/setup-go@v2\n with:\n go-version: '1.17'\n\n - name: Build UI\n run: |\n make ui\n\n - name: Build wg-ui for Linux (AMD64)\n run: |\n name=wg-ui\n target=linux-amd64\n release_name=\"$name-${GITHUB_REF#refs/tags/v}-$target\"\n release_tar=\"$release_name.tar.gz\"\n env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o \"$release_name\"\n tar czvf \"$release_tar\" \"$release_name\"\n echo -n \"$(shasum -ba 256 \"${release_tar}\" | cut -d \" \" -f 1)\" > \"${release_tar}.sha256\"\n rm \"$release_name\"\n\n - name: Build wg-ui for Linux (ARMv5)\n run: |\n name=wg-ui\n target=linux-armv5\n release_name=\"$name-${GITHUB_REF#refs/tags/v}-$target\"\n release_tar=\"$release_name.tar.gz\"\n env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 go build -o \"$release_name\"\n tar czvf \"$release_tar\" \"$release_name\"\n echo -n \"$(shasum -ba 256 \"${release_tar}\" | cut -d \" \" -f 1)\" > \"${release_tar}.sha256\"\n rm \"$release_name\"\n\n - name: Build wg-ui for Linux (ARMv6)\n run: |\n name=wg-ui\n target=linux-armv6\n release_name=\"$name-${GITHUB_REF#refs/tags/v}-$target\"\n release_tar=\"$release_name.tar.gz\"\n env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -o \"$release_name\"\n tar czvf \"$release_tar\" \"$release_name\"\n echo -n \"$(shasum -ba 256 \"${release_tar}\" | cut -d \" \" -f 1)\" > \"${release_tar}.sha256\"\n rm \"$release_name\"\n\n - name: Build wg-ui for Linux (ARMv7)\n run: |\n name=wg-ui\n target=linux-armv7\n release_name=\"$name-${GITHUB_REF#refs/tags/v}-$target\"\n release_tar=\"$release_name.tar.gz\"\n env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -o \"$release_name\"\n tar czvf \"$release_tar\" \"$release_name\"\n echo -n \"$(shasum -ba 256 \"${release_tar}\" | cut -d \" \" -f 1)\" > \"${release_tar}.sha256\"\n rm \"$release_name\"\n\n - name: Build wg-ui for Linux (ARM64)\n run: |\n name=wg-ui\n target=linux-arm64\n release_name=\"$name-${GITHUB_REF#refs/tags/v}-$target\"\n release_tar=\"$release_name.tar.gz\"\n env CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -o \"$release_name\"\n tar czvf \"$release_tar\" \"$release_name\"\n echo -n \"$(shasum -ba 256 \"${release_tar}\" | cut -d \" \" -f 1)\" > \"${release_tar}.sha256\"\n rm \"$release_name\"\n\n - name: List content\n run: |\n ls -lah wg-ui*\n\n - name: GitHub Release\n uses: softprops/action-gh-release@v1\n env:\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n with:\n draft: true\n files: \"wg-ui-*\"\n" }, { "path": ".gitignore", "content": ".DS_Store\n/wireguard-ui\n/bindata.go\nui/public/bundle.*\nnode_modules\nbin\n.idea\ndist\n" }, { "path": "CHANGELOG.md", "content": "# Changelog\nAll notable changes to this project will be documented in this file.\n\n\n## [Unreleased]\n\n## [v1.3.1] - 2023-02-23\n### Fixes\n- [PR#179](https://github.com/EmbarkStudios/wg-ui/pull/179) Add locks to all functions touching the config\n### Changes\n- [PR#163](https://github.com/EmbarkStudios/wg-ui/pull/163) Add support for user/pass authentication. Thanks to [@snowzach](https://github.com/snowzach)!\n- [PR#149](https://github.com/EmbarkStudios/wg-ui/pull/149) Revert name back to wireguard-ui\n- [PR#148](https://github.com/EmbarkStudios/wg-ui/pull/148) Update dependencies and golang to 1.17\n\n## [v1.3.0] - 2021-09-07\n### Added\n- [PR#141](https://github.com/EmbarkStudios/wg-ui/pull/141) Added support for additional allowed IPs. Thanks to [@gertdreyer](https://github.com/gertdreyer)!\n- [PR#140](https://github.com/EmbarkStudios/wg-ui/pull/140) Optional generation Preshared Key when creating a new client. Thanks to [@gertdreyer](https://github.com/gertdreyer)!\n\n\n## [v1.2.1] - 2021-07-27\n### Fixes\n- [PR#139](https://github.com/EmbarkStudios/wg-ui/pull/139) Fix for versioned docker releases.\n\n## [v1.2.0] - 2021-07-26\n### Added\n- [PR#113](https://github.com/EmbarkStudios/wg-ui/pull/113) Adding AWS ALB-specific header for username. Thanks to [@justnom](https://github.com/justnom)!\n- [PR#86](https://github.com/EmbarkStudios/wg-ui/pull/86) User sapce image for Docker. Thanks to [@m0ssc0de](https://github.com/m0ssc0de)!\n- [PR#80](https://github.com/EmbarkStudios/wg-ui/pull/80) Shibboleth SP documentation. Thanks to [@theseal](https://github.com/theseal)!\n- [PR#79](https://github.com/EmbarkStudios/wg-ui/pull/79) Google SSO documentation.\n\n### Fixes\n- [PR#136](https://github.com/EmbarkStudios/wg-ui/pull/136) Prevent full reload of wireguard interface. Thanks to [@gertdreyer](https://github.com/gertdreyer)!\n- [PR#135](https://github.com/EmbarkStudios/wg-ui/pull/135) Remove external dependencies for embedding assets. Thanks to [@thomasf](https://github.com/thomasf)!\n- [PR#114](https://github.com/EmbarkStudios/wg-ui/pull/114) Add docker-compose example. Thanks to [@ilyazzz](https://github.com/ilyazzz)!\n- [PR#70](https://github.com/EmbarkStudios/wg-ui/pull/70) Disable CGO. Thanks to [@condemil](https://github.com/condemil)!\n\n## [v1.1.0] - 2020-05-06\n### Added \n- [PR#49](https://github.com/EmbarkStudios/wg-ui/pull/49) Set name and label at creation of client. Thanks to [@spetzreborn](https://github.com/spetzreborn)!\n- [PR#47](https://github.com/EmbarkStudios/wg-ui/pull/47) Add limit in how many configurations each user may have. Thanks to [@spetzreborn](https://github.com/spetzreborn)!\n- [PR#44](https://github.com/EmbarkStudios/wg-ui/pull/44) Add timestamp to config. Thanks to [@spetzreborn](https://github.com/spetzreborn)!\n- [PR#41](https://github.com/EmbarkStudios/wg-ui/pull/41) Add `--no-nat` flag to disable NAT, NAT remains on by default.\n\n### Fixed\n- [PR#57](https://github.com/EmbarkStudios/wg-ui/pull/57) Fix gosec issues. Thanks to [@Sohalt](https://github.com/Sohalt)!\n- [PR#50](https://github.com/EmbarkStudios/wg-ui/pull/50) Update documentation for configuration. Thanks to [@Sohalt](https://github.com/Sohalt)!\n- [PR#35](https://github.com/EmbarkStudios/wg-ui/pull/35) Avoid \"async race\" with new client POST. Thanks to [@sclem](https://github.com/sclem)!\n- [PR#31](https://github.com/EmbarkStudios/wg-ui/pull/31) Only enable IP forwarding if it is disabled. Thanks to [@eest](https://github.com/eest)!\n\n### Changed\n- Name of project changed from `wireguard-ui` to `wg-ui`\n\n## [v1.0.0] - 2019-10-12\n### Added\n- This is the initial release of wireguard-ui\n\n\n[Unreleased]: https://github.com/EmbarkStudios/wg-ui/compare/v1.3.0...HEAD\n[v1.3.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.2.1...v1.3.0\n[v1.2.1]: https://github.com/EmbarkStudios/wg-ui/compare/v1.2.0...v1.2.1\n[v1.2.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.1.0...v1.2.0\n[v1.1.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.0.0...v1.1.0\n[v1.0.0]: https://github.com/EmbarkStudios/wg-ui/releases/tag/v1.0.0\n" }, { "path": "CODE_OF_CONDUCT.md", "content": "# Contributor Covenant Code of Conduct\n\n## Our Pledge\n\nIn the interest of fostering an open and welcoming environment, we as\ncontributors and maintainers pledge to making participation in our project and\nour community a harassment-free experience for everyone, regardless of age, body\nsize, disability, ethnicity, sex characteristics, gender identity and expression,\nlevel of experience, education, socio-economic status, nationality, personal\nappearance, race, religion, or sexual identity and orientation.\n\n## Our Standards\n\nExamples of behavior that contributes to creating a positive environment\ninclude:\n\n* Using welcoming and inclusive language\n* Being respectful of differing viewpoints and experiences\n* Gracefully accepting constructive criticism\n* Focusing on what is best for the community\n* Showing empathy towards other community members\n\nExamples of unacceptable behavior by participants include:\n\n* The use of sexualized language or imagery and unwelcome sexual attention or\n advances\n* Trolling, insulting/derogatory comments, and personal or political attacks\n* Public or private harassment\n* Publishing others' private information, such as a physical or electronic\n address, without explicit permission\n* Other conduct which could reasonably be considered inappropriate in a\n professional setting\n\n## Our Responsibilities\n\nProject maintainers are responsible for clarifying the standards of acceptable\nbehavior and are expected to take appropriate and fair corrective action in\nresponse to any instances of unacceptable behavior.\n\nProject maintainers have the right and responsibility to remove, edit, or\nreject comments, commits, code, wiki edits, issues, and other contributions\nthat are not aligned to this Code of Conduct, or to ban temporarily or\npermanently any contributor for other behaviors that they deem inappropriate,\nthreatening, offensive, or harmful.\n\n## Scope\n\nThis Code of Conduct applies both within project spaces and in public spaces\nwhen an individual is representing the project or its community. Examples of\nrepresenting a project or community include using an official project e-mail\naddress, posting via an official social media account, or acting as an appointed\nrepresentative at an online or offline event. Representation of a project may be\nfurther defined and clarified by project maintainers.\n\n## Enforcement\n\nInstances of abusive, harassing, or otherwise unacceptable behavior may be\nreported by contacting the project team at opensource@embark-studios.com. All\ncomplaints will be reviewed and investigated and will result in a response that\nis deemed necessary and appropriate to the circumstances. The project team is\nobligated to maintain confidentiality with regard to the reporter of an incident.\nFurther details of specific enforcement policies may be posted separately.\n\nProject maintainers who do not follow or enforce the Code of Conduct in good\nfaith may face temporary or permanent repercussions as determined by other\nmembers of the project's leadership.\n\n## Attribution\n\nThis Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,\navailable at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html\n\n[homepage]: https://www.contributor-covenant.org\n\nFor answers to common questions about this code of conduct, see\nhttps://www.contributor-covenant.org/faq\n" }, { "path": "CONTRIBUTING.md", "content": "# Embark Contributor Guidelines\n\nWelcome! This project is created by the team at [Embark Studios](https://embark.games). We're glad you're interested in contributing! We welcome contributions from people of all backgrounds who are interested in making great software with us.\n\nAt Embark, we aspire to empower everyone to create interactive experiences. To do this, we're exploring and pushing the boundaries of new technologies, and sharing our learnings with the open source community.\n\nIf you have ideas for collaboration, email us at opensource@embark-studios.com.\n\nWe're also hiring full-time engineers to work with us in Stockholm! Check out our current job postings [here](https://embark.games/careers).\n\n## Issues\n\n### Feature Requests\n\nIf you have ideas or how to improve our projects, you can suggest features by opening a GitHub issue. Make sure to include details about the feature or change, and describe any uses cases it would enable.\n\nFeature requests will be tagged as `enhancement` and their status will be updated in the comments of the issue.\n\n### Bugs\n\nWhen reporting a bug or unexpected behaviour in a project, make sure your issue descibes steps to reproduce the behaviour, including the platform you were using, what steps you took, and any error messages.\n\nReproducible bugs will be tagged as `bug` and their status will be updated in the comments of the issue.\n\n### Wontfix\n\nIssues will be closed and tagged as `wontfix` if we decide that we do not wish to implement it, usually due to being misaligned with the project vision or out of scope. We will comment on the issue with more detailed reasoning.\n\n## Contribution Workflow\n\n### Open Issues\n\nIf you're ready to contribute, start by looking at our open issues tagged as [`help wanted`](../../issues?q=is%3Aopen+is%3Aissue+label%3A\"help+wanted\") or [`good first issue`](../../issues?q=is%3Aopen+is%3Aissue+label%3A\"good+first+issue\").\n\nYou can comment on the issue to let others know you're interested in working on it or to ask questions.\n\n### Making Changes\n\n1. Fork the repository.\n\n2. Create a new feature branch.\n\n3. Make your changes. Ensure that there are no build errors by running the project with your changes locally.\n\n4. Open a pull request with a name and description of what you did. You can read more about working with pull requests on GitHub [here](https://help.github.com/en/articles/creating-a-pull-request-from-a-fork).\n\n5. A maintainer will review your pull request and may ask you to make changes.\n\n## Code Guidelines\n\n### Rust\n\nYou can read about our standards and recommendations for working with Rust [here](https://github.com/EmbarkStudios/rust-ecosystem/blob/master/guidelines.md).\n\n### Python\n\nWe recommend following [PEP8 conventions](https://www.python.org/dev/peps/pep-0008/) when working with Python modules.\n\n## Licensing\n\nUnless otherwise specified, all Embark open source projects are licensed under a dual MIT OR Apache-2.0 license, allowing licensees to chose either at their option. You can read more in each project's respective README.\n\n## Code of Conduct\n\nPlease note that our projects are released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md) to ensure that they are welcoming places for everyone to contribute. By participating in any Embark open source project, you agree to abide by these terms.\n" }, { "path": "Dockerfile", "content": "FROM docker.io/node:12 AS ui\nWORKDIR /ui\nCOPY ui/package.json ui/package-lock.json /ui/\nRUN npm install\nCOPY ui .\nRUN npm run build\n\nFROM docker.io/golang:latest AS build\nWORKDIR /wg\nCOPY go.mod .\nCOPY go.sum .\nRUN go mod download\nCOPY . .\nCOPY --from=ui /ui/dist ui/dist\nRUN go install .\n\nFROM gcr.io/distroless/base\nCOPY --from=build /go/bin/wireguard-ui /\nENTRYPOINT [ \"/wireguard-ui\" ]\n" }, { "path": "Dockerfile.debug", "content": "FROM embarkstudios/wireguard-ui AS latest\n\nFROM ubuntu:20.04\nRUN apt-get update -y && \\\n apt-get install -y software-properties-common iptables curl iproute2 ifupdown iputils-ping && \\\n echo resolvconf resolvconf/linkify-resolvconf boolean false | debconf-set-selections && \\\n echo \"REPORT_ABSENT_SYMLINK=no\" >> /etc/default/resolvconf && \\\n apt-get install resolvconf\nRUN apt-get install -qy --no-install-recommends wireguard\nCOPY --from=latest /wireguard-ui /\nENTRYPOINT [ \"/wireguard-ui\" ]\n" }, { "path": "LICENSE-APACHE", "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\nEND OF TERMS AND CONDITIONS\n\nAPPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\nCopyright [yyyy] [name of copyright owner]\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n" }, { "path": "LICENSE-MIT", "content": "Copyright (c) 2019 Embark Studios\n\nPermission is hereby granted, free of charge, to any\nperson obtaining a copy of this software and associated\ndocumentation files (the \"Software\"), to deal in the\nSoftware without restriction, including without\nlimitation the rights to use, copy, modify, merge,\npublish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software\nis furnished to do so, subject to the following\nconditions:\n\nThe above copyright notice and this permission notice\nshall be included in all copies or substantial portions\nof the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\nANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\nTO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\nPARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT\nSHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR\nIN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER\nDEALINGS IN THE SOFTWARE.\n" }, { "path": "Makefile", "content": "# Parameters\nGOCMD=go\nGOBUILD=$(GOCMD) build\nGOCLEAN=$(GOCMD) clean\nGOGET=$(GOCMD) get\nBINARY_NAME=wireguard-ui\n\n.PHONY: build container ui\n\nall: build\n\nclean:\n\t$(GOCLEAN)\n\trm -rf bin\n\trm -rf ui/node_modules ui/dist\n\nui:\n\tcd ui && npm install && npm run build\n\nbuild: ui\n\tCGO_ENABLED=0 $(GOBUILD) -o bin/$(BINARY_NAME) -v\n\nbuild-amd64: ui\n CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GOBUILD) -o bin/$(BINARY_NAME)-amd64 -v\n\nbuild-armv5: ui\n\tCGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 $(GOBUILD) -o bin/$(BINARY_NAME)-armv5 -v\n\nbuild-armv6: ui\n\tCGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 $(GOBUILD) -o bin/$(BINARY_NAME)-armv6 -v\n\nbuild-armv7: ui\n\tCGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o bin/$(BINARY_NAME)-armv7 -v\n\nbuild-armv8: ui\n\tCGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GOBUILD) -o bin/$(BINARY_NAME)-armv8 -v\n\ncontainer:\n\tdocker build -t wireguard-ui .\n\nrun-dev:\n\tsudo ./bin/$(BINARY_NAME) --log-level=debug --dev-ui-server=http://localhost:5000\n\nrun-dev-ui:\n\tcd ui && npm run dev\n" }, { "path": "README.md", "content": "# WG UI\n![Build Status](https://github.com/EmbarkStudios/wg-ui/actions/workflows/push_master.yaml/badge.svg)\n[![Embark](https://img.shields.io/badge/embark-open%20source-blueviolet.svg)](https://github.com/EmbarkStudios)\n[![Contributor Covenant](https://img.shields.io/badge/contributor%20covenant-v1.4%20adopted-ff69b4.svg)](CODE_OF_CONDUCT.md)\n\nA basic, self-contained management service for [WireGuard](https://wireguard.com) with a self-serve web UI. \nCurrent stable release: [v1.3.0](https://github.com/EmbarkStudios/wg-ui/releases/tag/v1.3.0) \n\n## Features\n\n * Self-serve and web based\n * QR-Code for convenient mobile client configuration\n * Optional multi-user support behind an authenticating proxy\n * Simple authentication support\n * Zero external dependencies - just a single binary using the wireguard kernel module\n * Binary and container deployment\n\n![Screenshot](wireguard-ui.png)\n\n## Running\n\nThe easiest way to run wg-ui is using the container image. To test it, run:\n\n```docker run --rm -it --privileged --entrypoint \"/wireguard-ui\" -v /tmp/wireguard-ui:/data -p 8080:8080 embarkstudios/wireguard-ui:latest --data-dir=/data --log-level=debug```\n\nWhen running in production, we recommend using the latest release as opposed to `latest`.\n\nImportant to know is that you need to have WireGuard installed on the machine in order for this to work, as this is 'just' a UI to manage WireGuard configs. \n\n### Configuration\n\nYou can configure wg-ui using commandline flags or environment variables.\nTo see all available flags run:\n\n```\ndocker run --rm -it embarkstudios/wireguard-ui:latest -h\n./wireguard-ui -h\n```\n\nYou can alternatively specify each flag through an environment variable of the form `WIREGUARD_UI_`, where `` is replaced with the flag name transformed to `CONSTANT_CASE`, e.g.\n\n```docker run --rm -it embarkstudios/wireguard-ui:latest --log-level=debug```\n\nand\n\n```docker run --rm -it -e WIREGUARD_UI_LOG_LEVEL=debug embarkstudios/wireguard-ui:latest```\n\nare the same.\n\n### Authentication\nYou can configure basic authentication using the flags/environment variables `--auth-basic-user=` and `--auth-basic-pass=` The password is\na bcrypt hash that you can generate yourself using the docker container:\n```\n$ docker run -it embarkstudios/wireguard-ui:latest passwd mySecretPass\nINFO[0001] Password Hash: $2a$14$D2jsPnpJixC0U0lyaGUd0OatV7QGzQ08yKV.gsmITVZgNevfZXj36\n```\n\n## Docker images\n\nThere are two ways to run wg-ui today, you can run it with kernel module installed on your host which is the best way to do it if you want performance. \n\n```\ndocker pull embarkstudios/wireguard-ui:latest\n```\n\nIf you however do not have the possibility or interest in having kernel module loaded on your host, there is now a solution for that using a docker image based on wireguard-go. Keep in mind that this runs in userspace and not in kernel module. \n\n```\ndocker pull embarkstudios/wireguard-ui:userspace\n```\n\nBoth images are built for `linux/amd64`, `linux/arm64` and `linux/arm/v7`. If you would need it for any other platform you can build wg-ui binaries with help from the documentation. \n\n\n## Install without Docker\n\nYou need to have WireGuard installed on the machine running `wg-ui`.\n\nUnless you use the userspace version with docker you're required to have WireGuard installed on your host machine. \n\nA few installation guides: \n[Ubuntu 20.04 LTS](https://www.cyberciti.biz/faq/ubuntu-20-04-set-up-wireguard-vpn-server/) \n[CentOS 8](https://www.cyberciti.biz/faq/centos-8-set-up-wireguard-vpn-server/) \n[Debian 10](https://www.cyberciti.biz/faq/debian-10-set-up-wireguard-vpn-server/) \n\n### Go installation (Debian)\nInstall latest version of Go from (https://golang.org/dl/)\n\n```\nsudo tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz\n```\n\n### Setup environment\nBash: ~/.bash_profile \nZSH: ~/.zshrc\n\n```\nexport PATH=$PATH:/usr/local/go/bin:$HOME/go/bin\nexport GOPATH=$HOME/go\n```\n\n### Install LTS version of nodejs for frontend.\n\n```\nsudo apt-get install curl software-properties-common\ncurl -sL https://deb.nodesource.com/setup_12.x | sudo bash -\nsudo apt-get install nodejs\n```\n\n### Fetch wg-ui\n\n```\ngit clone https://github.com/EmbarkStudios/wg-ui.git && cd wg-ui\n```\n\n### Build binary with ui\n\n```\nmake build\n```\n\n### Crosscompiling\n\n```\nmake build-amd64\n```\n\n```\nmake build-armv5\n```\n\n```\nmake build-armv6\n```\n\n```\nmake build-armv7\n```\n\n### Build step by step\n\n```\nmake ui\nmake build\n```\n\n## Developing\n\n### Start frontend server\n```\nnpm install --prefix=ui\nnpm run --prefix=ui dev\n```\n\n### Use frontend server when running the server\n\n```\nmake build\nsudo ./bin/wireguard-ui --log-level=debug --dev-ui-server http://localhost:5000\n```\n\n## Contributing\n\nWe welcome community contributions to this project.\n\nPlease read our [Contributor Guide](CONTRIBUTING.md) for more information on how to get started.\n\n## License\nLicensed under either of\n\n* Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)\n* MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)\n\nat your option.\n" }, { "path": "UserSpace.Dockerfile", "content": "FROM docker.io/node:12 AS ui\nWORKDIR /ui\nCOPY ui/package.json ui/package-lock.json /ui/\nRUN npm install\nCOPY ui .\nRUN npm run build\n\nFROM docker.io/golang:latest AS build\nWORKDIR /wg\nCOPY go.mod .\nCOPY go.sum .\nRUN go mod download\nCOPY . .\nCOPY --from=ui /ui/dist ui/dist\nRUN go install .\n\nFROM docker.io/golang:latest AS wg_go_build\nWORKDIR /wg-go\nRUN git init\nRUN git remote add origin https://git.zx2c4.com/wireguard-go\nRUN git fetch\nRUN git checkout tags/0.0.20210424 -b build\nRUN make\n\nFROM alpine:latest\nRUN apk add libc6-compat --no-cache\nCOPY ./wg-go-ui.sh /\nCOPY --from=build /go/bin/wireguard-ui /\nCOPY --from=wg_go_build /wg-go/wireguard-go /\nENTRYPOINT [ \"/wg-go-ui.sh\" ]\n" }, { "path": "config.go", "content": "package main\n\nimport (\n\t\"encoding/json\"\n\t\"io/ioutil\"\n\t\"net\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"time\"\n\n\tlog \"github.com/sirupsen/logrus\"\n\t\"golang.zx2c4.com/wireguard/wgctrl/wgtypes\"\n)\n\n// ServerConfig contains the reference to users, keys and where on disk the config is stored\ntype ServerConfig struct {\n\tconfigPath string\n\tPrivateKey string\n\tPublicKey string\n\tUsers map[string]*UserConfig\n}\n\n// UserConfig represents a user and it's clients\ntype UserConfig struct {\n\tName string\n\tClients map[string]*ClientConfig\n}\n\n// ClientConfig represents a single client for a user\ntype ClientConfig struct {\n\tName string\n\tPrivateKey string\n\tPublicKey string\n\tPresharedKey string\n\tIP net.IP\n\tAllowedIPs []*net.IPNet\n\tMTU int\n\tNotes string\n\tCreated string\n\tModified string\n}\n\n// NewClient provides fields that should not be saved however is neccesary on creation of a new client\ntype NewClient struct {\n\tClientConfig\n\tGeneratePSK bool\n}\n\n// NewServerConfig creates and returns a reference to a new ServerConfig\nfunc NewServerConfig(cfgPath string) *ServerConfig {\n\tkey, err := wgtypes.GeneratePrivateKey()\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\n\tcfg := &ServerConfig{\n\t\tconfigPath: cfgPath,\n\t\tPrivateKey: key.String(),\n\t\tPublicKey: key.PublicKey().String(),\n\t\tUsers: make(map[string]*UserConfig),\n\t}\n\n\tf, err := os.Open(filepath.Clean(cfgPath))\n\tif err == nil {\n\t\tif err = json.NewDecoder(f).Decode(cfg); err != nil {\n\t\t\tlog.Fatal(err)\n\t\t}\n\t\tlog.Debug(\"Read server config from file: \", cfgPath)\n\t} else if os.IsNotExist(err) {\n\t\tlog.Debug(\"No config found. Creating new: \", cfgPath)\n\t\terr = cfg.Write()\n\t}\n\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\n\tconfigWriteRequired := false\n\n\t// Set default MTU if MTU is not set (migration from old config)\n\tmigrationMTU := *wgPeerMtu\n\tif err := verifyLinkMTU(migrationMTU); err != nil {\n\t\tlog.WithError(err).Warnf(\"Invalid peer MTU, migration MTU is set to %d\", wgDefaultMtu)\n\t\tmigrationMTU = wgDefaultMtu\n\t}\n\n\tfor _, user := range cfg.Users {\n\t\tfor _, client := range user.Clients {\n\t\t\tif client.MTU == 0 {\n\t\t\t\tclient.MTU = migrationMTU\n\t\t\t\tconfigWriteRequired = true\n\t\t\t}\n\t\t}\n\t}\n\n\tif configWriteRequired {\n\t\terr = cfg.Write()\n\t\tif err != nil {\n\t\t\tlog.Fatal(err)\n\t\t}\n\t}\n\n\treturn cfg\n}\n\n// Write writes the ServerConfig to the path specified in the config\nfunc (cfg *ServerConfig) Write() error {\n\tdata, err := json.MarshalIndent(cfg, \"\", \" \")\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn ioutil.WriteFile(cfg.configPath, data, 0600)\n}\n\n// GetUserConfig returns a UserConfig for a specific user\nfunc (cfg *ServerConfig) GetUserConfig(user string) *UserConfig {\n\tc, ok := cfg.Users[user]\n\tif !ok {\n\t\tlog.WithField(\"user\", user).Info(\"No such user. Creating one.\")\n\t\tc = &UserConfig{\n\t\t\tName: user,\n\t\t\tClients: make(map[string]*ClientConfig),\n\t\t}\n\t\tcfg.Users[user] = c\n\t}\n\treturn c\n}\n\n// NewClientConfig initiates a new client, returning a reference to the new config\nfunc NewClientConfig(Name string, ip net.IP, mtu int, Notes string, generatePSK bool) *ClientConfig {\n\tkey, err := wgtypes.GeneratePrivateKey()\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\n\tpsk := \"\"\n\tif generatePSK {\n\t\tpskey, err := wgtypes.GenerateKey()\n\t\tif err != nil {\n\t\t\tlog.Fatal(err)\n\t\t}\n\t\tpsk = pskey.String()\n\t}\n\n\tcfg := ClientConfig{\n\t\tName: Name,\n\t\tPrivateKey: key.String(),\n\t\tPublicKey: key.PublicKey().String(),\n\t\tIP: ip,\n\t\tMTU: mtu,\n\t\tPresharedKey: psk,\n\t\tNotes: Notes,\n\t\tCreated: time.Now().Format(time.RFC3339),\n\t\tModified: time.Now().Format(time.RFC3339),\n\t}\n\n\treturn &cfg\n}\n" }, { "path": "doc/auth-google-sso.md", "content": "# Google SSO Implementation\n\nThis is a short documentation on how you can setup wg-ui and Google OAuth. \n\nThere are a few different projects on GitHub related to SSO and OAuth2, the most popular just now is [oauth2-proxy/oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy) but we at Embark Studios opted to use [buzzfeed/sso](https://github.com/buzzfeed/sso). This was done before the growth of oauth2-proxy.\n\n## SSO Proxy & Auth\n\nWhen setting up [buzzfeed/sso](https://github.com/buzzfeed/sso) we followed the quickstart documentation provided by the project found [here](https://github.com/buzzfeed/sso/blob/master/docs/quickstart.md). \nIn our setup we use the binaries provided by releases, and not a docker based solution. \n\n## Systemd\n\nBelow is two simple services to keep both `sso-auth` and `sso-proxy` running. \nAs you can notice we use environment files instead of parameters for the binaries. \n\n```\n[Unit]\nDescription=sso-auth\nAfter=network.target\n\n[Service]\nType=simple\nRestart=always\nEnvironmentFile=/path/to/sso-auth.env\nExecStart=/path/to/sso-auth\n\n[Install]\nWantedBy=multi-user.target\n```\n```\nSESSION_COOKIE_SECURE=true\nSESSION_COOKIE_HTTPONLY=true\nSESSION_COOKIE_DOMAIN=.domain.com\nSESSION_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\nSESSION_COOKIE_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\nCLIENT_PROXY_ID=\nCLIENT_PROXY_SECRET=\nSERVER_SCHEME=https\nSERVER_HOST=sso.domain.com\nSERVER_PORT=8000\nAUTHORIZE_EMAIL_DOMAINS=domain.com\nAUTHORIZE_PROXY_DOMAINS=domain.com\nPROVIDER_DOMAIN_CLIENT_ID=123456789000-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com\nPROVIDER_DOMAIN_CLIENT_SECRET=XXXXXXXXXXXXXXXXXXXXXXXX\nPROVIDER_DOMAIN_TYPE=google\nPROVIDER_DOMAIN_SLUG=google\nVIRTUAL_HOST=sso.domain.com\nCLUSTER=sso\nSTATSD_HOST=127.0.0.1\nSTATSD_PORT=8125\n```\n\n```\n[Unit]\nDescription=sso-proxy\nAfter=network.target\n\n[Service]\nType=simple\nRestart=always\nEnvironmentFile=/path/to/sso-proxy.env\nExecStart=/path/to/sso-proxy\n\n[Install]\nWantedBy=multi-user.target\n```\n```\nDEFAULT_ALLOWED_EMAIL_DOMAINS=domain.com\nUPSTREAM_CONFIGS=/path/to/upstream_configs.yaml\nPROVIDER_URL=https://sso.domain.com\nPROVIDER_URL_INTERNAL=http://localhost:8000\nCLIENT_ID=\nCLIENT_SECRET=\nCOOKIE_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\nCOOKIE_SECURE=true\nVIRTUAL_HOST=*.domain.com\nCLUSTER=sso\nSTATSD_HOST=127.0.0.1\nSTATSD_PORT=8125\n```\n\nYou will also need a yaml file which defines backend service (wg-ui) which is defined in sso-proxy.env as `UPSTREAM_CONFIGS`\n\n```\n- service: wg-ui\n default:\n from: vpn.domain.com\n to: http://localhost:8080/\n```\n\n## nginx\n\nWe use nginx for all HTTP(S) to endusers, below you can find an example for configuration.\n\n```\nserver {\n listen 443 http2;\n listen [::]:443 http2;\n\n server_name vpn.domain.com;\n\n ssl on;\n ssl_certificate /path/to/domain.com.bundle.crt;\n ssl_certificate_key /path/to/domain.com.key;\n\n location / {\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-Proto https;\n proxy_pass http://localhost:4180;\n }\n}\nserver {\n listen 443 http2;\n listen [::]:443 http2;\n\n server_name sso.domain.com;\n\n ssl on;\n ssl_certificate /path/to/domain.com.bundle.crt;\n ssl_certificate_key /path/to/domain.com.key;\n\n location / {\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-Proto https;\n proxy_pass http://localhost:8000;\n }\n}\n```\n" }, { "path": "doc/auth-shibboleth-sso.md", "content": "# Shibboleth SP Implementation\n\nThis is a short documentation on how you can setup wg-ui with Shibboleth SP (and apache)\nas auth proxy\n\nThe documentation will not cover how to configure `shibd` or the IdP part of this integration.\nThe [upstream documentation](https://wiki.shibboleth.net/confluence/) or\n[SWAMIDs\ndocumentation](https://wiki.sunet.se/display/SWAMID/SAML+WebSSO+Service+Provider+Best+Current+Practice)\ncould point you in the right direction.\n\n## SSO Proxy & Auth\n\nThis example uses\n[eduPersonPrincipalName](https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonPrincipalName)\n(or eppn as Shibboleth calls it) as the primary key to identify users. Make\nsure that it is released from the IdP to the SP as a SAML attribute. The\nattributes(s) are then forward/proxied as request header to the application.\n\nThe only thing that needs to be configured in the WG UI end is that the\napplication needs to be started with the `--auth-user-header` flag set to\n`eppn`.\n\n### The `apache` configuration\n\n```\n\n \n AuthType Shibboleth\n Require shib-attr entitlement ~ ^urn:mace:swami.se:gmai:vpn:user$\n ShibRequireSessionWith idp.example.com\n ShibUseHeaders On\n \n\n SSLCertificateFile /path/to/vpn.example.com.pem\n SSLCertificateKeyFile /path/to/vpn.example.com.key\n SSLCertificateChainFile /path/to/CA.crt\n\n ProxyPass \"/\" \"http://127.0.0.1:8080/\"\n ProxyPassReverse \"/\" \"http://127.0.0.1:8080/\"\n\n```\n\n#### Configuration in depth\n\n```\nRequire shib-attr entitlement ~ ^urn:mace:swami.se:gmai:su-vpn:user$\n```\nBy default apache and shibd lets everyone through and since WG UI has no\nknowlege about the user in beforehand we release another\n([eduPersonEntitlement](https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonEntitlement) (or entitlement as Shibboleth calls it))\nfrom the IdP to the SP and require a specific value on the user in order to be\nallowed to use the service.\n\n```\nShibUseHeaders On\n```\n\nThis enables `shibd` to publish SAML attributes to the application (in this case\nproxy) through request headers.\n" }, { "path": "docker-compose.userspace.yml", "content": "version: \"3.7\"\n\nservices:\n app:\n image: embarkstudios/wireguard-ui:userspace\n privileged: true\n network_mode: \"host\"\n volumes:\n - /opt/wireguard-ui:/data\n environment:\n - WIREGUARD_UI_LISTEN_ADDRESS=:8080\n - WIREGUARD_UI_LOG_LEVEL=debug\n - WIREGUARD_UI_DATA_DIR=/data\n - WIREGUARD_UI_WG_ENDPOINT=your-andpoint-address:51820\n - WIREGUARD_UI_CLIENT_IP_RANGE=192.168.10.1/24\n # - WIREGUARD_UI_WG_DNS=192.168.10.1\n - WIREGUARD_UI_NAT=true\n - WIREGUARD_UI_NAT_DEVICE=eth0\n # - WIREGUARD_UI_WG_DEVICE_NAME=wg1\n\n restart: always\n" }, { "path": "docker-compose.yml", "content": "version: \"3.7\"\n\nservices:\n app:\n image: embarkstudios/wireguard-ui:latest\n entrypoint: \"/wireguard-ui\"\n privileged: true\n network_mode: \"host\"\n volumes:\n - /opt/wireguard-ui:/data\n environment:\n - WIREGUARD_UI_LISTEN_ADDRESS=:8080\n - WIREGUARD_UI_LOG_LEVEL=debug\n - WIREGUARD_UI_DATA_DIR=/data\n - WIREGUARD_UI_WG_ENDPOINT=your-andpoint-address:51820\n - WIREGUARD_UI_CLIENT_IP_RANGE=192.168.10.0/24\n # - WIREGUARD_UI_WG_DNS=192.168.10.0\n - WIREGUARD_UI_NAT=true\n - WIREGUARD_UI_NAT_DEVICE=eth0\n # - WIREGUARD_UI_WG_DEVICE_NAME=wg0\n\n restart: always\n" }, { "path": "go.mod", "content": "module github.com/embarkstudios/wireguard-ui\n\ngo 1.17\n\nrequire (\n\tgithub.com/fujiwara/go-amzn-oidc v0.0.2\n\tgithub.com/google/nftables v0.0.0-20210916140115-16a134723a96\n\tgithub.com/julienschmidt/httprouter v1.3.0\n\tgithub.com/sirupsen/logrus v1.8.1\n\tgithub.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e\n\tgithub.com/vishvananda/netlink v1.1.0\n\tgithub.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f\n\tgolang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815\n\tgopkg.in/alecthomas/kingpin.v2 v2.2.6\n)\n\nrequire (\n\tgithub.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect\n\tgithub.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a // indirect\n\tgithub.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect\n\tgithub.com/golang-jwt/jwt v3.2.2+incompatible // indirect\n\tgithub.com/google/go-cmp v0.5.6 // indirect\n\tgithub.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect\n\tgithub.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d // indirect\n\tgithub.com/konsorten/go-windows-terminal-sequences v1.0.3 // indirect\n\tgithub.com/mdlayher/genetlink v1.0.0 // indirect\n\tgithub.com/mdlayher/netlink v1.4.1 // indirect\n\tgithub.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267 // indirect\n\tgithub.com/pkg/errors v0.9.1 // indirect\n\tgithub.com/shogo82148/go-retry v1.1.1 // indirect\n\tgolang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect\n\tgolang.org/x/net v0.0.0-20211008194852-3b03d305991f // indirect\n\tgolang.org/x/sys v0.0.0-20211007075335-d3039528d8ac // indirect\n\tgolang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect\n\tgolang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326 // indirect\n)\n" }, { "path": "go.sum", "content": "github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=\ngithub.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=\ngithub.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2cI+DC1Mbh0TJxzA3RcLoMsFw+aXw7E=\ngithub.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=\ngithub.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a h1:E/8AP5dFtMhl5KPJz66Kt9G0n+7Sn41Fy1wv9/jHOrc=\ngithub.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=\ngithub.com/cilium/ebpf v0.5.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=\ngithub.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=\ngithub.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=\ngithub.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=\ngithub.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=\ngithub.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=\ngithub.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=\ngithub.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=\ngithub.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=\ngithub.com/fujiwara/go-amzn-oidc v0.0.2 h1:BcniaR2fJFik2koEK6Vm80Kk/vg6uoGTyckNwuGKO48=\ngithub.com/fujiwara/go-amzn-oidc v0.0.2/go.mod h1:8dyKYVF6NzSbcIBDB8HAu1RB+RcA1kMBh6o5g5hQ3Ao=\ngithub.com/fujiwara/go-amzn-oidc v0.0.3 h1:K00bR4JM8100Tn7/14c9OR36n27YTOy10YgihiBlTq0=\ngithub.com/fujiwara/go-amzn-oidc v0.0.3/go.mod h1:K+wcevZcCVOFD2Sh5FAwq+lAkaz9huLnTQO7T4tJwRI=\ngithub.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=\ngithub.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=\ngithub.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=\ngithub.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=\ngithub.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=\ngithub.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=\ngithub.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=\ngithub.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=\ngithub.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=\ngithub.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=\ngithub.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=\ngithub.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=\ngithub.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=\ngithub.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=\ngithub.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=\ngithub.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=\ngithub.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=\ngithub.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=\ngithub.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=\ngithub.com/google/nftables v0.0.0-20200316075819-7127d9d22474 h1:D6bN82zzK92ywYsE+Zjca7EHZCRZbcNTU3At7WdxQ+c=\ngithub.com/google/nftables v0.0.0-20200316075819-7127d9d22474/go.mod h1:cfspEyr/Ap+JDIITA+N9a0ernqG0qZ4W1aqMRgDZa1g=\ngithub.com/google/nftables v0.0.0-20210916140115-16a134723a96 h1:bCm0Cf+suMHiri9F+ss5n5W0AVas85K5Z0Hekgpe7N0=\ngithub.com/google/nftables v0.0.0-20210916140115-16a134723a96/go.mod h1:cfspEyr/Ap+JDIITA+N9a0ernqG0qZ4W1aqMRgDZa1g=\ngithub.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=\ngithub.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=\ngithub.com/josharian/native v0.0.0-20200817173448-b6b71def0850 h1:uhL5Gw7BINiiPAo24A2sxkcDI0Jt/sqp1v5xQCniEFA=\ngithub.com/josharian/native v0.0.0-20200817173448-b6b71def0850/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20201009170750-9c6f07d100c1/go.mod h1:hqoO/u39cqLeBLebZ8fWdE96O7FxrAsRYhnVOdgHxok=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20201216134343-bde56ed16391/go.mod h1:cR77jAZG3Y3bsb8hF6fHJbFoyFukLFOkQ98S0pQz3xw=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20201220180245-69540ac93943/go.mod h1:z4c53zj6Eex712ROyh8WI0ihysb5j2ROyV42iNogmAs=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20210122163228-8d122574c736/go.mod h1:ZXpIyOK59ZnN7J0BV99cZUPmsqDRZ3eq5X+st7u/oSA=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b h1:c3NTyLNozICy8B4mlMXemD3z/gXgQzVXZS/HqT+i3do=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b/go.mod h1:8w9Rh8m+aHZIG69YPGGem1i5VzoyRC8nw2kA8B+ik5U=\ngithub.com/jsimonetti/rtnetlink v0.0.0-20210525051524-4cc836578190/go.mod h1:NmKSdU4VGSiv1bMsdqNALI4RSvvjtz65tTMCnD05qLo=\ngithub.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=\ngithub.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=\ngithub.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d h1:MFX8DxRnKMY/2M3H61iSsVbo/n3h0MWGmWNN1UViOU0=\ngithub.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d/go.mod h1:QHb4k4cr1fQikUahfcRVPcEXiUgFsdIstGqlurL0XL4=\ngithub.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=\ngithub.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=\ngithub.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=\ngithub.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=\ngithub.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=\ngithub.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43 h1:WgyLFv10Ov49JAQI/ZLUkCZ7VJS3r74hwFIGXJsgZlY=\ngithub.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43/go.mod h1:+t7E0lkKfbBsebllff1xdTmyJt8lH37niI6kwFk9OTo=\ngithub.com/mdlayher/genetlink v1.0.0 h1:OoHN1OdyEIkScEmRgxLEe2M9U8ClMytqA5niynLtfj0=\ngithub.com/mdlayher/genetlink v1.0.0/go.mod h1:0rJ0h4itni50A86M2kHcgS85ttZazNt7a8H2a2cw0Gc=\ngithub.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=\ngithub.com/mdlayher/netlink v0.0.0-20191009155606-de872b0d824b/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=\ngithub.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=\ngithub.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=\ngithub.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZmb2XgV7o=\ngithub.com/mdlayher/netlink v1.2.0/go.mod h1:kwVW1io0AZy9A1E2YYgaD4Cj+C+GPkU6klXCMzIJ9p8=\ngithub.com/mdlayher/netlink v1.2.1/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=\ngithub.com/mdlayher/netlink v1.2.2-0.20210123213345-5cc92139ae3e/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=\ngithub.com/mdlayher/netlink v1.3.0/go.mod h1:xK/BssKuwcRXHrtN04UBkwQ6dY9VviGGuriDdoPSWys=\ngithub.com/mdlayher/netlink v1.4.0 h1:n3ARR+Fm0dDv37dj5wSWZXDKcy+U0zwcXS3zKMnSiT0=\ngithub.com/mdlayher/netlink v1.4.0/go.mod h1:dRJi5IABcZpBD2A3D0Mv/AiX8I9uDEu5oGkAVrekmf8=\ngithub.com/mdlayher/netlink v1.4.1 h1:I154BCU+mKlIf7BgcAJB2r7QjveNPty6uNY1g9ChVfI=\ngithub.com/mdlayher/netlink v1.4.1/go.mod h1:e4/KuJ+s8UhfUpO9z00/fDZZmhSrs+oxyqAS9cNgn6Q=\ngithub.com/mdlayher/socket v0.0.0-20210307095302-262dc9984e00/go.mod h1:GAFlyu4/XV68LkQKYzKhIo/WW7j3Zi0YRAz/BOoanUc=\ngithub.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267 h1:Sii9ha8FHgdPEO3XW1rQ6SdUs8qNBERc64/v2tUyvis=\ngithub.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267/go.mod h1:nFZ1EtZYK8Gi/k6QNu7z7CgO20i/4ExeQswwWuPmG/g=\ngithub.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=\ngithub.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=\ngithub.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=\ngithub.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=\ngithub.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=\ngithub.com/onsi/ginkgo v1.14.2/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=\ngithub.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=\ngithub.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=\ngithub.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=\ngithub.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=\ngithub.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=\ngithub.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=\ngithub.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=\ngithub.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=\ngithub.com/shogo82148/go-retry v1.0.0 h1:c487Qe+QYUffpUpPxrUN5fGJq6WVHSzGS4N3MNuR2OU=\ngithub.com/shogo82148/go-retry v1.0.0/go.mod h1:5jiw5yPWW6K+pMyimtNoaQSDD08RMEsJbhDwFrui5rc=\ngithub.com/shogo82148/go-retry v1.1.1 h1:BfUEVHTNDSjYxoRPC+c/ht5Sy6qdwl+0kFhhubeh4Fo=\ngithub.com/shogo82148/go-retry v1.1.1/go.mod h1:TPSFDcc2rlx2D/yfhi8BBOlsHhVBjjJoMvxG7iFHUbI=\ngithub.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=\ngithub.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=\ngithub.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=\ngithub.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=\ngithub.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=\ngithub.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=\ngithub.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=\ngithub.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=\ngithub.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=\ngithub.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=\ngithub.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=\ngithub.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=\ngithub.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=\ngithub.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=\ngithub.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe h1:mjAZxE1nh8yvuwhGHpdDqdhtNu2dgbpk93TwoXuk5so=\ngithub.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=\ngithub.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f h1:p4VB7kIXpOQvVn1ZaTIVp+3vuYAXFe3OJEvjbUYJLaA=\ngithub.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=\ngolang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=\ngolang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=\ngolang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=\ngolang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e h1:8foAy0aoO5GkqCvAEJ4VC4P3zksTg4X4aJCDpZzmgQI=\ngolang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=\ngolang.org/x/crypto v0.0.0-20210921155107-089bfa567519 h1:7I4JAnoQBe7ZtJcBaYHi5UtiO8tQHbUSXxL+pnGRANg=\ngolang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=\ngolang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=\ngolang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=\ngolang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=\ngolang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=\ngolang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=\ngolang.org/x/net v0.0.0-20191028085509-fe3aa8a45271/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=\ngolang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=\ngolang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=\ngolang.org/x/net v0.0.0-20201006153459-a7d1128ccaa0/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=\ngolang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=\ngolang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=\ngolang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=\ngolang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=\ngolang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=\ngolang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=\ngolang.org/x/net v0.0.0-20210504132125-bbd867fde50d h1:nTDGCTeAu2LhcsHTRzjyIUbZHCJ4QePArsm27Hka0UM=\ngolang.org/x/net v0.0.0-20210504132125-bbd867fde50d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=\ngolang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=\ngolang.org/x/net v0.0.0-20210927181540-4e4d966f7476/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=\ngolang.org/x/net v0.0.0-20211008194852-3b03d305991f h1:1scJEYZBaF48BaG6tYbtxmLcXqwYGSfGcMoStTqkkIw=\ngolang.org/x/net v0.0.0-20211008194852-3b03d305991f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=\ngolang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=\ngolang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=\ngolang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=\ngolang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20191029155521-f43be2a4598c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20201118182958-a01c418693c7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20201218084310-7d0127a74742/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210110051926-789bb1bd4061/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210123111255-9b0068b26619/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210216163648-f7da38b97c65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210309040221-94ec62e08169/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=\ngolang.org/x/sys v0.0.0-20210503173754-0981d6026fa6 h1:cdsMqa2nXzqlgs183pHxtvoVwU7CyzaCTAUOg94af4c=\ngolang.org/x/sys v0.0.0-20210503173754-0981d6026fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=\ngolang.org/x/sys v0.0.0-20210525143221-35b2ab0089ea/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=\ngolang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=\ngolang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=\ngolang.org/x/sys v0.0.0-20211007075335-d3039528d8ac h1:oN6lz7iLW/YC7un8pq+9bOLyXrprv2+DKfkJY+2LJJw=\ngolang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=\ngolang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=\ngolang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=\ngolang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=\ngolang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=\ngolang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=\ngolang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=\ngolang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=\ngolang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=\ngolang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=\ngolang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=\ngolang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=\ngolang.zx2c4.com/wireguard v0.0.0-20210427022245-097af6e1351b/go.mod h1:a057zjmoc00UN7gVkaJt2sXVK523kMJcogDTEvPIasg=\ngolang.zx2c4.com/wireguard v0.0.0-20210624150102-15b24b6179e0 h1:qINUmOnDCCF7i14oomDDkGmlda7BSDTGfge77/aqdfk=\ngolang.zx2c4.com/wireguard v0.0.0-20210624150102-15b24b6179e0/go.mod h1:laHzsbfMhGSobUmruXWAyMKKHSqvIcrqZJMyHD+/3O8=\ngolang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326 h1:4yQQ5d6U5ozGB6n/WSDZa6B0XpPTmoQMtMDMoiZr4n0=\ngolang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326/go.mod h1:SDoazCvdy7RDjBPNEMBwrXhomlmtG7svs8mgwWEqtVI=\ngolang.zx2c4.com/wireguard/wgctrl v0.0.0-20210506160403-92e472f520a5 h1:LpEwXnbN4q2EIPkqbG9KHBUrducJYDOOdL+eMcJAlFo=\ngolang.zx2c4.com/wireguard/wgctrl v0.0.0-20210506160403-92e472f520a5/go.mod h1:+1XihzyZUBJcSc5WO9SwNA7v26puQwOEDwanaxfNXPQ=\ngolang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815 h1:avmQJRd/MfOtK7TRnf0Bi2o6W05ZaPhP1upcDCgvTTs=\ngolang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815/go.mod h1:G0zJhHaavrPDNb/ygHzf4uju6nSlKMi4f1E5RCT3WpE=\ngoogle.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=\ngoogle.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=\ngoogle.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=\ngoogle.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=\ngoogle.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=\ngoogle.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=\ngopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=\ngopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=\ngopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=\ngopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=\ngopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=\ngopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=\ngopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=\ngopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=\ngopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=\n" }, { "path": "main.go", "content": "package main\n\nimport (\n\t\"strings\"\n\n\tlog \"github.com/sirupsen/logrus\"\n\t\"golang.org/x/crypto/bcrypt\"\n\t\"gopkg.in/alecthomas/kingpin.v2\"\n)\n\nvar (\n\tlogLevel = kingpin.Flag(\"log-level\", \"The level of logging\").Default(\"info\").Enum(\"debug\", \"info\", \"warn\", \"error\", \"panic\", \"fatal\")\n)\n\nfunc main() {\n\tkingpin.HelpFlag.Short('h')\n\tkingpin.CommandLine.DefaultEnvars()\n\tkingpin.Command(\"server\", \"Start server.\").Default()\n\tpasswdCmd := kingpin.Command(\"passwd\", \"Generate password hash.\")\n\tpasswdCmdPassword := passwdCmd.Arg(\"password\", \"The password to hash\").Required().String()\n\tcmd := kingpin.Parse()\n\n\tswitch strings.ToLower(*logLevel) {\n\tcase \"debug\":\n\t\tlog.SetLevel(log.DebugLevel)\n\tcase \"warn\":\n\t\tlog.SetLevel(log.WarnLevel)\n\tcase \"error\":\n\t\tlog.SetLevel(log.ErrorLevel)\n\tcase \"panic\":\n\t\tlog.SetLevel(log.PanicLevel)\n\tdefault:\n\t\tlog.SetLevel(log.InfoLevel)\n\t}\n\n\tswitch cmd {\n\tcase \"passwd\":\n\t\tbytes, err := bcrypt.GenerateFromPassword([]byte(*passwdCmdPassword), 14)\n\t\tif err != nil {\n\t\t\tlog.Fatalf(\"generate password error: %v\", err)\n\t\t}\n\t\tlog.Infof(\"Password Hash: %s\", string(bytes))\n\t\treturn\n\tcase \"server\":\n\t\tlog.Info(\"Starting\")\n\t\tserver := NewServer()\n\t\terr := server.Start()\n\t\tif err != nil {\n\t\t\tlog.Fatal(err)\n\t\t}\n\tdefault:\n\t\tlog.Fatal(\"Unknown command\")\n\t}\n\n}\n" }, { "path": "server.go", "content": "package main\n\nimport (\n\t\"context\"\n\t\"embed\"\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"io/fs\"\n\t\"io/ioutil\"\n\t\"net\"\n\t\"net/http\"\n\t\"net/http/httputil\"\n\t\"net/url\"\n\t\"os\"\n\t\"path\"\n\t\"regexp\"\n\t\"strconv\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\tvalidator \"github.com/fujiwara/go-amzn-oidc/validator\"\n\t\"github.com/google/nftables\"\n\t\"github.com/google/nftables/expr\"\n\t\"github.com/julienschmidt/httprouter\"\n\tlog \"github.com/sirupsen/logrus\"\n\t\"github.com/skip2/go-qrcode\"\n\t\"github.com/vishvananda/netlink\"\n\t\"github.com/vishvananda/netns\"\n\t\"golang.org/x/crypto/bcrypt\"\n\t\"golang.zx2c4.com/wireguard/wgctrl\"\n\t\"golang.zx2c4.com/wireguard/wgctrl/wgtypes\"\n\t\"gopkg.in/alecthomas/kingpin.v2\"\n)\n\nconst (\n\twgDefaultMtu = 1420\n)\n\nvar (\n\tdataDir = kingpin.Flag(\"data-dir\", \"Directory used for storage\").Default(\"/var/lib/wireguard-ui\").String()\n\n\tlistenAddr = kingpin.Flag(\"listen-address\", \"Address to listen to\").Default(\":8080\").String()\n\tnatEnabled = kingpin.Flag(\"nat\", \"Whether NAT is enabled or not\").Default(\"true\").Bool()\n\tnatLink = kingpin.Flag(\"nat-device\", \"Network interface to masquerade\").Default(\"wlp2s0\").String()\n\tclientIPRange = kingpin.Flag(\"client-ip-range\", \"Client IP CIDR\").Default(\"172.31.255.0/24\").String()\n\tauthUserHeader = kingpin.Flag(\"auth-user-header\", \"Header containing username\").Default(\"X-Forwarded-User\").String()\n\tauthBasicUser = kingpin.Flag(\"auth-basic-user\", \"Basic auth static username\").Default(\"\").String()\n\tauthBasicPass = kingpin.Flag(\"auth-basic-pass\", \"Basic auth static password\").Default(\"\").String()\n\tmaxNumberClientConfig = kingpin.Flag(\"max-number-client-config\", \"Max number of configs an client can use. 0 is unlimited\").Default(\"0\").Int()\n\n\twgLinkName = kingpin.Flag(\"wg-device-name\", \"WireGuard network device name\").Default(\"wg0\").String()\n\twgListenPort = kingpin.Flag(\"wg-listen-port\", \"WireGuard UDP port to listen to\").Default(\"51820\").Int()\n\twgEndpoint = kingpin.Flag(\"wg-endpoint\", \"WireGuard endpoint address\").Default(\"127.0.0.1:51820\").String()\n\twgAllowedIPs = kingpin.Flag(\"wg-allowed-ips\", \"WireGuard client allowed ips\").Default(\"0.0.0.0/0\").Strings()\n\twgDNS = kingpin.Flag(\"wg-dns\", \"WireGuard client DNS server (optional)\").Default(\"\").String()\n\twgKeepAlive = kingpin.Flag(\"wg-keepalive\", \"WireGuard Keepalive for peers, defined in seconds (optional)\").Default(\"\").String()\n\twgServerMtu = kingpin.Flag(\"wg-server-mtu\", \"WireGuard server MTU\").Default(\"1420\").Int()\n\twgPeerMtu = kingpin.Flag(\"wg-peer-mtu\", \"WireGuard default peer MTU\").Default(strconv.Itoa(wgDefaultMtu)).Int()\n\n\tdevUIServer = kingpin.Flag(\"dev-ui-server\", \"Developer mode: If specified, proxy all static assets to this endpoint\").String()\n\n\tfilenameRe = regexp.MustCompile(\"[^a-zA-Z0-9]+\")\n)\n\ntype contextKey string\n\nconst key = contextKey(\"user\")\n\n// Server is the running server\ntype Server struct {\n\tserverConfigPath string\n\tmutex sync.RWMutex\n\tConfig *ServerConfig\n\tipAddr net.IP\n\tclientIPRange *net.IPNet\n\tassets http.Handler\n}\n\ntype wgLink struct {\n\tattrs *netlink.LinkAttrs\n}\n\nfunc (w *wgLink) Attrs() *netlink.LinkAttrs {\n\treturn w.attrs\n}\n\nfunc (w *wgLink) Type() string {\n\treturn \"wireguard\"\n}\n\nfunc ifname(n string) []byte {\n\tb := make([]byte, 16)\n\tcopy(b, []byte(n+\"\\x00\"))\n\treturn b\n}\n\n//go:embed ui/dist\nvar assetsFS embed.FS\n\n// NewServer returns an instance of Server which contains both the webserver and the reference to Wireguard\nfunc NewServer() *Server {\n\tipAddr, ipNet, err := net.ParseCIDR(*clientIPRange)\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tlog.Debugf(\"ipAddr: %s ipNet: %s\", ipAddr, ipNet)\n\n\terr = os.MkdirAll(*dataDir, 0700)\n\tif err != nil {\n\t\tlog.WithError(err).Fatalf(\"Error initializing data directory: %s\", *dataDir)\n\t}\n\n\tcfgPath := path.Join(*dataDir, \"config.json\")\n\tconfig := NewServerConfig(cfgPath)\n\n\tlog.Debug(\"Configuration loaded with public key: \", config.PublicKey)\n\n\tvar fsys fs.FS = assetsFS\n\tif f, err := fs.Sub(fsys, \"ui/dist\"); err != nil {\n\t\tlog.Error(fmt.Errorf(\"ui/dist does not exist in fs :%w\", err))\n\t} else {\n\t\tfsys = f\n\t}\n\tfmt.Println(fs.Glob(fsys, \"*\"))\n\n\tassets := http.FileServer(http.FS(fsys))\n\n\ts := Server{\n\t\tserverConfigPath: cfgPath,\n\t\tConfig: config,\n\t\tipAddr: ipAddr,\n\t\tclientIPRange: ipNet,\n\t\tassets: assets,\n\t}\n\n\tlog.Debug(\"Server initialized: \", *dataDir)\n\treturn &s\n}\n\nfunc (s *Server) enableIPForward() error {\n\tp := \"/proc/sys/net/ipv4/ip_forward\"\n\n\tcontent, err := ioutil.ReadFile(p)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif string(content) == \"0\\n\" {\n\t\tlog.Info(\"Enabling sys.net.ipv4.ip_forward\")\n\t\treturn ioutil.WriteFile(p, []byte(\"1\"), 0600)\n\t}\n\n\treturn nil\n}\n\nfunc (s *Server) initInterface() error {\n\tattrs := netlink.NewLinkAttrs()\n\tattrs.Name = *wgLinkName\n\n\tlink := wgLink{\n\t\tattrs: &attrs,\n\t}\n\n\tlog.Debug(\"Adding wireguard device: \", *wgLinkName)\n\terr := netlink.LinkAdd(&link)\n\tif os.IsExist(err) {\n\t\tlog.Infof(\"WireGuard interface %s already exists. Reusing.\", *wgLinkName)\n\t} else if err != nil {\n\t\treturn err\n\t}\n\n\tlog.Debug(\"Adding ip address to wireguard device: \", s.clientIPRange)\n\taddr, _ := netlink.ParseAddr(*clientIPRange)\n\terr = netlink.AddrAdd(&link, addr)\n\tif os.IsExist(err) {\n\t\tlog.Infof(\"WireGuard interface %s already has the requested address: \", s.clientIPRange)\n\t} else if err != nil {\n\t\treturn err\n\t}\n\n\tlog.Debug(\"Setting link MTU: \", *wgServerMtu)\n\terr = netlink.LinkSetMTU(&link, *wgServerMtu)\n\tif err != nil {\n\t\tlog.Error(\"Error setting link MTU: \", *wgLinkName)\n\t\treturn err\n\t}\n\n\tlog.Debug(\"Bringing up wireguard device: \", *wgLinkName)\n\terr = netlink.LinkSetUp(&link)\n\tif err != nil {\n\t\tlog.Error(\"Error bringing up device: \", *wgLinkName)\n\t\treturn err\n\t}\n\n\tif *natEnabled {\n\t\tlog.Debug(\"Adding NAT / IP masquerading using nftables\")\n\t\tns, err := netns.Get()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tconn := nftables.Conn{NetNS: int(ns)}\n\n\t\tlog.Debug(\"Flushing nftable rulesets\")\n\t\tconn.FlushRuleset()\n\n\t\tlog.Debug(\"Setting up nftable rules for ip masquerading\")\n\n\t\tnat := conn.AddTable(&nftables.Table{\n\t\t\tFamily: nftables.TableFamilyIPv4,\n\t\t\tName: \"nat\",\n\t\t})\n\n\t\tconn.AddChain(&nftables.Chain{\n\t\t\tName: \"prerouting\",\n\t\t\tTable: nat,\n\t\t\tType: nftables.ChainTypeNAT,\n\t\t\tHooknum: nftables.ChainHookPrerouting,\n\t\t\tPriority: nftables.ChainPriorityFilter,\n\t\t})\n\n\t\tpost := conn.AddChain(&nftables.Chain{\n\t\t\tName: \"postrouting\",\n\t\t\tTable: nat,\n\t\t\tType: nftables.ChainTypeNAT,\n\t\t\tHooknum: nftables.ChainHookPostrouting,\n\t\t\tPriority: nftables.ChainPriorityNATSource,\n\t\t})\n\n\t\tconn.AddRule(&nftables.Rule{\n\t\t\tTable: nat,\n\t\t\tChain: post,\n\t\t\tExprs: []expr.Any{\n\t\t\t\t&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},\n\t\t\t\t&expr.Cmp{\n\t\t\t\t\tOp: expr.CmpOpEq,\n\t\t\t\t\tRegister: 1,\n\t\t\t\t\tData: ifname(*natLink),\n\t\t\t\t},\n\t\t\t\t&expr.Masq{},\n\t\t\t},\n\t\t})\n\n\t\tif err := conn.Flush(); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (s *Server) allocateIP() net.IP {\n\tallocated := make(map[string]bool)\n\tallocated[s.ipAddr.String()] = true\n\tfor _, cfg := range s.Config.Users {\n\t\tfor _, dev := range cfg.Clients {\n\t\t\tallocated[dev.IP.String()] = true\n\t\t}\n\t}\n\n\tfor ip := s.ipAddr.Mask(s.clientIPRange.Mask); s.clientIPRange.Contains(ip); {\n\t\tfor i := len(ip) - 1; i >= 0; i-- {\n\t\t\tip[i]++\n\t\t\tif ip[i] > 0 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\n\t\tif !allocated[ip.String()] {\n\t\t\tlog.Debug(\"Allocated IP: \", ip)\n\t\t\treturn ip\n\t\t}\n\t}\n\n\tlog.Fatal(\"Unable to allocate IP. Address range exhausted\")\n\treturn nil\n}\n\nfunc (s *Server) reconfigure() {\n\tlog.Debug(\"Reconfiguring\")\n\n\terr := s.Config.Write()\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\n\terr = s.configureWireGuard()\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n}\n\nfunc (s *Server) configureWireGuard() error {\n\tlog.Debugf(\"Reconfiguring wireguard interface %s\", *wgLinkName)\n\twg, err := wgctrl.New()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tlog.Debug(\"Adding wireguard private key\")\n\tkey, err := wgtypes.ParseKey(s.Config.PrivateKey)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tlog.Debugf(\"Getting current Wireguard config\")\n\tcurrentdev, err := wg.Device(*wgLinkName)\n\tif err != nil {\n\t\treturn err\n\t}\n\tcurrentpeers := currentdev.Peers\n\tdiffpeers := make([]wgtypes.PeerConfig, 0)\n\n\tpeers := make([]wgtypes.PeerConfig, 0)\n\tfor user, cfg := range s.Config.Users {\n\t\tfor id, dev := range cfg.Clients {\n\t\t\tpubKey, err := wgtypes.ParseKey(dev.PublicKey)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tpsk, _ := wgtypes.ParseKey(dev.PresharedKey)\n\t\t\tallowedIPs := make([]net.IPNet, 1+len(dev.AllowedIPs))\n\t\t\tallowedIPs[0] = *netlink.NewIPNet(dev.IP)\n\n\t\t\tfor i, cidr := range dev.AllowedIPs {\n\t\t\t\tallowedIPs[1+i] = *cidr\n\t\t\t}\n\t\t\tpeer := wgtypes.PeerConfig{\n\t\t\t\tPublicKey: pubKey,\n\t\t\t\tReplaceAllowedIPs: true,\n\t\t\t\tAllowedIPs: allowedIPs,\n\t\t\t\tPresharedKey: &psk,\n\t\t\t}\n\n\t\t\tlog.WithFields(log.Fields{\"user\": user, \"client\": id, \"key\": dev.PublicKey, \"allowedIPs\": peer.AllowedIPs}).Debug(\"Adding wireguard peer\")\n\n\t\t\tpeers = append(peers, peer)\n\t\t}\n\t}\n\n\t// Determine peers updated and to be removed from WireGuard\n\tfor _, i := range currentpeers {\n\t\tfound := false\n\t\tfor _, j := range peers {\n\t\t\tif i.PublicKey == j.PublicKey {\n\t\t\t\tfound = true\n\t\t\t\tj.UpdateOnly = true\n\t\t\t\tdiffpeers = append(diffpeers, j)\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif !found {\n\t\t\tpeertoremove := wgtypes.PeerConfig{\n\t\t\t\tPublicKey: i.PublicKey,\n\t\t\t\tRemove: true,\n\t\t\t}\n\t\t\tdiffpeers = append(diffpeers, peertoremove)\n\t\t}\n\t}\n\n\t// Determine peers to be added to WireGuard\n\tfor _, i := range peers {\n\t\tfound := false\n\t\tfor _, j := range currentpeers {\n\t\t\tif i.PublicKey == j.PublicKey {\n\t\t\t\tfound = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif !found {\n\t\t\tdiffpeers = append(diffpeers, i)\n\t\t}\n\t}\n\n\tcfg := wgtypes.Config{\n\t\tPrivateKey: &key,\n\t\tListenPort: wgListenPort,\n\t\tReplacePeers: false,\n\t\tPeers: diffpeers,\n\t}\n\terr = wg.ConfigureDevice(*wgLinkName, cfg)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc verifyLinkMTU(mtu int) error {\n\tif mtu < 1280 || mtu > 1500 {\n\t\treturn fmt.Errorf(\"MTU must be between 1280 and 1500\")\n\t}\n\treturn nil\n}\n\n// Start configures wiregard and initiates the interfaces as well as starts the webserver to accept clients\nfunc (s *Server) Start() error {\n\terr := s.enableIPForward()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = s.initInterface()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = s.configureWireGuard()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\trouter := httprouter.New()\n\trouter.GET(\"/api/v1/whoami\", s.WhoAmI)\n\trouter.GET(\"/api/v1/users/:user/clients/:client\", s.withAuth(s.GetClient))\n\trouter.PUT(\"/api/v1/users/:user/clients/:client\", s.withAuth(s.EditClient))\n\trouter.DELETE(\"/api/v1/users/:user/clients/:client\", s.withAuth(s.DeleteClient))\n\trouter.GET(\"/api/v1/users/:user/clients\", s.withAuth(s.GetClients))\n\trouter.POST(\"/api/v1/users/:user/clients\", s.withAuth(s.CreateClient))\n\n\tif *devUIServer != \"\" {\n\t\tlog.Debug(\"Serving static assets proxying from development server: \", *devUIServer)\n\t\tdevProxy := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\t\turl, _ := url.Parse(*devUIServer)\n\t\t\tif strings.HasPrefix(r.URL.Path, \"/client/\") || r.URL.Path == \"/about\" {\n\t\t\t\tr.URL.Path = \"/\"\n\t\t\t}\n\t\t\tproxy := httputil.NewSingleHostReverseProxy(url)\n\t\t\tr.URL.Host = url.Host\n\t\t\tr.URL.Scheme = url.Scheme\n\t\t\tr.Header.Set(\"X-Forwarded-Host\", r.Header.Get(\"Host\"))\n\t\t\tr.Host = url.Host\n\t\t\tproxy.ServeHTTP(w, r)\n\t\t})\n\t\trouter.NotFound = devProxy\n\t} else {\n\t\tlog.Debug(\"Serving static assets embedded in binary\")\n\t\trouter.GET(\"/about\", s.Index)\n\t\trouter.GET(\"/client/:client\", s.Index)\n\t\trouter.NotFound = s.assets\n\t}\n\n\tlog.WithField(\"listenAddr\", *listenAddr).Info(\"Starting server\")\n\n\treturn http.ListenAndServe(*listenAddr, s.basicAuth(s.userFromHeader(router)))\n}\n\nfunc (s *Server) basicAuth(handler http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\n\t\t// If we specified a user, require auth\n\t\tif *authBasicUser != \"\" {\n\t\t\tu, p, ok := r.BasicAuth()\n\t\t\tif !ok || u != *authBasicUser || bcrypt.CompareHashAndPassword([]byte(*authBasicPass), []byte(p)) != nil {\n\t\t\t\tw.Header().Set(\"WWW-Authenticate\", `Basic realm=\"restricted\", charset=\"UTF-8\"`)\n\t\t\t\thttp.Error(w, \"Unauthorized\", http.StatusUnauthorized)\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\thandler.ServeHTTP(w, r)\n\n\t})\n}\n\nfunc (s *Server) userFromHeader(handler http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\tuser := r.Header.Get(*authUserHeader)\n\t\tif user == \"\" {\n\t\t\tlog.Debug(\"Unauthenticated request\")\n\t\t\tuser = \"anonymous\"\n\t\t}\n\n\t\tif *authUserHeader == \"X-Goog-Authenticated-User-Email\" {\n\t\t\tuser = strings.TrimPrefix(user, \"accounts.google.com:\")\n\t\t}\n\n\t\t// AWS ALB-specific JWT header (https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html)\n\t\tif *authUserHeader == \"x-amzn-oidc-data\" {\n\t\t\tclaims, err := validator.Validate(user)\n\t\t\tif err != nil {\n\t\t\t\tlog.Debug(\"Unauthenticated request\")\n\t\t\t\tuser = \"anonymous\"\n\t\t\t} else {\n\t\t\t\tuser = claims.Email()\n\t\t\t}\n\t\t}\n\n\t\tcookie := http.Cookie{\n\t\t\tName: \"wguser\",\n\t\t\tValue: user,\n\t\t\tPath: \"/\",\n\t\t}\n\t\thttp.SetCookie(w, &cookie)\n\n\t\tctx := context.WithValue(r.Context(), key, user)\n\t\thandler.ServeHTTP(w, r.WithContext(ctx))\n\t})\n}\n\nfunc (s *Server) withAuth(handler httprouter.Handle) httprouter.Handle {\n\treturn func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n\t\tlog.Debug(\"Auth required\")\n\n\t\tuser := r.Context().Value(key)\n\t\tif user == nil {\n\t\t\tlog.Error(\"Error getting username from request context\")\n\t\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\n\t\tif user != ps.ByName(\"user\") {\n\t\t\tlog.WithField(\"user\", user).WithField(\"path\", r.URL.Path).Warn(\"Unauthorized access\")\n\t\t\tw.WriteHeader(http.StatusUnauthorized)\n\t\t\treturn\n\t\t}\n\n\t\thandler(w, r, ps)\n\t}\n}\n\n// WhoAmI returns the identity of the current user\nfunc (s *Server) WhoAmI(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n\tuser := r.Context().Value(key).(string)\n\tlog.Debug(user)\n\terr := json.NewEncoder(w).Encode(struct{ User string }{user})\n\tif err != nil {\n\t\tlog.Error(err)\n\t\tw.WriteHeader(http.StatusInternalServerError)\n\t}\n}\n\n// GetClients returns a list of all clients for the current user\nfunc (s *Server) GetClients(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n\ts.mutex.RLock()\n\tdefer s.mutex.RUnlock()\n\tuser := r.Context().Value(key).(string)\n\tlog.Debug(user)\n\tclients := map[string]*ClientConfig{}\n\tuserConfig := s.Config.Users[user]\n\tif userConfig != nil {\n\t\tclients = userConfig.Clients\n\t}\n\n\terr := json.NewEncoder(w).Encode(clients)\n\tif err != nil {\n\t\tlog.Error(err)\n\t\tw.WriteHeader(http.StatusInternalServerError)\n\t}\n}\n\n// Index returns the single-page app\nfunc (s *Server) Index(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {\n\tlog.Debug(\"Serving single-page app from URL: \", r.URL)\n\tr.URL.Path = \"/\"\n\ts.assets.ServeHTTP(w, r)\n}\n\n// GetClient returns a specific client for the current user\nfunc (s *Server) GetClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n\ts.mutex.RLock()\n\tdefer s.mutex.RUnlock()\n\tuser := r.Context().Value(key).(string)\n\tusercfg := s.Config.Users[user]\n\tif usercfg == nil {\n\t\tw.WriteHeader(http.StatusNotFound)\n\t\treturn\n\t}\n\n\tclient := usercfg.Clients[ps.ByName(\"client\")]\n\tif client == nil {\n\t\tw.WriteHeader(http.StatusNotFound)\n\t\treturn\n\t}\n\n\tinterfaceConfig := []string{\n\t\t\"[Interface]\",\n\t\t\"Address = \" + client.IP.String(),\n\t\t\"PrivateKey = \" + client.PrivateKey,\n\t}\n\tif *wgDNS != \"\" {\n\t\tinterfaceConfig = append(interfaceConfig, \"DNS = \"+*wgDNS)\n\t}\n\tif client.MTU != wgDefaultMtu {\n\t\tinterfaceConfig = append(interfaceConfig, fmt.Sprintf(\"MTU = %d\", client.MTU))\n\t}\n\n\tpeerConfig := []string{\n\t\t\"[Peer]\",\n\t\t\"PublicKey = \" + s.Config.PublicKey,\n\t\t\"AllowedIPs = \" + strings.Join(*wgAllowedIPs, \",\"),\n\t\t\"Endpoint = \" + *wgEndpoint,\n\t}\n\tif *wgKeepAlive != \"\" {\n\t\tpeerConfig = append(peerConfig, \"PersistentKeepalive = \"+*wgKeepAlive)\n\t}\n\tif client.PresharedKey != \"\" {\n\t\tpeerConfig = append(peerConfig, \"PresharedKey = \"+client.PresharedKey)\n\t}\n\n\tclientConfig := strings.Join(interfaceConfig[:], \"\\n\") + \"\\n\\n\" + strings.Join(peerConfig[:], \"\\n\") + \"\\n\"\n\n\tformat := r.URL.Query().Get(\"format\")\n\n\tif format == \"qrcode\" {\n\t\tpng, err := qrcode.Encode(clientConfig, qrcode.Medium, 220)\n\t\tif err != nil {\n\t\t\tlog.Error(err)\n\t\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\tw.Header().Set(\"Content-Type\", \"image/png\")\n\t\tw.WriteHeader(http.StatusOK)\n\t\t_, err = w.Write(png)\n\t\tif err != nil {\n\t\t\tlog.Error(err)\n\t\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\n\t\treturn\n\t}\n\n\tif format == \"config\" {\n\t\tfilename := fmt.Sprintf(\"%s.conf\", filenameRe.ReplaceAllString(client.Name, \"_\"))\n\t\tw.Header().Set(\"Content-Disposition\", fmt.Sprintf(\"attachment; filename=\\\"%s\\\"\", filename))\n\t\tw.Header().Set(\"Content-Type\", \"application/config\")\n\t\tw.WriteHeader(http.StatusOK)\n\t\t_, err := fmt.Fprint(w, clientConfig)\n\t\tif err != nil {\n\t\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\t}\n\t\treturn\n\t}\n\n\terr := json.NewEncoder(w).Encode(client)\n\tif err != nil {\n\t\tlog.Error(err)\n\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\treturn\n\t}\n}\n\n// EditClient edits the specific client passed by the current user\nfunc (s *Server) EditClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n\ts.mutex.Lock()\n\tdefer s.mutex.Unlock()\n\tuser := r.Context().Value(key).(string)\n\tusercfg := s.Config.Users[user]\n\tif usercfg == nil {\n\t\tw.WriteHeader(http.StatusNotFound)\n\t\treturn\n\t}\n\n\tclient := usercfg.Clients[ps.ByName(\"client\")]\n\tif client == nil {\n\t\tw.WriteHeader(http.StatusNotFound)\n\t\treturn\n\t}\n\n\tcfg := ClientConfig{}\n\n\tif err := json.NewDecoder(r.Body).Decode(&cfg); err != nil {\n\t\tlog.Warn(\"Error parsing request: \", err)\n\t\tw.WriteHeader(http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tlog.Debugf(\"EditClient: %#v\", cfg)\n\n\tif cfg.Name != \"\" {\n\t\tclient.Name = cfg.Name\n\t}\n\n\tif cfg.Notes != \"\" {\n\t\tclient.Notes = cfg.Notes\n\t}\n\n\tif err := verifyLinkMTU(cfg.MTU); err == nil {\n\t\tclient.MTU = cfg.MTU\n\t}\n\n\tclient.PresharedKey = cfg.PresharedKey\n\n\tclient.Modified = time.Now().Format(time.RFC3339)\n\n\tif len(cfg.AllowedIPs) != 0 {\n\t\tclient.AllowedIPs = cfg.AllowedIPs\n\t}\n\ts.reconfigure()\n\n\tw.WriteHeader(http.StatusOK)\n\tif err := json.NewEncoder(w).Encode(client); err != nil {\n\t\tlog.Error(err)\n\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\treturn\n\t}\n}\n\n// DeleteClient deletes the specified client for the current user\nfunc (s *Server) DeleteClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n\ts.mutex.Lock()\n\tdefer s.mutex.Unlock()\n\tuser := r.Context().Value(key).(string)\n\tusercfg := s.Config.Users[user]\n\tif usercfg == nil {\n\t\tw.WriteHeader(http.StatusNotFound)\n\t\treturn\n\t}\n\n\tclient := ps.ByName(\"client\")\n\tif usercfg.Clients[client] == nil {\n\t\tw.WriteHeader(http.StatusNotFound)\n\t\treturn\n\t}\n\n\tdelete(usercfg.Clients, client)\n\ts.reconfigure()\n\n\tlog.WithField(\"user\", user).Debug(\"Deleted client: \", client)\n\n\tw.WriteHeader(http.StatusOK)\n}\n\n// CreateClient creates a new client for the current user\nfunc (s *Server) CreateClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n\ts.mutex.Lock()\n\tdefer s.mutex.Unlock()\n\n\tuser := r.Context().Value(key).(string)\n\tlog.WithField(\"user\", user).Debug(\"CreateClient\")\n\n\tc := s.Config.GetUserConfig(user)\n\tlog.Debugf(\"user config: %#v\", c)\n\n\tif *maxNumberClientConfig > 0 {\n\t\tif len(c.Clients) >= *maxNumberClientConfig {\n\t\t\tlog.Error(fmt.Errorf(\"user %q have too many configs\", c.Name))\n\n\t\t\te := struct {\n\t\t\t\tError string\n\t\t\t}{\n\t\t\t\tError: \"Max number of configs: \" + strconv.Itoa(*maxNumberClientConfig),\n\t\t\t}\n\n\t\t\tw.WriteHeader(http.StatusBadRequest)\n\t\t\terr := json.NewEncoder(w).Encode(e)\n\t\t\tif err != nil {\n\t\t\t\tlog.Error(err)\n\t\t\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\t\t\treturn\n\t\t\t}\n\t\t\treturn\n\t\t}\n\t}\n\n\tdecoder := json.NewDecoder(r.Body)\n\tnewclient := &NewClient{}\n\terr := decoder.Decode(&newclient)\n\tif err != nil {\n\t\tlog.Warn(\"Error parsing request: \", err)\n\t\tw.WriteHeader(http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tif newclient.Name == \"\" {\n\t\tlog.Debugf(\"No clientName:using default: \\\"Unnamed Client\\\"\")\n\t\tnewclient.Name = \"Unnamed Client\"\n\t}\n\n\tif err := verifyLinkMTU(newclient.MTU); err != nil {\n\t\tlog.Debugf(\"Invalid new client MTU: %d\", newclient.MTU)\n\t\tif err := verifyLinkMTU(*wgPeerMtu); err != nil {\n\t\t\tlog.Debugf(\"Invalid peer MTU: %d\", *wgPeerMtu)\n\t\t\tnewclient.MTU = wgDefaultMtu\n\t\t} else {\n\t\t\tnewclient.MTU = *wgPeerMtu\n\t\t}\n\t}\n\n\ti := 0\n\tfor k := range c.Clients {\n\t\tn, err := strconv.Atoi(k)\n\t\tif err != nil {\n\t\t\tlog.Error(err)\n\t\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\tif n > i {\n\t\t\ti = n\n\t\t}\n\t}\n\ti = i + 1\n\n\tip := s.allocateIP()\n\tclient := NewClientConfig(newclient.Name, ip, newclient.MTU, newclient.Notes, newclient.GeneratePSK)\n\tc.Clients[strconv.Itoa(i)] = client\n\n\ts.reconfigure()\n\n\terr = json.NewEncoder(w).Encode(client)\n\tif err != nil {\n\t\tlog.Error(err)\n\t\tw.WriteHeader(http.StatusInternalServerError)\n\t\treturn\n\t}\n}\n" }, { "path": "ui/.babelrc", "content": "{\n \"presets\": [\n [\"@babel/preset-env\", {\n \"targets\": {\n \"node\": \"current\"\n }\n }]\n ]\n}" }, { "path": "ui/.gitignore", "content": "node_modules\n.idea\n" }, { "path": "ui/.prettierrc", "content": "{\n \"singleQuote\": false,\n \"printWidth\": 120,\n \"useTabs\": false,\n \"tabWidth\": 4,\n \"jsxBracketSameLine\": true,\n \"semi\": true,\n \"bracketSpacing\": false,\n \"arrowParens\": \"always\"\n}" }, { "path": "ui/jest.config.js", "content": "// For a detailed explanation regarding each configuration property, visit:\n// https://jestjs.io/docs/en/configuration.html\n\nmodule.exports = {\n // All imported modules in your tests should be mocked automatically\n // automock: false,\n\n // Stop running tests after `n` failures\n // bail: 0,\n\n // Respect \"browser\" field in package.json when resolving modules\n // browser: false,\n\n // The directory where Jest should store its cached dependency information\n // cacheDirectory: \"/tmp/jest_rs\",\n\n // Automatically clear mock calls and instances between every test\n // clearMocks: false,\n\n // Indicates whether the coverage information should be collected while executing the test\n // collectCoverage: false,\n\n // An array of glob patterns indicating a set of files for which coverage information should be collected\n // collectCoverageFrom: null,\n\n // The directory where Jest should output its coverage files\n // coverageDirectory: null,\n\n // An array of regexp pattern strings used to skip coverage collection\n // coveragePathIgnorePatterns: [\n // \"/node_modules/\"\n // ],\n\n // A list of reporter names that Jest uses when writing coverage reports\n // coverageReporters: [\n // \"json\",\n // \"text\",\n // \"lcov\",\n // \"clover\"\n // ],\n\n // An object that configures minimum threshold enforcement for coverage results\n // coverageThreshold: null,\n\n // A path to a custom dependency extractor\n // dependencyExtractor: null,\n\n // Make calling deprecated APIs throw helpful error messages\n // errorOnDeprecated: false,\n\n // Force coverage collection from ignored files using an array of glob patterns\n // forceCoverageMatch: [],\n\n // A path to a module which exports an async function that is triggered once before all test suites\n // globalSetup: null,\n\n // A path to a module which exports an async function that is triggered once after all test suites\n // globalTeardown: null,\n\n // A set of global variables that need to be available in all test environments\n // globals: {},\n\n // The maximum amount of workers used to run your tests. Can be specified as % or a number. E.g. maxWorkers: 10% will use 10% of your CPU amount + 1 as the maximum worker number. maxWorkers: 2 will use a maximum of 2 workers.\n // maxWorkers: \"50%\",\n\n // An array of directory names to be searched recursively up from the requiring module's location\n // moduleDirectories: [\n // \"node_modules\"\n // ],\n\n // An array of file extensions your modules use\n // moduleFileExtensions: [\n // \"js\",\n // \"json\",\n // \"jsx\",\n // \"ts\",\n // \"tsx\",\n // \"node\"\n // ],\n\n // A map from regular expressions to module names that allow to stub out resources with a single module\n // moduleNameMapper: {},\n\n // An array of regexp pattern strings, matched against all module paths before considered 'visible' to the module loader\n // modulePathIgnorePatterns: [],\n\n // Activates notifications for test results\n // notify: false,\n\n // An enum that specifies notification mode. Requires { notify: true }\n // notifyMode: \"failure-change\",\n\n // A preset that is used as a base for Jest's configuration\n // preset: null,\n\n // Run tests from one or more projects\n // projects: null,\n\n // Use this configuration option to add custom reporters to Jest\n // reporters: undefined,\n\n // Automatically reset mock state between every test\n // resetMocks: false,\n\n // Reset the module registry before running each individual test\n // resetModules: false,\n\n // A path to a custom resolver\n // resolver: null,\n\n // Automatically restore mock state between every test\n // restoreMocks: false,\n\n // The root directory that Jest should scan for tests and modules within\n // rootDir: null,\n\n // A list of paths to directories that Jest should use to search for files in\n // roots: [\n // \"\"\n // ],\n\n // Allows you to use a custom runner instead of Jest's default test runner\n // runner: \"jest-runner\",\n\n // The paths to modules that run some code to configure or set up the testing environment before each test\n // setupFiles: [],\n\n // A list of paths to modules that run some code to configure or set up the testing framework before each test\n // setupFilesAfterEnv: [],\n\n // A list of paths to snapshot serializer modules Jest should use for snapshot testing\n // snapshotSerializers: [],\n\n // The test environment that will be used for testing\n testEnvironment: \"node\"\n\n // Options that will be passed to the testEnvironment\n // testEnvironmentOptions: {},\n\n // Adds a location field to test results\n // testLocationInResults: false,\n\n // The glob patterns Jest uses to detect test files\n // testMatch: [\n // \"**/__tests__/**/*.[jt]s?(x)\",\n // \"**/?(*.)+(spec|test).[tj]s?(x)\"\n // ],\n\n // An array of regexp pattern strings that are matched against all test paths, matched tests are skipped\n // testPathIgnorePatterns: [\n // \"/node_modules/\"\n // ],\n\n // The regexp pattern or array of patterns that Jest uses to detect test files\n // testRegex: [],\n\n // This option allows the use of a custom results processor\n // testResultsProcessor: null,\n\n // This option allows use of a custom test runner\n // testRunner: \"jasmine2\",\n\n // This option sets the URL for the jsdom environment. It is reflected in properties such as location.href\n // testURL: \"http://localhost\",\n\n // Setting this value to \"fake\" allows the use of fake timers for functions such as \"setTimeout\"\n // timers: \"real\",\n\n // A map from regular expressions to paths to transformers\n // transform: null,\n\n // An array of regexp pattern strings that are matched against all source file paths, matched files will skip transformation\n // transformIgnorePatterns: [\n // \"/node_modules/\"\n // ],\n\n // An array of regexp pattern strings that are matched against all modules before the module loader will automatically return a mock for them\n // unmockedModulePathPatterns: undefined,\n\n // Indicates whether each individual test should be reported during the run\n // verbose: null,\n\n // An array of regexp patterns that are matched against all source file paths before re-running tests in watch mode\n // watchPathIgnorePatterns: [],\n\n // Whether to use watchman for file crawling\n // watchman: true,\n};\n" }, { "path": "ui/package.json", "content": "{\n \"name\": \"wireguard-ui\",\n \"version\": \"1.0.0\",\n \"description\": \"WireGuard VPN web UI\",\n \"main\": \"index.js\",\n \"scripts\": {\n \"dev\": \"webpack-dev-server --mode=development --open --port 5000\",\n \"build\": \"cross-env NODE_ENV=production webpack --mode=production --progress\",\n \"test\": \"jest\",\n \"prettier\": \"prettier --check ./src/**/*.{js,css,json,md}\"\n },\n \"author\": \"Daniel Lundin \",\n \"license\": \"ISC\",\n \"dependencies\": {\n \"cookie-universal\": \"^2.0.16\"\n },\n \"devDependencies\": {\n \"@babel/cli\": \"^7.12.10\",\n \"@babel/core\": \"^7.11.6\",\n \"@babel/preset-env\": \"^7.11.5\",\n \"@material/typography\": \"^3.1.0\",\n \"@smui/button\": \"^1.0.0\",\n \"@smui/dialog\": \"^1.0.0\",\n \"@smui/fab\": \"^1.0.0\",\n \"@smui/form-field\": \"^1.0.0\",\n \"@smui/icon-button\": \"^1.0.0\",\n \"@smui/paper\": \"^1.0.0\",\n \"@smui/switch\": \"^1.0.0\",\n \"@smui/textfield\": \"^1.0.0\",\n \"@smui/top-app-bar\": \"^1.0.0\",\n \"babel-jest\": \"^24.9.0\",\n \"babel-loader\": \"^8.1.0\",\n \"clean-webpack-plugin\": \"^3.0.0\",\n \"cross-env\": \"^6.0.3\",\n \"css-loader\": \"^3.6.0\",\n \"html-webpack-plugin\": \"^3.2.0\",\n \"husky\": \"^3.1.0\",\n \"jest\": \"^24.9.0\",\n \"lint-staged\": \"^9.5.0\",\n \"mini-css-extract-plugin\": \"^0.8.2\",\n \"node-sass\": \"^4.14.1\",\n \"prettier\": \"^1.19.1\",\n \"sass-loader\": \"^8.0.2\",\n \"style-loader\": \"^1.2.1\",\n \"svelte\": \"^3.25.0\",\n \"svelte-loader\": \"^2.13.6\",\n \"svelte-routing\": \"1.4.0\",\n \"webpack\": \"^4.44.1\",\n \"webpack-cli\": \"^3.3.12\",\n \"webpack-dev-server\": \"^3.11.0\"\n },\n \"husky\": {\n \"hooks\": {\n \"pre-commit\": \"lint-staged\"\n }\n },\n \"lint-staged\": {\n \"*.{js,css,json,md}\": [\n \"prettier --write\",\n \"git add\"\n ]\n }\n}\n" }, { "path": "ui/src/About.svelte", "content": "

About

\n\n

\nWG UI is an Embark Studios Open Source project.\n

\n\n

\nFor contributions and feedback, please see the\nGitHub project.\n

\n\n

License

\n

\nWG UI is licensed under Apache License, Version 2.0\n

\n\n

Copyright © 2021, Embark Studios AB

\n\n\n" }, { "path": "ui/src/App.svelte", "content": "\n WireGuard VPN\n\n\n\n\n\n\n
\n\n \n\n
\n" }, { "path": "ui/src/Client.svelte", "content": "\n\n\n\n\n\n
\n edit\n
\n\n\n \"Mobile\n\n devices\n

\n {dev.Name}

\n\n
\n
IP
\n
{dev.IP}
\n
Public Key
\n
{dev.PublicKey}
\n
\n\n
\n \n
\n\n" }, { "path": "ui/src/Clients.svelte", "content": "\n\n\n\n
\n
\n
\n

My VPN Clients({user})

\n
\n
\n

Instructions

\n
    \n
  1. Install WireGuard
    2. \n
  2. Download your WireGuard config
    3. \n
  3. Connect to the VPN server
    4. \n
\n
\n
\n\n
\n\n {#each clients as dev}\n \n {/each}\n\n
\n add\n
\n\n\n" }, { "path": "ui/src/EditClient.svelte", "content": "\n\n\n\n
\narrow_back\n
\n\n

Client Properties ({client.Name})

\n\n
\n\n\n
\n\n
\n \n Friendly name of client / device\n
\n\n
\n \n Notes about the client.\n
\n
\n \n Additional allowed CIDR blocks accessible via the client separated by a newline\n
\n\n \n
\n
\n\n
\n

Additional Properties

\n
\n
IP Address
\n
{client.IP}
\n
Private Key
\n
{client.PrivateKey}
\n
Public Key
\n
{client.PublicKey}
\n
Preshared Key
\n
{client.PresharedKey}
\n
\n
\n\n
\n

Danger Zone

\n\n \n
\n Delete Client Config\n \n Are you sure you want to delete this client configuration?\n \n \n \n \n \n
\n \n\n \n\n
\n" }, { "path": "ui/src/Nav.svelte", "content": "\n\n\n\n\n \n
\n WireGuard VPN\n
\n
\n Logged in as {user}\n
\n \n\n" }, { "path": "ui/src/NavLink.svelte", "content": "\n\n\n \n\n" }, { "path": "ui/src/NewClient.svelte", "content": "\n\n\n\n
\narrow_back\n
\n\n

Create New Device Configuration

\n\n
\n\n\n
\n\n
\n \n Friendly name of client / device\n
\n\n
\n \n Notes about the client.\n
\n
\n \n \n Generate a Pre-shared Key\n \n
\n \n \n
\n
\n\n" }, { "path": "ui/src/index.ejs", "content": "\n\n\n \n \n \n <%= htmlWebpackPlugin.options.title %>\n \n \n \n\n\n\n\n" }, { "path": "ui/src/index.js", "content": "import \"./style.scss\";\nimport App from \"./App.svelte\";\n\nconst app = new App({\n target: document.body,\n props: {\n name: \"WireGuard VPN\"\n }\n});\n\nexport default app;\n" }, { "path": "ui/src/main.js", "content": "import App from './App.svelte';\n\nnew App({\n target: document.body,\n // hydrate: true,\n});\n\n" }, { "path": "ui/src/style.scss", "content": "@import \"@material/typography/mdc-typography\";\n\n.container {\n padding: 30px;\n}\n\nbody {\n margin: 0;\n padding: 0;\n}\n\n.float-right {\n float: right;\n}\n\ndl {\n display: flex;\n flex-flow: row wrap;\n}\n\ndt {\n flex-basis: 20%;\n font-weight: bold;\n text-align: right;\n}\n\ndd {\n flex-basis: 70%;\n flex-grow: 1;\n margin-left: 0.5em;\n overflow: hidden;\n}\n\n" }, { "path": "ui/theme/_smui-theme.scss", "content": "// Nothing here. Just use the default theme." }, { "path": "ui/webpack.config.js", "content": "const {CleanWebpackPlugin} = require(\"clean-webpack-plugin\");\nconst HtmlWebpackPlugin = require(\"html-webpack-plugin\");\nconst MiniCssExtractPlugin = require(\"mini-css-extract-plugin\");\nconst path = require(\"path\");\nconst webpack = require(\"webpack\");\n\nconst packageJSON = require(\"./package.json\");\n\nconst mode = process.env.NODE_ENV || \"development\";\nconst prod = mode === \"production\";\n\nconst devOverrides = {\n devServer: {\n historyApiFallback: true\n }\n};\nconst prodOverrides = {\n optimization: {\n minimize: true,\n splitChunks: {\n chunks: \"all\"\n }\n }\n};\n\nlet envOverride = prod ? prodOverrides : devOverrides;\n\nmodule.exports = {\n mode,\n entry: \"./src/index.js\",\n resolve: {\n alias: {\n svelte: path.resolve(\"node_modules\", \"svelte\")\n },\n extensions: [\".mjs\", \".js\", \".svelte\"],\n mainFields: [\"svelte\", \"browser\", \"module\", \"main\"]\n },\n devtool: prod\n ? \"source-map\" // For development\n : \"#eval-source-map\",\n output: {\n publicPath: \"/\",\n path: __dirname + \"/dist\",\n filename: \"[name].js\",\n chunkFilename: \"[name].[id].js\"\n },\n module: {\n rules: [\n {\n test: /\\.js$/,\n exclude: /(node_modules)/,\n use: {\n loader: \"babel-loader\"\n }\n },\n {\n test: /\\.s?css$/,\n use: [\n /**\n * MiniCssExtractPlugin doesn't support HMR.\n * For developing, use 'style-loader' instead.\n * */\n prod ? MiniCssExtractPlugin.loader : \"style-loader\",\n \"css-loader\",\n {\n loader: \"sass-loader\",\n options: {\n sassOptions: {\n includePaths: [\"./theme\", \"./node_modules\"]\n }\n }\n }\n ]\n },\n {\n test: /\\.svelte$/,\n use: {\n loader: \"svelte-loader\",\n options: {\n emitCss: true,\n hotReload: true\n }\n }\n }\n ]\n },\n plugins: [\n new webpack.ProgressPlugin(),\n new webpack.EnvironmentPlugin({\n NODE_ENV: mode,\n DEBUG: !prod\n }),\n new CleanWebpackPlugin(),\n new HtmlWebpackPlugin({\n title: packageJSON.name,\n hash: true,\n filename: \"./index.html\", //relative to root of the application\n template: \"./src/index.ejs\",\n favicon: \"assets/favicon.png\"\n }),\n new MiniCssExtractPlugin({\n filename: \"[name].css\"\n })\n ],\n ...envOverride\n};\n" }, { "path": "wg-go-ui.sh", "content": "#!/bin/sh\n\nset -eux\n\n# need `SYS_ADMIN` and `NET_ADMIN` capabilities.\nmkdir -p /dev/net\nTUNFILE=/dev/net/tun\n[ ! -c $TUNFILE ] && mknod $TUNFILE c 10 200\n\n# Start the first process\n./wireguard-go ${WIREGUARD_UI_WG_DEVICE_NAME:-wg0}\nstatus=$?\nif [ $status -ne 0 ]; then\n echo \"Failed to start wireguard-go: $status\"\n exit $status\nfi\n\n# Start the second process\n./wireguard-ui $@\nstatus=$?\nif [ $status -ne 0 ]; then\n echo \"Failed to start wireguard-ui: $status\"\n exit $status\nfi\n\n# Naive check runs checks once a minute to see if either of the processes exited.\n# This illustrates part of the heavy lifting you need to do if you want to run\n# more than one service in a container. The container exits with an error\n# if it detects that either of the processes has exited.\n# Otherwise it loops forever, waking up every 60 seconds\n\nwhile sleep 60; do\n ps aux |grep wireguard-go |grep -q -v grep\n PROCESS_1_STATUS=$?\n ps aux |grep wireguard-ui |grep -q -v grep\n PROCESS_2_STATUS=$?\n # If the greps above find anything, they exit with 0 status\n # If they are not both 0, then something is wrong\n if [ $PROCESS_1_STATUS -ne 0 -o $PROCESS_2_STATUS -ne 0 ]; then\n echo \"One of the processes has already exited.\"\n exit 1\n fi\ndone\n" } ]