<spanclass=w></span><spanclass=nt>api_verify_tls</span><spanclass=p>:</span><spanclass=w></span><spanclass="l l-Scalar l-Scalar-Plain">true</span><spanclass=w></span><spanclass=c1># set to false only if using self-signed during testing</span>
<spanclass=w></span><spanclass=nt>api_timeout</span><spanclass=p>:</span><spanclass=w></span><spanclass="l l-Scalar l-Scalar-Plain">30s</span><spanclass=w></span><spanclass=c1># maximum request duration</span>
<spanclass=w></span><spanclass=nt>concurrency</span><spanclass=p>:</span><spanclass=w></span><spanclass="l l-Scalar l-Scalar-Plain">5</span><spanclass=w></span><spanclass=c1># limit parallel REST calls to device</span>
<spanclass=w></span><spanclass=nt>debug</span><spanclass=p>:</span><spanclass=w></span><spanclass="l l-Scalar l-Scalar-Plain">false</span><spanclass=w></span><spanclass=c1># verbose logging for this backend</span>
</code></pre></div><h3id=known-limitations>Known limitations:</h3><ul><li>The MikroTik backend is still in beta. Some features may not work as expected.</li><li>Not all WireGuard Portal features are supported yet (e.g., no support for interface hooks)</li></ul><h2id=configuring-pfsense-backends>Configuring pfSense backends</h2><blockquote><p><imgalt=⚠class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@16.0.1/assets/svg/26a0.svgtitle=:warning:> The pfSense backend is currently <strong>alpha</strong>. Only basic interface and peer CRUD are supported. Traffic statistics (rx/tx, last handshake) are not exposed by the pfSense REST API and will show as empty.</p></blockquote><p>The pfSense backend talks to the pfSense REST API (pfSense Plus / CE with the REST API package installed). Point the backend at the appliance hostname without appending <code>/api/v2</code> — the portal appends <code>/api/v2</code> automatically. wg-portal is developed for and tested against REST API v2.8.0.</p><h3id=prerequisites-on-pfsense>Prerequisites on pfSense:</h3><ul><li>pfSense with the REST API package enabled (<code>System -> API</code>) and WireGuard configured.</li><li>An API key with permissions for WireGuard endpoints. If you use a read-only key, set <code>core.restore_state: false</code> in <code>config.yml</code> to avoid write attempts at startup.</li><li>HTTPS recommended; set <code>api_verify_tls: false</code> only for lab/self-signed setups.</li></ul><p>Example WireGuard Portal configuration:</p><divclass=highlight><pre><span></span><code><spanclass=nt>backend</span><spanclass=p>:</span>
</code></pre></div><h3id=known-limitations_1>Known limitations:</h3><ul><li>Alpha quality: behavior and API coverage may change.</li><li>Statistics (rx/tx bytes, last handshake) are not available from the pfSense REST API today.</li></ul><h2id=configuring-opnsense-backends>Configuring OPNsense backends</h2><blockquote><p><imgalt=⚠class=twemojisrc=https://cdn.jsdelivr.net/gh/jdecked/twemoji@16.0.1/assets/svg/26a0.svgtitle=:warning:> The OPNsense backend is currently <strong>alpha</strong>. Interface and peer CRUD are supported, as are <strong>per-peer</strong> traffic statistics (rx/tx bytes and last handshake), which the pfSense backend cannot provide. Interface-level byte counters are not reported, because OPNsense exposes counters per peer only. Interface hooks, DNS push and ping are not supported.</p></blockquote><p>The OPNsense backend talks to the WireGuard API that is part of <strong>OPNsense core</strong>. Unlike the pfSense backend, no add-on package needs to be installed — a stock OPNsense install already answers <code>/api/wireguard/*</code>.</p><p>Point <code>api_url</code> at the appliance root (for example <code>https://opnsense.example.com</code>); the portal appends the API paths itself.</p><h3id=prerequisites-on-opnsense>Prerequisites on OPNsense:</h3><ul><li>OPNsense 24.1 or newer, where WireGuard is part of the base system. Developed and tested against 26.7.</li><li>An API key/secret pair, created under <code>System -> Access -> Users -><user> -> API keys</code>. OPNsense shows the secret only once, at creation time.</li><li>The user needs permission for the WireGuard and firewall pages it should manage.</li><li>HTTPS recommended; set <code>api_verify_tls: false</code> only for lab/self-signed setups.</li></ul><p>Example WireGuard Portal configuration:</p><divclass=highlight><pre><span></span><code><spanclass=nt>backend</span><spanclass=p>:</span>
<spanclass=w></span><spanclass=c1># default backend decides where new interfaces are created</span>
