Stefano Bertelli
0546b44507
Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN management platform. All 10 implementation phases delivered. Core stack: - NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg) - Alembic migrations, Valkey/Redis cache, pydantic-settings config - WireGuard management via subprocess (wg/ip/nft CLIs) - 164 tests passing, 35% code coverage Features: - User/device/rule CRUD with admin and unprivileged roles - Full device config form with per-device WG overrides - WireGuard client config generation with QR codes - REST API (v0) with Bearer token auth for all resources - TOTP MFA with QR registration and challenge flow - OIDC SSO with authlib (provider registry, auto-create users) - Magic link passwordless sign-in via email - SAML SP-initiated SSO with IdP metadata parsing - WebAuthn/FIDO2 security key registration - nftables firewall with per-user chains and masquerade - Background tasks: WG stats polling, VPN session expiry, OIDC token refresh, WAN connectivity checks - Startup reconciliation (DB ↔ WireGuard state sync) - In-memory notification system with header badge - Admin UI: users, devices, rules, settings (3 tabs), diagnostics - Loguru logging with optional timestamped file output Deployment: - Multi-stage Dockerfile (python:3.13-slim) - Docker Compose prod stack (bridge networking, NET_ADMIN, nftables) - Forgejo CI: tests → semantic versioning → Docker registry push - Health endpoint at /api/health
55 lines
1.5 KiB
Docker
55 lines
1.5 KiB
Docker
FROM python:3.13-slim AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Install uv for fast dependency resolution
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
|
|
# Install system deps needed for building (wireguard-tools for wg CLI)
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
gcc libpq-dev wireguard-tools nftables iproute2 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy dependency files first for layer caching
|
|
COPY pyproject.toml uv.lock* ./
|
|
|
|
# Install dependencies (production only, no dev group)
|
|
RUN uv sync --no-dev --frozen 2>/dev/null || uv sync --no-dev
|
|
|
|
# Copy application code
|
|
COPY wiregui/ wiregui/
|
|
COPY alembic/ alembic/
|
|
COPY alembic.ini ./
|
|
|
|
FROM python:3.13-slim AS runner
|
|
|
|
WORKDIR /app
|
|
|
|
# Runtime dependencies
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
wireguard-tools nftables iproute2 libpq5 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy uv and virtualenv from builder
|
|
COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
|
|
COPY --from=builder /app/.venv /app/.venv
|
|
COPY --from=builder /app/wiregui /app/wiregui
|
|
COPY --from=builder /app/alembic /app/alembic
|
|
COPY --from=builder /app/alembic.ini /app/alembic.ini
|
|
COPY --from=builder /app/pyproject.toml /app/pyproject.toml
|
|
|
|
# Ensure the venv is on PATH
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
ENV PYTHONUNBUFFERED=1
|
|
|
|
# Create logs directory
|
|
RUN mkdir -p /app/logs
|
|
|
|
ARG VERSION=0.0.0-dev
|
|
ENV WG_VERSION=$VERSION
|
|
|
|
EXPOSE 13000
|
|
EXPOSE 51820/udp
|
|
|
|
# Run migrations then start the app
|
|
CMD ["sh", "-c", "alembic upgrade head && python -m wiregui.main"]
|