feat: initial WireGUI implementation — full VPN management platform
Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN
management platform. All 10 implementation phases delivered.
Core stack:
- NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg)
- Alembic migrations, Valkey/Redis cache, pydantic-settings config
- WireGuard management via subprocess (wg/ip/nft CLIs)
- 164 tests passing, 35% code coverage
Features:
- User/device/rule CRUD with admin and unprivileged roles
- Full device config form with per-device WG overrides
- WireGuard client config generation with QR codes
- REST API (v0) with Bearer token auth for all resources
- TOTP MFA with QR registration and challenge flow
- OIDC SSO with authlib (provider registry, auto-create users)
- Magic link passwordless sign-in via email
- SAML SP-initiated SSO with IdP metadata parsing
- WebAuthn/FIDO2 security key registration
- nftables firewall with per-user chains and masquerade
- Background tasks: WG stats polling, VPN session expiry,
OIDC token refresh, WAN connectivity checks
- Startup reconciliation (DB ↔ WireGuard state sync)
- In-memory notification system with header badge
- Admin UI: users, devices, rules, settings (3 tabs), diagnostics
- Loguru logging with optional timestamped file output
Deployment:
- Multi-stage Dockerfile (python:3.13-slim)
- Docker Compose prod stack (bridge networking, NET_ADMIN, nftables)
- Forgejo CI: tests → semantic versioning → Docker registry push
- Health endpoint at /api/health
2026-03-30 16:53:46 -05:00
|
|
|
services:
|
|
|
|
|
postgres:
|
|
|
|
|
image: postgres:17
|
|
|
|
|
environment:
|
|
|
|
|
POSTGRES_USER: wiregui
|
|
|
|
|
POSTGRES_PASSWORD: wiregui
|
|
|
|
|
POSTGRES_DB: wiregui
|
|
|
|
|
ports:
|
|
|
|
|
- "5432:5432"
|
|
|
|
|
volumes:
|
|
|
|
|
- postgres_data:/var/lib/postgresql/data
|
|
|
|
|
|
|
|
|
|
valkey:
|
|
|
|
|
image: valkey/valkey:8
|
|
|
|
|
ports:
|
|
|
|
|
- "6379:6379"
|
|
|
|
|
volumes:
|
|
|
|
|
- valkey_data:/data
|
|
|
|
|
|
2026-03-31 14:28:34 -05:00
|
|
|
# Test OIDC Identity Provider — accepts any login, issues real JWTs
|
|
|
|
|
# Discovery: http://localhost:9000/test-idp/.well-known/openid-configuration
|
|
|
|
|
# Login: enter any username/password, it will issue a token
|
|
|
|
|
mock-oidc:
|
|
|
|
|
image: ghcr.io/navikt/mock-oauth2-server:2.1.10
|
|
|
|
|
ports:
|
|
|
|
|
- "9000:9000"
|
|
|
|
|
environment:
|
|
|
|
|
SERVER_PORT: "9000"
|
|
|
|
|
JSON_CONFIG: >
|
|
|
|
|
{
|
|
|
|
|
"interactiveLogin": true,
|
|
|
|
|
"httpServer": "NettyWrapper",
|
|
|
|
|
"tokenCallbacks": [
|
|
|
|
|
{
|
|
|
|
|
"issuerId": "test-idp",
|
|
|
|
|
"tokenExpiry": 3600,
|
|
|
|
|
"requestMappings": [
|
|
|
|
|
{
|
|
|
|
|
"requestParam": "scope",
|
|
|
|
|
"match": "*",
|
|
|
|
|
"claims": {
|
|
|
|
|
"sub": "$${claim:sub}",
|
|
|
|
|
"email": "$${claim:sub}@test.local",
|
|
|
|
|
"name": "Test User"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
|
feat: initial WireGUI implementation — full VPN management platform
Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN
management platform. All 10 implementation phases delivered.
Core stack:
- NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg)
- Alembic migrations, Valkey/Redis cache, pydantic-settings config
- WireGuard management via subprocess (wg/ip/nft CLIs)
- 164 tests passing, 35% code coverage
Features:
- User/device/rule CRUD with admin and unprivileged roles
- Full device config form with per-device WG overrides
- WireGuard client config generation with QR codes
- REST API (v0) with Bearer token auth for all resources
- TOTP MFA with QR registration and challenge flow
- OIDC SSO with authlib (provider registry, auto-create users)
- Magic link passwordless sign-in via email
- SAML SP-initiated SSO with IdP metadata parsing
- WebAuthn/FIDO2 security key registration
- nftables firewall with per-user chains and masquerade
- Background tasks: WG stats polling, VPN session expiry,
OIDC token refresh, WAN connectivity checks
- Startup reconciliation (DB ↔ WireGuard state sync)
- In-memory notification system with header badge
- Admin UI: users, devices, rules, settings (3 tabs), diagnostics
- Loguru logging with optional timestamped file output
Deployment:
- Multi-stage Dockerfile (python:3.13-slim)
- Docker Compose prod stack (bridge networking, NET_ADMIN, nftables)
- Forgejo CI: tests → semantic versioning → Docker registry push
- Health endpoint at /api/health
2026-03-30 16:53:46 -05:00
|
|
|
volumes:
|
|
|
|
|
postgres_data:
|
|
|
|
|
valkey_data:
|