Repository: EmbarkStudios/wireguard-ui
Branch: main
Commit: 12fba36a5589
Files: 46
Total size: 123.5 KB

Directory structure:
gitextract_yyoo015_/

├── .github/
│   ├── CODEOWNERS
│   ├── ISSUE_TEMPLATE/
│   │   ├── bug_report.md
│   │   └── feature_request.md
│   └── workflows/
│       ├── pull_request.yaml
│       ├── push_master.yaml
│       └── release.yaml
├── .gitignore
├── CHANGELOG.md
├── CODE_OF_CONDUCT.md
├── CONTRIBUTING.md
├── Dockerfile
├── Dockerfile.debug
├── LICENSE-APACHE
├── LICENSE-MIT
├── Makefile
├── README.md
├── UserSpace.Dockerfile
├── config.go
├── doc/
│   ├── auth-google-sso.md
│   └── auth-shibboleth-sso.md
├── docker-compose.userspace.yml
├── docker-compose.yml
├── go.mod
├── go.sum
├── main.go
├── server.go
├── ui/
│   ├── .babelrc
│   ├── .gitignore
│   ├── .prettierrc
│   ├── jest.config.js
│   ├── package.json
│   ├── src/
│   │   ├── About.svelte
│   │   ├── App.svelte
│   │   ├── Client.svelte
│   │   ├── Clients.svelte
│   │   ├── EditClient.svelte
│   │   ├── Nav.svelte
│   │   ├── NavLink.svelte
│   │   ├── NewClient.svelte
│   │   ├── index.ejs
│   │   ├── index.js
│   │   ├── main.js
│   │   └── style.scss
│   ├── theme/
│   │   └── _smui-theme.scss
│   └── webpack.config.js
└── wg-go-ui.sh

================================================
FILE CONTENTS
================================================

================================================
FILE: .github/CODEOWNERS
================================================
* @suom1


================================================
FILE: .github/ISSUE_TEMPLATE/bug_report.md
================================================
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: bug
assignees: ''

---

**Describe the bug**
A clear and concise description of what the bug is.

**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

**Expected behavior**
A clear and concise description of what you expected to happen.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Device:**
 - OS: [e.g. iOS]
 - Browser [e.g. chrome, safari]
 - Version [e.g. 22]

**Additional context**
Add any other context about the problem here.


================================================
FILE: .github/ISSUE_TEMPLATE/feature_request.md
================================================
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: enhancement
assignees: ''

---

**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

**Describe the solution you'd like**
A clear and concise description of what you want to happen.

**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.

**Additional context**
Add any other context or screenshots about the feature request here.


================================================
FILE: .github/workflows/pull_request.yaml
================================================
name: PR
on:
  push:
    branches-ignore: main
  pull_request:
    branches:
      - main

jobs:
  review:
    name: Code Review
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: actions/setup-node@v2
      with:
        node-version: '14'
    - uses: actions/setup-go@v2
      with:
        go-version: '1.17'

    - name: npm install and build
      run: |
        npm install --prefix ui
        npm run --prefix ui build

    - name: Check styling error
      run: go install golang.org/x/lint/golint@latest; golint -set_exit_status main.go server.go config.go

    - name: Check missing error check
      run: go install github.com/kisielk/errcheck@latest; errcheck ./...

    - name: Check suspicious constructs (1)
      run: go install honnef.co/go/tools/cmd/staticcheck@latest; staticcheck -checks all,-ST1003,-U1000,-ST1005,-SA9002 ./... # have to disable ST1003,U1000,ST1005 due to the generated code

    - name: Check suspicious constructs (2)
      run: go vet ./...

    - name: Check security issues with gosec
      run: go install github.com/securego/gosec/cmd/gosec@latest; gosec ./... # https://github.com/securego/gosec

  build:
    name: Build wg-ui
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: actions/setup-node@v2
      with:
        node-version: '14'
    - uses: actions/setup-go@v2
      with:
        go-version: '1.17'

    - name: Build binary
      run: make build

    - name: Check binary
      run: file bin/wireguard-ui

    - name: Cleanup
      run: rm -rf bin/


================================================
FILE: .github/workflows/push_master.yaml
================================================
name: Main

on:
  push:
    branches:
      - main

jobs:
  docker-build:
    name: Docker Main
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: docker/setup-qemu-action@v1
      - uses: docker/setup-buildx-action@v1
      - uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - uses: actions/cache@v2
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Build and push
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: embarkstudios/wireguard-ui:latest
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache

  docker-userspace:
    name: Docker UserSpace
    runs-on: ubuntu-latest
    needs: docker-build
    steps:
      - uses: actions/checkout@v2
      - uses: docker/setup-qemu-action@v1
      - uses: docker/setup-buildx-action@v1
      - uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - uses: actions/cache@v2
        with:
          path: /tmp/.buildx-cache-userspace
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Build and push
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./UserSpace.Dockerfile
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: embarkstudios/wireguard-ui:userspace
          cache-from: type=local,src=/tmp/.buildx-cache-userspace
          cache-to: type=local,dest=/tmp/.buildx-cache-userspace

  docker-debug:
    name: Docker Debug
    runs-on: ubuntu-latest
    needs: [docker-build, docker-userspace]
    steps:
      - uses: actions/checkout@v2
      - uses: docker/setup-qemu-action@v1
      - uses: docker/setup-buildx-action@v1
      - uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - uses: actions/cache@v2
        with:
          path: /tmp/.buildx-cache-debug
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Build and push
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./Dockerfile.debug
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: embarkstudios/wireguard-ui:debug
          cache-from: type=local,src=/tmp/.buildx-cache-debug
          cache-to: type=local,dest=/tmp/.buildx-cache-debug


================================================
FILE: .github/workflows/release.yaml
================================================
name: Release

on:
  push:
    branches:
      - main
    tags:
      - v*

jobs:
  release-docker:
    name: Docker
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: docker/setup-qemu-action@v1
      - uses: docker/setup-buildx-action@v1
      - uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Set environment variable for version tag
        run: echo "WG-UI-VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV

      - name: Build and push
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: embarkstudios/wireguard-ui:${{ env.WG-UI-VERSION }}

      - name: Clear
        if: always()
        run: |
          rm -f ${HOME}/.docker/config.json

  release-binary:
    name: Binary
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: actions/setup-node@v2
      with:
        node-verison: '14'
    - uses: actions/setup-go@v2
      with:
        go-version: '1.17'

    - name: Build UI
      run: |
        make ui

    - name: Build wg-ui for Linux (AMD64)
      run: |
        name=wg-ui
        target=linux-amd64
        release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
        release_tar="$release_name.tar.gz"
        env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o "$release_name"
        tar czvf "$release_tar" "$release_name"
        echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
        rm "$release_name"

    - name: Build wg-ui for Linux (ARMv5)
      run: |
        name=wg-ui
        target=linux-armv5
        release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
        release_tar="$release_name.tar.gz"
        env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 go build -o "$release_name"
        tar czvf "$release_tar" "$release_name"
        echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
        rm "$release_name"

    - name: Build wg-ui for Linux (ARMv6)
      run: |
        name=wg-ui
        target=linux-armv6
        release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
        release_tar="$release_name.tar.gz"
        env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -o "$release_name"
        tar czvf "$release_tar" "$release_name"
        echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
        rm "$release_name"

    - name: Build wg-ui for Linux (ARMv7)
      run: |
        name=wg-ui
        target=linux-armv7
        release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
        release_tar="$release_name.tar.gz"
        env CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -o "$release_name"
        tar czvf "$release_tar" "$release_name"
        echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
        rm "$release_name"

    - name: Build wg-ui for Linux (ARM64)
      run: |
        name=wg-ui
        target=linux-arm64
        release_name="$name-${GITHUB_REF#refs/tags/v}-$target"
        release_tar="$release_name.tar.gz"
        env CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -o "$release_name"
        tar czvf "$release_tar" "$release_name"
        echo -n "$(shasum -ba 256 "${release_tar}" | cut -d " " -f 1)" > "${release_tar}.sha256"
        rm "$release_name"

    - name: List content
      run: |
        ls -lah wg-ui*

    - name: GitHub Release
      uses: softprops/action-gh-release@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        draft: true
        files: "wg-ui-*"


================================================
FILE: .gitignore
================================================
.DS_Store
/wireguard-ui
/bindata.go
ui/public/bundle.*
node_modules
bin
.idea
dist


================================================
FILE: CHANGELOG.md
================================================
# Changelog
All notable changes to this project will be documented in this file.

<!-- next-header -->
## [Unreleased]

## [v1.3.1] - 2023-02-23
### Fixes
- [PR#179](https://github.com/EmbarkStudios/wg-ui/pull/179) Add locks to all functions touching the config
### Changes
- [PR#163](https://github.com/EmbarkStudios/wg-ui/pull/163) Add support for user/pass authentication. Thanks to [@snowzach](https://github.com/snowzach)!
- [PR#149](https://github.com/EmbarkStudios/wg-ui/pull/149) Revert name back to wireguard-ui
- [PR#148](https://github.com/EmbarkStudios/wg-ui/pull/148) Update dependencies and golang to 1.17

## [v1.3.0] - 2021-09-07
### Added
- [PR#141](https://github.com/EmbarkStudios/wg-ui/pull/141) Added support for additional allowed IPs. Thanks to [@gertdreyer](https://github.com/gertdreyer)!
- [PR#140](https://github.com/EmbarkStudios/wg-ui/pull/140) Optional generation Preshared Key when creating a new client. Thanks to [@gertdreyer](https://github.com/gertdreyer)!


## [v1.2.1] - 2021-07-27
### Fixes
- [PR#139](https://github.com/EmbarkStudios/wg-ui/pull/139) Fix for versioned docker releases.

## [v1.2.0] - 2021-07-26
### Added
- [PR#113](https://github.com/EmbarkStudios/wg-ui/pull/113) Adding AWS ALB-specific header for username. Thanks to [@justnom](https://github.com/justnom)!
- [PR#86](https://github.com/EmbarkStudios/wg-ui/pull/86) User sapce image for Docker. Thanks to [@m0ssc0de](https://github.com/m0ssc0de)!
- [PR#80](https://github.com/EmbarkStudios/wg-ui/pull/80) Shibboleth SP documentation. Thanks to [@theseal](https://github.com/theseal)!
- [PR#79](https://github.com/EmbarkStudios/wg-ui/pull/79) Google SSO documentation.

### Fixes
- [PR#136](https://github.com/EmbarkStudios/wg-ui/pull/136) Prevent full reload of wireguard interface. Thanks to [@gertdreyer](https://github.com/gertdreyer)!
- [PR#135](https://github.com/EmbarkStudios/wg-ui/pull/135) Remove external dependencies for embedding assets. Thanks to [@thomasf](https://github.com/thomasf)!
- [PR#114](https://github.com/EmbarkStudios/wg-ui/pull/114) Add docker-compose example. Thanks to [@ilyazzz](https://github.com/ilyazzz)!
- [PR#70](https://github.com/EmbarkStudios/wg-ui/pull/70) Disable CGO. Thanks to [@condemil](https://github.com/condemil)!

## [v1.1.0] - 2020-05-06
### Added 
- [PR#49](https://github.com/EmbarkStudios/wg-ui/pull/49) Set name and label at creation of client. Thanks to [@spetzreborn](https://github.com/spetzreborn)!
- [PR#47](https://github.com/EmbarkStudios/wg-ui/pull/47) Add limit in how many configurations each user may have. Thanks to [@spetzreborn](https://github.com/spetzreborn)!
- [PR#44](https://github.com/EmbarkStudios/wg-ui/pull/44) Add timestamp to config. Thanks to [@spetzreborn](https://github.com/spetzreborn)!
- [PR#41](https://github.com/EmbarkStudios/wg-ui/pull/41) Add `--no-nat` flag to disable NAT, NAT remains on by default.

### Fixed
- [PR#57](https://github.com/EmbarkStudios/wg-ui/pull/57) Fix gosec issues. Thanks to [@Sohalt](https://github.com/Sohalt)!
- [PR#50](https://github.com/EmbarkStudios/wg-ui/pull/50) Update documentation for configuration. Thanks to [@Sohalt](https://github.com/Sohalt)!
- [PR#35](https://github.com/EmbarkStudios/wg-ui/pull/35) Avoid "async race" with new client POST. Thanks to [@sclem](https://github.com/sclem)!
- [PR#31](https://github.com/EmbarkStudios/wg-ui/pull/31) Only enable IP forwarding if it is disabled. Thanks to [@eest](https://github.com/eest)!

### Changed
- Name of project changed from `wireguard-ui` to `wg-ui`

## [v1.0.0] - 2019-10-12
### Added
- This is the initial release of wireguard-ui

<!-- next-url -->
[Unreleased]: https://github.com/EmbarkStudios/wg-ui/compare/v1.3.0...HEAD
[v1.3.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.2.1...v1.3.0
[v1.2.1]: https://github.com/EmbarkStudios/wg-ui/compare/v1.2.0...v1.2.1
[v1.2.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.1.0...v1.2.0
[v1.1.0]: https://github.com/EmbarkStudios/wg-ui/compare/v1.0.0...v1.1.0
[v1.0.0]: https://github.com/EmbarkStudios/wg-ui/releases/tag/v1.0.0


================================================
FILE: CODE_OF_CONDUCT.md
================================================
# Contributor Covenant Code of Conduct

## Our Pledge

In the interest of fostering an open and welcoming environment, we as
contributors and maintainers pledge to making participation in our project and
our community a harassment-free experience for everyone, regardless of age, body
size, disability, ethnicity, sex characteristics, gender identity and expression,
level of experience, education, socio-economic status, nationality, personal
appearance, race, religion, or sexual identity and orientation.

## Our Standards

Examples of behavior that contributes to creating a positive environment
include:

* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members

Examples of unacceptable behavior by participants include:

* The use of sexualized language or imagery and unwelcome sexual attention or
 advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic
 address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a
 professional setting

## Our Responsibilities

Project maintainers are responsible for clarifying the standards of acceptable
behavior and are expected to take appropriate and fair corrective action in
response to any instances of unacceptable behavior.

Project maintainers have the right and responsibility to remove, edit, or
reject comments, commits, code, wiki edits, issues, and other contributions
that are not aligned to this Code of Conduct, or to ban temporarily or
permanently any contributor for other behaviors that they deem inappropriate,
threatening, offensive, or harmful.

## Scope

This Code of Conduct applies both within project spaces and in public spaces
when an individual is representing the project or its community. Examples of
representing a project or community include using an official project e-mail
address, posting via an official social media account, or acting as an appointed
representative at an online or offline event. Representation of a project may be
further defined and clarified by project maintainers.

## Enforcement

Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at opensource@embark-studios.com. All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.

Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.

## Attribution

This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html

[homepage]: https://www.contributor-covenant.org

For answers to common questions about this code of conduct, see
https://www.contributor-covenant.org/faq


================================================
FILE: CONTRIBUTING.md
================================================
# Embark Contributor Guidelines

Welcome! This project is created by the team at [Embark Studios](https://embark.games). We're glad you're interested in contributing! We welcome contributions from people of all backgrounds who are interested in making great software with us.

At Embark, we aspire to empower everyone to create interactive experiences. To do this, we're exploring and pushing the boundaries of new technologies, and sharing our learnings with the open source community.

If you have ideas for collaboration, email us at opensource@embark-studios.com.

We're also hiring full-time engineers to work with us in Stockholm! Check out our current job postings [here](https://embark.games/careers).

## Issues

### Feature Requests

If you have ideas or how to improve our projects, you can suggest features by opening a GitHub issue. Make sure to include details about the feature or change, and describe any uses cases it would enable.

Feature requests will be tagged as `enhancement` and their status will be updated in the comments of the issue.

### Bugs

When reporting a bug or unexpected behaviour in a project, make sure your issue descibes steps to reproduce the behaviour, including the platform you were using, what steps you took, and any error messages.

Reproducible bugs will be tagged as `bug` and their status will be updated in the comments of the issue.

### Wontfix

Issues will be closed and tagged as `wontfix` if we decide that we do not wish to implement it, usually due to being misaligned with the project vision or out of scope. We will comment on the issue with more detailed reasoning.

## Contribution Workflow

### Open Issues

If you're ready to contribute, start by looking at our open issues tagged as [`help wanted`](../../issues?q=is%3Aopen+is%3Aissue+label%3A"help+wanted") or [`good first issue`](../../issues?q=is%3Aopen+is%3Aissue+label%3A"good+first+issue").

You can comment on the issue to let others know you're interested in working on it or to ask questions.

### Making Changes

1. Fork the repository.

2. Create a new feature branch.

3. Make your changes. Ensure that there are no build errors by running the project with your changes locally.

4. Open a pull request with a name and description of what you did. You can read more about working with pull requests on GitHub [here](https://help.github.com/en/articles/creating-a-pull-request-from-a-fork).

5. A maintainer will review your pull request and may ask you to make changes.

## Code Guidelines

### Rust

You can read about our standards and recommendations for working with Rust [here](https://github.com/EmbarkStudios/rust-ecosystem/blob/master/guidelines.md).

### Python

We recommend following [PEP8 conventions](https://www.python.org/dev/peps/pep-0008/) when working with Python modules.

## Licensing

Unless otherwise specified, all Embark open source projects are licensed under a dual MIT OR Apache-2.0 license, allowing licensees to chose either at their option. You can read more in each project's respective README.

## Code of Conduct

Please note that our projects are released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md) to ensure that they are welcoming places for everyone to contribute. By participating in any Embark open source project, you agree to abide by these terms.


================================================
FILE: Dockerfile
================================================
FROM docker.io/node:12 AS ui
WORKDIR /ui
COPY ui/package.json ui/package-lock.json /ui/
RUN npm install
COPY ui .
RUN npm run build

FROM docker.io/golang:latest AS build
WORKDIR /wg
COPY go.mod .
COPY go.sum .
RUN go mod download
COPY . .
COPY --from=ui /ui/dist ui/dist
RUN go install .

FROM gcr.io/distroless/base
COPY --from=build /go/bin/wireguard-ui /
ENTRYPOINT [ "/wireguard-ui" ]


================================================
FILE: Dockerfile.debug
================================================
FROM embarkstudios/wireguard-ui AS latest

FROM ubuntu:20.04
RUN apt-get update -y && \
    apt-get install -y software-properties-common iptables curl iproute2 ifupdown iputils-ping && \
    echo resolvconf resolvconf/linkify-resolvconf boolean false | debconf-set-selections && \
    echo "REPORT_ABSENT_SYMLINK=no" >> /etc/default/resolvconf && \
    apt-get install resolvconf
RUN apt-get install -qy --no-install-recommends wireguard
COPY --from=latest /wireguard-ui /
ENTRYPOINT [ "/wireguard-ui" ]


================================================
FILE: LICENSE-APACHE
================================================
                              Apache License
                        Version 2.0, January 2004
                     http://www.apache.org/licenses/

TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

1. Definitions.

   "License" shall mean the terms and conditions for use, reproduction,
   and distribution as defined by Sections 1 through 9 of this document.

   "Licensor" shall mean the copyright owner or entity authorized by
   the copyright owner that is granting the License.

   "Legal Entity" shall mean the union of the acting entity and all
   other entities that control, are controlled by, or are under common
   control with that entity. For the purposes of this definition,
   "control" means (i) the power, direct or indirect, to cause the
   direction or management of such entity, whether by contract or
   otherwise, or (ii) ownership of fifty percent (50%) or more of the
   outstanding shares, or (iii) beneficial ownership of such entity.

   "You" (or "Your") shall mean an individual or Legal Entity
   exercising permissions granted by this License.

   "Source" form shall mean the preferred form for making modifications,
   including but not limited to software source code, documentation
   source, and configuration files.

   "Object" form shall mean any form resulting from mechanical
   transformation or translation of a Source form, including but
   not limited to compiled object code, generated documentation,
   and conversions to other media types.

   "Work" shall mean the work of authorship, whether in Source or
   Object form, made available under the License, as indicated by a
   copyright notice that is included in or attached to the work
   (an example is provided in the Appendix below).

   "Derivative Works" shall mean any work, whether in Source or Object
   form, that is based on (or derived from) the Work and for which the
   editorial revisions, annotations, elaborations, or other modifications
   represent, as a whole, an original work of authorship. For the purposes
   of this License, Derivative Works shall not include works that remain
   separable from, or merely link (or bind by name) to the interfaces of,
   the Work and Derivative Works thereof.

   "Contribution" shall mean any work of authorship, including
   the original version of the Work and any modifications or additions
   to that Work or Derivative Works thereof, that is intentionally
   submitted to Licensor for inclusion in the Work by the copyright owner
   or by an individual or Legal Entity authorized to submit on behalf of
   the copyright owner. For the purposes of this definition, "submitted"
   means any form of electronic, verbal, or written communication sent
   to the Licensor or its representatives, including but not limited to
   communication on electronic mailing lists, source code control systems,
   and issue tracking systems that are managed by, or on behalf of, the
   Licensor for the purpose of discussing and improving the Work, but
   excluding communication that is conspicuously marked or otherwise
   designated in writing by the copyright owner as "Not a Contribution."

   "Contributor" shall mean Licensor and any individual or Legal Entity
   on behalf of whom a Contribution has been received by Licensor and
   subsequently incorporated within the Work.

2. Grant of Copyright License. Subject to the terms and conditions of
   this License, each Contributor hereby grants to You a perpetual,
   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
   copyright license to reproduce, prepare Derivative Works of,
   publicly display, publicly perform, sublicense, and distribute the
   Work and such Derivative Works in Source or Object form.

3. Grant of Patent License. Subject to the terms and conditions of
   this License, each Contributor hereby grants to You a perpetual,
   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
   (except as stated in this section) patent license to make, have made,
   use, offer to sell, sell, import, and otherwise transfer the Work,
   where such license applies only to those patent claims licensable
   by such Contributor that are necessarily infringed by their
   Contribution(s) alone or by combination of their Contribution(s)
   with the Work to which such Contribution(s) was submitted. If You
   institute patent litigation against any entity (including a
   cross-claim or counterclaim in a lawsuit) alleging that the Work
   or a Contribution incorporated within the Work constitutes direct
   or contributory patent infringement, then any patent licenses
   granted to You under this License for that Work shall terminate
   as of the date such litigation is filed.

4. Redistribution. You may reproduce and distribute copies of the
   Work or Derivative Works thereof in any medium, with or without
   modifications, and in Source or Object form, provided that You
   meet the following conditions:

   (a) You must give any other recipients of the Work or
       Derivative Works a copy of this License; and

   (b) You must cause any modified files to carry prominent notices
       stating that You changed the files; and

   (c) You must retain, in the Source form of any Derivative Works
       that You distribute, all copyright, patent, trademark, and
       attribution notices from the Source form of the Work,
       excluding those notices that do not pertain to any part of
       the Derivative Works; and

   (d) If the Work includes a "NOTICE" text file as part of its
       distribution, then any Derivative Works that You distribute must
       include a readable copy of the attribution notices contained
       within such NOTICE file, excluding those notices that do not
       pertain to any part of the Derivative Works, in at least one
       of the following places: within a NOTICE text file distributed
       as part of the Derivative Works; within the Source form or
       documentation, if provided along with the Derivative Works; or,
       within a display generated by the Derivative Works, if and
       wherever such third-party notices normally appear. The contents
       of the NOTICE file are for informational purposes only and
       do not modify the License. You may add Your own attribution
       notices within Derivative Works that You distribute, alongside
       or as an addendum to the NOTICE text from the Work, provided
       that such additional attribution notices cannot be construed
       as modifying the License.

   You may add Your own copyright statement to Your modifications and
   may provide additional or different license terms and conditions
   for use, reproduction, or distribution of Your modifications, or
   for any such Derivative Works as a whole, provided Your use,
   reproduction, and distribution of the Work otherwise complies with
   the conditions stated in this License.

5. Submission of Contributions. Unless You explicitly state otherwise,
   any Contribution intentionally submitted for inclusion in the Work
   by You to the Licensor shall be under the terms and conditions of
   this License, without any additional terms or conditions.
   Notwithstanding the above, nothing herein shall supersede or modify
   the terms of any separate license agreement you may have executed
   with Licensor regarding such Contributions.

6. Trademarks. This License does not grant permission to use the trade
   names, trademarks, service marks, or product names of the Licensor,
   except as required for reasonable and customary use in describing the
   origin of the Work and reproducing the content of the NOTICE file.

7. Disclaimer of Warranty. Unless required by applicable law or
   agreed to in writing, Licensor provides the Work (and each
   Contributor provides its Contributions) on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
   implied, including, without limitation, any warranties or conditions
   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
   PARTICULAR PURPOSE. You are solely responsible for determining the
   appropriateness of using or redistributing the Work and assume any
   risks associated with Your exercise of permissions under this License.

8. Limitation of Liability. In no event and under no legal theory,
   whether in tort (including negligence), contract, or otherwise,
   unless required by applicable law (such as deliberate and grossly
   negligent acts) or agreed to in writing, shall any Contributor be
   liable to You for damages, including any direct, indirect, special,
   incidental, or consequential damages of any character arising as a
   result of this License or out of the use or inability to use the
   Work (including but not limited to damages for loss of goodwill,
   work stoppage, computer failure or malfunction, or any and all
   other commercial damages or losses), even if such Contributor
   has been advised of the possibility of such damages.

9. Accepting Warranty or Additional Liability. While redistributing
   the Work or Derivative Works thereof, You may choose to offer,
   and charge a fee for, acceptance of support, warranty, indemnity,
   or other liability obligations and/or rights consistent with this
   License. However, in accepting such obligations, You may act only
   on Your own behalf and on Your sole responsibility, not on behalf
   of any other Contributor, and only if You agree to indemnify,
   defend, and hold each Contributor harmless for any liability
   incurred by, or claims asserted against, such Contributor by reason
   of your accepting any such warranty or additional liability.

END OF TERMS AND CONDITIONS

APPENDIX: How to apply the Apache License to your work.

   To apply the Apache License to your work, attach the following
   boilerplate notice, with the fields enclosed by brackets "[]"
   replaced with your own identifying information. (Don't include
   the brackets!)  The text should be enclosed in the appropriate
   comment syntax for the file format. We also recommend that a
   file or class name and description of purpose be included on the
   same "printed page" as the copyright notice for easier
   identification within third-party archives.

Copyright [yyyy] [name of copyright owner]

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.


================================================
FILE: LICENSE-MIT
================================================
Copyright (c) 2019 Embark Studios

Permission is hereby granted, free of charge, to any
person obtaining a copy of this software and associated
documentation files (the "Software"), to deal in the
Software without restriction, including without
limitation the rights to use, copy, modify, merge,
publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software
is furnished to do so, subject to the following
conditions:

The above copyright notice and this permission notice
shall be included in all copies or substantial portions
of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.


================================================
FILE: Makefile
================================================
# Parameters
GOCMD=go
GOBUILD=$(GOCMD) build
GOCLEAN=$(GOCMD) clean
GOGET=$(GOCMD) get
BINARY_NAME=wireguard-ui

.PHONY: build container ui

all: build

clean:
	$(GOCLEAN)
	rm -rf bin
	rm -rf ui/node_modules ui/dist

ui:
	cd ui && npm install && npm run build

build: ui
	CGO_ENABLED=0 $(GOBUILD) -o bin/$(BINARY_NAME) -v

build-amd64: ui
        CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GOBUILD) -o bin/$(BINARY_NAME)-amd64 -v

build-armv5: ui
	CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 $(GOBUILD) -o bin/$(BINARY_NAME)-armv5 -v

build-armv6: ui
	CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 $(GOBUILD) -o bin/$(BINARY_NAME)-armv6 -v

build-armv7: ui
	CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o bin/$(BINARY_NAME)-armv7 -v

build-armv8: ui
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GOBUILD) -o bin/$(BINARY_NAME)-armv8 -v

container:
	docker build -t wireguard-ui .

run-dev:
	sudo ./bin/$(BINARY_NAME) --log-level=debug --dev-ui-server=http://localhost:5000

run-dev-ui:
	cd ui && npm run dev


================================================
FILE: README.md
================================================
# WG UI
![Build Status](https://github.com/EmbarkStudios/wg-ui/actions/workflows/push_master.yaml/badge.svg)
[![Embark](https://img.shields.io/badge/embark-open%20source-blueviolet.svg)](https://github.com/EmbarkStudios)
[![Contributor Covenant](https://img.shields.io/badge/contributor%20covenant-v1.4%20adopted-ff69b4.svg)](CODE_OF_CONDUCT.md)

A basic, self-contained management service for [WireGuard](https://wireguard.com) with a self-serve web UI.  
Current stable release: [v1.3.0](https://github.com/EmbarkStudios/wg-ui/releases/tag/v1.3.0)  

## Features

 * Self-serve and web based
 * QR-Code for convenient mobile client configuration
 * Optional multi-user support behind an authenticating proxy
 * Simple authentication support
 * Zero external dependencies - just a single binary using the wireguard kernel module
 * Binary and container deployment

![Screenshot](wireguard-ui.png)

## Running

The easiest way to run wg-ui is using the container image. To test it, run:

```docker run --rm -it --privileged --entrypoint "/wireguard-ui" -v /tmp/wireguard-ui:/data -p 8080:8080 embarkstudios/wireguard-ui:latest --data-dir=/data --log-level=debug```

When running in production, we recommend using the latest release as opposed to `latest`.

Important to know is that you need to have WireGuard installed on the machine in order for this to work, as this is 'just' a UI to manage WireGuard configs. 

### Configuration

You can configure wg-ui using commandline flags or environment variables.
To see all available flags run:

```
docker run --rm -it embarkstudios/wireguard-ui:latest -h
./wireguard-ui -h
```

You can alternatively specify each flag through an environment variable of the form `WIREGUARD_UI_<FLAG_NAME>`, where `<FLAG_NAME>` is replaced with the flag name transformed to `CONSTANT_CASE`, e.g.

```docker run --rm -it embarkstudios/wireguard-ui:latest --log-level=debug```

and

```docker run --rm -it -e WIREGUARD_UI_LOG_LEVEL=debug embarkstudios/wireguard-ui:latest```

are the same.

### Authentication
You can configure basic authentication using the flags/environment variables `--auth-basic-user=<user>` and `--auth-basic-pass=<bcrypt hash>` The password is
a bcrypt hash that you can generate yourself using the docker container:
```
$ docker run -it embarkstudios/wireguard-ui:latest passwd mySecretPass
INFO[0001] Password Hash: $2a$14$D2jsPnpJixC0U0lyaGUd0OatV7QGzQ08yKV.gsmITVZgNevfZXj36
```

## Docker images

There are two ways to run wg-ui today, you can run it with kernel module installed on your host which is the best way to do it if you want performance.  

```
docker pull embarkstudios/wireguard-ui:latest
```

If you however do not have the possibility or interest in having kernel module loaded on your host, there is now a solution for that using a docker image based on wireguard-go. Keep in mind that this runs in userspace and not in kernel module.  

```
docker pull embarkstudios/wireguard-ui:userspace
```

Both images are built for `linux/amd64`, `linux/arm64` and `linux/arm/v7`. If you would need it for any other platform you can build wg-ui binaries with help from the documentation.  


## Install without Docker

You need to have WireGuard installed on the machine running `wg-ui`.

Unless you use the userspace version with docker you're required to have WireGuard installed on your host machine.  

A few installation guides:  
[Ubuntu 20.04 LTS](https://www.cyberciti.biz/faq/ubuntu-20-04-set-up-wireguard-vpn-server/)  
[CentOS 8](https://www.cyberciti.biz/faq/centos-8-set-up-wireguard-vpn-server/)  
[Debian 10](https://www.cyberciti.biz/faq/debian-10-set-up-wireguard-vpn-server/)  

### Go installation (Debian)
Install latest version of Go from (https://golang.org/dl/)

```
sudo tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz
```

### Setup environment
Bash: ~/.bash_profile  
ZSH: ~/.zshrc

```
export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin
export GOPATH=$HOME/go
```

### Install LTS version of nodejs for frontend.

```
sudo apt-get install curl software-properties-common
curl -sL https://deb.nodesource.com/setup_12.x | sudo bash -
sudo apt-get install nodejs
```

### Fetch wg-ui

```
git clone https://github.com/EmbarkStudios/wg-ui.git && cd wg-ui
```

### Build binary with ui

```
make build
```

### Crosscompiling

```
make build-amd64
```

```
make build-armv5
```

```
make build-armv6
```

```
make build-armv7
```

### Build step by step

```
make ui
make build
```

## Developing

### Start frontend server
```
npm install --prefix=ui
npm run --prefix=ui dev
```

### Use frontend server when running the server

```
make build
sudo ./bin/wireguard-ui --log-level=debug --dev-ui-server http://localhost:5000
```

## Contributing

We welcome community contributions to this project.

Please read our [Contributor Guide](CONTRIBUTING.md) for more information on how to get started.

## License
Licensed under either of

* Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
* MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)

at your option.


================================================
FILE: UserSpace.Dockerfile
================================================
FROM docker.io/node:12 AS ui
WORKDIR /ui
COPY ui/package.json ui/package-lock.json /ui/
RUN npm install
COPY ui .
RUN npm run build

FROM docker.io/golang:latest AS build
WORKDIR /wg
COPY go.mod .
COPY go.sum .
RUN go mod download
COPY . .
COPY --from=ui /ui/dist ui/dist
RUN go install .

FROM docker.io/golang:latest AS wg_go_build
WORKDIR /wg-go
RUN git init
RUN git remote add origin https://git.zx2c4.com/wireguard-go
RUN git fetch
RUN git checkout tags/0.0.20210424 -b build
RUN make

FROM alpine:latest
RUN apk add libc6-compat --no-cache
COPY ./wg-go-ui.sh /
COPY --from=build /go/bin/wireguard-ui /
COPY --from=wg_go_build /wg-go/wireguard-go /
ENTRYPOINT [ "/wg-go-ui.sh" ]


================================================
FILE: config.go
================================================
package main

import (
	"encoding/json"
	"io/ioutil"
	"net"
	"os"
	"path/filepath"
	"time"

	log "github.com/sirupsen/logrus"
	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
)

// ServerConfig contains the reference to users, keys and where on disk the config is stored
type ServerConfig struct {
	configPath string
	PrivateKey string
	PublicKey  string
	Users      map[string]*UserConfig
}

// UserConfig represents a user and it's clients
type UserConfig struct {
	Name    string
	Clients map[string]*ClientConfig
}

// ClientConfig represents a single client for a user
type ClientConfig struct {
	Name         string
	PrivateKey   string
	PublicKey    string
	PresharedKey string
	IP           net.IP
	AllowedIPs   []*net.IPNet
	MTU          int
	Notes        string
	Created      string
	Modified     string
}

// NewClient provides fields that should not be saved however is neccesary on creation of a new client
type NewClient struct {
	ClientConfig
	GeneratePSK bool
}

// NewServerConfig creates and returns a reference to a new ServerConfig
func NewServerConfig(cfgPath string) *ServerConfig {
	key, err := wgtypes.GeneratePrivateKey()
	if err != nil {
		log.Fatal(err)
	}

	cfg := &ServerConfig{
		configPath: cfgPath,
		PrivateKey: key.String(),
		PublicKey:  key.PublicKey().String(),
		Users:      make(map[string]*UserConfig),
	}

	f, err := os.Open(filepath.Clean(cfgPath))
	if err == nil {
		if err = json.NewDecoder(f).Decode(cfg); err != nil {
			log.Fatal(err)
		}
		log.Debug("Read server config from file: ", cfgPath)
	} else if os.IsNotExist(err) {
		log.Debug("No config found. Creating new: ", cfgPath)
		err = cfg.Write()
	}

	if err != nil {
		log.Fatal(err)
	}

	configWriteRequired := false

	// Set default MTU if MTU is not set (migration from old config)
	migrationMTU := *wgPeerMtu
	if err := verifyLinkMTU(migrationMTU); err != nil {
		log.WithError(err).Warnf("Invalid peer MTU, migration MTU is set to %d", wgDefaultMtu)
		migrationMTU = wgDefaultMtu
	}

	for _, user := range cfg.Users {
		for _, client := range user.Clients {
			if client.MTU == 0 {
				client.MTU = migrationMTU
				configWriteRequired = true
			}
		}
	}

	if configWriteRequired {
		err = cfg.Write()
		if err != nil {
			log.Fatal(err)
		}
	}

	return cfg
}

// Write writes the ServerConfig to the path specified in the config
func (cfg *ServerConfig) Write() error {
	data, err := json.MarshalIndent(cfg, "", " ")
	if err != nil {
		return err
	}
	return ioutil.WriteFile(cfg.configPath, data, 0600)
}

// GetUserConfig returns a UserConfig for a specific user
func (cfg *ServerConfig) GetUserConfig(user string) *UserConfig {
	c, ok := cfg.Users[user]
	if !ok {
		log.WithField("user", user).Info("No such user. Creating one.")
		c = &UserConfig{
			Name:    user,
			Clients: make(map[string]*ClientConfig),
		}
		cfg.Users[user] = c
	}
	return c
}

// NewClientConfig initiates a new client, returning a reference to the new config
func NewClientConfig(Name string, ip net.IP, mtu int, Notes string, generatePSK bool) *ClientConfig {
	key, err := wgtypes.GeneratePrivateKey()
	if err != nil {
		log.Fatal(err)
	}

	psk := ""
	if generatePSK {
		pskey, err := wgtypes.GenerateKey()
		if err != nil {
			log.Fatal(err)
		}
		psk = pskey.String()
	}

	cfg := ClientConfig{
		Name:         Name,
		PrivateKey:   key.String(),
		PublicKey:    key.PublicKey().String(),
		IP:           ip,
		MTU:          mtu,
		PresharedKey: psk,
		Notes:        Notes,
		Created:      time.Now().Format(time.RFC3339),
		Modified:     time.Now().Format(time.RFC3339),
	}

	return &cfg
}


================================================
FILE: doc/auth-google-sso.md
================================================
# Google SSO Implementation

This is a short documentation on how you can setup wg-ui and Google OAuth. 

There are a few different projects on GitHub related to SSO and OAuth2, the most popular just now is [oauth2-proxy/oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy) but we at Embark Studios opted to use [buzzfeed/sso](https://github.com/buzzfeed/sso). This was done before the growth of oauth2-proxy.

## SSO Proxy & Auth

When setting up [buzzfeed/sso](https://github.com/buzzfeed/sso) we followed the quickstart documentation provided by the project found [here](https://github.com/buzzfeed/sso/blob/master/docs/quickstart.md).  
In our setup we use the binaries provided by releases, and not a docker based solution. 

## Systemd

Below is two simple services to keep both `sso-auth` and `sso-proxy` running. 
As you can notice we use environment files instead of parameters for the binaries. 

```
[Unit]
Description=sso-auth
After=network.target

[Service]
Type=simple
Restart=always
EnvironmentFile=/path/to/sso-auth.env
ExecStart=/path/to/sso-auth

[Install]
WantedBy=multi-user.target
```
```
SESSION_COOKIE_SECURE=true
SESSION_COOKIE_HTTPONLY=true
SESSION_COOKIE_DOMAIN=.domain.com
SESSION_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
SESSION_COOKIE_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
CLIENT_PROXY_ID=<shared with proxy's environment file>
CLIENT_PROXY_SECRET=<shared with proxy's environment file>
SERVER_SCHEME=https
SERVER_HOST=sso.domain.com
SERVER_PORT=8000
AUTHORIZE_EMAIL_DOMAINS=domain.com
AUTHORIZE_PROXY_DOMAINS=domain.com
PROVIDER_DOMAIN_CLIENT_ID=123456789000-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com
PROVIDER_DOMAIN_CLIENT_SECRET=XXXXXXXXXXXXXXXXXXXXXXXX
PROVIDER_DOMAIN_TYPE=google
PROVIDER_DOMAIN_SLUG=google
VIRTUAL_HOST=sso.domain.com
CLUSTER=sso
STATSD_HOST=127.0.0.1
STATSD_PORT=8125
```

```
[Unit]
Description=sso-proxy
After=network.target

[Service]
Type=simple
Restart=always
EnvironmentFile=/path/to/sso-proxy.env
ExecStart=/path/to/sso-proxy

[Install]
WantedBy=multi-user.target
```
```
DEFAULT_ALLOWED_EMAIL_DOMAINS=domain.com
UPSTREAM_CONFIGS=/path/to/upstream_configs.yaml
PROVIDER_URL=https://sso.domain.com
PROVIDER_URL_INTERNAL=http://localhost:8000
CLIENT_ID=<shared with auth's environment file>
CLIENT_SECRET=<shared with auth's environment file>
COOKIE_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
COOKIE_SECURE=true
VIRTUAL_HOST=*.domain.com
CLUSTER=sso
STATSD_HOST=127.0.0.1
STATSD_PORT=8125
```

You will also need a yaml file which defines backend service (wg-ui) which is defined in sso-proxy.env as `UPSTREAM_CONFIGS`

```
- service: wg-ui
  default:
    from: vpn.domain.com
    to: http://localhost:8080/
```

## nginx

We use nginx for all HTTP(S) to endusers, below you can find an example for configuration.

```
server {
        listen 443 http2;
        listen [::]:443 http2;

        server_name vpn.domain.com;

        ssl on;
        ssl_certificate /path/to/domain.com.bundle.crt;
        ssl_certificate_key /path/to/domain.com.key;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-Proto https;
                proxy_pass http://localhost:4180;
        }
}
server {
        listen 443 http2;
        listen [::]:443 http2;

        server_name sso.domain.com;

        ssl on;
        ssl_certificate /path/to/domain.com.bundle.crt;
        ssl_certificate_key /path/to/domain.com.key;

                location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-Proto https;
                proxy_pass http://localhost:8000;
        }
}
```


================================================
FILE: doc/auth-shibboleth-sso.md
================================================
# Shibboleth SP Implementation

This is a short documentation on how you can setup wg-ui with Shibboleth SP (and apache)
as auth proxy

The documentation will not cover how to configure `shibd` or the IdP part of this integration.
The [upstream documentation](https://wiki.shibboleth.net/confluence/) or
[SWAMIDs
documentation](https://wiki.sunet.se/display/SWAMID/SAML+WebSSO+Service+Provider+Best+Current+Practice)
could point you in the right direction.

## SSO Proxy & Auth

This example uses
[eduPersonPrincipalName](https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonPrincipalName)
(or eppn as Shibboleth calls it) as the  primary key to identify users. Make
sure that it is released from the IdP to the SP as a SAML attribute. The
attributes(s) are then forward/proxied as request header to the application.

The only thing that needs to be configured in the WG UI end is that the
application needs to be started with the `--auth-user-header` flag set to
`eppn`.

### The `apache` configuration

```
<VirtualHost *:443>
    <LocationMatch "/">
        AuthType Shibboleth
        Require shib-attr entitlement ~ ^urn:mace:swami.se:gmai:vpn:user$
        ShibRequireSessionWith idp.example.com
        ShibUseHeaders On
    </LocationMatch>

    SSLCertificateFile    /path/to/vpn.example.com.pem
    SSLCertificateKeyFile /path/to/vpn.example.com.key
    SSLCertificateChainFile /path/to/CA.crt

    ProxyPass "/" "http://127.0.0.1:8080/"
    ProxyPassReverse "/" "http://127.0.0.1:8080/"
</VirtualHost>
```

#### Configuration in depth

```
Require shib-attr entitlement ~ ^urn:mace:swami.se:gmai:su-vpn:user$
```
By default apache and shibd lets everyone through and since WG UI has no
knowlege about the user in beforehand we release another
([eduPersonEntitlement](https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonEntitlement) (or entitlement as Shibboleth calls it))
from the IdP to the SP and require a specific value on the user in order to be
allowed to use the service.

```
ShibUseHeaders On
```

This enables `shibd` to publish SAML attributes to the application (in this case
proxy) through request headers.


================================================
FILE: docker-compose.userspace.yml
================================================
version: "3.7"

services:
  app:
    image: embarkstudios/wireguard-ui:userspace
    privileged: true
    network_mode: "host"
    volumes:
      - /opt/wireguard-ui:/data
    environment:
      - WIREGUARD_UI_LISTEN_ADDRESS=:8080
      - WIREGUARD_UI_LOG_LEVEL=debug
      - WIREGUARD_UI_DATA_DIR=/data
      - WIREGUARD_UI_WG_ENDPOINT=your-andpoint-address:51820
      - WIREGUARD_UI_CLIENT_IP_RANGE=192.168.10.1/24
     # - WIREGUARD_UI_WG_DNS=192.168.10.1
      - WIREGUARD_UI_NAT=true
      - WIREGUARD_UI_NAT_DEVICE=eth0
     # - WIREGUARD_UI_WG_DEVICE_NAME=wg1

    restart: always


================================================
FILE: docker-compose.yml
================================================
version: "3.7"

services:
  app:
    image: embarkstudios/wireguard-ui:latest
    entrypoint: "/wireguard-ui"
    privileged: true
    network_mode: "host"
    volumes:
      - /opt/wireguard-ui:/data
    environment:
      - WIREGUARD_UI_LISTEN_ADDRESS=:8080
      - WIREGUARD_UI_LOG_LEVEL=debug
      - WIREGUARD_UI_DATA_DIR=/data
      - WIREGUARD_UI_WG_ENDPOINT=your-andpoint-address:51820
      - WIREGUARD_UI_CLIENT_IP_RANGE=192.168.10.0/24
     # - WIREGUARD_UI_WG_DNS=192.168.10.0
      - WIREGUARD_UI_NAT=true
      - WIREGUARD_UI_NAT_DEVICE=eth0
     # - WIREGUARD_UI_WG_DEVICE_NAME=wg0

    restart: always


================================================
FILE: go.mod
================================================
module github.com/embarkstudios/wireguard-ui

go 1.17

require (
	github.com/fujiwara/go-amzn-oidc v0.0.2
	github.com/google/nftables v0.0.0-20210916140115-16a134723a96
	github.com/julienschmidt/httprouter v1.3.0
	github.com/sirupsen/logrus v1.8.1
	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
	github.com/vishvananda/netlink v1.1.0
	github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f
	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815
	gopkg.in/alecthomas/kingpin.v2 v2.2.6
)

require (
	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
	github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a // indirect
	github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
	github.com/google/go-cmp v0.5.6 // indirect
	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
	github.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d // indirect
	github.com/konsorten/go-windows-terminal-sequences v1.0.3 // indirect
	github.com/mdlayher/genetlink v1.0.0 // indirect
	github.com/mdlayher/netlink v1.4.1 // indirect
	github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	github.com/shogo82148/go-retry v1.1.1 // indirect
	golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect
	golang.org/x/net v0.0.0-20211008194852-3b03d305991f // indirect
	golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac // indirect
	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
	golang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326 // indirect
)


================================================
FILE: go.sum
================================================
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2cI+DC1Mbh0TJxzA3RcLoMsFw+aXw7E=
github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a h1:E/8AP5dFtMhl5KPJz66Kt9G0n+7Sn41Fy1wv9/jHOrc=
github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
github.com/cilium/ebpf v0.5.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
github.com/fujiwara/go-amzn-oidc v0.0.2 h1:BcniaR2fJFik2koEK6Vm80Kk/vg6uoGTyckNwuGKO48=
github.com/fujiwara/go-amzn-oidc v0.0.2/go.mod h1:8dyKYVF6NzSbcIBDB8HAu1RB+RcA1kMBh6o5g5hQ3Ao=
github.com/fujiwara/go-amzn-oidc v0.0.3 h1:K00bR4JM8100Tn7/14c9OR36n27YTOy10YgihiBlTq0=
github.com/fujiwara/go-amzn-oidc v0.0.3/go.mod h1:K+wcevZcCVOFD2Sh5FAwq+lAkaz9huLnTQO7T4tJwRI=
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/nftables v0.0.0-20200316075819-7127d9d22474 h1:D6bN82zzK92ywYsE+Zjca7EHZCRZbcNTU3At7WdxQ+c=
github.com/google/nftables v0.0.0-20200316075819-7127d9d22474/go.mod h1:cfspEyr/Ap+JDIITA+N9a0ernqG0qZ4W1aqMRgDZa1g=
github.com/google/nftables v0.0.0-20210916140115-16a134723a96 h1:bCm0Cf+suMHiri9F+ss5n5W0AVas85K5Z0Hekgpe7N0=
github.com/google/nftables v0.0.0-20210916140115-16a134723a96/go.mod h1:cfspEyr/Ap+JDIITA+N9a0ernqG0qZ4W1aqMRgDZa1g=
github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 h1:uhL5Gw7BINiiPAo24A2sxkcDI0Jt/sqp1v5xQCniEFA=
github.com/josharian/native v0.0.0-20200817173448-b6b71def0850/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=
github.com/jsimonetti/rtnetlink v0.0.0-20201009170750-9c6f07d100c1/go.mod h1:hqoO/u39cqLeBLebZ8fWdE96O7FxrAsRYhnVOdgHxok=
github.com/jsimonetti/rtnetlink v0.0.0-20201216134343-bde56ed16391/go.mod h1:cR77jAZG3Y3bsb8hF6fHJbFoyFukLFOkQ98S0pQz3xw=
github.com/jsimonetti/rtnetlink v0.0.0-20201220180245-69540ac93943/go.mod h1:z4c53zj6Eex712ROyh8WI0ihysb5j2ROyV42iNogmAs=
github.com/jsimonetti/rtnetlink v0.0.0-20210122163228-8d122574c736/go.mod h1:ZXpIyOK59ZnN7J0BV99cZUPmsqDRZ3eq5X+st7u/oSA=
github.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b h1:c3NTyLNozICy8B4mlMXemD3z/gXgQzVXZS/HqT+i3do=
github.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b/go.mod h1:8w9Rh8m+aHZIG69YPGGem1i5VzoyRC8nw2kA8B+ik5U=
github.com/jsimonetti/rtnetlink v0.0.0-20210525051524-4cc836578190/go.mod h1:NmKSdU4VGSiv1bMsdqNALI4RSvvjtz65tTMCnD05qLo=
github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
github.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d h1:MFX8DxRnKMY/2M3H61iSsVbo/n3h0MWGmWNN1UViOU0=
github.com/koneu/natend v0.0.0-20150829182554-ec0926ea948d/go.mod h1:QHb4k4cr1fQikUahfcRVPcEXiUgFsdIstGqlurL0XL4=
github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
github.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43 h1:WgyLFv10Ov49JAQI/ZLUkCZ7VJS3r74hwFIGXJsgZlY=
github.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43/go.mod h1:+t7E0lkKfbBsebllff1xdTmyJt8lH37niI6kwFk9OTo=
github.com/mdlayher/genetlink v1.0.0 h1:OoHN1OdyEIkScEmRgxLEe2M9U8ClMytqA5niynLtfj0=
github.com/mdlayher/genetlink v1.0.0/go.mod h1:0rJ0h4itni50A86M2kHcgS85ttZazNt7a8H2a2cw0Gc=
github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
github.com/mdlayher/netlink v0.0.0-20191009155606-de872b0d824b/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
github.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZmb2XgV7o=
github.com/mdlayher/netlink v1.2.0/go.mod h1:kwVW1io0AZy9A1E2YYgaD4Cj+C+GPkU6klXCMzIJ9p8=
github.com/mdlayher/netlink v1.2.1/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
github.com/mdlayher/netlink v1.2.2-0.20210123213345-5cc92139ae3e/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
github.com/mdlayher/netlink v1.3.0/go.mod h1:xK/BssKuwcRXHrtN04UBkwQ6dY9VviGGuriDdoPSWys=
github.com/mdlayher/netlink v1.4.0 h1:n3ARR+Fm0dDv37dj5wSWZXDKcy+U0zwcXS3zKMnSiT0=
github.com/mdlayher/netlink v1.4.0/go.mod h1:dRJi5IABcZpBD2A3D0Mv/AiX8I9uDEu5oGkAVrekmf8=
github.com/mdlayher/netlink v1.4.1 h1:I154BCU+mKlIf7BgcAJB2r7QjveNPty6uNY1g9ChVfI=
github.com/mdlayher/netlink v1.4.1/go.mod h1:e4/KuJ+s8UhfUpO9z00/fDZZmhSrs+oxyqAS9cNgn6Q=
github.com/mdlayher/socket v0.0.0-20210307095302-262dc9984e00/go.mod h1:GAFlyu4/XV68LkQKYzKhIo/WW7j3Zi0YRAz/BOoanUc=
github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267 h1:Sii9ha8FHgdPEO3XW1rQ6SdUs8qNBERc64/v2tUyvis=
github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267/go.mod h1:nFZ1EtZYK8Gi/k6QNu7z7CgO20i/4ExeQswwWuPmG/g=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
github.com/onsi/ginkgo v1.14.2/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
github.com/shogo82148/go-retry v1.0.0 h1:c487Qe+QYUffpUpPxrUN5fGJq6WVHSzGS4N3MNuR2OU=
github.com/shogo82148/go-retry v1.0.0/go.mod h1:5jiw5yPWW6K+pMyimtNoaQSDD08RMEsJbhDwFrui5rc=
github.com/shogo82148/go-retry v1.1.1 h1:BfUEVHTNDSjYxoRPC+c/ht5Sy6qdwl+0kFhhubeh4Fo=
github.com/shogo82148/go-retry v1.1.1/go.mod h1:TPSFDcc2rlx2D/yfhi8BBOlsHhVBjjJoMvxG7iFHUbI=
github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
github.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe h1:mjAZxE1nh8yvuwhGHpdDqdhtNu2dgbpk93TwoXuk5so=
github.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f h1:p4VB7kIXpOQvVn1ZaTIVp+3vuYAXFe3OJEvjbUYJLaA=
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
golang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e h1:8foAy0aoO5GkqCvAEJ4VC4P3zksTg4X4aJCDpZzmgQI=
golang.org/x/crypto v0.0.0-20210503195802-e9a32991a82e/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 h1:7I4JAnoQBe7ZtJcBaYHi5UtiO8tQHbUSXxL+pnGRANg=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20191028085509-fe3aa8a45271/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
golang.org/x/net v0.0.0-20201006153459-a7d1128ccaa0/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210504132125-bbd867fde50d h1:nTDGCTeAu2LhcsHTRzjyIUbZHCJ4QePArsm27Hka0UM=
golang.org/x/net v0.0.0-20210504132125-bbd867fde50d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20210927181540-4e4d966f7476/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20211008194852-3b03d305991f h1:1scJEYZBaF48BaG6tYbtxmLcXqwYGSfGcMoStTqkkIw=
golang.org/x/net v0.0.0-20211008194852-3b03d305991f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191029155521-f43be2a4598c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201118182958-a01c418693c7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201218084310-7d0127a74742/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210110051926-789bb1bd4061/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210123111255-9b0068b26619/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210309040221-94ec62e08169/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210503173754-0981d6026fa6 h1:cdsMqa2nXzqlgs183pHxtvoVwU7CyzaCTAUOg94af4c=
golang.org/x/sys v0.0.0-20210503173754-0981d6026fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210525143221-35b2ab0089ea/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac h1:oN6lz7iLW/YC7un8pq+9bOLyXrprv2+DKfkJY+2LJJw=
golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.zx2c4.com/wireguard v0.0.0-20210427022245-097af6e1351b/go.mod h1:a057zjmoc00UN7gVkaJt2sXVK523kMJcogDTEvPIasg=
golang.zx2c4.com/wireguard v0.0.0-20210624150102-15b24b6179e0 h1:qINUmOnDCCF7i14oomDDkGmlda7BSDTGfge77/aqdfk=
golang.zx2c4.com/wireguard v0.0.0-20210624150102-15b24b6179e0/go.mod h1:laHzsbfMhGSobUmruXWAyMKKHSqvIcrqZJMyHD+/3O8=
golang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326 h1:4yQQ5d6U5ozGB6n/WSDZa6B0XpPTmoQMtMDMoiZr4n0=
golang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326/go.mod h1:SDoazCvdy7RDjBPNEMBwrXhomlmtG7svs8mgwWEqtVI=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20210506160403-92e472f520a5 h1:LpEwXnbN4q2EIPkqbG9KHBUrducJYDOOdL+eMcJAlFo=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20210506160403-92e472f520a5/go.mod h1:+1XihzyZUBJcSc5WO9SwNA7v26puQwOEDwanaxfNXPQ=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815 h1:avmQJRd/MfOtK7TRnf0Bi2o6W05ZaPhP1upcDCgvTTs=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20211006223443-a91c1c5da815/go.mod h1:G0zJhHaavrPDNb/ygHzf4uju6nSlKMi4f1E5RCT3WpE=
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=


================================================
FILE: main.go
================================================
package main

import (
	"strings"

	log "github.com/sirupsen/logrus"
	"golang.org/x/crypto/bcrypt"
	"gopkg.in/alecthomas/kingpin.v2"
)

var (
	logLevel = kingpin.Flag("log-level", "The level of logging").Default("info").Enum("debug", "info", "warn", "error", "panic", "fatal")
)

func main() {
	kingpin.HelpFlag.Short('h')
	kingpin.CommandLine.DefaultEnvars()
	kingpin.Command("server", "Start server.").Default()
	passwdCmd := kingpin.Command("passwd", "Generate password hash.")
	passwdCmdPassword := passwdCmd.Arg("password", "The password to hash").Required().String()
	cmd := kingpin.Parse()

	switch strings.ToLower(*logLevel) {
	case "debug":
		log.SetLevel(log.DebugLevel)
	case "warn":
		log.SetLevel(log.WarnLevel)
	case "error":
		log.SetLevel(log.ErrorLevel)
	case "panic":
		log.SetLevel(log.PanicLevel)
	default:
		log.SetLevel(log.InfoLevel)
	}

	switch cmd {
	case "passwd":
		bytes, err := bcrypt.GenerateFromPassword([]byte(*passwdCmdPassword), 14)
		if err != nil {
			log.Fatalf("generate password error: %v", err)
		}
		log.Infof("Password Hash: %s", string(bytes))
		return
	case "server":
		log.Info("Starting")
		server := NewServer()
		err := server.Start()
		if err != nil {
			log.Fatal(err)
		}
	default:
		log.Fatal("Unknown command")
	}

}


================================================
FILE: server.go
================================================
package main

import (
	"context"
	"embed"
	"encoding/json"
	"fmt"
	"io/fs"
	"io/ioutil"
	"net"
	"net/http"
	"net/http/httputil"
	"net/url"
	"os"
	"path"
	"regexp"
	"strconv"
	"strings"
	"sync"
	"time"

	validator "github.com/fujiwara/go-amzn-oidc/validator"
	"github.com/google/nftables"
	"github.com/google/nftables/expr"
	"github.com/julienschmidt/httprouter"
	log "github.com/sirupsen/logrus"
	"github.com/skip2/go-qrcode"
	"github.com/vishvananda/netlink"
	"github.com/vishvananda/netns"
	"golang.org/x/crypto/bcrypt"
	"golang.zx2c4.com/wireguard/wgctrl"
	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
	"gopkg.in/alecthomas/kingpin.v2"
)

const (
	wgDefaultMtu = 1420
)

var (
	dataDir = kingpin.Flag("data-dir", "Directory used for storage").Default("/var/lib/wireguard-ui").String()

	listenAddr            = kingpin.Flag("listen-address", "Address to listen to").Default(":8080").String()
	natEnabled            = kingpin.Flag("nat", "Whether NAT is enabled or not").Default("true").Bool()
	natLink               = kingpin.Flag("nat-device", "Network interface to masquerade").Default("wlp2s0").String()
	clientIPRange         = kingpin.Flag("client-ip-range", "Client IP CIDR").Default("172.31.255.0/24").String()
	authUserHeader        = kingpin.Flag("auth-user-header", "Header containing username").Default("X-Forwarded-User").String()
	authBasicUser         = kingpin.Flag("auth-basic-user", "Basic auth static username").Default("").String()
	authBasicPass         = kingpin.Flag("auth-basic-pass", "Basic auth static password").Default("").String()
	maxNumberClientConfig = kingpin.Flag("max-number-client-config", "Max number of configs an client can use. 0 is unlimited").Default("0").Int()

	wgLinkName   = kingpin.Flag("wg-device-name", "WireGuard network device name").Default("wg0").String()
	wgListenPort = kingpin.Flag("wg-listen-port", "WireGuard UDP port to listen to").Default("51820").Int()
	wgEndpoint   = kingpin.Flag("wg-endpoint", "WireGuard endpoint address").Default("127.0.0.1:51820").String()
	wgAllowedIPs = kingpin.Flag("wg-allowed-ips", "WireGuard client allowed ips").Default("0.0.0.0/0").Strings()
	wgDNS        = kingpin.Flag("wg-dns", "WireGuard client DNS server (optional)").Default("").String()
	wgKeepAlive  = kingpin.Flag("wg-keepalive", "WireGuard Keepalive for peers, defined in seconds (optional)").Default("").String()
	wgServerMtu  = kingpin.Flag("wg-server-mtu", "WireGuard server MTU").Default("1420").Int()
	wgPeerMtu    = kingpin.Flag("wg-peer-mtu", "WireGuard default peer MTU").Default(strconv.Itoa(wgDefaultMtu)).Int()

	devUIServer = kingpin.Flag("dev-ui-server", "Developer mode: If specified, proxy all static assets to this endpoint").String()

	filenameRe = regexp.MustCompile("[^a-zA-Z0-9]+")
)

type contextKey string

const key = contextKey("user")

// Server is the running server
type Server struct {
	serverConfigPath string
	mutex            sync.RWMutex
	Config           *ServerConfig
	ipAddr           net.IP
	clientIPRange    *net.IPNet
	assets           http.Handler
}

type wgLink struct {
	attrs *netlink.LinkAttrs
}

func (w *wgLink) Attrs() *netlink.LinkAttrs {
	return w.attrs
}

func (w *wgLink) Type() string {
	return "wireguard"
}

func ifname(n string) []byte {
	b := make([]byte, 16)
	copy(b, []byte(n+"\x00"))
	return b
}

//go:embed ui/dist
var assetsFS embed.FS

// NewServer returns an instance of Server which contains both the webserver and the reference to Wireguard
func NewServer() *Server {
	ipAddr, ipNet, err := net.ParseCIDR(*clientIPRange)
	if err != nil {
		log.Fatal(err)
	}
	log.Debugf("ipAddr: %s  ipNet: %s", ipAddr, ipNet)

	err = os.MkdirAll(*dataDir, 0700)
	if err != nil {
		log.WithError(err).Fatalf("Error initializing data directory: %s", *dataDir)
	}

	cfgPath := path.Join(*dataDir, "config.json")
	config := NewServerConfig(cfgPath)

	log.Debug("Configuration loaded with public key: ", config.PublicKey)

	var fsys fs.FS = assetsFS
	if f, err := fs.Sub(fsys, "ui/dist"); err != nil {
		log.Error(fmt.Errorf("ui/dist does not exist in fs :%w", err))
	} else {
		fsys = f
	}
	fmt.Println(fs.Glob(fsys, "*"))

	assets := http.FileServer(http.FS(fsys))

	s := Server{
		serverConfigPath: cfgPath,
		Config:           config,
		ipAddr:           ipAddr,
		clientIPRange:    ipNet,
		assets:           assets,
	}

	log.Debug("Server initialized: ", *dataDir)
	return &s
}

func (s *Server) enableIPForward() error {
	p := "/proc/sys/net/ipv4/ip_forward"

	content, err := ioutil.ReadFile(p)
	if err != nil {
		return err
	}

	if string(content) == "0\n" {
		log.Info("Enabling sys.net.ipv4.ip_forward")
		return ioutil.WriteFile(p, []byte("1"), 0600)
	}

	return nil
}

func (s *Server) initInterface() error {
	attrs := netlink.NewLinkAttrs()
	attrs.Name = *wgLinkName

	link := wgLink{
		attrs: &attrs,
	}

	log.Debug("Adding wireguard device: ", *wgLinkName)
	err := netlink.LinkAdd(&link)
	if os.IsExist(err) {
		log.Infof("WireGuard interface %s already exists. Reusing.", *wgLinkName)
	} else if err != nil {
		return err
	}

	log.Debug("Adding ip address to wireguard device: ", s.clientIPRange)
	addr, _ := netlink.ParseAddr(*clientIPRange)
	err = netlink.AddrAdd(&link, addr)
	if os.IsExist(err) {
		log.Infof("WireGuard interface %s already has the requested address: ", s.clientIPRange)
	} else if err != nil {
		return err
	}

	log.Debug("Setting link MTU: ", *wgServerMtu)
	err = netlink.LinkSetMTU(&link, *wgServerMtu)
	if err != nil {
		log.Error("Error setting link MTU: ", *wgLinkName)
		return err
	}

	log.Debug("Bringing up wireguard device: ", *wgLinkName)
	err = netlink.LinkSetUp(&link)
	if err != nil {
		log.Error("Error bringing up device: ", *wgLinkName)
		return err
	}

	if *natEnabled {
		log.Debug("Adding NAT / IP masquerading using nftables")
		ns, err := netns.Get()
		if err != nil {
			return err
		}

		conn := nftables.Conn{NetNS: int(ns)}

		log.Debug("Flushing nftable rulesets")
		conn.FlushRuleset()

		log.Debug("Setting up nftable rules for ip masquerading")

		nat := conn.AddTable(&nftables.Table{
			Family: nftables.TableFamilyIPv4,
			Name:   "nat",
		})

		conn.AddChain(&nftables.Chain{
			Name:     "prerouting",
			Table:    nat,
			Type:     nftables.ChainTypeNAT,
			Hooknum:  nftables.ChainHookPrerouting,
			Priority: nftables.ChainPriorityFilter,
		})

		post := conn.AddChain(&nftables.Chain{
			Name:     "postrouting",
			Table:    nat,
			Type:     nftables.ChainTypeNAT,
			Hooknum:  nftables.ChainHookPostrouting,
			Priority: nftables.ChainPriorityNATSource,
		})

		conn.AddRule(&nftables.Rule{
			Table: nat,
			Chain: post,
			Exprs: []expr.Any{
				&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
				&expr.Cmp{
					Op:       expr.CmpOpEq,
					Register: 1,
					Data:     ifname(*natLink),
				},
				&expr.Masq{},
			},
		})

		if err := conn.Flush(); err != nil {
			return err
		}
	}

	return nil
}

func (s *Server) allocateIP() net.IP {
	allocated := make(map[string]bool)
	allocated[s.ipAddr.String()] = true
	for _, cfg := range s.Config.Users {
		for _, dev := range cfg.Clients {
			allocated[dev.IP.String()] = true
		}
	}

	for ip := s.ipAddr.Mask(s.clientIPRange.Mask); s.clientIPRange.Contains(ip); {
		for i := len(ip) - 1; i >= 0; i-- {
			ip[i]++
			if ip[i] > 0 {
				break
			}
		}

		if !allocated[ip.String()] {
			log.Debug("Allocated IP: ", ip)
			return ip
		}
	}

	log.Fatal("Unable to allocate IP. Address range exhausted")
	return nil
}

func (s *Server) reconfigure() {
	log.Debug("Reconfiguring")

	err := s.Config.Write()
	if err != nil {
		log.Fatal(err)
	}

	err = s.configureWireGuard()
	if err != nil {
		log.Fatal(err)
	}
}

func (s *Server) configureWireGuard() error {
	log.Debugf("Reconfiguring wireguard interface %s", *wgLinkName)
	wg, err := wgctrl.New()
	if err != nil {
		return err
	}

	log.Debug("Adding wireguard private key")
	key, err := wgtypes.ParseKey(s.Config.PrivateKey)
	if err != nil {
		return err
	}

	log.Debugf("Getting current Wireguard config")
	currentdev, err := wg.Device(*wgLinkName)
	if err != nil {
		return err
	}
	currentpeers := currentdev.Peers
	diffpeers := make([]wgtypes.PeerConfig, 0)

	peers := make([]wgtypes.PeerConfig, 0)
	for user, cfg := range s.Config.Users {
		for id, dev := range cfg.Clients {
			pubKey, err := wgtypes.ParseKey(dev.PublicKey)
			if err != nil {
				return err
			}

			psk, _ := wgtypes.ParseKey(dev.PresharedKey)
			allowedIPs := make([]net.IPNet, 1+len(dev.AllowedIPs))
			allowedIPs[0] = *netlink.NewIPNet(dev.IP)

			for i, cidr := range dev.AllowedIPs {
				allowedIPs[1+i] = *cidr
			}
			peer := wgtypes.PeerConfig{
				PublicKey:         pubKey,
				ReplaceAllowedIPs: true,
				AllowedIPs:        allowedIPs,
				PresharedKey:      &psk,
			}

			log.WithFields(log.Fields{"user": user, "client": id, "key": dev.PublicKey, "allowedIPs": peer.AllowedIPs}).Debug("Adding wireguard peer")

			peers = append(peers, peer)
		}
	}

	// Determine peers updated and to be removed from WireGuard
	for _, i := range currentpeers {
		found := false
		for _, j := range peers {
			if i.PublicKey == j.PublicKey {
				found = true
				j.UpdateOnly = true
				diffpeers = append(diffpeers, j)
				break
			}
		}
		if !found {
			peertoremove := wgtypes.PeerConfig{
				PublicKey: i.PublicKey,
				Remove:    true,
			}
			diffpeers = append(diffpeers, peertoremove)
		}
	}

	// Determine peers to be added to WireGuard
	for _, i := range peers {
		found := false
		for _, j := range currentpeers {
			if i.PublicKey == j.PublicKey {
				found = true
				break
			}
		}
		if !found {
			diffpeers = append(diffpeers, i)
		}
	}

	cfg := wgtypes.Config{
		PrivateKey:   &key,
		ListenPort:   wgListenPort,
		ReplacePeers: false,
		Peers:        diffpeers,
	}
	err = wg.ConfigureDevice(*wgLinkName, cfg)
	if err != nil {
		return err
	}

	return nil
}

func verifyLinkMTU(mtu int) error {
	if mtu < 1280 || mtu > 1500 {
		return fmt.Errorf("MTU must be between 1280 and 1500")
	}
	return nil
}

// Start configures wiregard and initiates the interfaces as well as starts the webserver to accept clients
func (s *Server) Start() error {
	err := s.enableIPForward()
	if err != nil {
		return err
	}

	err = s.initInterface()
	if err != nil {
		return err
	}

	err = s.configureWireGuard()
	if err != nil {
		return err
	}

	router := httprouter.New()
	router.GET("/api/v1/whoami", s.WhoAmI)
	router.GET("/api/v1/users/:user/clients/:client", s.withAuth(s.GetClient))
	router.PUT("/api/v1/users/:user/clients/:client", s.withAuth(s.EditClient))
	router.DELETE("/api/v1/users/:user/clients/:client", s.withAuth(s.DeleteClient))
	router.GET("/api/v1/users/:user/clients", s.withAuth(s.GetClients))
	router.POST("/api/v1/users/:user/clients", s.withAuth(s.CreateClient))

	if *devUIServer != "" {
		log.Debug("Serving static assets proxying from development server: ", *devUIServer)
		devProxy := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			url, _ := url.Parse(*devUIServer)
			if strings.HasPrefix(r.URL.Path, "/client/") || r.URL.Path == "/about" {
				r.URL.Path = "/"
			}
			proxy := httputil.NewSingleHostReverseProxy(url)
			r.URL.Host = url.Host
			r.URL.Scheme = url.Scheme
			r.Header.Set("X-Forwarded-Host", r.Header.Get("Host"))
			r.Host = url.Host
			proxy.ServeHTTP(w, r)
		})
		router.NotFound = devProxy
	} else {
		log.Debug("Serving static assets embedded in binary")
		router.GET("/about", s.Index)
		router.GET("/client/:client", s.Index)
		router.NotFound = s.assets
	}

	log.WithField("listenAddr", *listenAddr).Info("Starting server")

	return http.ListenAndServe(*listenAddr, s.basicAuth(s.userFromHeader(router)))
}

func (s *Server) basicAuth(handler http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

		// If we specified a user, require auth
		if *authBasicUser != "" {
			u, p, ok := r.BasicAuth()
			if !ok || u != *authBasicUser || bcrypt.CompareHashAndPassword([]byte(*authBasicPass), []byte(p)) != nil {
				w.Header().Set("WWW-Authenticate", `Basic realm="restricted", charset="UTF-8"`)
				http.Error(w, "Unauthorized", http.StatusUnauthorized)
				return
			}
		}

		handler.ServeHTTP(w, r)

	})
}

func (s *Server) userFromHeader(handler http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		user := r.Header.Get(*authUserHeader)
		if user == "" {
			log.Debug("Unauthenticated request")
			user = "anonymous"
		}

		if *authUserHeader == "X-Goog-Authenticated-User-Email" {
			user = strings.TrimPrefix(user, "accounts.google.com:")
		}

		// AWS ALB-specific JWT header (https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html)
		if *authUserHeader == "x-amzn-oidc-data" {
			claims, err := validator.Validate(user)
			if err != nil {
				log.Debug("Unauthenticated request")
				user = "anonymous"
			} else {
				user = claims.Email()
			}
		}

		cookie := http.Cookie{
			Name:  "wguser",
			Value: user,
			Path:  "/",
		}
		http.SetCookie(w, &cookie)

		ctx := context.WithValue(r.Context(), key, user)
		handler.ServeHTTP(w, r.WithContext(ctx))
	})
}

func (s *Server) withAuth(handler httprouter.Handle) httprouter.Handle {
	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
		log.Debug("Auth required")

		user := r.Context().Value(key)
		if user == nil {
			log.Error("Error getting username from request context")
			w.WriteHeader(http.StatusInternalServerError)
			return
		}

		if user != ps.ByName("user") {
			log.WithField("user", user).WithField("path", r.URL.Path).Warn("Unauthorized access")
			w.WriteHeader(http.StatusUnauthorized)
			return
		}

		handler(w, r, ps)
	}
}

// WhoAmI returns the identity of the current user
func (s *Server) WhoAmI(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	user := r.Context().Value(key).(string)
	log.Debug(user)
	err := json.NewEncoder(w).Encode(struct{ User string }{user})
	if err != nil {
		log.Error(err)
		w.WriteHeader(http.StatusInternalServerError)
	}
}

// GetClients returns a list of all clients for the current user
func (s *Server) GetClients(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	s.mutex.RLock()
	defer s.mutex.RUnlock()
	user := r.Context().Value(key).(string)
	log.Debug(user)
	clients := map[string]*ClientConfig{}
	userConfig := s.Config.Users[user]
	if userConfig != nil {
		clients = userConfig.Clients
	}

	err := json.NewEncoder(w).Encode(clients)
	if err != nil {
		log.Error(err)
		w.WriteHeader(http.StatusInternalServerError)
	}
}

// Index returns the single-page app
func (s *Server) Index(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
	log.Debug("Serving single-page app from URL: ", r.URL)
	r.URL.Path = "/"
	s.assets.ServeHTTP(w, r)
}

// GetClient returns a specific client for the current user
func (s *Server) GetClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	s.mutex.RLock()
	defer s.mutex.RUnlock()
	user := r.Context().Value(key).(string)
	usercfg := s.Config.Users[user]
	if usercfg == nil {
		w.WriteHeader(http.StatusNotFound)
		return
	}

	client := usercfg.Clients[ps.ByName("client")]
	if client == nil {
		w.WriteHeader(http.StatusNotFound)
		return
	}

	interfaceConfig := []string{
		"[Interface]",
		"Address = " + client.IP.String(),
		"PrivateKey = " + client.PrivateKey,
	}
	if *wgDNS != "" {
		interfaceConfig = append(interfaceConfig, "DNS = "+*wgDNS)
	}
	if client.MTU != wgDefaultMtu {
		interfaceConfig = append(interfaceConfig, fmt.Sprintf("MTU = %d", client.MTU))
	}

	peerConfig := []string{
		"[Peer]",
		"PublicKey = " + s.Config.PublicKey,
		"AllowedIPs = " + strings.Join(*wgAllowedIPs, ","),
		"Endpoint = " + *wgEndpoint,
	}
	if *wgKeepAlive != "" {
		peerConfig = append(peerConfig, "PersistentKeepalive = "+*wgKeepAlive)
	}
	if client.PresharedKey != "" {
		peerConfig = append(peerConfig, "PresharedKey = "+client.PresharedKey)
	}

	clientConfig := strings.Join(interfaceConfig[:], "\n") + "\n\n" + strings.Join(peerConfig[:], "\n") + "\n"

	format := r.URL.Query().Get("format")

	if format == "qrcode" {
		png, err := qrcode.Encode(clientConfig, qrcode.Medium, 220)
		if err != nil {
			log.Error(err)
			w.WriteHeader(http.StatusInternalServerError)
			return
		}
		w.Header().Set("Content-Type", "image/png")
		w.WriteHeader(http.StatusOK)
		_, err = w.Write(png)
		if err != nil {
			log.Error(err)
			w.WriteHeader(http.StatusInternalServerError)
			return
		}

		return
	}

	if format == "config" {
		filename := fmt.Sprintf("%s.conf", filenameRe.ReplaceAllString(client.Name, "_"))
		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
		w.Header().Set("Content-Type", "application/config")
		w.WriteHeader(http.StatusOK)
		_, err := fmt.Fprint(w, clientConfig)
		if err != nil {
			w.WriteHeader(http.StatusInternalServerError)
		}
		return
	}

	err := json.NewEncoder(w).Encode(client)
	if err != nil {
		log.Error(err)
		w.WriteHeader(http.StatusInternalServerError)
		return
	}
}

// EditClient edits the specific client passed by the current user
func (s *Server) EditClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	s.mutex.Lock()
	defer s.mutex.Unlock()
	user := r.Context().Value(key).(string)
	usercfg := s.Config.Users[user]
	if usercfg == nil {
		w.WriteHeader(http.StatusNotFound)
		return
	}

	client := usercfg.Clients[ps.ByName("client")]
	if client == nil {
		w.WriteHeader(http.StatusNotFound)
		return
	}

	cfg := ClientConfig{}

	if err := json.NewDecoder(r.Body).Decode(&cfg); err != nil {
		log.Warn("Error parsing request: ", err)
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	log.Debugf("EditClient: %#v", cfg)

	if cfg.Name != "" {
		client.Name = cfg.Name
	}

	if cfg.Notes != "" {
		client.Notes = cfg.Notes
	}

	if err := verifyLinkMTU(cfg.MTU); err == nil {
		client.MTU = cfg.MTU
	}

	client.PresharedKey = cfg.PresharedKey

	client.Modified = time.Now().Format(time.RFC3339)

	if len(cfg.AllowedIPs) != 0 {
		client.AllowedIPs = cfg.AllowedIPs
	}
	s.reconfigure()

	w.WriteHeader(http.StatusOK)
	if err := json.NewEncoder(w).Encode(client); err != nil {
		log.Error(err)
		w.WriteHeader(http.StatusInternalServerError)
		return
	}
}

// DeleteClient deletes the specified client for the current user
func (s *Server) DeleteClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	s.mutex.Lock()
	defer s.mutex.Unlock()
	user := r.Context().Value(key).(string)
	usercfg := s.Config.Users[user]
	if usercfg == nil {
		w.WriteHeader(http.StatusNotFound)
		return
	}

	client := ps.ByName("client")
	if usercfg.Clients[client] == nil {
		w.WriteHeader(http.StatusNotFound)
		return
	}

	delete(usercfg.Clients, client)
	s.reconfigure()

	log.WithField("user", user).Debug("Deleted client: ", client)

	w.WriteHeader(http.StatusOK)
}

// CreateClient creates a new client for the current user
func (s *Server) CreateClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	s.mutex.Lock()
	defer s.mutex.Unlock()

	user := r.Context().Value(key).(string)
	log.WithField("user", user).Debug("CreateClient")

	c := s.Config.GetUserConfig(user)
	log.Debugf("user config: %#v", c)

	if *maxNumberClientConfig > 0 {
		if len(c.Clients) >= *maxNumberClientConfig {
			log.Error(fmt.Errorf("user %q have too many configs", c.Name))

			e := struct {
				Error string
			}{
				Error: "Max number of configs: " + strconv.Itoa(*maxNumberClientConfig),
			}

			w.WriteHeader(http.StatusBadRequest)
			err := json.NewEncoder(w).Encode(e)
			if err != nil {
				log.Error(err)
				w.WriteHeader(http.StatusInternalServerError)
				return
			}
			return
		}
	}

	decoder := json.NewDecoder(r.Body)
	newclient := &NewClient{}
	err := decoder.Decode(&newclient)
	if err != nil {
		log.Warn("Error parsing request: ", err)
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	if newclient.Name == "" {
		log.Debugf("No clientName:using default: \"Unnamed Client\"")
		newclient.Name = "Unnamed Client"
	}

	if err := verifyLinkMTU(newclient.MTU); err != nil {
		log.Debugf("Invalid new client MTU: %d", newclient.MTU)
		if err := verifyLinkMTU(*wgPeerMtu); err != nil {
			log.Debugf("Invalid peer MTU: %d", *wgPeerMtu)
			newclient.MTU = wgDefaultMtu
		} else {
			newclient.MTU = *wgPeerMtu
		}
	}

	i := 0
	for k := range c.Clients {
		n, err := strconv.Atoi(k)
		if err != nil {
			log.Error(err)
			w.WriteHeader(http.StatusInternalServerError)
			return
		}
		if n > i {
			i = n
		}
	}
	i = i + 1

	ip := s.allocateIP()
	client := NewClientConfig(newclient.Name, ip, newclient.MTU, newclient.Notes, newclient.GeneratePSK)
	c.Clients[strconv.Itoa(i)] = client

	s.reconfigure()

	err = json.NewEncoder(w).Encode(client)
	if err != nil {
		log.Error(err)
		w.WriteHeader(http.StatusInternalServerError)
		return
	}
}


================================================
FILE: ui/.babelrc
================================================
{
  "presets": [
    ["@babel/preset-env", {
      "targets": {
        "node": "current"
      }
    }]
  ]
}

================================================
FILE: ui/.gitignore
================================================
node_modules
.idea


================================================
FILE: ui/.prettierrc
================================================
{
  "singleQuote": false,
  "printWidth": 120,
  "useTabs": false,
  "tabWidth": 4,
  "jsxBracketSameLine": true,
  "semi": true,
  "bracketSpacing": false,
  "arrowParens": "always"
}

================================================
FILE: ui/jest.config.js
================================================
// For a detailed explanation regarding each configuration property, visit:
// https://jestjs.io/docs/en/configuration.html

module.exports = {
    // All imported modules in your tests should be mocked automatically
    // automock: false,

    // Stop running tests after `n` failures
    // bail: 0,

    // Respect "browser" field in package.json when resolving modules
    // browser: false,

    // The directory where Jest should store its cached dependency information
    // cacheDirectory: "/tmp/jest_rs",

    // Automatically clear mock calls and instances between every test
    // clearMocks: false,

    // Indicates whether the coverage information should be collected while executing the test
    // collectCoverage: false,

    // An array of glob patterns indicating a set of files for which coverage information should be collected
    // collectCoverageFrom: null,

    // The directory where Jest should output its coverage files
    // coverageDirectory: null,

    // An array of regexp pattern strings used to skip coverage collection
    // coveragePathIgnorePatterns: [
    //   "/node_modules/"
    // ],

    // A list of reporter names that Jest uses when writing coverage reports
    // coverageReporters: [
    //   "json",
    //   "text",
    //   "lcov",
    //   "clover"
    // ],

    // An object that configures minimum threshold enforcement for coverage results
    // coverageThreshold: null,

    // A path to a custom dependency extractor
    // dependencyExtractor: null,

    // Make calling deprecated APIs throw helpful error messages
    // errorOnDeprecated: false,

    // Force coverage collection from ignored files using an array of glob patterns
    // forceCoverageMatch: [],

    // A path to a module which exports an async function that is triggered once before all test suites
    // globalSetup: null,

    // A path to a module which exports an async function that is triggered once after all test suites
    // globalTeardown: null,

    // A set of global variables that need to be available in all test environments
    // globals: {},

    // The maximum amount of workers used to run your tests. Can be specified as % or a number. E.g. maxWorkers: 10% will use 10% of your CPU amount + 1 as the maximum worker number. maxWorkers: 2 will use a maximum of 2 workers.
    // maxWorkers: "50%",

    // An array of directory names to be searched recursively up from the requiring module's location
    // moduleDirectories: [
    //   "node_modules"
    // ],

    // An array of file extensions your modules use
    // moduleFileExtensions: [
    //   "js",
    //   "json",
    //   "jsx",
    //   "ts",
    //   "tsx",
    //   "node"
    // ],

    // A map from regular expressions to module names that allow to stub out resources with a single module
    // moduleNameMapper: {},

    // An array of regexp pattern strings, matched against all module paths before considered 'visible' to the module loader
    // modulePathIgnorePatterns: [],

    // Activates notifications for test results
    // notify: false,

    // An enum that specifies notification mode. Requires { notify: true }
    // notifyMode: "failure-change",

    // A preset that is used as a base for Jest's configuration
    // preset: null,

    // Run tests from one or more projects
    // projects: null,

    // Use this configuration option to add custom reporters to Jest
    // reporters: undefined,

    // Automatically reset mock state between every test
    // resetMocks: false,

    // Reset the module registry before running each individual test
    // resetModules: false,

    // A path to a custom resolver
    // resolver: null,

    // Automatically restore mock state between every test
    // restoreMocks: false,

    // The root directory that Jest should scan for tests and modules within
    // rootDir: null,

    // A list of paths to directories that Jest should use to search for files in
    // roots: [
    //   "<rootDir>"
    // ],

    // Allows you to use a custom runner instead of Jest's default test runner
    // runner: "jest-runner",

    // The paths to modules that run some code to configure or set up the testing environment before each test
    // setupFiles: [],

    // A list of paths to modules that run some code to configure or set up the testing framework before each test
    // setupFilesAfterEnv: [],

    // A list of paths to snapshot serializer modules Jest should use for snapshot testing
    // snapshotSerializers: [],

    // The test environment that will be used for testing
    testEnvironment: "node"

    // Options that will be passed to the testEnvironment
    // testEnvironmentOptions: {},

    // Adds a location field to test results
    // testLocationInResults: false,

    // The glob patterns Jest uses to detect test files
    // testMatch: [
    //   "**/__tests__/**/*.[jt]s?(x)",
    //   "**/?(*.)+(spec|test).[tj]s?(x)"
    // ],

    // An array of regexp pattern strings that are matched against all test paths, matched tests are skipped
    // testPathIgnorePatterns: [
    //   "/node_modules/"
    // ],

    // The regexp pattern or array of patterns that Jest uses to detect test files
    // testRegex: [],

    // This option allows the use of a custom results processor
    // testResultsProcessor: null,

    // This option allows use of a custom test runner
    // testRunner: "jasmine2",

    // This option sets the URL for the jsdom environment. It is reflected in properties such as location.href
    // testURL: "http://localhost",

    // Setting this value to "fake" allows the use of fake timers for functions such as "setTimeout"
    // timers: "real",

    // A map from regular expressions to paths to transformers
    // transform: null,

    // An array of regexp pattern strings that are matched against all source file paths, matched files will skip transformation
    // transformIgnorePatterns: [
    //   "/node_modules/"
    // ],

    // An array of regexp pattern strings that are matched against all modules before the module loader will automatically return a mock for them
    // unmockedModulePathPatterns: undefined,

    // Indicates whether each individual test should be reported during the run
    // verbose: null,

    // An array of regexp patterns that are matched against all source file paths before re-running tests in watch mode
    // watchPathIgnorePatterns: [],

    // Whether to use watchman for file crawling
    // watchman: true,
};


================================================
FILE: ui/package.json
================================================
{
    "name": "wireguard-ui",
    "version": "1.0.0",
    "description": "WireGuard VPN web UI",
    "main": "index.js",
    "scripts": {
        "dev": "webpack-dev-server --mode=development --open --port 5000",
        "build": "cross-env NODE_ENV=production webpack --mode=production --progress",
        "test": "jest",
        "prettier": "prettier --check ./src/**/*.{js,css,json,md}"
    },
    "author": "Daniel Lundin <daniel.lundin@embark-studios.com>",
    "license": "ISC",
    "dependencies": {
        "cookie-universal": "^2.0.16"
    },
    "devDependencies": {
        "@babel/cli": "^7.12.10",
        "@babel/core": "^7.11.6",
        "@babel/preset-env": "^7.11.5",
        "@material/typography": "^3.1.0",
        "@smui/button": "^1.0.0",
        "@smui/dialog": "^1.0.0",
        "@smui/fab": "^1.0.0",
        "@smui/form-field": "^1.0.0",
        "@smui/icon-button": "^1.0.0",
        "@smui/paper": "^1.0.0",
        "@smui/switch": "^1.0.0",
        "@smui/textfield": "^1.0.0",
        "@smui/top-app-bar": "^1.0.0",
        "babel-jest": "^24.9.0",
        "babel-loader": "^8.1.0",
        "clean-webpack-plugin": "^3.0.0",
        "cross-env": "^6.0.3",
        "css-loader": "^3.6.0",
        "html-webpack-plugin": "^3.2.0",
        "husky": "^3.1.0",
        "jest": "^24.9.0",
        "lint-staged": "^9.5.0",
        "mini-css-extract-plugin": "^0.8.2",
        "node-sass": "^4.14.1",
        "prettier": "^1.19.1",
        "sass-loader": "^8.0.2",
        "style-loader": "^1.2.1",
        "svelte": "^3.25.0",
        "svelte-loader": "^2.13.6",
        "svelte-routing": "1.4.0",
        "webpack": "^4.44.1",
        "webpack-cli": "^3.3.12",
        "webpack-dev-server": "^3.11.0"
    },
    "husky": {
        "hooks": {
            "pre-commit": "lint-staged"
        }
    },
    "lint-staged": {
        "*.{js,css,json,md}": [
            "prettier --write",
            "git add"
        ]
    }
}


================================================
FILE: ui/src/About.svelte
================================================
<h1>About</h1>

<p>
WG UI is an <a href="https://www.embark-studios.com/">Embark Studios</a> Open Source project.
</p>

<p>
For contributions and feedback, please see the
<a href="https://github.com/EmbarkStudios/wg-ui">GitHub project</a>.
</p>

<h2>License</h2>
<p>
WG UI is licensed under <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>
</p>

<p>Copyright &copy; 2021, Embark Studios AB</p>




================================================
FILE: ui/src/App.svelte
================================================
<svelte:head>
  <title>WireGuard VPN</title>
</svelte:head>

<script>
  import { onMount } from 'svelte';
  import { Router, Link, Route } from "svelte-routing";
  import About from "./About.svelte";
  import Clients from "./Clients.svelte";
  import EditClient from "./EditClient.svelte";
  import Nav from "./Nav.svelte";
  import NewClient from "./NewClient.svelte";

  import Cookie from "cookie-universal";
  const cookies = Cookie();
  export let user = cookies.get("wguser", { fromRes: true}) || "anonymous";

  export let url = "";
</script>

<style>
main {
/*  max-width: 960px;
  margin-left: auto;
  margin-right: auto;
*/

}
footer {
  margin-top: 3em;
  border-top: 1px solid #ddd;
  text-align: center;
  background: #f7f7f7;
}
</style>

<div class="mdc-typography">

  <Router url="{url}">

    <Nav user="{user}" />

    <main role="main" class="container">
      <div>
        <Route path="client/:clientId" component="{EditClient}" />
        <Route path="newclient/" component="{NewClient}" />
        <Route path="about" component="{About}" />
        <Route path="/"><Clients user="{user}" /></Route>
      </div>
    </main>

  </Router>

  <footer>
    <p>
      Powered by <a href="https://github.com/EmbarkStudios/wg-ui">WG UI</a>.
    </p>
    <p>
      Copyright &copy; 2021 <a href="https://embark-studios.com">Embark Studios</a>.
    </p>
  </footer>
</div>


================================================
FILE: ui/src/Client.svelte
================================================
<script>
  import Button, {Group, GroupItem, Label} from '@smui/button';
  import IconButton, {Icon} from '@smui/icon-button';
  import Paper, {Title, Subtitle, Content} from '@smui/paper';
  import { link,navigate } from "svelte-routing";


  export let client;
  export let user;

  let clientId = client[0];
  let dev = client[1];

  var hash = 0;
  for (var i = 0; i < dev.PrivateKey.length; i++) {
    hash = dev.PrivateKey.charCodeAt(i) + ((hash << 5) - hash);
  }
  const color = "hsl(" + (hash % 360) + ",50%,95%)";

  function onEdit() {
    navigate("/client/" + clientId, { replace: true });
  }
</script>

<style>
  @media screen and (max-width: 800px) {
    img {
      display: none;
    }
  }

  img {
    margin-right: 40px;
    border: 1px solid #ccc;
  }

  .download {
    margin-top: 2em;
  }
</style>

<Paper elevation="8" style="background-color: {color}; margin: 2em 0;" class="card">

  <div class="float-right">
    <IconButton class="float-right material-icons" on:click={onEdit}>edit</IconButton>
  </div>


  <img src="/api/v1/users/{user}/clients/{clientId}?format=qrcode" class="qrcode float-right" alt="Mobile client config"/>

  <i class="material-icons" aria-hidden="true">devices</i>
  <h3 class="mdc-typography--headline5">
  {dev.Name}</h3>

  <dl>
    <dt>IP</dt>
    <dd>{dev.IP}</dd>
    <dt>Public Key</dt>
    <dd>{dev.PublicKey}</dd>
  </dl>

  <div class="download">
    <Button  href="/api/v1/users/{user}/clients/{clientId}?format=config" variant="raised"><Label>Download Config</Label></Button>
  </div>
</Paper>


================================================
FILE: ui/src/Clients.svelte
================================================
<script>
  import Fab, {Label, Icon} from '@smui/fab';
  import { onMount } from 'svelte';
  import Client from './Client.svelte';
  import { link,navigate } from "svelte-routing";

  export let user;

  let clientsUrl = "/api/v1/users/" + user + "/clients";
  let clients = [];

  async function getClients() {
    const res = await fetch(clientsUrl);
		clients = Object.entries(await res.json());
    console.log("Fetched clients", clients);
  }


  function onCreateNewClient() {
    navigate("/newclient", { replace: true });
  }


	onMount(getClients);
</script>

<style>
.newClient {
  float: right;
}

h2 small {
  display: block;
  clear: left;
  color: #ccc;
}


.content {}

.row {
  display: flex;
  flex-direction: row;
  flex-wrap: wrap;
  width: 100%;
}

.col {
  display: flex;
  flex-direction: column;
  flex-basis: 100%;
  flex: 1;
  margin-left: 2em;
}

.help {
flex-basis: 10%;
}

h2 {
margin: 0;
padding: 0;
}
</style>

<div class="content">
  <div class="row">
    <div class="col">
      <h2 class="mdc-typography--headline2">My VPN Clients<small class="mdc-typography--headline5">({user})</small></h2>
    </div>
    <div class="col help">
      <h3>Instructions</h3>
      <ol>
        <li><a href="https://www.wireguard.com/install/">Install WireGuard</a></li>
        <li>Download your WireGuard config</li>
        <li>Connect to the VPN server</li>
      </ol>
    </div>
  </div>

</div>

      {#each clients as dev}
        <Client user={user} client={dev}/>
      {/each}

      <div class="newClient">
        <Fab color="primary" on:click={onCreateNewClient}><Icon class="material-icons">add</Icon></Fab>
      </div>




================================================
FILE: ui/src/EditClient.svelte
================================================
<script>
  import Fab, {Label, Icon} from '@smui/fab';
  import Dialog, {Actions, InitialFocus} from '@smui/dialog';
  import Textfield, {Input, Textarea} from '@smui/textfield';
  import HelperText from '@smui/textfield/helper-text/index';
  import Button, {Group, GroupItem} from '@smui/button';
  import Paper, {Title, Subtitle, Content} from '@smui/paper';

  import Cookie from "cookie-universal";
  import { onMount } from 'svelte';
  import { link, navigate } from "svelte-routing";

  export let clientId;

  const user = Cookie().get("wguser", { fromRes: true});

  const clientUrl = `/api/v1/users/` + user + `/clients/` + clientId;

  let client = {};
  let clientName = "";
  let clientNotes = "";
  let allowedIPsText = "";
  let deleteDialog;

  function CIDRsubnetToNETIPMask(cidrmask){
    let bitmask = "".padStart(cidrmask,"1").padEnd(32,"0");
    return btoa(String.fromCharCode(
      parseInt(bitmask.slice(0,8),2),
      parseInt(bitmask.slice(8,16),2),
      parseInt(bitmask.slice(16,24),2),
      parseInt(bitmask.slice(24,32),2)))
  }
  
  function NETIPMaskToCIDRSubnet(bitmaskb64){
    let bitmask = atob(bitmaskb64).split("").map((x) => x.charCodeAt(0).toString(2).padStart(8,0)).join("");
    console.log(bitmask);
    let cidrmask = bitmask.lastIndexOf("1");
    return cidrmask == -1 ? 0 : cidrmask + 1
  }

  function convertTextCIDRsToNETIP(allowedIPsText){
    if (allowedIPsText.length == 0) {
      return null;
    }
    return allowedIPsText.split('\n').map(cidr => {
      if (cidr.length == 0){
        return null
      }else if (cidr.indexOf('/') != -1){
        let cidrsplit = cidr.split('/'); 
        return {IP: cidrsplit[0], Mask: CIDRsubnetToNETIPMask(parseInt(cidrsplit[1]))}
      }else{
        return {IP: cidr, Mask: btoa(32)}
      } 
    }).filter(x => !!x);
  }

  function convertNETIPToTextCIDRs(netIPs){
    return netIPs.map(netip => netip.IP+ "/"+ NETIPMaskToCIDRSubnet(netip.Mask)).join("\n")
  }

  async function getClient() {
    const res = await fetch(clientUrl);
    client = await res.json();
    clientName = client.Name;
    clientNotes = client.Notes;
    allowedIPsText = convertNETIPToTextCIDRs(client.AllowedIPs)
    console.log("Fetched client", client);
  }

  async function handleSubmit(event) {
    client.Name = clientName;
    client.Notes = clientNotes;
    client.AllowedIPs = convertTextCIDRsToNETIP(allowedIPsText);
    const res = await fetch(clientUrl, {
      method: "PUT",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify(client),
    });
    client = await res.json();
    navigate("/", { replace: true });
    console.log("Saved changes", res);
  }


  function handleBackClick(event) {
    navigate("/", { replace: true });
  }

  async function deleteHandler(e) {
    switch (e.detail.action) {
      case 'delete':
        const res = await fetch(clientUrl, {
          method: "DELETE",
        });
        await res;
        navigate("/", { replace: true });
        break;
      default:
        break;
    }
  }

	onMount(getClient);
</script>

<style>
  .back {
    position: fixed;
    left: 10px;
    top: 70px;
  }
</style>

<div class="back">
<Fab color="primary" on:click={handleBackClick}><Icon class="material-icons">arrow_back</Icon></Fab>
</div>

<h3 class="mdc-typography--headline3">Client Properties <small class="text-muted">({client.Name})</small></h3>

<div class="container">


  <form on:submit|preventDefault={handleSubmit}>

    <div class="margins">
      <Textfield input$id="name" bind:value={clientName} variant="outlined" label="Client Name" input$aria-controls="client-name" input$aria-describedby="client-name-help" />
      <HelperText id="client-name-help">Friendly name of client / device</HelperText>
    </div>

    <div class="margins">
      <Textfield input$id="notes" fullwidth textarea bind:value={clientNotes} label="Label" input$aria-controls="client-notes" input$aria-describedby="client-notes-help" />
      <HelperText id="client-notes-help">Notes about the client.</HelperText>
    </div>
        <div class="margins">
            <Textfield
                input$id="allowedIps"
                fullwidth
                textarea
                bind:value={allowedIPsText}
                label="Allowed IPs"
                input$aria-controls="client-allowedIps"
                input$aria-describedby="client-allowedIps"
            />
            <HelperText id="client-notes-help"
                >Additional allowed CIDR blocks accessible via the client separated by a newline</HelperText
            >
        </div>

    <Button variant="raised"><Label>Save Changes</Label></Button>
  </form>
</div>

<div class="container">
  <h3 class="mdc-typography--headline5">Additional Properties</h3>
  <dl>
    <dt>IP Address</dt>
    <dd>{client.IP}</dd>
    <dt>Private Key</dt>
    <dd>{client.PrivateKey}</dd>
    <dt>Public Key</dt>
    <dd>{client.PublicKey}</dd>
    <dt>Preshared Key</dt>
    <dd>{client.PresharedKey}</dd>
  </dl>
</div>

<div class="container">
  <h3 class="mdc-typography--headline4">Danger Zone</h3>

  <Dialog bind:this={deleteDialog} aria-labelledby="delete-title" aria-describedby="delete-content" on:MDCDialog:closed={deleteHandler}>
  <div class="container">
    <Title id="delete-title">Delete Client Config</Title>
    <Content id="delete-content">
      Are you sure you want to delete this client configuration?
    </Content>
    <Actions>
      <Button action="none">
        <Label>No</Label>
      </Button>
      <Button action="delete" default use={[InitialFocus]}>
        <Label>Yes</Label>
      </Button>
    </Actions>
    </div>
  </Dialog>

  <Button id="delete" variant="raised" on:click={() => deleteDialog.open()}><Label>Delete Client Config</Label></Button>

</div>


================================================
FILE: ui/src/Nav.svelte
================================================
<script>
  import TopAppBar, {Row, Section, Title} from "@smui/top-app-bar";
  import { Router, Link, Route } from "svelte-routing";
  import About from "./About.svelte";
  import Clients from "./Clients.svelte";
  import NavLink from "./NavLink.svelte";

  export let user;
</script>

<style>
  @media screen and (max-width: 800px) {
    .user {
      display: none;
    }
  }
</style>

<TopAppBar variant="static" color="primary">
  <Row>
    <Section>
      <Title>WireGuard VPN</Title>
    </Section>
    <Section align="end" toolbar>
      <small class="user">Logged in as {user}</small>
    </Section>
  </Row>
</TopAppBar>


================================================
FILE: ui/src/NavLink.svelte
================================================
<script>
  import { Link } from "svelte-routing";
  export let to = "";

  function getProps({ location, href, isPartiallyCurrent, isCurrent }) {
    const isActive = href === "/" ? isCurrent : isPartiallyCurrent || isCurrent;
    // The object returned here is spread on the anchor element's attributes
    if (isActive) {
      return { class: "nav-link active" };
    }
    return { class: "nav-link" };
  }
</script>

<Link to="{to}" getProps="{getProps}">
  <slot />
</Link>


================================================
FILE: ui/src/NewClient.svelte
================================================
<script>
  import Fab, {Label, Icon} from '@smui/fab';
  import Dialog, {Actions, InitialFocus} from '@smui/dialog';
  import Textfield, {Input, Textarea} from '@smui/textfield';
  import HelperText from '@smui/textfield/helper-text/index';
  import Button, {Group, GroupItem} from '@smui/button';
  import Paper, {Title, Subtitle, Content} from '@smui/paper';
  import Switch from '@smui/switch';
  import FormField from '@smui/form-field'
  import Cookie from "cookie-universal";
  import { onMount } from 'svelte';
  import { link, navigate } from "svelte-routing";

  const user = Cookie().get("wguser", { fromRes: true});

  let clientsUrl = "/api/v1/users/" + user + "/clients";

  let client = {};
  let clientName = "";
  let clientNotes = "";
  let generatePSK = false;
  let deleteDialog;

  async function handleSubmit(event) {
    client.Name = clientName;
    client.Notes = clientNotes;
    client.generatePSK = generatePSK;
    const res = await fetch(clientsUrl, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify(client),
    })
      .then(response => {
        return response.json();
    })
    .then(data => {
      if (typeof data.Error != "undefined") {
          console.log(data.Error);
          alert(data.Error);
      } else {
        console.log("New client added", data);
      }
    });
    navigate("/", { replace: true });
  };


  function handleBackClick(event) {
    navigate("/", { replace: true });
  }

</script>

<style>
  .back {
    position: fixed;
    left: 10px;
    top: 70px;
  }
</style>

<div class="back">
<Fab color="primary" on:click={handleBackClick}><Icon class="material-icons">arrow_back</Icon></Fab>
</div>

<h3 class="mdc-typography--headline3"><small>Create New Device Configuration</small></h3>

<div class="container">


  <form on:submit|preventDefault={handleSubmit}>

    <div class="margins">
      <Textfield input$id="name" bind:value={clientName} variant="outlined" label="Client Name" input$aria-controls="client-name" input$aria-describedby="client-name-help" />
      <HelperText id="client-name-help">Friendly name of client / device</HelperText>
    </div>

    <div class="margins">
      <Textfield input$id="notes" fullwidth textarea bind:value={clientNotes} label="Label" input$aria-controls="client-notes" input$aria-describedby="client-notes-help" />
      <HelperText id="client-notes-help">Notes about the client.</HelperText>
    </div>
        <div class="margins">
            <FormField  style="margin-bottom: 2em;">
                <Switch bind:checked={generatePSK} />
                <span slot="label">Generate a Pre-shared Key</span>
            </FormField>
        </div>
        
    <Button variant="raised"><Label>Create</Label></Button>
  </form>
</div>



================================================
FILE: ui/src/index.ejs
================================================
<!doctype html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport"
    content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
  <meta http-equiv="X-UA-Compatible" content="ie=edge">
  <title><%= htmlWebpackPlugin.options.title %></title>
  <link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
  <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700">
  <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto+Mono">
</head>
<body>
</body>
</html>


================================================
FILE: ui/src/index.js
================================================
import "./style.scss";
import App from "./App.svelte";

const app = new App({
    target: document.body,
    props: {
        name: "WireGuard VPN"
    }
});

export default app;


================================================
FILE: ui/src/main.js
================================================
import App from './App.svelte';

new App({
  target: document.body,
  // hydrate: true,
});



================================================
FILE: ui/src/style.scss
================================================
@import "@material/typography/mdc-typography";

.container {
  padding: 30px;
}

body {
  margin: 0;
  padding: 0;
}

.float-right {
  float: right;
}

dl {
  display: flex;
  flex-flow: row wrap;
}

dt {
  flex-basis: 20%;
  font-weight: bold;
  text-align: right;
}

dd {
  flex-basis: 70%;
  flex-grow: 1;
  margin-left: 0.5em;
  overflow: hidden;
}



================================================
FILE: ui/theme/_smui-theme.scss
================================================
// Nothing here. Just use the default theme.

================================================
FILE: ui/webpack.config.js
================================================
const {CleanWebpackPlugin} = require("clean-webpack-plugin");
const HtmlWebpackPlugin = require("html-webpack-plugin");
const MiniCssExtractPlugin = require("mini-css-extract-plugin");
const path = require("path");
const webpack = require("webpack");

const packageJSON = require("./package.json");

const mode = process.env.NODE_ENV || "development";
const prod = mode === "production";

const devOverrides = {
    devServer: {
        historyApiFallback: true
    }
};
const prodOverrides = {
    optimization: {
        minimize: true,
        splitChunks: {
            chunks: "all"
        }
    }
};

let envOverride = prod ? prodOverrides : devOverrides;

module.exports = {
    mode,
    entry: "./src/index.js",
    resolve: {
        alias: {
            svelte: path.resolve("node_modules", "svelte")
        },
        extensions: [".mjs", ".js", ".svelte"],
        mainFields: ["svelte", "browser", "module", "main"]
    },
    devtool: prod
        ? "source-map" // For development
        : "#eval-source-map",
    output: {
        publicPath: "/",
        path: __dirname + "/dist",
        filename: "[name].js",
        chunkFilename: "[name].[id].js"
    },
    module: {
        rules: [
            {
                test: /\.js$/,
                exclude: /(node_modules)/,
                use: {
                    loader: "babel-loader"
                }
            },
            {
                test: /\.s?css$/,
                use: [
                    /**
                     * MiniCssExtractPlugin doesn't support HMR.
                     * For developing, use 'style-loader' instead.
                     * */
                    prod ? MiniCssExtractPlugin.loader : "style-loader",
                    "css-loader",
                    {
                        loader: "sass-loader",
                        options: {
                            sassOptions: {
                                includePaths: ["./theme", "./node_modules"]
                            }
                        }
                    }
                ]
            },
            {
                test: /\.svelte$/,
                use: {
                    loader: "svelte-loader",
                    options: {
                        emitCss: true,
                        hotReload: true
                    }
                }
            }
        ]
    },
    plugins: [
        new webpack.ProgressPlugin(),
        new webpack.EnvironmentPlugin({
            NODE_ENV: mode,
            DEBUG: !prod
        }),
        new CleanWebpackPlugin(),
        new HtmlWebpackPlugin({
            title: packageJSON.name,
            hash: true,
            filename: "./index.html", //relative to root of the application
            template: "./src/index.ejs",
            favicon: "assets/favicon.png"
        }),
        new MiniCssExtractPlugin({
            filename: "[name].css"
        })
    ],
    ...envOverride
};


================================================
FILE: wg-go-ui.sh
================================================
#!/bin/sh

set -eux

# need `SYS_ADMIN` and `NET_ADMIN` capabilities.
mkdir -p /dev/net
TUNFILE=/dev/net/tun
[ ! -c $TUNFILE ] && mknod $TUNFILE c 10 200

# Start the first process
./wireguard-go ${WIREGUARD_UI_WG_DEVICE_NAME:-wg0}
status=$?
if [ $status -ne 0 ]; then
  echo "Failed to start wireguard-go: $status"
  exit $status
fi

# Start the second process
./wireguard-ui $@
status=$?
if [ $status -ne 0 ]; then
  echo "Failed to start wireguard-ui: $status"
  exit $status
fi

# Naive check runs checks once a minute to see if either of the processes exited.
# This illustrates part of the heavy lifting you need to do if you want to run
# more than one service in a container. The container exits with an error
# if it detects that either of the processes has exited.
# Otherwise it loops forever, waking up every 60 seconds

while sleep 60; do
  ps aux |grep wireguard-go |grep -q -v grep
  PROCESS_1_STATUS=$?
  ps aux |grep wireguard-ui |grep -q -v grep
  PROCESS_2_STATUS=$?
  # If the greps above find anything, they exit with 0 status
  # If they are not both 0, then something is wrong
  if [ $PROCESS_1_STATUS -ne 0 -o $PROCESS_2_STATUS -ne 0 ]; then
    echo "One of the processes has already exited."
    exit 1
  fi
done