Use Github Container Registry

Also publish docker images on ghcr.io

.github/workflows/docker-publish.yml

@@ -0,0 +1,59 @@
+name: Docker
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on:
+  push:
+    branches: [ master ]
+    # Publish vX.X.X tags as releases.
+    tags: [ 'v*.*.*' ]
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -32,3 +32,5 @@ ssh.key
 .testCoverage.txt
 wg_portal.db
 go.sum
+swagger.json
+swagger.yaml

.travis.yml

@@ -20,11 +20,11 @@ script:
   - go get -t -v ./...
   - diff -u <(echo -n) <(gofmt -d .)
   - go vet $(go list ./... | grep -v /vendor/)
-  - make build
+  - make ENV_BUILD_IDENTIFIER=$TRAVIS_TAG ENV_BUILD_VERSION=$(echo $TRAVIS_COMMIT | cut -c1-7) build
   # Switch over GCC to cross compilation (breaks 386, hence why do it here only)
   - sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install gcc-arm-linux-gnueabi libc6-dev-armel-cross gcc-arm-linux-gnueabihf libc6-dev-armhf-cross gcc-aarch64-linux-gnu libc6-dev-arm64-cross
   - sudo ln -s /usr/include/asm-generic /usr/include/asm
-  - make build-cross-plat
+  - make ENV_BUILD_IDENTIFIER=$TRAVIS_TAG ENV_BUILD_VERSION=$(echo $TRAVIS_COMMIT | cut -c1-7) build-cross-plat
 
 deploy:
   provider: releases

Dockerfile

@@ -6,6 +6,12 @@
 ######-
 FROM golang:1.16 as builder
 
+ARG BUILD_IDENTIFIER
+ENV ENV_BUILD_IDENTIFIER=$BUILD_IDENTIFIER
+
+ARG BUILD_VERSION
+ENV ENV_BUILD_VERSION=$BUILD_VERSION
+
 RUN mkdir /build
 
 # Copy the source from the current directory to the Working Directory inside the container
@@ -17,28 +23,32 @@ WORKDIR /build
 # Workaround for failing travis-ci builds
 RUN rm -rf ~/go; rm -rf go.sum
 
+# Download dependencies
+RUN curl -L https://git.prolicht.digital/pub/healthcheck/-/releases/v1.0.1/downloads/binaries/hc -o /build/hc; \
+    chmod +rx /build/hc; \
+    echo "Building version: $ENV_BUILD_IDENTIFIER-$ENV_BUILD_VERSION"
+
 # Build the Go app
-RUN go clean -modcache; go mod tidy; make build
+RUN go clean -modcache; go mod tidy; make build-docker
 
 ######-
 # Here starts the main image
 ######-
-FROM debian:buster
+FROM scratch
 
 # Setup timezone
 ENV TZ=Europe/Vienna
 
-# GOSS for container health checks
-ENV GOSS_VERSION v0.3.16
-RUN apt-get update && apt-get upgrade -y && \
-        apt-get install --no-install-recommends -y moreutils ca-certificates curl && \
-        rm -rf /var/cache/apt /var/lib/apt/lists/*; \
-        curl -L https://github.com/aelsabbahy/goss/releases/download/$GOSS_VERSION/goss-linux-amd64 -o /usr/local/bin/goss && \
-        chmod +rx /usr/local/bin/goss && \
-        goss --version
+# Import linux stuff from builder.
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/group /etc/group
 
-COPY --from=builder /build/dist/wg-portal-amd64 /app/wgportal
-COPY --from=builder /build/scripts /app/
+# Import healthcheck binary
+COPY --from=builder /build/hc /app/hc
+
+# Copy binaries
+COPY --from=builder /build/dist/wgportal /app/wgportal
 
 # Set the Current Working Directory inside the container
 WORKDIR /app
@@ -46,5 +56,4 @@ WORKDIR /app
 # Command to run the executable
 CMD [ "/app/wgportal" ]
 
-HEALTHCHECK --interval=1m --timeout=10s \
-    CMD /app/docker-healthcheck.sh
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD [ "/app/hc", "http://localhost:11223/health" ]

Makefile

@@ -18,6 +18,9 @@ build-cross-plat: dep build $(addsuffix -arm,$(addprefix $(BUILDDIR)/,$(BINARIES
 	cp scripts/wg-portal.service $(BUILDDIR)
 	cp scripts/wg-portal.env $(BUILDDIR)
 
+build-docker: dep
+	CGO_ENABLED=1 GOOS=linux GOARCH=amd64 $(GOCMD) build -o $(BUILDDIR)/wgportal -ldflags "-w -s -linkmode external -extldflags \"-static\" -X github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}" -tags netgo cmd/wg-portal/main.go
+
 dep:
 	$(GOCMD) mod download
 
@@ -48,13 +51,17 @@ docker-build:
 docker-push:
 	docker push $(IMAGE)
 
+api-docs:
+	cd internal/server; swag init --parseDependency --parseInternal --generalInfo api.go
+	$(GOCMD) fmt internal/server/docs/docs.go
+
 $(BUILDDIR)/%-amd64: cmd/%/main.go dep phony
-	GOOS=linux GOARCH=amd64 $(GOCMD) build -o $@ $<
+	GOOS=linux GOARCH=amd64 $(GOCMD) build -ldflags "-X github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}" -o $@ $<
 
 # On arch-linux install aarch64-linux-gnu-gcc to crosscompile for arm64
 $(BUILDDIR)/%-arm64: cmd/%/main.go dep phony
-	CGO_ENABLED=1 CC=aarch64-linux-gnu-gcc GOOS=linux GOARCH=arm64 $(GOCMD) build -ldflags "-linkmode external -extldflags -static" -o $@ $<
+	CGO_ENABLED=1 CC=aarch64-linux-gnu-gcc GOOS=linux GOARCH=arm64 $(GOCMD) build -ldflags "-linkmode external -extldflags \"-static\" -X github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}" -o $@ $<
 
 # On arch-linux install arm-linux-gnueabihf-gcc to crosscompile for arm
 $(BUILDDIR)/%-arm: cmd/%/main.go dep phony
-	CGO_ENABLED=1 CC=arm-linux-gnueabi-gcc GOOS=linux GOARCH=arm GOARM=7 $(GOCMD) build -ldflags "-linkmode external -extldflags -static" -o $@ $<
+	CGO_ENABLED=1 CC=arm-linux-gnueabi-gcc GOOS=linux GOARCH=arm GOARM=7 $(GOCMD) build -ldflags "-linkmode external -extldflags \"-static\" -X github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}" -o $@ $<

README.md

@@ -9,11 +9,11 @@
 [![Docker Pulls](https://img.shields.io/docker/pulls/h44z/wg-portal.svg)](https://hub.docker.com/r/h44z/wg-portal/)
 
 A simple, web based configuration portal for [WireGuard](https://wireguard.com). 
-The portal uses the WireGuard [wgctrl](https://github.com/WireGuard/wgctrl-go) library to manage the VPN 
-interface. This allows for seamless activation or deactivation of new users, without disturbing existing VPN 
+The portal uses the WireGuard [wgctrl](https://github.com/WireGuard/wgctrl-go) library to manage existing VPN 
+interfaces. This allows for seamless activation or deactivation of new users, without disturbing existing VPN 
 connections.
 
-The configuration portal currently supports using SQLite, MySQL as a user source for authentication and profile data.
+The configuration portal currently supports using SQLite and MySQL as a user source for authentication and profile data.
 It also supports LDAP (Active Directory or OpenLDAP) as authentication provider.
 
 ## Features
@@ -30,14 +30,19 @@ It also supports LDAP (Active Directory or OpenLDAP) as authentication provider.
  * One single binary
  * Can be used with existing WireGuard setups
  * Support for multiple WireGuard interfaces
+ * REST API for management and client deployment
  
 ![Screenshot](screenshot.png)
 
 ## Setup
+Make sure that your host system has at least one WireGuard interface (for example wg0) available. 
+If you did not start up a WireGuard interface yet, take a look at [wg-quick](https://manpages.debian.org/unstable/wireguard-tools/wg-quick.8.en.html) in order to get started.
 
 ### Docker
 The easiest way to run WireGuard Portal is to use the Docker image provided.
 
+HINT: the *latest* tag always refers to the master branch and might contain unstable or incompatible code!
+
 Docker Compose snippet with some sample configuration values:
 ```
 version: '3.6'
@@ -78,11 +83,11 @@ services:
       - LDAP_ADMIN_GROUP=CN=WireGuardAdmins,OU=Users,DC=COMPANY,DC=LOCAL
 ```
 Please note that mapping ```/etc/wireguard``` to ```/etc/wireguard``` inside the docker, will erase your host's current configuration.
-If needed, please make sure to backup your files from ```/etc/wireguard```.
+If needed, please make sure to back up your files from ```/etc/wireguard```.
 For a full list of configuration options take a look at the source file [internal/server/configuration.go](internal/server/configuration.go#L56).
 
 ### Standalone
-For a standalone application, use the Makefile provided in the repository to build the application.
+For a standalone application, use the Makefile provided in the repository to build the application. Go version 1.16 or higher has to be installed to build WireGuard Portal.
 
 ```
 make
@@ -94,11 +99,113 @@ make build-cross-plat
 The compiled binary will be located in the dist folder.
 A detailed description for using this software with a raspberry pi can be found in the [README-RASPBERRYPI.md](README-RASPBERRYPI.md).
 
-## What is out of scope
+## Configuration
+You can configure WireGuard Portal using either environment variables or a yaml configuration file.
+The filepath of the yaml configuration file defaults to **config.yml** in the working directory of the executable.
+It is possible to override the configuration filepath using the environment variable **CONFIG_FILE**.
+For example: `CONFIG_FILE=/home/test/config.yml ./wg-portal-amd64`.
 
- * Generation or application of any `iptables` or `nftables` rules
- * Setting up or changing IP-addresses of the WireGuard interface on operating systems other than linux
- * Importing private keys of an existing WireGuard setup
+### Configuration Options
+The following configuration options are available:
+
+| environment           | yaml              | yaml_parent | default_value                                   | description                                                                                                                          |
+|-----------------------|-------------------|-------------|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
+| LISTENING_ADDRESS     | listeningAddress  | core        | :8123                                           | The address on which the web server is listening. Optional IP address and port, e.g.: 127.0.0.1:8080.                                |
+| EXTERNAL_URL          | externalUrl       | core        | http://localhost:8123                           | The external URL where the web server is reachable. This link is used in emails that are created by the WireGuard Portal.            |
+| WEBSITE_TITLE         | title             | core        | WireGuard VPN                                   | The website title.                                                                                                                   |
+| COMPANY_NAME          | company           | core        | WireGuard Portal                                | The company name (for branding).                                                                                                     |
+| MAIL_FROM             | mailFrom          | core        | WireGuard VPN <noreply@company.com>             | The email address from which emails are sent.                                                                                        |
+| ADMIN_USER            | adminUser         | core        | admin@wgportal.local                            | The administrator user. Must be a valid email address.                                                                               |
+| ADMIN_PASS            | adminPass         | core        | wgportal                                        | The administrator password. If unchanged, a random password will be set on first startup.                                            |
+| EDITABLE_KEYS         | editableKeys      | core        | true                                            | Allow to edit key-pairs in the UI.                                                                                                   |
+| CREATE_DEFAULT_PEER   | createDefaultPeer | core        | false                                           | If an LDAP user logs in for the first time, a new WireGuard peer will be created on the WG_DEFAULT_DEVICE if this option is enabled. |
+| SELF_PROVISIONING     | selfProvisioning  | core        | false                                           | Allow registered users to automatically create peers via the RESTful API.                                                            |
+| LDAP_ENABLED          | ldapEnabled       | core        | false                                           | Enable or disable the LDAP backend.                                                                                                  |
+| SESSION_SECRET        | sessionSecret     | core        | secret                                          | Use a custom secret to encrypt session data.                                                                                         |
+| DATABASE_TYPE         | typ               | database    | sqlite                                          | Either mysql or sqlite.                                                                                                              |
+| DATABASE_HOST         | host              | database    |                                                 | The mysql server address.                                                                                                            |
+| DATABASE_PORT         | port              | database    |                                                 | The mysql server port.                                                                                                               |
+| DATABASE_NAME         | database          | database    | data/wg_portal.db                               | For sqlite database: the database file-path, otherwise the database name.                                                            |
+| DATABASE_USERNAME     | user              | database    |                                                 | The mysql user.                                                                                                                      |
+| DATABASE_PASSWORD     | password          | database    |                                                 | The mysql password.                                                                                                                  |
+| EMAIL_HOST            | host              | email       | 127.0.0.1                                       | The email server address.                                                                                                            |
+| EMAIL_PORT            | port              | email       | 25                                              | The email server port.                                                                                                               |
+| EMAIL_TLS             | tls               | email       | false                                           | Use STARTTLS. DEPRECATED: use EMAIL_ENCRYPTION instead.                                                                              |
+| EMAIL_ENCRYPTION      | encryption        | email       | none                                            | Either none, tls or starttls.                                                                                                        |
+| EMAIL_CERT_VALIDATION | certcheck         | email       | false                                           | Validate the email server certificate.                                                                                               |
+| EMAIL_USERNAME        | user              | email       |                                                 | An optional username for SMTP authentication.                                                                                        |
+| EMAIL_PASSWORD        | pass              | email       |                                                 | An optional password for SMTP authentication.                                                                                        |
+| EMAIL_AUTHTYPE        | auth              | email       | plain                                           | Either plain, login or crammd5. If username and password are empty, this value is ignored.                                           |
+| WG_DEVICES            | devices           | wg          | wg0                                             | A comma separated list of WireGuard devices.                                                                                         |
+| WG_DEFAULT_DEVICE     | defaultDevice     | wg          | wg0                                             | This device is used for auto-created peers (if CREATE_DEFAULT_PEER is enabled).                                                      |
+| WG_CONFIG_PATH        | configDirectory   | wg          | /etc/wireguard                                  | If set, interface configuration updates will be written to this path, filename: <devicename>.conf.                                   |
+| MANAGE_IPS            | manageIPAddresses | wg          | true                                            | Handle IP address setup of interface, only available on linux.                                                                       |
+| LDAP_URL              | url               | ldap        | ldap://srv-ad01.company.local:389               | The LDAP server url.                                                                                                                 |
+| LDAP_STARTTLS         | startTLS          | ldap        | true                                            | Use STARTTLS.                                                                                                                        |
+| LDAP_CERT_VALIDATION  | certcheck         | ldap        | false                                           | Validate the LDAP server certificate.                                                                                                |
+| LDAP_BASEDN           | dn                | ldap        | DC=COMPANY,DC=LOCAL                             | The base DN for searching users.                                                                                                     |
+| LDAP_USER             | user              | ldap        | company\\\\ldap_wireguard                       | The bind user.                                                                                                                       |
+| LDAP_PASSWORD         | pass              | ldap        | SuperSecret                                     | The bind password.                                                                                                                   |
+| LDAP_LOGIN_FILTER     | loginFilter       | ldap        | (&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2)) | {{login_identifier}} will be replaced with the login email address.  |
+| LDAP_SYNC_FILTER      | syncFilter        | ldap        | (&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))                    | The filter string for the LDAP synchronization service.              |
+| LDAP_ADMIN_GROUP      | adminGroup        | ldap        | CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL | Users in this group are marked as administrators.                                                                                    |
+| LDAP_ATTR_EMAIL       | attrEmail         | ldap        | mail                                            | User email attribute.                                                                                                                |
+| LDAP_ATTR_FIRSTNAME   | attrFirstname     | ldap        | givenName                                       | User firstname attribute.                                                                                                            |
+| LDAP_ATTR_LASTNAME    | attrLastname      | ldap        | sn                                              | User lastname attribute.                                                                                                             |
+| LDAP_ATTR_PHONE       | attrPhone         | ldap        | telephoneNumber                                 | User phone number attribute.                                                                                                         |
+| LDAP_ATTR_GROUPS      | attrGroups        | ldap        | memberOf                                        | User groups attribute.                                                                                                               |
+| LOG_LEVEL             |                   |             | debug                                           | Specify log level, one of: trace, debug, info, off.                                                                                  |
+| LOG_JSON              |                   |             | false                                           | Format log output as JSON.                                                                                                           |
+| LOG_COLOR             |                   |             | true                                            | Colorize log output.                                                                                                                 |
+| CONFIG_FILE           |                   |             | config.yml                                      | The config file path.                                                                                                                |
+
+### Sample yaml configuration
+config.yml:
+```yaml
+core:
+  listeningAddress: :8123
+  externalUrl: https://wg-test.test.com
+  adminUser: test@test.com
+  adminPass: test
+  editableKeys: true
+  createDefaultPeer: false
+  ldapEnabled: true
+  mailFrom: WireGuard VPN <noreply@test.com>
+ldap:
+  url: ldap://10.10.10.10:389
+  dn: DC=test,DC=test
+  startTLS: false
+  user: wireguard@test.test
+  pass: test
+  adminGroup: CN=WireGuardAdmins,CN=Users,DC=test,DC=test
+database:
+  typ: sqlite
+  database: data/wg_portal.db
+email:
+  host: smtp.gmail.com
+  port: 587
+  tls: true
+  user: test@gmail.com
+  pass: topsecret
+wg:
+  devices: 
+    - wg0
+    - wg1
+  defaultDevice: wg0
+  configDirectory: /etc/wireguard
+  manageIPAddresses: true
+```
+
+### RESTful API
+WireGuard Portal offers a RESTful API to interact with. 
+The API is documented using OpenAPI 2.0, the Swagger UI can be found 
+under the URL `http://<your wg-portal ip/domain>/swagger/index.html`.
+
+## What is out of scope
+ * Creating or removing WireGuard (wgX) interfaces.
+ * Generation or application of any `iptables` or `nftables` rules.
+ * Setting up or changing IP-addresses of the WireGuard interface on operating systems other than linux.
+ * Importing private keys of an existing WireGuard setup.
  
 ## Application stack
 
@@ -112,4 +219,4 @@ A detailed description for using this software with a raspberry pi can be found
  * MIT License. [MIT](LICENSE.txt) or https://opensource.org/licenses/MIT
  
 
-This project was inspired by [wg-gen-web](https://github.com/vx3r/wg-gen-web).
+This project was inspired by [wg-gen-web](https://github.com/vx3r/wg-gen-web).

assets/css/bootstrap-tokenfield.min.css

@@ -2,4 +2,4 @@
  * bootstrap-tokenfield
  * https://github.com/sliptree/bootstrap-tokenfield
  * Copyright 2013-2014 Sliptree and other contributors; Licensed MIT
- */@-webkit-keyframes 'blink'{0%{border-color:#ededed}100%{border-color:#b94a48}}@-moz-keyframes 'blink'{0%{border-color:#ededed}100%{border-color:#b94a48}}@keyframes 'blink'{0%{border-color:#ededed}100%{border-color:#b94a48}}.tokenfield{height:auto;min-height:34px;padding-bottom:0}.tokenfield.focus{border-color:#66afe9;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6);box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6)}.tokenfield .token{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;display:inline-block;border:1px solid #d9d9d9;background-color:#ededed;white-space:nowrap;margin:-1px 5px 5px 0;height:22px;vertical-align:top;cursor:default}.tokenfield .token:hover{border-color:#b9b9b9}.tokenfield .token.active{border-color:#52a8ec;border-color:rgba(82,168,236,.8)}.tokenfield .token.duplicate{border-color:#ebccd1;-webkit-animation-name:blink;animation-name:blink;-webkit-animation-duration:.1s;animation-duration:.1s;-webkit-animation-direction:normal;animation-direction:normal;-webkit-animation-timing-function:ease;animation-timing-function:ease;-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}.tokenfield .token.invalid{background:0 0;border:1px solid transparent;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;border-bottom:1px dotted #d9534f}.tokenfield .token.invalid.active{background:#ededed;border:1px solid #ededed;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px}.tokenfield .token .token-label{display:inline-block;overflow:hidden;text-overflow:ellipsis;padding-left:4px;vertical-align:top}.tokenfield .token .close{font-family:Arial;display:inline-block;line-height:100%;font-size:1.1em;line-height:1.49em;margin-left:5px;float:none;height:100%;vertical-align:top;padding-right:4px}.tokenfield .token-input{background:0 0;width:60px;min-width:60px;border:0;height:20px;padding:0;margin-bottom:6px;-webkit-box-shadow:none;box-shadow:none}.tokenfield .token-input:focus{border-color:transparent;outline:0;-webkit-box-shadow:none;box-shadow:none}.tokenfield.disabled{cursor:not-allowed;background-color:#eee}.tokenfield.disabled .token-input{cursor:not-allowed}.tokenfield.disabled .token:hover{cursor:not-allowed;border-color:#d9d9d9}.tokenfield.disabled .token:hover .close{cursor:not-allowed;opacity:.2;filter:alpha(opacity=20)}.has-warning .tokenfield.focus{border-color:#66512c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b}.has-error .tokenfield.focus{border-color:#843534;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483}.has-success .tokenfield.focus{border-color:#2b542c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168}.tokenfield.input-sm,.input-group-sm .tokenfield{min-height:30px;padding-bottom:0}.input-group-sm .token,.tokenfield.input-sm .token{height:20px;margin-bottom:4px}.input-group-sm .token-input,.tokenfield.input-sm .token-input{height:18px;margin-bottom:5px}.tokenfield.input-lg,.input-group-lg .tokenfield{min-height:45px;padding-bottom:4px}.input-group-lg .token,.tokenfield.input-lg .token{height:25px}.input-group-lg .token-label,.tokenfield.input-lg .token-label{line-height:23px}.input-group-lg .token .close,.tokenfield.input-lg .token .close{line-height:1.3em}.input-group-lg .token-input,.tokenfield.input-lg .token-input{height:23px;line-height:23px;margin-bottom:6px;vertical-align:top}.tokenfield.rtl{direction:rtl;text-align:right}.tokenfield.rtl .token{margin:-1px 0 5px 5px}.tokenfield.rtl .token .token-label{padding-left:0;padding-right:4px}
+ */@-webkit-keyframes blink{0%{border-color:#ededed}100%{border-color:#b94a48}}@-moz-keyframes blink{0%{border-color:#ededed}100%{border-color:#b94a48}}@keyframes blink{0%{border-color:#ededed}100%{border-color:#b94a48}}.tokenfield{height:auto;min-height:34px;padding-bottom:0}.tokenfield.focus{border-color:#66afe9;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6);box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6)}.tokenfield .token{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;display:inline-block;border:1px solid #d9d9d9;background-color:#ededed;white-space:nowrap;margin:-1px 5px 5px 0;height:22px;vertical-align:top;cursor:default}.tokenfield .token:hover{border-color:#b9b9b9}.tokenfield .token.active{border-color:#52a8ec;border-color:rgba(82,168,236,.8)}.tokenfield .token.duplicate{border-color:#ebccd1;-webkit-animation-name:blink;animation-name:blink;-webkit-animation-duration:.1s;animation-duration:.1s;-webkit-animation-direction:normal;animation-direction:normal;-webkit-animation-timing-function:ease;animation-timing-function:ease;-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}.tokenfield .token.invalid{background:0 0;border:1px solid transparent;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;border-bottom:1px dotted #d9534f}.tokenfield .token.invalid.active{background:#ededed;border:1px solid #ededed;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px}.tokenfield .token .token-label{display:inline-block;overflow:hidden;text-overflow:ellipsis;padding-left:4px;vertical-align:top}.tokenfield .token .close{font-family:Arial;display:inline-block;line-height:100%;font-size:1.1em;line-height:1.49em;margin-left:5px;float:none;height:100%;vertical-align:top;padding-right:4px}.tokenfield .token-input{background:0 0;width:60px;min-width:60px;border:0;height:20px;padding:0;margin-bottom:6px;-webkit-box-shadow:none;box-shadow:none}.tokenfield .token-input:focus{border-color:transparent;outline:0;-webkit-box-shadow:none;box-shadow:none}.tokenfield.disabled{cursor:not-allowed;background-color:#eee}.tokenfield.disabled .token-input{cursor:not-allowed}.tokenfield.disabled .token:hover{cursor:not-allowed;border-color:#d9d9d9}.tokenfield.disabled .token:hover .close{cursor:not-allowed;opacity:.2;filter:alpha(opacity=20)}.has-warning .tokenfield.focus{border-color:#66512c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b}.has-error .tokenfield.focus{border-color:#843534;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483}.has-success .tokenfield.focus{border-color:#2b542c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168}.tokenfield.input-sm,.input-group-sm .tokenfield{min-height:30px;padding-bottom:0}.input-group-sm .token,.tokenfield.input-sm .token{height:20px;margin-bottom:4px}.input-group-sm .token-input,.tokenfield.input-sm .token-input{height:18px;margin-bottom:5px}.tokenfield.input-lg,.input-group-lg .tokenfield{height:auto;min-height:45px;padding-bottom:4px}.input-group-lg .token,.tokenfield.input-lg .token{height:25px}.input-group-lg .token-label,.tokenfield.input-lg .token-label{line-height:23px}.input-group-lg .token .close,.tokenfield.input-lg .token .close{line-height:1.3em}.input-group-lg .token-input,.tokenfield.input-lg .token-input{height:23px;line-height:23px;margin-bottom:6px;vertical-align:top}.tokenfield.rtl{direction:rtl;text-align:right}.tokenfield.rtl .token{margin:-1px 0 5px 5px}.tokenfield.rtl .token .token-label{padding-left:0;padding-right:4px}

assets/css/custom.css

@@ -80,4 +80,24 @@ pre{background:#f7f7f9}iframe{overflow:hidden;border:none}@media (min-width: 768
 .form-group.required label:after {
     content:"*";
     color:red;
+}
+
+a.advanced-settings:before {
+    content: "Hide";
+}
+
+a.advanced-settings.collapsed:before {
+    content: "Show";
+}
+
+.form-group.global-config label:after, .custom-control.global-config label:after {
+    content: "g";
+    color: #0057bb;
+    font-size: xx-small;
+    top: -5px;
+    position: absolute;
+}
+
+.text-blue {
+    color: #0057bb;
 }

assets/css/signin.css

@@ -0,0 +1,3 @@
+.navbar {
+    padding: 0.5rem 1rem;
+}

assets/tpl/admin_create_clients.html

@@ -24,13 +24,13 @@
             <div class="form-row">
                 <div class="form-group required col-md-12">
                     <label for="inputEmail">Email Addresses</label>
-                    <input type="text" name="email" class="form-control" id="inputEmail" value="{{.FormData.Emails}}">
+                    <input type="text" name="email" class="form-control" id="inputEmail" value="{{.FormData.Emails}}" required>
                 </div>
             </div>
             <div class="form-row">
                 <div class="form-group required col-md-12">
                     <label for="inputIdentifier">Client Friendly Name (will be added as suffix to the name of the user)</label>
-                    <input type="text" name="identifier" class="form-control" id="inputIdentifier" value="{{.FormData.Identifier}}">
+                    <input type="text" name="identifier" class="form-control" id="inputIdentifier" value="{{.FormData.Identifier}}" required>
                 </div>
             </div>
 
@@ -52,11 +52,19 @@
             if (!valid) {
                 $(e.relatedTarget).addClass('invalid')
             }
+        }).on('tokenfield:createtoken', function (e) {
+            var existingTokens = $(this).tokenfield('getTokens');
+            $.each(existingTokens, function(index, token) {
+                if (token.value === e.attrs.value)
+                    e.preventDefault();
+            });
         }).tokenfield({
             autocomplete: {
-                source: [{{range $i, $u :=.Users}}{{$u.Email}},{{end}}],
+                source: [{{range $i, $u :=.Users}}{{if ne $i 0}},{{end}}'{{$u.Email}}'{{end}}],
                 delay: 100
             },
+            inputType: 'email',
+            createTokensOnBlur: true,
             showAutocompleteOnFocus: false
         })</script>
 </body>

assets/tpl/admin_edit_client.html

@@ -13,34 +13,39 @@
 <body id="page-top" class="d-flex flex-column min-vh-100">
     {{template "prt_nav.html" .}}
     <div class="container mt-5">
+        {{template "prt_flashes.html" .}}
+
+        <!-- server mode -->
+        {{if eq .Device.Type "server"}}
         {{if .Peer.IsNew}}
             <h1>Create a new client</h1>
         {{else}}
-            <h1>Edit client <strong>{{.Peer.Identifier}}</strong></h1>
+            <h1>Edit client: <strong>{{.Peer.Identifier}}</strong></h1>
         {{end}}
 
-        {{template "prt_flashes.html" .}}
-
         <form method="post" enctype="multipart/form-data">
             <input type="hidden" name="_csrf" value="{{.Csrf}}">
             <input type="hidden" name="uid" value="{{.Peer.UID}}">
+            <input type="hidden" name="devicetype" value="{{.Device.Type}}">
+            <input type="hidden" name="device" value="{{.Device.DeviceName}}">
+            <input type="hidden" name="endpoint" value="{{.Peer.Endpoint}}">
             {{if .EditableKeys}}
                 <div class="form-row">
                     <div class="form-group col-md-12">
-                        <label for="inputServerPrivateKey">Private Key</label>
-                        <input type="text" name="privkey" class="form-control" id="inputServerPrivateKey" value="{{.Peer.PrivateKey}}">
+                        <label for="server_PrivateKey">Private Key</label>
+                        <input type="text" name="privkey" class="form-control" id="server_PrivateKey" value="{{.Peer.PrivateKey}}">
                     </div>
                 </div>
                 <div class="form-row">
                     <div class="form-group required col-md-12">
-                        <label for="inputServerPublicKey">Public Key</label>
-                        <input type="text" name="pubkey" class="form-control" id="inputServerPublicKey" value="{{.Peer.PublicKey}}">
+                        <label for="server_PublicKey">Public Key</label>
+                        <input type="text" name="pubkey" class="form-control" id="server_PublicKey" value="{{.Peer.PublicKey}}" required>
                     </div>
                 </div>
                 <div class="form-row">
                     <div class="form-group col-md-12">
-                        <label for="inputServerPresharedKey">Preshared Key</label>
-                        <input type="text" name="presharedkey" class="form-control" id="inputServerPresharedKey" value="{{.Peer.PresharedKey}}">
+                        <label for="server_PresharedKey">Preshared Key</label>
+                        <input type="text" name="presharedkey" class="form-control" id="server_PresharedKey" value="{{.Peer.PresharedKey}}" required>
                     </div>
                 </div>
             {{else}}
@@ -48,48 +53,70 @@
                 <input type="hidden" name="presharedkey" value="{{.Peer.PresharedKey}}">
                 <div class="form-row">
                     <div class="form-group col-md-12">
-                        <label for="inputServerPublicKey">Public Key</label>
-                        <input type="text" name="pubkey" readonly class="form-control" id="inputServerPublicKey" value="{{.Peer.PublicKey}}">
+                        <label for="server_ro_PublicKey">Public Key</label>
+                        <input type="text" name="pubkey" readonly class="form-control" id="server_ro_PublicKey" value="{{.Peer.PublicKey}}">
                     </div>
                 </div>
             {{end}}
             <div class="form-row">
                 <div class="form-group required col-md-12">
-                    <label for="inputIdentifier">Client Friendly Name</label>
-                    <input type="text" name="identifier" class="form-control" id="inputIdentifier" value="{{.Peer.Identifier}}">
+                    <label for="server_Identifier">Client Friendly Name</label>
+                    <input type="text" name="identifier" class="form-control" id="server_Identifier" value="{{.Peer.Identifier}}" required>
                 </div>
             </div>
             <div class="form-row">
                 <div class="form-group required col-md-12">
-                    <label for="inputEmail">Client Email Address</label>
-                    <input type="email" name="mail" class="form-control" id="inputEmail" value="{{.Peer.Email}}">
+                    <label for="server_Email">Client Email Address</label>
+                    <input type="email" name="mail" class="form-control" id="server_Email" value="{{.Peer.Email}}" required>
                 </div>
             </div>
             <div class="form-row">
                 <div class="form-group required col-md-12">
-                    <label for="inputIP">Client IP Address</label>
-                    <input type="text" name="ip" class="form-control" id="inputIP" value="{{.Peer.IPsStr}}">
+                    <label for="server_IP">Client IP Address</label>
+                    <input type="text" name="ip" class="form-control" id="server_IP" value="{{.Peer.IPsStr}}" required>
                 </div>
             </div>
             <div class="form-row">
-                <div class="form-group required col-md-12">
-                    <label for="inputAllowedIP">Allowed IPs</label>
-                    <input type="text" name="allowedip" class="form-control" id="inputAllowedIP" value="{{.Peer.AllowedIPsStr}}">
+                <div class="form-group col-md-12 global-config">
+                    <label for="server_AllowedIP">Allowed IPs</label>
+                    <input type="text" name="allowedip" class="form-control" id="server_AllowedIP" value="{{.Peer.AllowedIPsStr}}">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <label for="server_AllowedIPSrv">Extra Allowed IPs (Server sided)</label>
+                    <input type="text" name="allowedipSrv" class="form-control" id="server_AllowedIPSrv" value="{{.Peer.AllowedIPsSrvStr}}">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-12 global-config">
+                    <label for="server_DNS">Client DNS Servers</label>
+                    <input type="text" name="dns" class="form-control" id="server_DNS" value="{{.Peer.DNSStr}}">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-6 global-config">
+                    <label for="server_PersistentKeepalive">Persistent Keepalive (0 = off)</label>
+                    <input type="number" name="keepalive" class="form-control" id="server_PersistentKeepalive" placeholder="16" value="{{.Peer.PersistentKeepalive}}">
+                </div>
+                <div class="form-group col-md-6 global-config">
+                    <label for="server_MTU">Client MTU (0 = default)</label>
+                    <input type="number" name="mtu" class="form-control" id="server_MTU" placeholder="" value="{{.Peer.Mtu}}">
                 </div>
             </div>
 
             <div class="form-row">
                 <div class="form-group col-md-12">
                     <div class="custom-control custom-switch">
-                        <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="inputDisabled" {{if .Peer.DeactivatedAt}}checked{{end}}>
-                        <label class="custom-control-label" for="inputDisabled">
+                        <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="server_Disabled" {{if .Peer.DeactivatedAt}}checked{{end}}>
+                        <label class="custom-control-label" for="server_Disabled">
                             Disabled
                         </label>
                     </div>
                     <div class="custom-control custom-switch">
-                        <input class="custom-control-input" name="ignorekeepalive" type="checkbox" value="true" id="inputIgnoreKeepalive" {{if .Peer.IgnorePersistentKeepalive}}checked{{end}}>
-                        <label class="custom-control-label" for="inputIgnoreKeepalive">
-                            Ignore persistent keepalive
+                        <input class="custom-control-input" name="ignoreglobalsettings" type="checkbox" value="true" id="server_IgnoreGlobalSettings" {{if .Peer.IgnoreGlobalSettings}}checked{{end}}>
+                        <label class="custom-control-label" for="server_IgnoreGlobalSettings">
+                            Ignore global settings (<span class="text-blue">g</span>)
                         </label>
                     </div>
                 </div>
@@ -99,6 +126,80 @@
             <button type="submit" class="btn btn-primary">Save</button>
             <a href="/admin" class="btn btn-secondary">Cancel</a>
         </form>
+        {{end}}
+
+        <!-- client mode -->
+        {{if eq .Device.Type "client"}}
+        {{if .Peer.IsNew}}
+        <h1>Create a new remote endpoint</h1>
+        {{else}}
+        <h1>Edit remote endpoint: <strong>{{.Peer.Identifier}}</strong></h1>
+        {{end}}
+
+        <form method="post" enctype="multipart/form-data">
+            <input type="hidden" name="_csrf" value="{{.Csrf}}">
+            <input type="hidden" name="uid" value="{{.Peer.UID}}">
+            <input type="hidden" name="mail" value="{{.AdminEmail}}">
+            <input type="hidden" name="devicetype" value="{{.Device.Type}}">
+            <input type="hidden" name="device" value="{{.Device.DeviceName}}">
+            <input type="hidden" name="privkey" value="{{.Peer.PrivateKey}}">
+                        <div class="form-row">
+                <div class="form-group required col-md-12">
+                    <label for="client_Identifier">Endpoint Friendly Name</label>
+                    <input type="text" name="identifier" class="form-control" id="client_Identifier" value="{{.Peer.Identifier}}" required>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group required col-md-12">
+                    <label for="client_Endpoint">Endpoint Address</label>
+                    <input type="text" name="endpoint" class="form-control" id="client_Endpoint" value="{{.Peer.Endpoint}}" required>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group required col-md-12">
+                    <label for="client_PublicKey">Endpoint Public Key</label>
+                    <input type="text" name="pubkey" class="form-control" id="client_PublicKey" value="{{.Peer.PublicKey}}" required>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <label for="client_PresharedKey">Preshared Key</label>
+                    <input type="text" name="presharedkey" class="form-control" id="client_PresharedKey" value="{{.Peer.PresharedKey}}">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <label for="client_AllowedIP">Allowed IPs</label>
+                    <input type="text" name="allowedip" class="form-control" id="client_AllowedIP" value="{{.Peer.AllowedIPsStr}}">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-6">
+                    <label for="client_PersistentKeepalive">Persistent Keepalive (0 = off)</label>
+                    <input type="number" name="keepalive" class="form-control" id="client_PersistentKeepalive" placeholder="16" value="{{.Peer.PersistentKeepalive}}">
+                </div>
+                <div class="form-group col-md-6">
+                    <label for="client_IP">Ping-Check IP Address</label>
+                    <input type="text" name="ip" class="form-control" id="client_IP" value="{{.Peer.IPsStr}}">
+                </div>
+            </div>
+
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <div class="custom-control custom-switch">
+                        <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="client_Disabled" {{if .Peer.DeactivatedAt}}checked{{end}}>
+                        <label class="custom-control-label" for="client_Disabled">
+                            Disabled
+                        </label>
+                    </div>
+                </div>
+            </div>
+
+
+            <button type="submit" class="btn btn-primary">Save</button>
+            <a href="/admin" class="btn btn-secondary">Cancel</a>
+        </form>
+        {{end}}
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>

assets/tpl/admin_edit_interface.html

@@ -16,99 +16,240 @@
         <h1>Edit interface <strong>{{.Device.DeviceName}}</strong></h1>
         {{template "prt_flashes.html" .}}
 
-        <form method="post" enctype="multipart/form-data">
-            <input type="hidden" name="_csrf" value="{{.Csrf}}">
-            <input type="hidden" name="device" value="{{.Device.DeviceName}}">
-            <h3>Server's interface configuration</h3>
-            {{if .EditableKeys}}
-            <div class="form-row">
-                <div class="form-group required col-md-12">
-                    <label for="inputServerPrivateKey">Private Key</label>
-                    <input type="text" name="privkey" class="form-control" id="inputServerPrivateKey" value="{{.Device.PrivateKey}}">
-                </div>
-            </div>
-            <div class="form-row">
-                <div class="form-group required col-md-12">
-                    <label for="inputServerPublicKey">Public Key</label>
-                    <input type="text" name="pubkey" class="form-control" id="inputServerPublicKey" value="{{.Device.PublicKey}}">
-                </div>
-            </div>
-            {{else}}
-            <input type="hidden" name="privkey" value="{{.Device.PrivateKey}}">
-            <div class="form-row">
-                <div class="form-group col-md-12">
-                    <label for="inputServerPublicKey">Public Key</label>
-                    <input type="text" name="pubkey" readonly class="form-control" id="inputServerPublicKey" value="{{.Device.PublicKey}}">
-                </div>
-            </div>
-            {{end}}
-            <div class="form-row">
-                <div class="form-group required col-md-6">
-                    <label for="inputListenPort">Listen port</label>
-                    <input type="number" name="port" class="form-control" id="inputListenPort" placeholder="51820" value="{{.Device.ListenPort}}">
-                </div>
-                <div class="form-group required col-md-6">
-                    <label for="inputIPs">Server IP address</label>
-                    <input type="text" name="ip" class="form-control" id="inputIPs" placeholder="10.6.6.1/24" value="{{.Device.IPsStr}}">
-                </div>
-            </div>
-            <h3>Client's global configuration</h3>
-            <div class="form-row">
-                <div class="form-group required col-md-12">
-                    <label for="inputPublicEndpoint">Public Endpoint for Clients</label>
-                    <input type="text" name="endpoint" class="form-control" id="inputPublicEndpoint" placeholder="vpn.company.com:51820" value="{{.Device.Endpoint}}">
-                </div>
-            </div>
-            <div class="form-row">
-                <div class="form-group col-md-6">
-                    <label for="inputDNS">DNS Servers</label>
-                    <input type="text" name="dns" class="form-control" id="inputDNS" placeholder="1.1.1.1" value="{{.Device.DNSStr}}">
-                </div>
-                <div class="form-group col-md-6">
-                    <label for="inputAllowedIP">Default allowed IPs</label>
-                    <input type="text" name="allowedip" class="form-control" id="inputAllowedIP" placeholder="10.6.6.0/24" value="{{.Device.AllowedIPsStr}}">
-                </div>
-            </div>
-            <div class="form-row">
-                <div class="form-group col-md-6">
-                    <label for="inputMTU">Global MTU</label>
-                    <input type="number" name="mtu" class="form-control" id="inputMTU" placeholder="0" value="{{.Device.Mtu}}">
-                </div>
-                <div class="form-group col-md-6">
-                    <label for="inputPersistentKeepalive">Persistent Keepalive</label>
-                    <input type="number" name="keepalive" class="form-control" id="inputPersistentKeepalive" placeholder="16" value="{{.Device.PersistentKeepalive}}">
-                </div>
-            </div>
-            <h3>Interface configuration hooks</h3>
-            <div class="form-row">
-                <div class="form-group col-md-12">
-                    <label for="inputPreUp">Pre Up</label>
-                    <input type="text" name="preup" class="form-control" id="inputPreUp" value="{{.Device.PreUp}}">
-                </div>
-            </div>
-            <div class="form-row">
-                <div class="form-group col-md-12">
-                    <label for="inputPostUp">Post Up</label>
-                    <input type="text" name="postup" class="form-control" id="inputPostUp" value="{{.Device.PostUp}}">
-                </div>
-            </div>
-            <div class="form-row">
-                <div class="form-group col-md-12">
-                    <label for="inputPreDown">Pre Down</label>
-                    <input type="text" name="predown" class="form-control" id="inputPreDown" value="{{.Device.PreDown}}">
-                </div>
-            </div>
-            <div class="form-row">
-                <div class="form-group col-md-12">
-                    <label for="inputPostDown">Post Down</label>
-                    <input type="text" name="postdown" class="form-control" id="inputPostDown" value="{{.Device.PostDown}}">
-                </div>
+        <ul class="nav nav-tabs">
+            <li class="nav-item">
+                <a class="nav-link {{if eq .Device.Type "server"}}active{{end}}" data-toggle="tab" href="#server">Server Mode</a>
+            </li>
+            <li class="nav-item">
+                <a class="nav-link {{if eq .Device.Type "client"}}active{{end}}" data-toggle="tab" href="#client">Client Mode</a>
+            </li>
+        </ul>
+
+        <div id="configContent" class="tab-content">
+            <!-- server mode -->
+            <div class="tab-pane fade {{if eq .Device.Type "server"}}active show{{end}}" id="server">
+                <form method="post" enctype="multipart/form-data">
+                    <input type="hidden" name="_csrf" value="{{.Csrf}}">
+                    <input type="hidden" name="device" value="{{.Device.DeviceName}}">
+                    <input type="hidden" name="devicetype" value="server">
+                    <h3>Server's interface configuration</h3>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="server_DisplayName">Display Name</label>
+                            <input type="text" name="displayname" class="form-control" id="server_DisplayName" value="{{.Device.DisplayName}}">
+                        </div>
+                    </div>
+                    {{if .EditableKeys}}
+                    <div class="form-row">
+                        <div class="form-group required col-md-12">
+                            <label for="server_PrivateKey">Private Key</label>
+                            <input type="text" name="privkey" class="form-control" id="server_PrivateKey" value="{{.Device.PrivateKey}}" required>
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group required col-md-12">
+                            <label for="server_PublicKey">Public Key</label>
+                            <input type="text" name="pubkey" class="form-control" id="server_PublicKey" value="{{.Device.PublicKey}}" required>
+                        </div>
+                    </div>
+                    {{else}}
+                    <input type="hidden" name="privkey" value="{{.Device.PrivateKey}}">
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="server_ro_PublicKey">Public Key</label>
+                            <input type="text" name="pubkey" readonly class="form-control" id="server_ro_PublicKey" value="{{.Device.PublicKey}}">
+                        </div>
+                    </div>
+                    {{end}}
+                    <div class="form-row">
+                        <div class="form-group required col-md-6">
+                            <label for="server_ListenPort">Listen port</label>
+                            <input type="number" name="port" class="form-control" id="server_ListenPort" placeholder="51820" value="{{.Device.ListenPort}}" required>
+                        </div>
+                        <div class="form-group required col-md-6">
+                            <label for="server_IPs">Server IP address</label>
+                            <input type="text" name="ip" class="form-control" id="server_IPs" placeholder="10.6.6.1/24" value="{{.Device.IPsStr}}" required>
+                        </div>
+                    </div>
+                    <h3>Client's global configuration (<span class="text-blue">g</span>)</h3>
+                    <div class="form-row">
+                        <div class="form-group required col-md-12">
+                            <label for="server_PublicEndpoint">Public Endpoint for Clients</label>
+                            <input type="text" name="endpoint" class="form-control" id="server_PublicEndpoint" placeholder="vpn.company.com:51820" value="{{.Device.DefaultEndpoint}}" required>
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-6">
+                            <label for="server_DNS">DNS Servers</label>
+                            <input type="text" name="dns" class="form-control" id="server_DNS" placeholder="1.1.1.1" value="{{.Device.DNSStr}}">
+                        </div>
+                        <div class="form-group col-md-6">
+                            <label for="server_AllowedIP">Default allowed IPs</label>
+                            <input type="text" name="allowedip" class="form-control" id="server_AllowedIP" placeholder="10.6.6.0/24" value="{{.Device.DefaultAllowedIPsStr}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-6">
+                            <label for="server_MTU">MTU (also used for the server interface, 0 = default)</label>
+                            <input type="number" name="mtu" class="form-control" id="server_MTU" placeholder="" value="{{.Device.Mtu}}">
+                        </div>
+                        <div class="form-group col-md-6">
+                            <label for="server_PersistentKeepalive">Persistent Keepalive (0 = off)</label>
+                            <input type="number" name="keepalive" class="form-control" id="server_PersistentKeepalive" placeholder="16" value="{{.Device.DefaultPersistentKeepalive}}">
+                        </div>
+                    </div>
+                    <h3>Interface configuration hooks</h3>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="server_PreUp">Pre Up</label>
+                            <input type="text" name="preup" class="form-control" id="server_PreUp" value="{{.Device.PreUp}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="server_PostUp">Post Up</label>
+                            <input type="text" name="postup" class="form-control" id="server_PostUp" value="{{.Device.PostUp}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="server_PreDown">Pre Down</label>
+                            <input type="text" name="predown" class="form-control" id="server_PreDown" value="{{.Device.PreDown}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="server_PostDown">Post Down</label>
+                            <input type="text" name="postdown" class="form-control" id="server_PostDown" value="{{.Device.PostDown}}">
+                        </div>
+                    </div>
+
+                    <div class="form-row">
+                        <div class="d-flex align-items-center">
+                            <a href="#" class="advanced-settings btn btn-link collapsed" data-toggle="collapse" data-target="#collapseAdvancedServer" aria-expanded="false" aria-controls="collapseAdvancedServer">
+                                Advanced Settings
+                            </a>
+                        </div>
+                    </div>
+                    <div id="collapseAdvancedServer" class="collapse" aria-labelledby="collapseAdvancedServer">
+                        <div class="form-row">
+                            <div class="form-group col-md-6">
+                                <label for="server_FirewallMark">Firewall Mark (0 = default or off)</label>
+                                <input type="number" name="firewallmark" class="form-control" id="server_FirewallMark" placeholder="" value="{{.Device.FirewallMark}}">
+                            </div>
+                            <div class="form-group col-md-6">
+                                <label for="server_RoutingTable">Routing Table (empty = default or auto)</label>
+                                <input type="text" name="routingtable" class="form-control" id="server_RoutingTable" placeholder="auto" value="{{.Device.RoutingTable}}">
+                            </div>
+                        </div>
+                        <div class="form-row">
+                            <div class="form-group col-md-12">
+                                <div class="custom-control custom-switch">
+                                    <input class="custom-control-input" name="saveconfig" type="checkbox" value="true" id="server_SaveConfig" {{if .Peer.SaveConfig}}checked{{end}}>
+                                    <label class="custom-control-label" for="server_SaveConfig">
+                                        Save Configuration (if interface was edited via WireGuard configuration tool)
+                                    </label>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <button type="submit" class="btn btn-primary">Save</button>
+                    <a href="/admin" class="btn btn-secondary">Cancel</a>
+                    <a href="/admin/device/applyglobals" class="btn btn-dark float-right">Apply Global Settings (<span class="text-blue">g</span>) to clients</a>
+                </form>
             </div>
 
-            <button type="submit" class="btn btn-primary">Save</button>
-            <a href="/admin" class="btn btn-secondary">Cancel</a>
-            <a href="/admin/device/applyglobals" class="btn btn-dark float-right">Apply Allowed IP's to clients</a>
-        </form>
+            <!-- client mode -->
+            <div class="tab-pane fade {{if eq .Device.Type "client"}}active show{{end}}" id="client">
+                <form method="post" enctype="multipart/form-data">
+                    <input type="hidden" name="_csrf" value="{{.Csrf}}">
+                    <input type="hidden" name="device" value="{{.Device.DeviceName}}">
+                    <input type="hidden" name="devicetype" value="client">
+                    <h3>Client's interface configuration</h3>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="client_DisplayName">Display Name</label>
+                            <input type="text" name="displayname" class="form-control" id="client_DisplayName" value="{{.Device.DisplayName}}">
+                        </div>
+                    </div>
+                    {{if .EditableKeys}}
+                    <div class="form-row">
+                        <div class="form-group required col-md-12">
+                            <label for="client_PrivateKey">Private Key</label>
+                            <input type="text" name="privkey" class="form-control" id="client_PrivateKey" value="{{.Device.PrivateKey}}" required>
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group required col-md-12">
+                            <label for="client_PublicKey">Public Key</label>
+                            <input type="text" name="pubkey" class="form-control" id="client_PublicKey" value="{{.Device.PublicKey}}" required>
+                        </div>
+                    </div>
+                    {{else}}
+                    <input type="hidden" name="privkey" value="{{.Device.PrivateKey}}">
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="client_ro_PublicKey">Public Key</label>
+                            <input type="text" name="pubkey" readonly class="form-control" id="client_ro_PublicKey" value="{{.Device.PublicKey}}">
+                        </div>
+                    </div>
+                    {{end}}
+                    <div class="form-row">
+                        <div class="form-group required col-md-6">
+                            <label for="client_IPs">Client IP address</label>
+                            <input type="text" name="ip" class="form-control" id="client_IPs" placeholder="10.6.6.1/24" value="{{.Device.IPsStr}}" required>
+                        </div>
+                        <div class="form-group col-md-6">
+                            <label for="client_DNS">DNS Servers</label>
+                            <input type="text" name="dns" class="form-control" id="client_DNS" placeholder="1.1.1.1" value="{{.Device.DNSStr}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-4">
+                            <label for="client_MTU">MTU (0 = default)</label>
+                            <input type="number" name="mtu" class="form-control" id="client_MTU" placeholder="" value="{{.Device.Mtu}}">
+                        </div>
+                        <div class="form-group col-md-4">
+                            <label for="client_FirewallMark">Firewall Mark (0 = default or off)</label>
+                            <input type="number" name="firewallmark" class="form-control" id="client_FirewallMark" placeholder="" value="{{.Device.FirewallMark}}">
+                        </div>
+                        <div class="form-group col-md-4">
+                            <label for="client_RoutingTable">Routing Table (empty = default or auto)</label>
+                            <input type="text" name="routingtable" class="form-control" id="client_RoutingTable" placeholder="auto" value="{{.Device.RoutingTable}}">
+                        </div>
+                    </div>
+                    <h3>Interface configuration hooks</h3>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="client_PreUp">Pre Up</label>
+                            <input type="text" name="preup" class="form-control" id="client_PreUp" value="{{.Device.PreUp}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="client_PostUp">Post Up</label>
+                            <input type="text" name="postup" class="form-control" id="client_PostUp" value="{{.Device.PostUp}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="client_PreDown">Pre Down</label>
+                            <input type="text" name="predown" class="form-control" id="client_PreDown" value="{{.Device.PreDown}}">
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group col-md-12">
+                            <label for="client_PostDown">Post Down</label>
+                            <input type="text" name="postdown" class="form-control" id="client_PostDown" value="{{.Device.PostDown}}">
+                        </div>
+                    </div>
+
+                    <button type="submit" class="btn btn-primary">Save</button>
+                    <a href="/admin" class="btn btn-secondary">Cancel</a>
+                </form>
+            </div>
+        </div>
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>

assets/tpl/admin_edit_user.html

@@ -27,7 +27,7 @@
         <div class="form-row">
             <div class="form-group required col-md-12">
                 <label for="inputEmail">Email</label>
-                <input type="text" name="email" class="form-control" id="inputEmail" value="{{.User.Email}}">
+                <input type="text" name="email" class="form-control" id="inputEmail" value="{{.User.Email}}" required>
             </div>
         </div>
         {{else}}
@@ -36,13 +36,13 @@
         <div class="form-row">
             <div class="form-group required col-md-12">
                 <label for="inputFirstname">Firstname</label>
-                <input type="text" name="firstname" class="form-control" id="inputFirstname" value="{{.User.Firstname}}">
+                <input type="text" name="firstname" class="form-control" id="inputFirstname" value="{{.User.Firstname}}" required>
             </div>
         </div>
         <div class="form-row">
             <div class="form-group required col-md-12">
                 <label for="inputLastname">Lastname</label>
-                <input type="text" name="lastname" class="form-control" id="inputLastname" value="{{.User.Lastname}}">
+                <input type="text" name="lastname" class="form-control" id="inputLastname" value="{{.User.Lastname}}" required>
             </div>
         </div>
         <div class="form-row">
@@ -54,7 +54,7 @@
         <div class="form-row">
             <div class="form-group col-md-12 {{if eq .User.CreatedAt .Epoch}}required{{end}}">
                 <label for="inputPassword">Password</label>
-                <input type="password" name="password" class="form-control" id="inputPassword">
+                <input type="password" name="password" class="form-control" id="inputPassword" {{if eq .User.CreatedAt .Epoch}}required{{end}}>
             </div>
         </div>
         <div class="form-row">

assets/tpl/admin_index.html

@@ -18,7 +18,9 @@
         <div class="card">
             <div class="card-header">
                 <div class="d-flex align-items-center">
-                    <span class="mr-auto">Interface status for <strong>{{.Device.DeviceName}}</strong></span>
+                    <span class="mr-auto">Interface status for <strong>{{.Device.DeviceName}}</strong> {{if eq $.Device.Type "server"}}(server mode){{end}}{{if eq $.Device.Type "client"}}(client mode){{end}}</span>
+                    <a href="/admin/device/write?dev={{.Device.DeviceName}}" title="Write interface configuration"><i class="fas fa-save"></i></a>
+                    &nbsp;&nbsp;&nbsp;
                     <a href="/admin/device/download?dev={{.Device.DeviceName}}" title="Download interface configuration"><i class="fas fa-download"></i></a>
                     &nbsp;&nbsp;&nbsp;
                     <a href="/admin/device/edit?dev={{.Device.DeviceName}}" title="Edit interface settings"><i class="fas fa-cog"></i></a>
@@ -26,6 +28,7 @@
             </div>
             <div class="card-body">
                 <div class="row">
+                    {{if eq $.Device.Type "server"}}
                     <div class="col-sm-6">
                         <table class="table table-sm table-borderless device-status-table">
                             <tbody>
@@ -35,7 +38,7 @@
                             </tr>
                             <tr>
                                 <td>Public Endpoint:</td>
-                                <td>{{.Device.Endpoint}}</td>
+                                <td>{{.Device.DefaultEndpoint}}</td>
                             </tr>
                             <tr>
                                 <td>Listening Port:</td>
@@ -61,7 +64,7 @@
                             </tr>
                             <tr>
                                 <td>Default allowed IP's:</td>
-                                <td>{{.Device.AllowedIPsStr}}</td>
+                                <td>{{.Device.DefaultAllowedIPsStr}}</td>
                             </tr>
                             <tr>
                                 <td>Default DNS servers:</td>
@@ -73,22 +76,68 @@
                             </tr>
                             <tr>
                                 <td>Default Keepalive Interval:</td>
-                                <td>{{.Device.PersistentKeepalive}}</td>
+                                <td>{{.Device.DefaultPersistentKeepalive}}</td>
                             </tr>
                             </tbody>
                         </table>
                     </div>
+                    {{end}}
+                    {{if eq $.Device.Type "client"}}
+                    <div class="col-sm-6">
+                        <table class="table table-sm table-borderless device-status-table">
+                            <tbody>
+                            <tr>
+                                <td>Public Key:</td>
+                                <td>{{.Device.PublicKey}}</td>
+                            </tr>
+                            <tr>
+                                <td>Enabled Endpoints:</td>
+                                <td>{{len .Device.Interface.Peers}}</td>
+                            </tr>
+                            <tr>
+                                <td>Total Endpoints:</td>
+                                <td>{{.TotalPeers}}</td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                    <div class="col-sm-6">
+                        <table class="table table-sm table-borderless device-status-table">
+                            <tbody>
+                            <tr>
+                                <td>IP Address:</td>
+                                <td>{{.Device.IPsStr}}</td>
+                            </tr>
+                            <tr>
+                                <td>DNS servers:</td>
+                                <td>{{.Device.DNSStr}}</td>
+                            </tr>
+                            <tr>
+                                <td>Default MTU:</td>
+                                <td>{{.Device.Mtu}}</td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                    {{end}}
                 </div>
 
             </div>
         </div>
         <div class="mt-4 row">
             <div class="col-sm-10 col-12">
+                {{if eq $.Device.Type "server"}}
                 <h2 class="mt-2">Current VPN Peers</h2>
+                {{end}}
+                {{if eq $.Device.Type "client"}}
+                <h2 class="mt-2">Current VPN Endpoints</h2>
+                {{end}}
             </div>
             <div class="col-sm-2 col-12 text-right">
+                {{if eq $.Device.Type "server"}}
                 <a href="/admin/peer/createldap" title="Add multiple peers" class="btn btn-primary"><i class="fa fa-fw fa-user-plus"></i></a>
-                <a href="/admin/peer/create" title="Manually add a peer" class="btn btn-primary"><i class="fa fa-fw fa-plus"></i>M</a>
+                {{end}}
+                <a href="/admin/peer/create" title="Add a peer" class="btn btn-primary"><i class="fa fa-fw fa-plus"></i>M</a>
             </div>
         </div>
         <div class="mt-2 table-responsive">
@@ -98,8 +147,15 @@
                     <th scope="col" class="list-image-cell"></th><!-- Status and expand -->
                     <th scope="col"><a href="?sort=id">Identifier <i class="fa fa-fw {{.Session.GetSortIcon "peers" "id"}}"></i></a></th>
                     <th scope="col"><a href="?sort=pubKey">Public Key <i class="fa fa-fw {{.Session.GetSortIcon "peers" "pubKey"}}"></i></a></th>
+                    {{if eq $.Device.Type "server"}}
                     <th scope="col"><a href="?sort=mail">E-Mail <i class="fa fa-fw {{.Session.GetSortIcon "peers" "mail"}}"></i></a></th>
+                    {{end}}
+                    {{if eq $.Device.Type "server"}}
                     <th scope="col"><a href="?sort=ip">IP's <i class="fa fa-fw {{.Session.GetSortIcon "peers" "ip"}}"></i></a></th>
+                    {{end}}
+                    {{if eq $.Device.Type "client"}}
+                    <th scope="col"><a href="?sort=endpoint">Endpoint <i class="fa fa-fw {{.Session.GetSortIcon "peers" "endpoint"}}"></i></a></th>
+                    {{end}}
                     <th scope="col"><a href="?sort=handshake">Handshake <i class="fa fa-fw {{.Session.GetSortIcon "peers" "handshake"}}"></i></a></th>
                     <th scope="col"></th><!-- Actions -->
                 </tr>
@@ -115,8 +171,15 @@
                         </th>
                         <td>{{$p.Identifier}}</td>
                         <td>{{$p.PublicKey}}</td>
+                        {{if eq $.Device.Type "server"}}
                         <td>{{$p.Email}}</td>
+                        {{end}}
+                        {{if eq $.Device.Type "server"}}
                         <td>{{$p.IPsStr}}</td>
+                        {{end}}
+                        {{if eq $.Device.Type "client"}}
+                        <td>{{$p.Endpoint}}</td>
+                        {{end}}
                         <td><span data-toggle="tooltip" data-placement="left" title="" data-original-title="{{$p.LastHandshakeTime}}">{{$p.LastHandshake}}</span></td>
                         <td>
                             {{if eq $.Session.IsAdmin true}}
@@ -133,9 +196,11 @@
                                             <li class="nav-item">
                                                 <a class="nav-link active" data-toggle="tab" href="#t1{{$p.UID}}">Personal</a>
                                             </li>
+                                            {{if eq $.Device.Type "server"}}
                                             <li class="nav-item">
                                                 <a class="nav-link" data-toggle="tab" href="#t2{{$p.UID}}">Configuration</a>
                                             </li>
+                                            {{end}}
                                             <li class="nav-item">
                                                 <a class="nav-link" data-toggle="tab" href="#t3{{$p.UID}}">Danger Zone</a>
                                             </li>
@@ -161,22 +226,28 @@
                                                     <p class="ml-4">{{if $p.DeactivatedAt}}-{{else}}<i class="fas fa-long-arrow-alt-down" title="Download"></i> {{formatBytes $p.Peer.ReceiveBytes}} / <i class="fas fa-long-arrow-alt-up" title="Upload"></i> {{formatBytes $p.Peer.TransmitBytes}}{{end}}</p>
                                                 {{end}}
                                             </div>
+                                            {{if eq $.Device.Type "server"}}
                                             <div id="t2{{$p.UID}}" class="tab-pane fade">
                                                 <pre>{{$p.Config}}</pre>
                                             </div>
+                                            {{end}}
                                             <div id="t3{{$p.UID}}" class="tab-pane fade">
                                                 <a href="/admin/peer/delete?pkey={{$p.PublicKey}}" class="btn btn-danger" title="Delete peer">Delete</a>
                                             </div>
                                         </div>
                                     </div>
                                     <div class="col-md-3">
+                                        {{if eq $.Device.Type "server"}}
                                         <img class="list-image-large" src="/user/qrcode?pkey={{$p.PublicKey}}"/>
+                                        {{end}}
                                     </div>
                                     <div class="col-md-3">
+                                        {{if eq $.Device.Type "server"}}
                                         <div class="float-right mt-5">
                                         <a href="/admin/peer/download?pkey={{$p.PublicKey}}" class="btn btn-primary" title="Download configuration">Download</a>
                                         <a href="/admin/peer/email?pkey={{$p.PublicKey}}" class="btn btn-primary" title="Send configuration via Email">Email</a>
                                         </div>
+                                        {{end}}
                                     </div>
                                 </div>
                             </div>

assets/tpl/login.html

@@ -13,8 +13,17 @@
     <link rel="stylesheet" href="/css/signin.css">
 </head>
 
-<body class="bg-gradient-primary">
-    <div class="container">
+<body id="page-top" class="d-flex flex-column min-vh-100">
+    <nav class="navbar navbar-expand-lg navbar-dark bg-primary">
+        <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#topNavbar" aria-controls="topNavbar" aria-expanded="false" aria-label="Toggle navigation">
+            <span class="navbar-toggler-icon"></span>
+        </button>
+
+        <a class="navbar-brand" href="/"><img src="{{$.static.WebsiteLogo}}" alt="{{$.static.CompanyName}}"/></a>
+        <div id="topNavbar" class="navbar-collapse collapse">
+        </div><!--/.navbar-collapse -->
+    </nav>
+    <div class="container mt-1">
         <div class="card mt-5">
             <div class="card-header">Please sign in</div>
             <div class="card-body">
@@ -28,15 +37,16 @@
                         <label for="inputPassword">Password</label>
                         <input type="password" name="password" class="form-control" id="inputPassword" placeholder="Password">
                     </div>
-                    <button class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button>
+                    <button class="btn btn-lg btn-primary btn-block mt-5" type="submit">Sign in</button>
 
                     {{ if eq .error true }}
-                        <hr>
-                        <span class="text-danger">{{.message}}</span>
+                        <div class="alert alert-danger mt-3" role="alert">
+                            {{.message}}
+                        </div>
                     {{end}}
                 </form>
 
-                <div class="card shadow-lg o-hidden border-0 my-5">
+                <div class="card o-hidden border-0 my-5">
                     <div class="card-body p-0">
                         <a href="/" class="btn btn-white btn-block text-primary btn-user">Go Home</a>
                     </div>

assets/tpl/prt_footer.html

@@ -1,5 +1,5 @@
 <footer class="page-footer mt-auto">
     <div class="container mt-3">
-        <p class="text-muted">Copyright © {{ $.Static.CompanyName }} {{$.Static.Year}} <a class="scroll-to-top" href="#page-top"><i class="fas fa-angle-up"></i></a></p>
+        <p class="text-muted">Copyright © {{ $.Static.CompanyName }} {{$.Static.Year}}, version {{$.Static.Version}} <a class="float-right scroll-to-top" href="#page-top"><i class="fas fa-angle-up"></i></a></p>
     </div>
 </footer>

assets/tpl/prt_nav.html

@@ -27,8 +27,8 @@
         <form class="form-inline my-2 my-lg-0" method="get">
             <div class="form-group mr-sm-2">
                 <select name="device" id="inputDevice" class="form-control device-selector">
-                    {{range $i, $d :=$.DeviceNames}}
-                    <option value="{{$d}}" {{if eq $d $.Session.DeviceName}}selected{{end}}>{{$d}}</option>
+                    {{range $d, $dn := $.DeviceNames}}
+                    <option value="{{$d}}" {{if eq $d $.Session.DeviceName}}selected{{end}}>{{$d}} {{if and (ne $dn "") (ne $d $dn)}}({{$dn}}){{end}}</option>
                     {{end}}
                 </select>
             </div>

cmd/wg-portal/main.go

@@ -8,24 +8,26 @@ import (
 	"syscall"
 	"time"
 
+	"git.prolicht.digital/pub/healthcheck"
 	"github.com/h44z/wg-portal/internal/server"
 	"github.com/sirupsen/logrus"
 )
 
-var Version = "unknown (local build)"
-
 func main() {
 	_ = setupLogger(logrus.StandardLogger())
 
 	c := make(chan os.Signal, 1)
 	signal.Notify(c, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
 
-	logrus.Infof("starting WireGuard Portal Server [%s]...", Version)
+	logrus.Infof("starting WireGuard Portal Server [%s]...", server.Version)
 
 	// Context for clean shutdown
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
+	// start health check service on port 11223
+	healthcheck.New(healthcheck.WithContext(ctx)).Start()
+
 	service := server.Server{}
 	if err := service.Setup(ctx); err != nil {
 		logrus.Fatalf("setup failed: %v", err)

docker-compose.yml

@@ -1,7 +1,7 @@
 version: '3.6'
 services:
   wg-portal:
-    image: h44z/wg-portal:latest
+    image: h44z/wg-portal:1.0.6
     container_name: wg-portal
     restart: unless-stopped
     cap_add:

go.mod

@@ -3,24 +3,35 @@ module github.com/h44z/wg-portal
 go 1.16
 
 require (
+	git.prolicht.digital/pub/healthcheck v1.0.1
+	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751
+	github.com/evanphx/json-patch v0.5.2
 	github.com/gin-contrib/sessions v0.0.3
 	github.com/gin-gonic/gin v1.6.3
 	github.com/go-ldap/ldap/v3 v3.2.4
-	github.com/go-playground/validator/v10 v10.2.0
+	github.com/go-openapi/spec v0.20.3 // indirect
+	github.com/go-openapi/swag v0.19.15 // indirect
+	github.com/go-playground/validator/v10 v10.4.1
 	github.com/gorilla/sessions v1.2.1 // indirect
-	github.com/jordan-wright/email v4.0.1-0.20200917010138-e1c00e156980+incompatible
 	github.com/kelseyhightower/envconfig v1.4.0
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/milosgajdos/tenus v0.0.3
 	github.com/pkg/errors v0.9.1
-	github.com/sirupsen/logrus v1.7.0
+	github.com/sirupsen/logrus v1.8.1
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
+	github.com/swaggo/gin-swagger v1.3.0
+	github.com/swaggo/swag v1.7.0
 	github.com/tatsushid/go-fastping v0.0.0-20160109021039-d7bb493dee3e
-	github.com/toorop/gin-logrus v0.0.0-20200831135515-d2ee50d38dae
+	github.com/toorop/gin-logrus v0.0.0-20210225092905-2c785434f26f
 	github.com/utrack/gin-csrf v0.0.0-20190424104817-40fb8d2c8fca
-	golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9
+	github.com/xhit/go-simple-mail/v2 v2.8.1
+	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2
+	golang.org/x/net v0.0.0-20210423184538-5f58ad60dda6 // indirect
+	golang.org/x/sys v0.0.0-20210426080607-c94f62235c83 // indirect
+	golang.org/x/tools v0.1.0 // indirect
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20200609130330-bd2cb7843e1b
-	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c
-	gorm.io/driver/mysql v1.0.4
-	gorm.io/driver/sqlite v1.1.3
-	gorm.io/gorm v1.20.12
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+	gorm.io/driver/mysql v1.0.5
+	gorm.io/driver/sqlite v1.1.4
+	gorm.io/gorm v1.21.6
 )

hooks/build

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# File needs to be called /hooks/build relative to the Dockerfile.
+# Some environment variables are injected into the build hook, see: https://docs.docker.com/docker-hub/builds/advanced/.
+
+GIT_SHORT_HASH=$(echo $SOURCE_COMMIT | cut -c1-7)
+echo "Build hook running for git hash $GIT_SHORT_HASH"
+docker build --build-arg BUILD_IDENTIFIER=$DOCKER_TAG \
+             --build-arg BUILD_VERSION=$GIT_SHORT_HASH \
+             -t $IMAGE_NAME .

internal/authentication/providers/ldap/provider.go

@@ -2,7 +2,6 @@ package ldap
 
 import (
 	"crypto/tls"
-	"fmt"
 	"strings"
 
 	"github.com/gin-gonic/gin"
@@ -69,13 +68,11 @@ func (provider Provider) Login(ctx *authentication.AuthContext) (string, error)
 
 	// Search for the given username
 	attrs := []string{"dn", provider.config.EmailAttribute}
-	if provider.config.DisabledAttribute != "" {
-		attrs = append(attrs, provider.config.DisabledAttribute)
-	}
+	loginFilter := strings.Replace(provider.config.LoginFilter, "{{login_identifier}}", username, -1)
 	searchRequest := ldap.NewSearchRequest(
 		provider.config.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(&(objectClass=%s)(%s=%s))", provider.config.UserClass, provider.config.EmailAttribute, username),
+		loginFilter,
 		attrs,
 		nil,
 	)
@@ -89,24 +86,8 @@ func (provider Provider) Login(ctx *authentication.AuthContext) (string, error)
 		return "", errors.Errorf("invalid amount of ldap entries (%d)", len(sr.Entries))
 	}
 
-	userDN := sr.Entries[0].DN
-
-	// Check if user is disabled, if so deny login
-	if provider.config.DisabledAttribute != "" {
-		uac := sr.Entries[0].GetAttributeValue(provider.config.DisabledAttribute)
-		switch provider.config.Type {
-		case ldapconfig.TypeActiveDirectory:
-			if ldapconfig.IsActiveDirectoryUserDisabled(uac) {
-				return "", errors.New("user is disabled")
-			}
-		case ldapconfig.TypeOpenLDAP:
-			if ldapconfig.IsOpenLdapUserDisabled(uac) {
-				return "", errors.New("user is disabled")
-			}
-		}
-	}
-
 	// Bind as the user to verify their password
+	userDN := sr.Entries[0].DN
 	err = client.Bind(userDN, password)
 	if err != nil {
 		return "", errors.Wrapf(err, "invalid credentials")
@@ -136,13 +117,11 @@ func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authent
 	// Search for the given username
 	attrs := []string{"dn", provider.config.EmailAttribute, provider.config.FirstNameAttribute, provider.config.LastNameAttribute,
 		provider.config.PhoneAttribute, provider.config.GroupMemberAttribute}
-	if provider.config.DisabledAttribute != "" {
-		attrs = append(attrs, provider.config.DisabledAttribute)
-	}
+	loginFilter := strings.Replace(provider.config.LoginFilter, "{{login_identifier}}", username, -1)
 	searchRequest := ldap.NewSearchRequest(
 		provider.config.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(&(objectClass=%s)(%s=%s))", provider.config.UserClass, provider.config.EmailAttribute, username),
+		loginFilter,
 		attrs,
 		nil,
 	)
@@ -175,14 +154,15 @@ func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authent
 }
 
 func (provider Provider) open() (*ldap.Conn, error) {
-	conn, err := ldap.DialURL(provider.config.URL)
+	tlsConfig := &tls.Config{InsecureSkipVerify: !provider.config.CertValidation}
+	conn, err := ldap.DialURL(provider.config.URL, ldap.DialWithTLSConfig(tlsConfig))
 	if err != nil {
 		return nil, err
 	}
 
 	if provider.config.StartTLS {
 		// Reconnect with TLS
-		err = conn.StartTLS(&tls.Config{InsecureSkipVerify: !provider.config.CertValidation})
+		err = conn.StartTLS(tlsConfig)
 		if err != nil {
 			return nil, err
 		}

internal/authentication/providers/password/provider.go

@@ -7,10 +7,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/h44z/wg-portal/internal/common"
-
 	"github.com/gin-gonic/gin"
 	"github.com/h44z/wg-portal/internal/authentication"
+	"github.com/h44z/wg-portal/internal/common"
 	"github.com/h44z/wg-portal/internal/users"
 	"github.com/pkg/errors"
 	"golang.org/x/crypto/bcrypt"
@@ -109,6 +108,7 @@ func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authent
 }
 
 func (provider Provider) InitializeAdmin(email, password string) error {
+	email = strings.ToLower(email)
 	if !emailRegex.MatchString(email) {
 		return errors.New("admin username must be an email address")
 	}
@@ -136,7 +136,7 @@ func (provider Provider) InitializeAdmin(email, password string) error {
 		}
 
 		admin.Email = email
-		admin.Password = string(hashedPassword)
+		admin.Password = users.PrivateString(hashedPassword)
 		admin.Firstname = "WireGuard"
 		admin.Lastname = "Administrator"
 		admin.CreatedAt = time.Now()
@@ -170,7 +170,7 @@ func (provider Provider) InitializeAdmin(email, password string) error {
 			return errors.Wrap(err, "failed to hash admin password")
 		}
 
-		admin.Password = string(hashedPassword)
+		admin.Password = users.PrivateString(hashedPassword)
 		admin.IsAdmin = true
 		admin.UpdatedAt = time.Now()
 

internal/common/db.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
 	"time"
 
 	"github.com/pkg/errors"
@@ -14,6 +15,29 @@ import (
 	"gorm.io/gorm/logger"
 )
 
+func init() {
+	migrations = append(migrations, Migration{
+		version: "1.0.7",
+		migrateFn: func(db *gorm.DB) error {
+			if err := db.Exec("UPDATE users SET email = LOWER(email)").Error; err != nil {
+				return errors.Wrap(err, "failed to convert user emails to lower case")
+			}
+			if err := db.Exec("UPDATE peers SET email = LOWER(email)").Error; err != nil {
+				return errors.Wrap(err, "failed to convert peer emails to lower case")
+			}
+			logrus.Infof("upgraded database format to version 1.0.7")
+			return nil
+		},
+	})
+	migrations = append(migrations, Migration{
+		version: "1.0.8",
+		migrateFn: func(db *gorm.DB) error {
+			logrus.Infof("upgraded database format to version 1.0.8")
+			return nil
+		},
+	})
+}
+
 type SupportedDatabase string
 
 const (
@@ -38,7 +62,7 @@ func GetDatabaseForConfig(cfg *DatabaseConfig) (db *gorm.DB, err error) {
 				return
 			}
 		}
-		db, err = gorm.Open(sqlite.Open(cfg.Database), &gorm.Config{})
+		db, err = gorm.Open(sqlite.Open(cfg.Database), &gorm.Config{DisableForeignKeyConstraintWhenMigrating: true})
 		if err != nil {
 			return
 		}
@@ -74,3 +98,63 @@ func GetDatabaseForConfig(cfg *DatabaseConfig) (db *gorm.DB, err error) {
 	db.Config.Logger = logger.New(logrus.StandardLogger(), logCfg)
 	return
 }
+
+type DatabaseMigrationInfo struct {
+	Version string `gorm:"primaryKey"`
+	Applied time.Time
+}
+
+type Migration struct {
+	version   string
+	migrateFn func(db *gorm.DB) error
+}
+
+var migrations []Migration
+
+func MigrateDatabase(db *gorm.DB, version string) error {
+	if err := db.AutoMigrate(&DatabaseMigrationInfo{}); err != nil {
+		return errors.Wrap(err, "failed to migrate version database")
+	}
+
+	existingMigration := DatabaseMigrationInfo{}
+	db.Where("version = ?", version).FirstOrInit(&existingMigration)
+
+	if existingMigration.Version == "" {
+		lastVersion := DatabaseMigrationInfo{}
+		db.Order("applied desc, version desc").FirstOrInit(&lastVersion)
+
+		if lastVersion.Version == "" {
+			// fresh database, no migrations to apply
+			res := db.Create(&DatabaseMigrationInfo{
+				Version: version,
+				Applied: time.Now(),
+			})
+			if res.Error != nil {
+				return errors.Wrapf(res.Error, "failed to write version %s to database", version)
+			}
+			return nil
+		}
+
+		sort.Slice(migrations, func(i, j int) bool {
+			return migrations[i].version < migrations[j].version
+		})
+
+		for _, migration := range migrations {
+			if migration.version > lastVersion.Version {
+				if err := migration.migrateFn(db); err != nil {
+					return errors.Wrapf(err, "failed to migrate to version %s", migration.version)
+				}
+
+				res := db.Create(&DatabaseMigrationInfo{
+					Version: migration.version,
+					Applied: time.Now(),
+				})
+				if res.Error != nil {
+					return errors.Wrapf(res.Error, "failed to write version %s to database", migration.version)
+				}
+			}
+		}
+	}
+
+	return nil
+}

internal/common/email.go

@@ -3,20 +3,38 @@ package common
 import (
 	"crypto/tls"
 	"io"
-	"net/smtp"
-	"strconv"
-	"strings"
+	"io/ioutil"
+	"time"
 
-	"github.com/jordan-wright/email"
+	"github.com/pkg/errors"
+	mail "github.com/xhit/go-simple-mail/v2"
+)
+
+type MailEncryption string
+
+const (
+	MailEncryptionNone     MailEncryption = "none"
+	MailEncryptionTLS      MailEncryption = "tls"
+	MailEncryptionStartTLS MailEncryption = "starttls"
+)
+
+type MailAuthType string
+
+const (
+	MailAuthPlain   MailAuthType = "plain"
+	MailAuthLogin   MailAuthType = "login"
+	MailAuthCramMD5 MailAuthType = "crammd5"
 )
 
 type MailConfig struct {
-	Host           string `yaml:"host" envconfig:"EMAIL_HOST"`
-	Port           int    `yaml:"port" envconfig:"EMAIL_PORT"`
-	TLS            bool   `yaml:"tls" envconfig:"EMAIL_TLS"`
-	CertValidation bool   `yaml:"certcheck" envconfig:"EMAIL_CERT_VALIDATION"`
-	Username       string `yaml:"user" envconfig:"EMAIL_USERNAME"`
-	Password       string `yaml:"pass" envconfig:"EMAIL_PASSWORD"`
+	Host           string         `yaml:"host" envconfig:"EMAIL_HOST"`
+	Port           int            `yaml:"port" envconfig:"EMAIL_PORT"`
+	TLS            bool           `yaml:"tls" envconfig:"EMAIL_TLS"` // Deprecated, use MailConfig.Encryption instead.
+	Encryption     MailEncryption `yaml:"encryption" envconfig:"EMAIL_ENCRYPTION"`
+	CertValidation bool           `yaml:"certcheck" envconfig:"EMAIL_CERT_VALIDATION"`
+	Username       string         `yaml:"user" envconfig:"EMAIL_USERNAME"`
+	Password       string         `yaml:"pass" envconfig:"EMAIL_PASSWORD"`
+	AuthType       MailAuthType   `yaml:"auth" envconfig:"EMAIL_AUTHTYPE"`
 }
 
 type MailAttachment struct {
@@ -27,53 +45,73 @@ type MailAttachment struct {
 }
 
 // SendEmailWithAttachments sends a mail with optional attachments.
-func SendEmailWithAttachments(cfg MailConfig, sender, replyTo, subject, body string, htmlBody string, receivers []string, attachments []MailAttachment) error {
-	e := email.NewEmail()
+func SendEmailWithAttachments(cfg MailConfig, sender, replyTo, subject, body, htmlBody string, receivers []string, attachments []MailAttachment) error {
+	srv := mail.NewSMTPClient()
+
+	srv.ConnectTimeout = 30 * time.Second
+	srv.SendTimeout = 30 * time.Second
+	srv.Host = cfg.Host
+	srv.Port = cfg.Port
+	srv.Username = cfg.Username
+	srv.Password = cfg.Password
+
+	// TODO: remove this once the deprecated MailConfig.TLS config option has been removed
+	if cfg.TLS {
+		cfg.Encryption = MailEncryptionStartTLS
+	}
+	switch cfg.Encryption {
+	case MailEncryptionTLS:
+		srv.Encryption = mail.EncryptionSSLTLS
+	case MailEncryptionStartTLS:
+		srv.Encryption = mail.EncryptionSTARTTLS
+	default: // MailEncryptionNone
+		srv.Encryption = mail.EncryptionNone
+	}
+	srv.TLSConfig = &tls.Config{ServerName: srv.Host, InsecureSkipVerify: !cfg.CertValidation}
+	switch cfg.AuthType {
+	case MailAuthPlain:
+		srv.Authentication = mail.AuthPlain
+	case MailAuthLogin:
+		srv.Authentication = mail.AuthLogin
+	case MailAuthCramMD5:
+		srv.Authentication = mail.AuthCRAMMD5
+	}
+
+	client, err := srv.Connect()
+	if err != nil {
+		return errors.Wrap(err, "failed to connect via SMTP")
+	}
 
-	hostname := cfg.Host + ":" + strconv.Itoa(cfg.Port)
-	subject = strings.Trim(subject, "\n\r\t")
-	sender = strings.Trim(sender, "\n\r\t")
-	replyTo = strings.Trim(replyTo, "\n\r\t")
 	if replyTo == "" {
 		replyTo = sender
 	}
 
-	var auth smtp.Auth
-	if cfg.Username == "" {
-		auth = nil
-	} else {
-		// Set up authentication information.
-		auth = smtp.PlainAuth(
-			"",
-			cfg.Username,
-			cfg.Password,
-			cfg.Host,
-		)
-	}
+	email := mail.NewMSG()
+	email.SetFrom(sender).
+		AddTo(receivers...).
+		SetReplyTo(replyTo).
+		SetSubject(subject)
 
-	// Set email data.
-	e.From = sender
-	e.To = receivers
-	e.ReplyTo = []string{replyTo}
-	e.Subject = subject
-	e.Text = []byte(body)
-	if htmlBody != "" {
-		e.HTML = []byte(htmlBody)
-	}
+	email.SetBody(mail.TextHTML, htmlBody)
+	email.AddAlternative(mail.TextPlain, body)
 
 	for _, attachment := range attachments {
-		a, err := e.Attach(attachment.Data, attachment.Name, attachment.ContentType)
+		attachmentData, err := ioutil.ReadAll(attachment.Data)
 		if err != nil {
-			return err
+			return errors.Wrapf(err, "failed to read attachment data for %s", attachment.Name)
 		}
+
 		if attachment.Embedded {
-			a.HTMLRelated = true
+			email.AddInlineData(attachmentData, attachment.Name, attachment.ContentType)
+		} else {
+			email.AddAttachmentData(attachmentData, attachment.Name, attachment.ContentType)
 		}
 	}
 
-	if cfg.TLS {
-		return e.SendWithStartTLS(hostname, auth, &tls.Config{InsecureSkipVerify: !cfg.CertValidation})
-	} else {
-		return e.Send(hostname, auth)
+	// Call Send and pass the client
+	err = email.Send(client)
+	if err != nil {
+		return errors.Wrapf(err, "failed to send email")
 	}
+	return nil
 }

internal/ldap/config.go

@@ -15,14 +15,13 @@ type Config struct {
 	BindUser       string `yaml:"user" envconfig:"LDAP_USER"`
 	BindPass       string `yaml:"pass" envconfig:"LDAP_PASSWORD"`
 
-	Type                 Type   `yaml:"typ" envconfig:"LDAP_TYPE"` // AD for active directory, OpenLDAP for OpenLDAP
-	UserClass            string `yaml:"userClass" envconfig:"LDAP_USER_CLASS"`
 	EmailAttribute       string `yaml:"attrEmail" envconfig:"LDAP_ATTR_EMAIL"`
 	FirstNameAttribute   string `yaml:"attrFirstname" envconfig:"LDAP_ATTR_FIRSTNAME"`
 	LastNameAttribute    string `yaml:"attrLastname" envconfig:"LDAP_ATTR_LASTNAME"`
 	PhoneAttribute       string `yaml:"attrPhone" envconfig:"LDAP_ATTR_PHONE"`
 	GroupMemberAttribute string `yaml:"attrGroups" envconfig:"LDAP_ATTR_GROUPS"`
-	DisabledAttribute    string `yaml:"attrDisabled" envconfig:"LDAP_ATTR_DISABLED"`
 
+	LoginFilter    string `yaml:"loginFilter" envconfig:"LDAP_LOGIN_FILTER"` // {{login_identifier}} gets replaced with the login email address
+	SyncFilter     string `yaml:"syncFilter" envconfig:"LDAP_SYNC_FILTER"`
 	AdminLdapGroup string `yaml:"adminGroup" envconfig:"LDAP_ADMIN_GROUP"` // Members of this group receive admin rights in WG-Portal
 }

internal/ldap/ldap.go

@@ -2,8 +2,6 @@ package ldap
 
 import (
 	"crypto/tls"
-	"fmt"
-	"strconv"
 
 	"github.com/go-ldap/ldap/v3"
 	"github.com/pkg/errors"
@@ -16,14 +14,15 @@ type RawLdapData struct {
 }
 
 func Open(cfg *Config) (*ldap.Conn, error) {
-	conn, err := ldap.DialURL(cfg.URL)
+	tlsConfig := &tls.Config{InsecureSkipVerify: !cfg.CertValidation}
+	conn, err := ldap.DialURL(cfg.URL, ldap.DialWithTLSConfig(tlsConfig))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to connect to LDAP")
 	}
 
 	if cfg.StartTLS {
 		// Reconnect with TLS
-		err = conn.StartTLS(&tls.Config{InsecureSkipVerify: !cfg.CertValidation})
+		err = conn.StartTLS(tlsConfig)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to star TLS on connection")
 		}
@@ -53,13 +52,10 @@ func FindAllUsers(cfg *Config) ([]RawLdapData, error) {
 	// Search all users
 	attrs := []string{"dn", cfg.EmailAttribute, cfg.EmailAttribute, cfg.FirstNameAttribute, cfg.LastNameAttribute,
 		cfg.PhoneAttribute, cfg.GroupMemberAttribute}
-	if cfg.DisabledAttribute != "" {
-		attrs = append(attrs, cfg.DisabledAttribute)
-	}
 	searchRequest := ldap.NewSearchRequest(
 		cfg.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(objectClass=%s)", cfg.UserClass), attrs, nil,
+		cfg.SyncFilter, attrs, nil,
 	)
 
 	sr, err := client.Search(searchRequest)
@@ -86,27 +82,3 @@ func FindAllUsers(cfg *Config) ([]RawLdapData, error) {
 
 	return tmpData, nil
 }
-
-func IsActiveDirectoryUserDisabled(userAccountControl string) bool {
-	if userAccountControl == "" {
-		return false
-	}
-
-	uacInt, err := strconv.ParseInt(userAccountControl, 10, 32)
-	if err != nil {
-		return true
-	}
-	if int32(uacInt)&0x2 != 0 {
-		return true // bit 2 set means account is disabled
-	}
-
-	return false
-}
-
-func IsOpenLdapUserDisabled(pwdAccountLockedTime string) bool {
-	if pwdAccountLockedTime != "" {
-		return true
-	}
-
-	return false
-}

internal/server/api.go

@@ -0,0 +1,926 @@
+package server
+
+// go get -u github.com/swaggo/swag/cmd/swag
+// run: swag init --parseDependency --parseInternal --generalInfo api.go
+// in the internal/server folder
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	"github.com/gin-gonic/gin"
+	"github.com/h44z/wg-portal/internal/common"
+	"github.com/h44z/wg-portal/internal/users"
+	"github.com/h44z/wg-portal/internal/wireguard"
+)
+
+// @title WireGuard Portal API
+// @version 1.0
+// @description WireGuard Portal API for managing users and peers.
+
+// @license.name MIT
+// @license.url https://github.com/h44z/wg-portal/blob/master/LICENSE.txt
+
+// @contact.name WireGuard Portal Project
+// @contact.url https://github.com/h44z/wg-portal
+
+// @securityDefinitions.basic ApiBasicAuth
+// @in header
+// @name Authorization
+// @scope.admin Admin access required
+
+// @securityDefinitions.basic GeneralBasicAuth
+// @in header
+// @name Authorization
+// @scope.user User access required
+
+// @BasePath /api/v1
+
+// ApiServer is a simple wrapper struct so that we can have fresh member function names.
+type ApiServer struct {
+	s *Server
+}
+
+type ApiError struct {
+	Message string
+}
+
+// GetUsers godoc
+// @Tags Users
+// @Summary Retrieves all users
+// @Produce json
+// @Success 200 {object} []users.User
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/users [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetUsers(c *gin.Context) {
+	allUsers := s.s.users.GetUsersUnscoped()
+
+	c.JSON(http.StatusOK, allUsers)
+}
+
+// GetUser godoc
+// @Tags Users
+// @Summary Retrieves user based on given Email
+// @Produce json
+// @Param email query string true "User Email"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/user [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must be specified"})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// PostUser godoc
+// @Tags Users
+// @Summary Creates a new user based on the given user model
+// @Accept  json
+// @Produce json
+// @Param user body users.User true "User Model"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/users [post]
+// @Security ApiBasicAuth
+func (s *ApiServer) PostUser(c *gin.Context) {
+	newUser := users.User{}
+	if err := c.BindJSON(&newUser); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	if user := s.s.users.GetUserUnscoped(newUser.Email); user != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "user already exists"})
+		return
+	}
+
+	if err := s.s.CreateUser(newUser, s.s.wg.Cfg.GetDefaultDeviceName()); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(newUser.Email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// PutUser godoc
+// @Tags Users
+// @Summary Updates a user based on the given user model
+// @Accept  json
+// @Produce json
+// @Param email query string true "User Email"
+// @Param user body users.User true "User Model"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/user [put]
+// @Security ApiBasicAuth
+func (s *ApiServer) PutUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must be specified"})
+		return
+	}
+
+	updateUser := users.User{}
+	if err := c.BindJSON(&updateUser); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	// Changing email address is not allowed
+	if email != updateUser.Email {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must match the model email address"})
+		return
+	}
+
+	if user := s.s.users.GetUserUnscoped(email); user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user does not exist"})
+		return
+	}
+
+	if err := s.s.UpdateUser(updateUser); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// PatchUser godoc
+// @Tags Users
+// @Summary Updates a user based on the given partial user model
+// @Accept  json
+// @Produce json
+// @Param email query string true "User Email"
+// @Param user body users.User true "User Model"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/user [patch]
+// @Security ApiBasicAuth
+func (s *ApiServer) PatchUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must be specified"})
+		return
+	}
+
+	patch, err := c.GetRawData()
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user does not exist"})
+		return
+	}
+	userData, err := json.Marshal(user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	mergedUserData, err := jsonpatch.MergePatch(userData, patch)
+	var mergedUser users.User
+	err = json.Unmarshal(mergedUserData, &mergedUser)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	// CHanging email address is not allowed
+	if email != mergedUser.Email {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must match the model email address"})
+		return
+	}
+
+	if err := s.s.UpdateUser(mergedUser); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	user = s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// DeleteUser godoc
+// @Tags Users
+// @Summary Deletes the specified user
+// @Produce json
+// @Param email query string true "User Email"
+// @Success 204 "No content"
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/user [delete]
+// @Security ApiBasicAuth
+func (s *ApiServer) DeleteUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must be specified"})
+		return
+	}
+
+	var user *users.User
+	if user = s.s.users.GetUserUnscoped(email); user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user does not exist"})
+		return
+	}
+
+	if err := s.s.DeleteUser(*user); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+// GetPeers godoc
+// @Tags Peers
+// @Summary Retrieves all peers for the given interface
+// @Produce json
+// @Param device query string true "Device Name"
+// @Success 200 {object} []wireguard.Peer
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/peers [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetPeers(c *gin.Context) {
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("device")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "device parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	peers := s.s.peers.GetAllPeers(deviceName)
+	c.JSON(http.StatusOK, peers)
+}
+
+// GetPeer godoc
+// @Tags Peers
+// @Summary Retrieves the peer for the given public key
+// @Produce json
+// @Param pkey query string true "Public Key (Base 64)"
+// @Success 200 {object} wireguard.Peer
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/peer [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetPeer(c *gin.Context) {
+	pkey := c.Query("pkey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// PostPeer godoc
+// @Tags Peers
+// @Summary Creates a new peer based on the given peer model
+// @Accept  json
+// @Produce json
+// @Param device query string true "Device Name"
+// @Param peer body wireguard.Peer true "Peer Model"
+// @Success 200 {object} wireguard.Peer
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peers [post]
+// @Security ApiBasicAuth
+func (s *ApiServer) PostPeer(c *gin.Context) {
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("device")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "device parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	newPeer := wireguard.Peer{}
+	if err := c.BindJSON(&newPeer); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	if peer := s.s.peers.GetPeerByKey(newPeer.PublicKey); peer.IsValid() {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "peer already exists"})
+		return
+	}
+
+	if err := s.s.CreatePeer(deviceName, newPeer); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(newPeer.PublicKey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// PutPeer godoc
+// @Tags Peers
+// @Summary Updates the given peer based on the given peer model
+// @Accept  json
+// @Produce json
+// @Param pkey query string true "Public Key"
+// @Param peer body wireguard.Peer true "Peer Model"
+// @Success 200 {object} wireguard.Peer
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peer [put]
+// @Security ApiBasicAuth
+func (s *ApiServer) PutPeer(c *gin.Context) {
+	updatePeer := wireguard.Peer{}
+	if err := c.BindJSON(&updatePeer); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	pkey := c.Query("pkey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must be specified"})
+		return
+	}
+
+	if peer := s.s.peers.GetPeerByKey(pkey); !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	// Changing public key is not allowed
+	if pkey != updatePeer.PublicKey {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must match the model public key"})
+		return
+	}
+
+	now := time.Now()
+	if updatePeer.DeactivatedAt != nil {
+		updatePeer.DeactivatedAt = &now
+	}
+	if err := s.s.UpdatePeer(updatePeer, now); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(updatePeer.PublicKey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// PatchPeer godoc
+// @Tags Peers
+// @Summary Updates the given peer based on the given partial peer model
+// @Accept  json
+// @Produce json
+// @Param pkey query string true "Public Key"
+// @Param peer body wireguard.Peer true "Peer Model"
+// @Success 200 {object} wireguard.Peer
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peer [patch]
+// @Security ApiBasicAuth
+func (s *ApiServer) PatchPeer(c *gin.Context) {
+	patch, err := c.GetRawData()
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	pkey := c.Query("pkey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	peerData, err := json.Marshal(peer)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	mergedPeerData, err := jsonpatch.MergePatch(peerData, patch)
+	var mergedPeer wireguard.Peer
+	err = json.Unmarshal(mergedPeerData, &mergedPeer)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	if !mergedPeer.IsValid() {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "invalid peer model"})
+		return
+	}
+
+	// Changing public key is not allowed
+	if pkey != mergedPeer.PublicKey {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must match the model public key"})
+		return
+	}
+
+	now := time.Now()
+	if mergedPeer.DeactivatedAt != nil {
+		mergedPeer.DeactivatedAt = &now
+	}
+	if err := s.s.UpdatePeer(mergedPeer, now); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	peer = s.s.peers.GetPeerByKey(mergedPeer.PublicKey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// DeletePeer godoc
+// @Tags Peers
+// @Summary Updates the given peer based on the given partial peer model
+// @Produce json
+// @Param pkey query string true "Public Key"
+// @Success 202 "No Content"
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peer [delete]
+// @Security ApiBasicAuth
+func (s *ApiServer) DeletePeer(c *gin.Context) {
+	pkey := c.Query("pkey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if peer.PublicKey == "" {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	if err := s.s.DeletePeer(peer); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+// GetDevices godoc
+// @Tags Interface
+// @Summary Get all devices
+// @Produce json
+// @Success 200 {object} []wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/devices [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetDevices(c *gin.Context) {
+	var devices []wireguard.Device
+	for _, deviceName := range s.s.config.WG.DeviceNames {
+		device := s.s.peers.GetDevice(deviceName)
+		if !device.IsValid() {
+			continue
+		}
+		devices = append(devices, device)
+	}
+
+	c.JSON(http.StatusOK, devices)
+}
+
+// GetDevice godoc
+// @Tags Interface
+// @Summary Get the given device
+// @Produce json
+// @Param device query string true "Device Name"
+// @Success 200 {object} wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/device [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetDevice(c *gin.Context) {
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("device")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "device parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(deviceName)
+	if !device.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "device not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, device)
+}
+
+// PutDevice godoc
+// @Tags Interface
+// @Summary Updates the given device based on the given device model (UNIMPLEMENTED)
+// @Accept  json
+// @Produce json
+// @Param device query string true "Device Name"
+// @Param body body wireguard.Device true "Device Model"
+// @Success 200 {object} wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/device [put]
+// @Security ApiBasicAuth
+func (s *ApiServer) PutDevice(c *gin.Context) {
+	updateDevice := wireguard.Device{}
+	if err := c.BindJSON(&updateDevice); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("device")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "device parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(deviceName)
+	if !device.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+
+	// Changing device name is not allowed
+	if deviceName != updateDevice.DeviceName {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "device parameter must match the model device name"})
+		return
+	}
+
+	// TODO: implement
+
+	c.JSON(http.StatusNotImplemented, device)
+}
+
+// PatchDevice godoc
+// @Tags Interface
+// @Summary Updates the given device based on the given partial device model (UNIMPLEMENTED)
+// @Accept  json
+// @Produce json
+// @Param device query string true "Device Name"
+// @Param body body wireguard.Device true "Device Model"
+// @Success 200 {object} wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/device [patch]
+// @Security ApiBasicAuth
+func (s *ApiServer) PatchDevice(c *gin.Context) {
+	patch, err := c.GetRawData()
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("device")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "device parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(deviceName)
+	if !device.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+
+	deviceData, err := json.Marshal(device)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	mergedDeviceData, err := jsonpatch.MergePatch(deviceData, patch)
+	var mergedDevice wireguard.Device
+	err = json.Unmarshal(mergedDeviceData, &mergedDevice)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	if !mergedDevice.IsValid() {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "invalid device model"})
+		return
+	}
+
+	// Changing device name is not allowed
+	if deviceName != mergedDevice.DeviceName {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "device parameter must match the model device name"})
+		return
+	}
+
+	// TODO: implement
+
+	c.JSON(http.StatusNotImplemented, device)
+}
+
+type PeerDeploymentInformation struct {
+	PublicKey        string
+	Identifier       string
+	Device           string
+	DeviceIdentifier string
+}
+
+// GetPeerDeploymentInformation godoc
+// @Tags Provisioning
+// @Summary Retrieves all active peers for the given email address
+// @Produce json
+// @Param email query string true "Email Address"
+// @Success 200 {object} []PeerDeploymentInformation "All active WireGuard peers"
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /provisioning/peers [get]
+// @Security GeneralBasicAuth
+func (s *ApiServer) GetPeerDeploymentInformation(c *gin.Context) {
+	email := c.Query("email")
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must be specified"})
+		return
+	}
+
+	// Get authenticated user to check permissions
+	username, _, _ := c.Request.BasicAuth()
+	user := s.s.users.GetUser(username)
+
+	if !user.IsAdmin && user.Email != email {
+		c.JSON(http.StatusForbidden, ApiError{Message: "not enough permissions to access this resource"})
+		return
+	}
+
+	peers := s.s.peers.GetPeersByMail(email)
+	result := make([]PeerDeploymentInformation, 0, len(peers))
+	for i := range peers {
+		if peers[i].DeactivatedAt != nil {
+			continue // skip deactivated peers
+		}
+
+		device := s.s.peers.GetDevice(peers[i].DeviceName)
+		if device.Type != wireguard.DeviceTypeServer {
+			continue // Skip peers on non-server devices
+		}
+
+		result = append(result, PeerDeploymentInformation{
+			PublicKey:        peers[i].PublicKey,
+			Identifier:       peers[i].Identifier,
+			Device:           device.DeviceName,
+			DeviceIdentifier: device.DisplayName,
+		})
+	}
+
+	c.JSON(http.StatusOK, result)
+}
+
+// GetPeerDeploymentConfig godoc
+// @Tags Provisioning
+// @Summary Retrieves the peer config for the given public key
+// @Produce plain
+// @Param pkey query string true "Public Key (Base 64)"
+// @Success 200 {object} string "The WireGuard configuration file"
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /provisioning/peer [get]
+// @Security GeneralBasicAuth
+func (s *ApiServer) GetPeerDeploymentConfig(c *gin.Context) {
+	pkey := c.Query("pkey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	// Get authenticated user to check permissions
+	username, _, _ := c.Request.BasicAuth()
+	user := s.s.users.GetUser(username)
+
+	if !user.IsAdmin && user.Email != peer.Email {
+		c.JSON(http.StatusForbidden, ApiError{Message: "not enough permissions to access this resource"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(peer.DeviceName)
+	config, err := peer.GetConfigFile(device)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Data(http.StatusOK, "text/plain", config)
+}
+
+type ProvisioningRequest struct {
+	// DeviceName is optional, if not specified, the configured default device will be used.
+	DeviceName string `json:",omitempty"`
+	Identifier string `binding:"required"`
+	Email      string `binding:"required"`
+
+	// Client specific and optional settings
+
+	AllowedIPsStr       string `binding:"cidrlist" json:",omitempty"`
+	PersistentKeepalive int    `binding:"gte=0" json:",omitempty"`
+	DNSStr              string `binding:"iplist" json:",omitempty"`
+	Mtu                 int    `binding:"gte=0,lte=1500" json:",omitempty"`
+}
+
+// PostPeerDeploymentConfig godoc
+// @Tags Provisioning
+// @Summary Creates the requested peer config and returns the config file
+// @Accept  json
+// @Produce plain
+// @Param body body ProvisioningRequest true "Provisioning Request Model"
+// @Success 200 {object} string "The WireGuard configuration file"
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /provisioning/peers [post]
+// @Security GeneralBasicAuth
+func (s *ApiServer) PostPeerDeploymentConfig(c *gin.Context) {
+	req := ProvisioningRequest{}
+	if err := c.BindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	// Get authenticated user to check permissions
+	username, _, _ := c.Request.BasicAuth()
+	user := s.s.users.GetUser(username)
+
+	if !user.IsAdmin && !s.s.config.Core.SelfProvisioningAllowed {
+		c.JSON(http.StatusForbidden, ApiError{Message: "peer provisioning service disabled"})
+		return
+	}
+
+	if !user.IsAdmin && user.Email != req.Email {
+		c.JSON(http.StatusForbidden, ApiError{Message: "not enough permissions to access this resource"})
+		return
+	}
+
+	deviceName := req.DeviceName
+	if deviceName == "" || !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		deviceName = s.s.config.WG.GetDefaultDeviceName()
+	}
+	device := s.s.peers.GetDevice(deviceName)
+	if device.Type != wireguard.DeviceTypeServer {
+		c.JSON(http.StatusForbidden, ApiError{Message: "invalid device, provisioning disabled"})
+		return
+	}
+
+	// check if private/public keys are set, if so check database for existing entries
+	peer, err := s.s.PrepareNewPeer(deviceName)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+	peer.Email = req.Email
+	peer.Identifier = req.Identifier
+
+	if req.AllowedIPsStr != "" {
+		peer.AllowedIPsStr = req.AllowedIPsStr
+	}
+	if req.PersistentKeepalive != 0 {
+		peer.PersistentKeepalive = req.PersistentKeepalive
+	}
+	if req.DNSStr != "" {
+		peer.DNSStr = req.DNSStr
+	}
+	if req.Mtu != 0 {
+		peer.Mtu = req.Mtu
+	}
+
+	if err := s.s.CreatePeer(deviceName, peer); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	config, err := peer.GetConfigFile(device)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Data(http.StatusOK, "text/plain", config)
+}

internal/server/configuration.go

@@ -55,17 +55,18 @@ func loadConfigEnv(cfg interface{}) error {
 
 type Config struct {
 	Core struct {
-		ListeningAddress  string `yaml:"listeningAddress" envconfig:"LISTENING_ADDRESS"`
-		ExternalUrl       string `yaml:"externalUrl" envconfig:"EXTERNAL_URL"`
-		Title             string `yaml:"title" envconfig:"WEBSITE_TITLE"`
-		CompanyName       string `yaml:"company" envconfig:"COMPANY_NAME"`
-		MailFrom          string `yaml:"mailFrom" envconfig:"MAIL_FROM"`
-		AdminUser         string `yaml:"adminUser" envconfig:"ADMIN_USER"` // must be an email address
-		AdminPassword     string `yaml:"adminPass" envconfig:"ADMIN_PASS"`
-		EditableKeys      bool   `yaml:"editableKeys" envconfig:"EDITABLE_KEYS"`
-		CreateDefaultPeer bool   `yaml:"createDefaultPeer" envconfig:"CREATE_DEFAULT_PEER"`
-		LdapEnabled       bool   `yaml:"ldapEnabled" envconfig:"LDAP_ENABLED"`
-		SessionSecret     string `yaml:"sessionSecret" envconfig:"SESSION_SECRET"`
+		ListeningAddress        string `yaml:"listeningAddress" envconfig:"LISTENING_ADDRESS"`
+		ExternalUrl             string `yaml:"externalUrl" envconfig:"EXTERNAL_URL"`
+		Title                   string `yaml:"title" envconfig:"WEBSITE_TITLE"`
+		CompanyName             string `yaml:"company" envconfig:"COMPANY_NAME"`
+		MailFrom                string `yaml:"mailFrom" envconfig:"MAIL_FROM"`
+		AdminUser               string `yaml:"adminUser" envconfig:"ADMIN_USER"` // must be an email address
+		AdminPassword           string `yaml:"adminPass" envconfig:"ADMIN_PASS"`
+		EditableKeys            bool   `yaml:"editableKeys" envconfig:"EDITABLE_KEYS"`
+		CreateDefaultPeer       bool   `yaml:"createDefaultPeer" envconfig:"CREATE_DEFAULT_PEER"`
+		SelfProvisioningAllowed bool   `yaml:"selfProvisioning" envconfig:"SELF_PROVISIONING"`
+		LdapEnabled             bool   `yaml:"ldapEnabled" envconfig:"LDAP_ENABLED"`
+		SessionSecret           string `yaml:"sessionSecret" envconfig:"SESSION_SECRET"`
 	} `yaml:"core"`
 	Database common.DatabaseConfig `yaml:"database"`
 	Email    common.MailConfig     `yaml:"email"`
@@ -85,6 +86,7 @@ func NewConfig() *Config {
 	cfg.Core.AdminUser = "admin@wgportal.local"
 	cfg.Core.AdminPassword = "wgportal"
 	cfg.Core.LdapEnabled = false
+	cfg.Core.EditableKeys = true
 	cfg.Core.SessionSecret = "secret"
 
 	cfg.Database.Typ = "sqlite"
@@ -95,15 +97,14 @@ func NewConfig() *Config {
 	cfg.LDAP.StartTLS = true
 	cfg.LDAP.BindUser = "company\\\\ldap_wireguard"
 	cfg.LDAP.BindPass = "SuperSecret"
-	cfg.LDAP.Type = "AD"
-	cfg.LDAP.UserClass = "organizationalPerson"
 	cfg.LDAP.EmailAttribute = "mail"
 	cfg.LDAP.FirstNameAttribute = "givenName"
 	cfg.LDAP.LastNameAttribute = "sn"
 	cfg.LDAP.PhoneAttribute = "telephoneNumber"
 	cfg.LDAP.GroupMemberAttribute = "memberOf"
-	cfg.LDAP.DisabledAttribute = "userAccountControl"
 	cfg.LDAP.AdminLdapGroup = "CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL"
+	cfg.LDAP.LoginFilter = "(&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2))"
+	cfg.LDAP.SyncFilter = "(&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))"
 
 	cfg.WG.DeviceNames = []string{"wg0"}
 	cfg.WG.DefaultDeviceName = "wg0"
@@ -111,6 +112,8 @@ func NewConfig() *Config {
 	cfg.WG.ManageIPAddresses = true
 	cfg.Email.Host = "127.0.0.1"
 	cfg.Email.Port = 25
+	cfg.Email.Encryption = common.MailEncryptionNone
+	cfg.Email.AuthType = common.MailAuthPlain
 
 	// Load config from file and environment
 	cfgFile, ok := os.LookupEnv("CONFIG_FILE")

internal/server/handlers_auth.go

@@ -4,12 +4,13 @@ import (
 	"net/http"
 	"strings"
 
-	csrf "github.com/utrack/gin-csrf"
+	"github.com/pkg/errors"
 
 	"github.com/gin-gonic/gin"
 	"github.com/h44z/wg-portal/internal/authentication"
 	"github.com/h44z/wg-portal/internal/users"
 	"github.com/sirupsen/logrus"
+	csrf "github.com/utrack/gin-csrf"
 )
 
 func (s *Server) GetLogin(c *gin.Context) {
@@ -54,65 +55,15 @@ func (s *Server) PostLogin(c *gin.Context) {
 		return
 	}
 
-	// Check user database for an matching entry
-	var loginProvider authentication.AuthProvider
-	email := ""
-	user := s.users.GetUser(username) // retrieve active candidate user from db
-	if user != nil {                  // existing user
-		loginProvider = s.auth.GetProvider(string(user.Source))
-		if loginProvider == nil {
-			s.GetHandleError(c, http.StatusInternalServerError, "login error", "login provider unavailable")
-			return
-		}
-		authEmail, err := loginProvider.Login(&authentication.AuthContext{
-			Username: username,
-			Password: password,
-		})
-		if err == nil {
-			email = authEmail
-		}
-	} else { // possible new user
-		// Check all available auth backends
-		for _, provider := range s.auth.GetProvidersForType(authentication.AuthProviderTypePassword) {
-			// try to log in to the given provider
-			authEmail, err := provider.Login(&authentication.AuthContext{
-				Username: username,
-				Password: password,
-			})
-			if err != nil {
-				continue
-			}
-
-			email = authEmail
-			loginProvider = provider
-
-			// create new user in the database (or reactivate him)
-			userData, err := loginProvider.GetUserModel(&authentication.AuthContext{
-				Username: email,
-			})
-			if err != nil {
-				s.GetHandleError(c, http.StatusInternalServerError, "login error", err.Error())
-				return
-			}
-			if err := s.CreateUser(users.User{
-				Email:     userData.Email,
-				Source:    users.UserSource(loginProvider.GetName()),
-				IsAdmin:   userData.IsAdmin,
-				Firstname: userData.Firstname,
-				Lastname:  userData.Lastname,
-				Phone:     userData.Phone,
-			}, s.wg.Cfg.GetDefaultDeviceName()); err != nil {
-				s.GetHandleError(c, http.StatusInternalServerError, "login error", "failed to update user data")
-				return
-			}
-
-			user = s.users.GetUser(username)
-			break
-		}
+	// Check all available auth backends
+	user, err := s.checkAuthentication(username, password)
+	if err != nil {
+		s.GetHandleError(c, http.StatusInternalServerError, "login error", err.Error())
+		return
 	}
 
 	// Check if user is authenticated
-	if email == "" || loginProvider == nil || user == nil {
+	if user == nil {
 		c.Redirect(http.StatusSeeOther, "/auth/login?err=authfail")
 		return
 	}
@@ -153,3 +104,48 @@ func (s *Server) GetLogout(c *gin.Context) {
 	}
 	c.Redirect(http.StatusSeeOther, "/")
 }
+
+func (s *Server) checkAuthentication(username, password string) (*users.User, error) {
+	var user *users.User
+
+	// Check all available auth backends
+	for _, provider := range s.auth.GetProvidersForType(authentication.AuthProviderTypePassword) {
+		// try to log in to the given provider
+		authEmail, err := provider.Login(&authentication.AuthContext{
+			Username: username,
+			Password: password,
+		})
+		if err != nil {
+			continue
+		}
+
+		// Login succeeded
+		user = s.users.GetUser(authEmail)
+		if user != nil {
+			break // user exists, nothing more to do...
+		}
+
+		// create new user in the database (or reactivate him)
+		userData, err := provider.GetUserModel(&authentication.AuthContext{
+			Username: username,
+		})
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to get user model")
+		}
+		if err := s.CreateUser(users.User{
+			Email:     userData.Email,
+			Source:    users.UserSource(provider.GetName()),
+			IsAdmin:   userData.IsAdmin,
+			Firstname: userData.Firstname,
+			Lastname:  userData.Lastname,
+			Phone:     userData.Phone,
+		}, s.wg.Cfg.GetDefaultDeviceName()); err != nil {
+			return nil, errors.Wrap(err, "failed to update user data")
+		}
+
+		user = s.users.GetUser(authEmail)
+		break
+	}
+
+	return user, nil
+}

internal/server/handlers_common.go

@@ -23,7 +23,7 @@ func (s *Server) GetHandleError(c *gin.Context, code int, message, details strin
 		"Session":     GetSessionData(c),
 		"Static":      s.getStaticData(),
 		"Device":      s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 	})
 }
 
@@ -36,7 +36,7 @@ func (s *Server) GetIndex(c *gin.Context) {
 		"Session":     currentSession,
 		"Static":      s.getStaticData(),
 		"Device":      s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 	})
 }
 
@@ -104,7 +104,7 @@ func (s *Server) GetAdminIndex(c *gin.Context) {
 		"TotalPeers":  len(s.peers.GetAllPeers(currentSession.DeviceName)),
 		"Users":       s.users.GetUsers(),
 		"Device":      device,
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 	})
 }
 
@@ -143,7 +143,7 @@ func (s *Server) GetUserIndex(c *gin.Context) {
 		"TotalPeers":  len(peers),
 		"Users":       []users.User{*s.users.GetUser(currentSession.Email)},
 		"Device":      s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 	})
 }
 
@@ -160,6 +160,7 @@ func (s *Server) updateFormInSession(c *gin.Context, formData interface{}) error
 
 func (s *Server) setNewPeerFormInSession(c *gin.Context) (SessionData, error) {
 	currentSession := GetSessionData(c)
+
 	// If session does not contain a peer form ignore update
 	// If url contains a formerr parameter reset the form
 	if currentSession.FormData == nil || c.Query("formerr") == "" {

internal/server/handlers_interface.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -26,7 +27,7 @@ func (s *Server) GetAdminEditInterface(c *gin.Context) {
 		"Static":       s.getStaticData(),
 		"Device":       currentSession.FormData.(wireguard.Device),
 		"EditableKeys": s.config.Core.EditableKeys,
-		"DeviceNames":  s.wg.Cfg.DeviceNames,
+		"DeviceNames":  s.GetDeviceNames(),
 		"Csrf":         csrf.GetToken(c),
 	})
 }
@@ -44,12 +45,20 @@ func (s *Server) PostAdminEditInterface(c *gin.Context) {
 		return
 	}
 	// Clean list input
-	formDevice.IPs = common.ParseStringList(formDevice.IPsStr)
-	formDevice.AllowedIPs = common.ParseStringList(formDevice.AllowedIPsStr)
-	formDevice.DNS = common.ParseStringList(formDevice.DNSStr)
-	formDevice.IPsStr = common.ListToString(formDevice.IPs)
-	formDevice.AllowedIPsStr = common.ListToString(formDevice.AllowedIPs)
-	formDevice.DNSStr = common.ListToString(formDevice.DNS)
+	formDevice.IPsStr = common.ListToString(common.ParseStringList(formDevice.IPsStr))
+	formDevice.DefaultAllowedIPsStr = common.ListToString(common.ParseStringList(formDevice.DefaultAllowedIPsStr))
+	formDevice.DNSStr = common.ListToString(common.ParseStringList(formDevice.DNSStr))
+
+	// Clean interface parameters based on interface type
+	switch formDevice.Type {
+	case wireguard.DeviceTypeClient:
+		formDevice.ListenPort = 0
+		formDevice.DefaultEndpoint = ""
+		formDevice.DefaultAllowedIPsStr = ""
+		formDevice.DefaultPersistentKeepalive = 0
+		formDevice.SaveConfig = false
+	case wireguard.DeviceTypeServer:
+	}
 
 	// Update WireGuard device
 	err := s.wg.UpdateDevice(formDevice.DeviceName, formDevice.GetConfig())
@@ -80,7 +89,7 @@ func (s *Server) PostAdminEditInterface(c *gin.Context) {
 
 	// Update interface IP address
 	if s.config.WG.ManageIPAddresses {
-		if err := s.wg.SetIPAddress(currentSession.DeviceName, formDevice.IPs); err != nil {
+		if err := s.wg.SetIPAddress(currentSession.DeviceName, formDevice.GetIPAddresses()); err != nil {
 			_ = s.updateFormInSession(c, formDevice)
 			SetFlashMessage(c, "Failed to update ip address: "+err.Error(), "danger")
 			c.Redirect(http.StatusSeeOther, "/admin/device/edit?formerr=update")
@@ -116,21 +125,53 @@ func (s *Server) GetInterfaceConfig(c *gin.Context) {
 	return
 }
 
+func (s *Server) GetSaveConfig(c *gin.Context) {
+	currentSession := GetSessionData(c)
+
+	err := s.WriteWireGuardConfigFile(currentSession.DeviceName)
+	if err != nil {
+		SetFlashMessage(c, "Failed to save WireGuard config-file: "+err.Error(), "danger")
+		c.Redirect(http.StatusSeeOther, "/admin/")
+		return
+	}
+
+	SetFlashMessage(c, "Updated WireGuard config-file", "success")
+	c.Redirect(http.StatusSeeOther, "/admin/")
+	return
+}
+
 func (s *Server) GetApplyGlobalConfig(c *gin.Context) {
 	currentSession := GetSessionData(c)
 	device := s.peers.GetDevice(currentSession.DeviceName)
 	peers := s.peers.GetAllPeers(device.DeviceName)
 
+	if device.Type == wireguard.DeviceTypeClient {
+		SetFlashMessage(c, "Cannot apply global configuration while interface is in client mode.", "danger")
+		c.Redirect(http.StatusSeeOther, "/admin/device/edit")
+		return
+	}
+
+	updateCounter := 0
 	for _, peer := range peers {
-		peer.AllowedIPs = device.AllowedIPs
-		peer.AllowedIPsStr = device.AllowedIPsStr
+		if peer.IgnoreGlobalSettings {
+			continue
+		}
+
+		peer.AllowedIPsStr = device.DefaultAllowedIPsStr
+		peer.Endpoint = device.DefaultEndpoint
+		peer.PersistentKeepalive = device.DefaultPersistentKeepalive
+		peer.DNSStr = device.DNSStr
+		peer.Mtu = device.Mtu
+
 		if err := s.peers.UpdatePeer(peer); err != nil {
 			SetFlashMessage(c, err.Error(), "danger")
 			c.Redirect(http.StatusSeeOther, "/admin/device/edit")
+			return
 		}
+		updateCounter++
 	}
 
-	SetFlashMessage(c, "Allowed IP's updated for all clients.", "success")
+	SetFlashMessage(c, fmt.Sprintf("Global configuration updated for %d clients.", updateCounter), "success")
 	c.Redirect(http.StatusSeeOther, "/admin/device/edit")
 	return
 }

internal/server/handlers_peer.go

@@ -39,7 +39,8 @@ func (s *Server) GetAdminEditPeer(c *gin.Context) {
 		"Peer":         currentSession.FormData.(wireguard.Peer),
 		"EditableKeys": s.config.Core.EditableKeys,
 		"Device":       s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames":  s.wg.Cfg.DeviceNames,
+		"DeviceNames":  s.GetDeviceNames(),
+		"AdminEmail":   s.config.Core.AdminUser,
 		"Csrf":         csrf.GetToken(c),
 	})
 }
@@ -61,10 +62,9 @@ func (s *Server) PostAdminEditPeer(c *gin.Context) {
 	}
 
 	// Clean list input
-	formPeer.IPs = common.ParseStringList(formPeer.IPsStr)
-	formPeer.AllowedIPs = common.ParseStringList(formPeer.AllowedIPsStr)
-	formPeer.IPsStr = common.ListToString(formPeer.IPs)
-	formPeer.AllowedIPsStr = common.ListToString(formPeer.AllowedIPs)
+	formPeer.IPsStr = common.ListToString(common.ParseStringList(formPeer.IPsStr))
+	formPeer.AllowedIPsStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsStr))
+	formPeer.AllowedIPsSrvStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsSrvStr))
 
 	disabled := c.PostForm("isdisabled") != ""
 	now := time.Now()
@@ -100,7 +100,8 @@ func (s *Server) GetAdminCreatePeer(c *gin.Context) {
 		"Peer":         currentSession.FormData.(wireguard.Peer),
 		"EditableKeys": s.config.Core.EditableKeys,
 		"Device":       s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames":  s.wg.Cfg.DeviceNames,
+		"DeviceNames":  s.GetDeviceNames(),
+		"AdminEmail":   s.config.Core.AdminUser,
 		"Csrf":         csrf.GetToken(c),
 	})
 }
@@ -119,10 +120,9 @@ func (s *Server) PostAdminCreatePeer(c *gin.Context) {
 	}
 
 	// Clean list input
-	formPeer.IPs = common.ParseStringList(formPeer.IPsStr)
-	formPeer.AllowedIPs = common.ParseStringList(formPeer.AllowedIPsStr)
-	formPeer.IPsStr = common.ListToString(formPeer.IPs)
-	formPeer.AllowedIPsStr = common.ListToString(formPeer.AllowedIPs)
+	formPeer.IPsStr = common.ListToString(common.ParseStringList(formPeer.IPsStr))
+	formPeer.AllowedIPsStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsStr))
+	formPeer.AllowedIPsSrvStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsSrvStr))
 
 	disabled := c.PostForm("isdisabled") != ""
 	now := time.Now()
@@ -156,7 +156,7 @@ func (s *Server) GetAdminCreateLdapPeers(c *gin.Context) {
 		"Users":       s.users.GetFilteredAndSortedUsers("lastname", "asc", ""),
 		"FormData":    currentSession.FormData.(LdapCreateForm),
 		"Device":      s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 		"Csrf":        csrf.GetToken(c),
 	})
 }
@@ -177,7 +177,7 @@ func (s *Server) PostAdminCreateLdapPeers(c *gin.Context) {
 	emails := common.ParseStringList(formData.Emails)
 	for i := range emails {
 		// TODO: also check email addr for validity?
-		if !strings.ContainsRune(emails[i], '@') || s.users.GetUser(emails[i]) == nil {
+		if !strings.ContainsRune(emails[i], '@') {
 			_ = s.updateFormInSession(c, formData)
 			SetFlashMessage(c, "invalid email address: "+emails[i], "danger")
 			c.Redirect(http.StatusSeeOther, "/admin/peer/createldap?formerr=mail")
@@ -267,6 +267,7 @@ func (s *Server) GetPeerConfigMail(c *gin.Context) {
 		return
 	}
 	// Apply mail template
+	qrcodeFileName := "wireguard-qrcode.png"
 	var tplBuff bytes.Buffer
 	if err := s.mailTpl.Execute(&tplBuff, struct {
 		Peer          wireguard.Peer
@@ -276,7 +277,7 @@ func (s *Server) GetPeerConfigMail(c *gin.Context) {
 	}{
 		Peer:          peer,
 		User:          user,
-		QrcodePngName: "wireguard-config.png",
+		QrcodePngName: qrcodeFileName,
 		PortalUrl:     s.config.Core.ExternalUrl,
 	}); err != nil {
 		s.GetHandleError(c, http.StatusInternalServerError, "Template error", err.Error())
@@ -291,7 +292,13 @@ func (s *Server) GetPeerConfigMail(c *gin.Context) {
 			Data:        bytes.NewReader(cfg),
 		},
 		{
-			Name:        "wireguard-config.png",
+			Name:        qrcodeFileName,
+			ContentType: "image/png",
+			Data:        bytes.NewReader(png),
+			Embedded:    true,
+		},
+		{
+			Name:        qrcodeFileName,
 			ContentType: "image/png",
 			Data:        bytes.NewReader(png),
 		},
@@ -328,7 +335,7 @@ func (s *Server) GetPeerStatus(c *gin.Context) {
 	isOnline := false
 	ping := make(chan bool)
 	defer close(ping)
-	for _, cidr := range peer.IPs {
+	for _, cidr := range peer.GetIPAddresses() {
 		ip, _, _ := net.ParseCIDR(cidr)
 		var ra *net.IPAddr
 		if common.IsIPv6(ip.String()) {

internal/server/handlers_user.go

@@ -8,7 +8,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/h44z/wg-portal/internal/users"
 	csrf "github.com/utrack/gin-csrf"
-	"golang.org/x/crypto/bcrypt"
 	"gorm.io/gorm"
 )
 
@@ -58,7 +57,7 @@ func (s *Server) GetAdminUsersIndex(c *gin.Context) {
 		"Users":       dbUsers,
 		"TotalUsers":  len(s.users.GetUsers()),
 		"Device":      s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 	})
 }
 
@@ -78,7 +77,7 @@ func (s *Server) GetAdminUsersEdit(c *gin.Context) {
 		"Static":      s.getStaticData(),
 		"User":        currentSession.FormData.(users.User),
 		"Device":      s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 		"Epoch":       time.Time{},
 		"Csrf":        csrf.GetToken(c),
 	})
@@ -105,19 +104,6 @@ func (s *Server) PostAdminUsersEdit(c *gin.Context) {
 		return
 	}
 
-	if formUser.Password != "" {
-		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(formUser.Password), bcrypt.DefaultCost)
-		if err != nil {
-			_ = s.updateFormInSession(c, formUser)
-			SetFlashMessage(c, "failed to hash admin password", "danger")
-			c.Redirect(http.StatusSeeOther, "/admin/users/edit?pkey="+urlEncodedKey+"&formerr=bind")
-			return
-		}
-		formUser.Password = string(hashedPassword)
-	} else {
-		formUser.Password = currentUser.Password
-	}
-
 	disabled := c.PostForm("isdisabled") != ""
 	if disabled {
 		formUser.DeletedAt = gorm.DeletedAt{
@@ -156,7 +142,7 @@ func (s *Server) GetAdminUsersCreate(c *gin.Context) {
 		"Static":      s.getStaticData(),
 		"User":        currentSession.FormData.(users.User),
 		"Device":      s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.wg.Cfg.DeviceNames,
+		"DeviceNames": s.GetDeviceNames(),
 		"Epoch":       time.Time{},
 		"Csrf":        csrf.GetToken(c),
 	})
@@ -175,15 +161,7 @@ func (s *Server) PostAdminUsersCreate(c *gin.Context) {
 		return
 	}
 
-	if formUser.Password != "" {
-		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(formUser.Password), bcrypt.DefaultCost)
-		if err != nil {
-			SetFlashMessage(c, "failed to hash admin password", "danger")
-			c.Redirect(http.StatusSeeOther, "/admin/users/create?formerr=bind")
-			return
-		}
-		formUser.Password = string(hashedPassword)
-	} else {
+	if formUser.Password == "" {
 		_ = s.updateFormInSession(c, formUser)
 		SetFlashMessage(c, "invalid password", "danger")
 		c.Redirect(http.StatusSeeOther, "/admin/users/create?formerr=create")

internal/server/ldapsync.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"strings"
 	"time"
 
 	"github.com/h44z/wg-portal/internal/ldap"
@@ -31,107 +32,33 @@ func (s *Server) SyncLdapWithUserDatabase() {
 			continue
 		}
 
-		for i := range ldapUsers {
-			// prefilter
-			if ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute] == "" ||
-				ldapUsers[i].Attributes[s.config.LDAP.FirstNameAttribute] == "" ||
-				ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute] == "" {
-				continue
-			}
+		// Update existing LDAP users
+		s.updateLdapUsers(ldapUsers)
 
-			user, err := s.users.GetOrCreateUserUnscoped(ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute])
-			if err != nil {
-				logrus.Errorf("failed to get/create user %s in database: %v", ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute], err)
-			}
-
-			// check if user should be deactivated
-			ldapDeactivated := false
-			switch s.config.LDAP.Type {
-			case ldap.TypeActiveDirectory:
-				ldapDeactivated = ldap.IsActiveDirectoryUserDisabled(ldapUsers[i].Attributes[s.config.LDAP.DisabledAttribute])
-			case ldap.TypeOpenLDAP:
-				ldapDeactivated = ldap.IsOpenLdapUserDisabled(ldapUsers[i].Attributes[s.config.LDAP.DisabledAttribute])
-			}
-
-			// check if user has been disabled in ldap, update peers accordingly
-			if ldapDeactivated != user.DeletedAt.Valid {
-				if ldapDeactivated {
-					// disable all peers for the given user
-					for _, peer := range s.peers.GetPeersByMail(user.Email) {
-						now := time.Now()
-						peer.DeactivatedAt = &now
-						if err = s.UpdatePeer(peer, now); err != nil {
-							logrus.Errorf("failed to update deactivated peer %s: %v", peer.PublicKey, err)
-						}
-					}
-				} else {
-					// enable all peers for the given user
-					for _, peer := range s.peers.GetPeersByMail(user.Email) {
-						now := time.Now()
-						peer.DeactivatedAt = nil
-						if err = s.UpdatePeer(peer, now); err != nil {
-							logrus.Errorf("failed to update activated peer %s: %v", peer.PublicKey, err)
-						}
-					}
-				}
-			}
-
-			// Sync attributes from ldap
-			if s.UserChangedInLdap(user, &ldapUsers[i]) {
-				user.Firstname = ldapUsers[i].Attributes[s.config.LDAP.FirstNameAttribute]
-				user.Lastname = ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute]
-				user.Email = ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute]
-				user.Phone = ldapUsers[i].Attributes[s.config.LDAP.PhoneAttribute]
-				user.IsAdmin = false
-				user.Source = users.UserSourceLdap
-				user.DeletedAt = gorm.DeletedAt{} // Not deleted
-
-				for _, group := range ldapUsers[i].RawAttributes[s.config.LDAP.GroupMemberAttribute] {
-					if string(group) == s.config.LDAP.AdminLdapGroup {
-						user.IsAdmin = true
-						break
-					}
-				}
-
-				if err = s.users.UpdateUser(user); err != nil {
-					logrus.Errorf("failed to update ldap user %s in database: %v", user.Email, err)
-					continue
-				}
-
-				if ldapDeactivated {
-					if err = s.users.DeleteUser(user); err != nil {
-						logrus.Errorf("failed to delete deactivated user %s in database: %v", user.Email, err)
-						continue
-					}
-				}
-			}
-		}
+		// Disable missing LDAP users
+		s.disableMissingLdapUsers(ldapUsers)
 	}
 	logrus.Info("ldap user synchronization stopped")
 }
 
-func (s Server) UserChangedInLdap(user *users.User, ldapData *ldap.RawLdapData) bool {
+func (s Server) userChangedInLdap(user *users.User, ldapData *ldap.RawLdapData) bool {
 	if user.Firstname != ldapData.Attributes[s.config.LDAP.FirstNameAttribute] {
 		return true
 	}
 	if user.Lastname != ldapData.Attributes[s.config.LDAP.LastNameAttribute] {
 		return true
 	}
-	if user.Email != ldapData.Attributes[s.config.LDAP.EmailAttribute] {
+	if user.Email != strings.ToLower(ldapData.Attributes[s.config.LDAP.EmailAttribute]) {
 		return true
 	}
 	if user.Phone != ldapData.Attributes[s.config.LDAP.PhoneAttribute] {
 		return true
 	}
-
-	ldapDeactivated := false
-	switch s.config.LDAP.Type {
-	case ldap.TypeActiveDirectory:
-		ldapDeactivated = ldap.IsActiveDirectoryUserDisabled(ldapData.Attributes[s.config.LDAP.DisabledAttribute])
-	case ldap.TypeOpenLDAP:
-		ldapDeactivated = ldap.IsOpenLdapUserDisabled(ldapData.Attributes[s.config.LDAP.DisabledAttribute])
+	if user.Source != users.UserSourceLdap {
+		return true
 	}
-	if ldapDeactivated != user.DeletedAt.Valid {
+
+	if user.DeletedAt.Valid {
 		return true
 	}
 
@@ -148,3 +75,88 @@ func (s Server) UserChangedInLdap(user *users.User, ldapData *ldap.RawLdapData)
 
 	return false
 }
+
+func (s *Server) disableMissingLdapUsers(ldapUsers []ldap.RawLdapData) {
+	// Disable missing LDAP users
+	activeUsers := s.users.GetUsers()
+	for i := range activeUsers {
+		if activeUsers[i].Source != users.UserSourceLdap {
+			continue
+		}
+
+		existsInLDAP := false
+		for j := range ldapUsers {
+			if activeUsers[i].Email == strings.ToLower(ldapUsers[j].Attributes[s.config.LDAP.EmailAttribute]) {
+				existsInLDAP = true
+				break
+			}
+		}
+
+		if existsInLDAP {
+			continue
+		}
+
+		// disable all peers for the given user
+		for _, peer := range s.peers.GetPeersByMail(activeUsers[i].Email) {
+			now := time.Now()
+			peer.DeactivatedAt = &now
+			if err := s.UpdatePeer(peer, now); err != nil {
+				logrus.Errorf("failed to update deactivated peer %s: %v", peer.PublicKey, err)
+			}
+		}
+
+		if err := s.users.DeleteUser(&activeUsers[i]); err != nil {
+			logrus.Errorf("failed to delete deactivated user %s in database: %v", activeUsers[i].Email, err)
+		}
+	}
+}
+
+func (s *Server) updateLdapUsers(ldapUsers []ldap.RawLdapData) {
+	for i := range ldapUsers {
+		if ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute] == "" {
+			logrus.Tracef("skipping sync of %s, empty email attribute", ldapUsers[i].DN)
+			continue
+		}
+
+		user, err := s.users.GetOrCreateUserUnscoped(ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute])
+		if err != nil {
+			logrus.Errorf("failed to get/create user %s in database: %v", ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute], err)
+		}
+
+		// re-enable LDAP user if the user was disabled
+		if user.DeletedAt.Valid {
+			// enable all peers for the given user
+			for _, peer := range s.peers.GetPeersByMail(user.Email) {
+				now := time.Now()
+				peer.DeactivatedAt = nil
+				if err = s.UpdatePeer(peer, now); err != nil {
+					logrus.Errorf("failed to update activated peer %s: %v", peer.PublicKey, err)
+				}
+			}
+		}
+
+		// Sync attributes from ldap
+		if s.userChangedInLdap(user, &ldapUsers[i]) {
+			logrus.Debugf("updating ldap user %s", user.Email)
+			user.Firstname = ldapUsers[i].Attributes[s.config.LDAP.FirstNameAttribute]
+			user.Lastname = ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute]
+			user.Email = ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute]
+			user.Phone = ldapUsers[i].Attributes[s.config.LDAP.PhoneAttribute]
+			user.IsAdmin = false
+			user.Source = users.UserSourceLdap
+			user.DeletedAt = gorm.DeletedAt{} // Not deleted
+
+			for _, group := range ldapUsers[i].RawAttributes[s.config.LDAP.GroupMemberAttribute] {
+				if string(group) == s.config.LDAP.AdminLdapGroup {
+					user.IsAdmin = true
+					break
+				}
+			}
+
+			if err = s.users.UpdateUser(user); err != nil {
+				logrus.Errorf("failed to update ldap user %s in database: %v", user.Email, err)
+				continue
+			}
+		}
+	}
+}

internal/server/routes.go

@@ -2,12 +2,25 @@ package server
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 	wgportal "github.com/h44z/wg-portal"
+	_ "github.com/h44z/wg-portal/internal/server/docs" // docs is generated by Swag CLI, you have to import it.
+	ginSwagger "github.com/swaggo/gin-swagger"
+	"github.com/swaggo/gin-swagger/swaggerFiles"
+	csrf "github.com/utrack/gin-csrf"
 )
 
 func SetupRoutes(s *Server) {
+	csrfMiddleware := csrf.Middleware(csrf.Options{
+		Secret: s.config.Core.SessionSecret,
+		ErrorFunc: func(c *gin.Context) {
+			c.String(400, "CSRF token mismatch")
+			c.Abort()
+		},
+	})
+
 	// Startpage
 	s.server.GET("/", s.GetIndex)
 	s.server.GET("/favicon.ico", func(c *gin.Context) {
@@ -21,17 +34,20 @@ func SetupRoutes(s *Server) {
 
 	// Auth routes
 	auth := s.server.Group("/auth")
+	auth.Use(csrfMiddleware)
 	auth.GET("/login", s.GetLogin)
 	auth.POST("/login", s.PostLogin)
 	auth.GET("/logout", s.GetLogout)
 
 	// Admin routes
 	admin := s.server.Group("/admin")
+	admin.Use(csrfMiddleware)
 	admin.Use(s.RequireAuthentication("admin"))
 	admin.GET("/", s.GetAdminIndex)
 	admin.GET("/device/edit", s.GetAdminEditInterface)
 	admin.POST("/device/edit", s.PostAdminEditInterface)
 	admin.GET("/device/download", s.GetInterfaceConfig)
+	admin.GET("/device/write", s.GetSaveConfig)
 	admin.GET("/device/applyglobals", s.GetApplyGlobalConfig)
 	admin.GET("/peer/edit", s.GetAdminEditPeer)
 	admin.POST("/peer/edit", s.PostAdminEditPeer)
@@ -51,6 +67,7 @@ func SetupRoutes(s *Server) {
 
 	// User routes
 	user := s.server.Group("/user")
+	user.Use(csrfMiddleware)
 	user.Use(s.RequireAuthentication("")) // empty scope = all logged in users
 	user.GET("/qrcode", s.GetPeerQRCode)
 	user.GET("/profile", s.GetUserIndex)
@@ -59,6 +76,44 @@ func SetupRoutes(s *Server) {
 	user.GET("/status", s.GetPeerStatus)
 }
 
+func SetupApiRoutes(s *Server) {
+	api := ApiServer{s: s}
+
+	// Admin authenticated routes
+	apiV1Backend := s.server.Group("/api/v1/backend")
+	apiV1Backend.Use(s.RequireApiAuthentication("admin"))
+
+	apiV1Backend.GET("/users", api.GetUsers)
+	apiV1Backend.POST("/users", api.PostUser)
+	apiV1Backend.GET("/user", api.GetUser)
+	apiV1Backend.PUT("/user", api.PutUser)
+	apiV1Backend.PATCH("/user", api.PatchUser)
+	apiV1Backend.DELETE("/user", api.DeleteUser)
+
+	apiV1Backend.GET("/peers", api.GetPeers)
+	apiV1Backend.POST("/peers", api.PostPeer)
+	apiV1Backend.GET("/peer", api.GetPeer)
+	apiV1Backend.PUT("/peer", api.PutPeer)
+	apiV1Backend.PATCH("/peer", api.PatchPeer)
+	apiV1Backend.DELETE("/peer", api.DeletePeer)
+
+	apiV1Backend.GET("/devices", api.GetDevices)
+	apiV1Backend.GET("/device", api.GetDevice)
+	apiV1Backend.PUT("/device", api.PutDevice)
+	apiV1Backend.PATCH("/device", api.PatchDevice)
+
+	// Simple authenticated routes
+	apiV1Deployment := s.server.Group("/api/v1/provisioning")
+	apiV1Deployment.Use(s.RequireApiAuthentication(""))
+
+	apiV1Deployment.GET("/peers", api.GetPeerDeploymentInformation)
+	apiV1Deployment.GET("/peer", api.GetPeerDeploymentConfig)
+	apiV1Deployment.POST("/peers", api.PostPeerDeploymentConfig)
+
+	// Swagger doc/ui
+	s.server.GET("/swagger/*any", ginSwagger.WrapHandler(swaggerFiles.Handler))
+}
+
 func (s *Server) RequireAuthentication(scope string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		session := GetSessionData(c)
@@ -77,7 +132,7 @@ func (s *Server) RequireAuthentication(scope string) gin.HandlerFunc {
 			return
 		}
 
-		// default case if some randome scope was set...
+		// default case if some random scope was set...
 		if scope != "" && !session.IsAdmin {
 			// Abort the request with the appropriate error code
 			c.Abort()
@@ -89,3 +144,55 @@ func (s *Server) RequireAuthentication(scope string) gin.HandlerFunc {
 		c.Next()
 	}
 }
+
+func (s *Server) RequireApiAuthentication(scope string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		username, password, hasAuth := c.Request.BasicAuth()
+		if !hasAuth {
+			c.Abort()
+			c.JSON(http.StatusUnauthorized, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// Validate form input
+		if strings.Trim(username, " ") == "" || strings.Trim(password, " ") == "" {
+			c.Abort()
+			c.JSON(http.StatusUnauthorized, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// Check all available auth backends
+		user, err := s.checkAuthentication(username, password)
+		if err != nil {
+			c.Abort()
+			c.JSON(http.StatusInternalServerError, ApiError{Message: "login error"})
+			return
+		}
+
+		// Check if user is authenticated
+		if user == nil {
+			c.Abort()
+			c.JSON(http.StatusUnauthorized, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// Check admin scope
+		if scope == "admin" && !user.IsAdmin {
+			// Abort the request with the appropriate error code
+			c.Abort()
+			c.JSON(http.StatusForbidden, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// default case if some random scope was set...
+		if scope != "" && !user.IsAdmin {
+			// Abort the request with the appropriate error code
+			c.Abort()
+			c.JSON(http.StatusForbidden, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// Continue down the chain to handler etc
+		c.Next()
+	}
+}

internal/server/server.go

@@ -26,7 +26,6 @@ import (
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	ginlogrus "github.com/toorop/gin-logrus"
-	csrf "github.com/utrack/gin-csrf"
 	"gorm.io/gorm"
 )
 
@@ -69,6 +68,7 @@ type StaticData struct {
 	WebsiteLogo  string
 	CompanyName  string
 	Year         int
+	Version      string
 }
 
 type Server struct {
@@ -103,6 +103,10 @@ func (s *Server) Setup(ctx context.Context) error {
 	if err != nil {
 		return errors.WithMessage(err, "database setup failed")
 	}
+	err = common.MigrateDatabase(s.db, DatabaseVersion)
+	if err != nil {
+		return errors.WithMessage(err, "database migration failed")
+	}
 
 	// Setup http server
 	gin.SetMode(gin.DebugMode)
@@ -113,13 +117,6 @@ func (s *Server) Setup(ctx context.Context) error {
 	}
 	s.server.Use(gin.Recovery())
 	s.server.Use(sessions.Sessions("authsession", memstore.NewStore([]byte(s.config.Core.SessionSecret))))
-	s.server.Use(csrf.Middleware(csrf.Options{
-		Secret: s.config.Core.SessionSecret,
-		ErrorFunc: func(c *gin.Context) {
-			c.String(400, "CSRF token mismatch")
-			c.Abort()
-		},
-	}))
 	s.server.SetFuncMap(template.FuncMap{
 		"formatBytes": common.ByteCountSI,
 		"urlEncode":   url.QueryEscape,
@@ -146,6 +143,7 @@ func (s *Server) Setup(ctx context.Context) error {
 
 	// Setup all routes
 	SetupRoutes(s)
+	SetupApiRoutes(s)
 
 	// Setup user database (also needed for database authentication)
 	s.users, err = users.NewManager(s.db)
@@ -183,9 +181,6 @@ func (s *Server) Setup(ctx context.Context) error {
 	if s.peers, err = wireguard.NewPeerManager(s.db, s.wg); err != nil {
 		return errors.WithMessage(err, "unable to setup peer manager")
 	}
-	if err = s.peers.InitFromPhysicalInterface(); err != nil {
-		return errors.WithMessagef(err, "unable to initialize peer manager")
-	}
 
 	for _, deviceName := range s.wg.Cfg.DeviceNames {
 		if err = s.RestoreWireGuardInterface(deviceName); err != nil {
@@ -252,6 +247,7 @@ func (s *Server) getStaticData() StaticData {
 		WebsiteLogo:  "/img/header-logo.png",
 		CompanyName:  s.config.Core.CompanyName,
 		Year:         time.Now().Year(),
+		Version:      Version,
 	}
 }
 

internal/server/server_helper.go

@@ -8,11 +8,11 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/h44z/wg-portal/internal/common"
 	"github.com/h44z/wg-portal/internal/users"
 	"github.com/h44z/wg-portal/internal/wireguard"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
+	"golang.org/x/crypto/bcrypt"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"gorm.io/gorm"
 )
@@ -20,50 +20,61 @@ import (
 // PrepareNewPeer initiates a new peer for the given WireGuard device.
 func (s *Server) PrepareNewPeer(device string) (wireguard.Peer, error) {
 	dev := s.peers.GetDevice(device)
+	deviceIPs := dev.GetIPAddresses()
 
 	peer := wireguard.Peer{}
 	peer.IsNew = true
-	peer.AllowedIPsStr = dev.AllowedIPsStr
-	peer.IPs = make([]string, len(dev.IPs))
-	for i := range dev.IPs {
-		freeIP, err := s.peers.GetAvailableIp(device, dev.IPs[i])
-		if err != nil {
-			return wireguard.Peer{}, errors.WithMessage(err, "failed to get available IP addresses")
+
+	switch dev.Type {
+	case wireguard.DeviceTypeServer:
+		peerIPs := make([]string, len(deviceIPs))
+		for i := range deviceIPs {
+			freeIP, err := s.peers.GetAvailableIp(device, deviceIPs[i])
+			if err != nil {
+				return wireguard.Peer{}, errors.WithMessage(err, "failed to get available IP addresses")
+			}
+			peerIPs[i] = freeIP
 		}
-		peer.IPs[i] = freeIP
+		peer.SetIPAddresses(peerIPs...)
+		psk, err := wgtypes.GenerateKey()
+		if err != nil {
+			return wireguard.Peer{}, errors.Wrap(err, "failed to generate key")
+		}
+		key, err := wgtypes.GeneratePrivateKey()
+		if err != nil {
+			return wireguard.Peer{}, errors.Wrap(err, "failed to generate private key")
+		}
+		peer.PresharedKey = psk.String()
+		peer.PrivateKey = key.String()
+		peer.PublicKey = key.PublicKey().String()
+		peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
+		peer.Endpoint = dev.DefaultEndpoint
+		peer.DNSStr = dev.DNSStr
+		peer.PersistentKeepalive = dev.DefaultPersistentKeepalive
+		peer.AllowedIPsStr = dev.DefaultAllowedIPsStr
+		peer.Mtu = dev.Mtu
+		peer.DeviceName = device
+	case wireguard.DeviceTypeClient:
+		peer.UID = "newendpoint"
 	}
-	peer.IPsStr = common.ListToString(peer.IPs)
-	psk, err := wgtypes.GenerateKey()
-	if err != nil {
-		return wireguard.Peer{}, errors.Wrap(err, "failed to generate key")
-	}
-	key, err := wgtypes.GeneratePrivateKey()
-	if err != nil {
-		return wireguard.Peer{}, errors.Wrap(err, "failed to generate private key")
-	}
-	peer.PresharedKey = psk.String()
-	peer.PrivateKey = key.String()
-	peer.PublicKey = key.PublicKey().String()
-	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
 
 	return peer, nil
 }
 
-// CreatePeerByEmail creates a new peer for the given email. If no user with the specified email was found, a new one
-// will be created.
+// CreatePeerByEmail creates a new peer for the given email.
 func (s *Server) CreatePeerByEmail(device, email, identifierSuffix string, disabled bool) error {
-	user, err := s.users.GetOrCreateUser(email)
-	if err != nil {
-		return errors.WithMessagef(err, "failed to load/create related user %s", email)
-	}
+	user := s.users.GetUser(email)
 
 	peer, err := s.PrepareNewPeer(device)
 	if err != nil {
 		return errors.WithMessage(err, "failed to prepare new peer")
 	}
 	peer.Email = email
-	peer.Identifier = fmt.Sprintf("%s %s (%s)", user.Firstname, user.Lastname, identifierSuffix)
-
+	if user != nil {
+		peer.Identifier = fmt.Sprintf("%s %s (%s)", user.Firstname, user.Lastname, identifierSuffix)
+	} else {
+		peer.Identifier = fmt.Sprintf("%s (%s)", email, identifierSuffix)
+	}
 	now := time.Now()
 	if disabled {
 		peer.DeactivatedAt = &now
@@ -77,19 +88,22 @@ func (s *Server) CreatePeerByEmail(device, email, identifierSuffix string, disab
 // This function also configures the new peer on the physical WireGuard interface if the peer is not deactivated.
 func (s *Server) CreatePeer(device string, peer wireguard.Peer) error {
 	dev := s.peers.GetDevice(device)
-	peer.AllowedIPsStr = dev.AllowedIPsStr
-	if peer.IPs == nil || len(peer.IPs) == 0 {
-		peer.IPs = make([]string, len(dev.IPs))
-		for i := range dev.IPs {
-			freeIP, err := s.peers.GetAvailableIp(device, dev.IPs[i])
+	deviceIPs := dev.GetIPAddresses()
+	peerIPs := peer.GetIPAddresses()
+
+	peer.AllowedIPsStr = dev.DefaultAllowedIPsStr
+	if len(peerIPs) == 0 && dev.Type == wireguard.DeviceTypeServer {
+		peerIPs = make([]string, len(deviceIPs))
+		for i := range deviceIPs {
+			freeIP, err := s.peers.GetAvailableIp(device, deviceIPs[i])
 			if err != nil {
 				return errors.WithMessage(err, "failed to get available IP addresses")
 			}
-			peer.IPs[i] = freeIP
+			peerIPs[i] = freeIP
 		}
-		peer.IPsStr = common.ListToString(peer.IPs)
+		peer.SetIPAddresses(peerIPs...)
 	}
-	if peer.PrivateKey == "" { // if private key is empty create a new one
+	if peer.PrivateKey == "" && dev.Type == wireguard.DeviceTypeServer { // if private key is empty create a new one
 		psk, err := wgtypes.GenerateKey()
 		if err != nil {
 			return errors.Wrap(err, "failed to generate key")
@@ -107,7 +121,7 @@ func (s *Server) CreatePeer(device string, peer wireguard.Peer) error {
 
 	// Create WireGuard interface
 	if peer.DeactivatedAt == nil {
-		if err := s.wg.AddPeer(device, peer.GetConfig()); err != nil {
+		if err := s.wg.AddPeer(device, peer.GetConfig(&dev)); err != nil {
 			return errors.WithMessage(err, "failed to add WireGuard peer")
 		}
 	}
@@ -123,21 +137,24 @@ func (s *Server) CreatePeer(device string, peer wireguard.Peer) error {
 // UpdatePeer updates the physical WireGuard interface and the database.
 func (s *Server) UpdatePeer(peer wireguard.Peer, updateTime time.Time) error {
 	currentPeer := s.peers.GetPeerByKey(peer.PublicKey)
+	dev := s.peers.GetDevice(peer.DeviceName)
 
 	// Update WireGuard device
 	var err error
 	switch {
-	case peer.DeactivatedAt == &updateTime:
+	case peer.DeactivatedAt != nil && *peer.DeactivatedAt == updateTime:
 		err = s.wg.RemovePeer(peer.DeviceName, peer.PublicKey)
 	case peer.DeactivatedAt == nil && currentPeer.Peer != nil:
-		err = s.wg.UpdatePeer(peer.DeviceName, peer.GetConfig())
+		err = s.wg.UpdatePeer(peer.DeviceName, peer.GetConfig(&dev))
 	case peer.DeactivatedAt == nil && currentPeer.Peer == nil:
-		err = s.wg.AddPeer(peer.DeviceName, peer.GetConfig())
+		err = s.wg.AddPeer(peer.DeviceName, peer.GetConfig(&dev))
 	}
 	if err != nil {
 		return errors.WithMessage(err, "failed to update WireGuard peer")
 	}
 
+	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
+
 	// Update in database
 	if err := s.peers.UpdatePeer(peer); err != nil {
 		return errors.WithMessage(err, "failed to update peer")
@@ -164,10 +181,11 @@ func (s *Server) DeletePeer(peer wireguard.Peer) error {
 // RestoreWireGuardInterface restores the state of the physical WireGuard interface from the database.
 func (s *Server) RestoreWireGuardInterface(device string) error {
 	activePeers := s.peers.GetActivePeers(device)
+	dev := s.peers.GetDevice(device)
 
 	for i := range activePeers {
 		if activePeers[i].Peer == nil {
-			if err := s.wg.AddPeer(device, activePeers[i].GetConfig()); err != nil {
+			if err := s.wg.AddPeer(device, activePeers[i].GetConfig(&dev)); err != nil {
 				return errors.WithMessage(err, "failed to add WireGuard peer")
 			}
 		}
@@ -209,6 +227,15 @@ func (s *Server) CreateUser(user users.User, device string) error {
 		return s.UpdateUser(user)
 	}
 
+	// Hash user password (if set)
+	if user.Password != "" {
+		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
+		if err != nil {
+			return errors.Wrap(err, "unable to hash password")
+		}
+		user.Password = users.PrivateString(hashedPassword)
+	}
+
 	// Create user in database
 	if err := s.users.CreateUser(&user); err != nil {
 		return errors.WithMessage(err, "failed to create user in manager")
@@ -227,6 +254,17 @@ func (s *Server) UpdateUser(user users.User) error {
 
 	currentUser := s.users.GetUserUnscoped(user.Email)
 
+	// Hash user password (if set)
+	if user.Password != "" {
+		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
+		if err != nil {
+			return errors.Wrap(err, "unable to hash password")
+		}
+		user.Password = users.PrivateString(hashedPassword)
+	} else {
+		user.Password = currentUser.Password // keep current password
+	}
+
 	// Update in database
 	if err := s.users.UpdateUser(&user); err != nil {
 		return errors.WithMessage(err, "failed to update user in manager")
@@ -271,6 +309,11 @@ func (s *Server) DeleteUser(user users.User) error {
 }
 
 func (s *Server) CreateUserDefaultPeer(email, device string) error {
+	// Check if automatic peer creation is enabled
+	if !s.config.Core.CreateDefaultPeer {
+		return nil
+	}
+
 	// Check if user is active, if not, quit
 	var existingUser *users.User
 	if existingUser = s.users.GetUser(email); existingUser == nil {
@@ -278,19 +321,38 @@ func (s *Server) CreateUserDefaultPeer(email, device string) error {
 	}
 
 	// Check if user already has a peer setup, if not, create one
-	if s.config.Core.CreateDefaultPeer {
-		peers := s.peers.GetPeersByMail(email)
-		if len(peers) == 0 { // Create default vpn peer
-			if err := s.CreatePeer(device, wireguard.Peer{
-				Identifier: existingUser.Firstname + " " + existingUser.Lastname + " (Default)",
-				Email:      existingUser.Email,
-				CreatedBy:  existingUser.Email,
-				UpdatedBy:  existingUser.Email,
-			}); err != nil {
-				return errors.WithMessagef(err, "failed to automatically create vpn peer for %s", email)
-			}
-		}
+	peers := s.peers.GetPeersByMail(email)
+	if len(peers) != 0 {
+		return nil
+	}
+
+	// Create default vpn peer
+	peer, err := s.PrepareNewPeer(device)
+	if err != nil {
+		return errors.WithMessage(err, "failed to prepare new peer")
+	}
+	peer.Email = email
+	if existingUser.Firstname != "" && existingUser.Lastname != "" {
+		peer.Identifier = fmt.Sprintf("%s %s (%s)", existingUser.Firstname, existingUser.Lastname, "Default")
+	} else {
+		peer.Identifier = fmt.Sprintf("%s (%s)", existingUser.Email, "Default")
+	}
+	peer.CreatedBy = existingUser.Email
+	peer.UpdatedBy = existingUser.Email
+	if err := s.CreatePeer(device, peer); err != nil {
+		return errors.WithMessagef(err, "failed to automatically create vpn peer for %s", email)
 	}
 
 	return nil
 }
+
+func (s *Server) GetDeviceNames() map[string]string {
+	devNames := make(map[string]string, len(s.wg.Cfg.DeviceNames))
+
+	for _, devName := range s.wg.Cfg.DeviceNames {
+		dev := s.peers.GetDevice(devName)
+		devNames[devName] = dev.DisplayName
+	}
+
+	return devNames
+}

internal/server/version.go

@@ -0,0 +1,4 @@
+package server
+
+var Version = "testbuild"
+var DatabaseVersion = "1.0.8"

internal/users/manager.go

@@ -51,6 +51,8 @@ func (m Manager) UserExists(email string) bool {
 }
 
 func (m Manager) GetUser(email string) *User {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Where("email = ?", email).First(&user)
 
@@ -62,6 +64,8 @@ func (m Manager) GetUser(email string) *User {
 }
 
 func (m Manager) GetUserUnscoped(email string) *User {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Unscoped().Where("email = ?", email).First(&user)
 
@@ -93,6 +97,8 @@ func (m Manager) GetFilteredAndSortedUsersUnscoped(sortKey, sortDirection, searc
 }
 
 func (m Manager) GetOrCreateUser(email string) (*User, error) {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Where("email = ?", email).FirstOrInit(&user)
 
@@ -113,6 +119,8 @@ func (m Manager) GetOrCreateUser(email string) (*User, error) {
 }
 
 func (m Manager) GetOrCreateUserUnscoped(email string) (*User, error) {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Unscoped().Where("email = ?", email).FirstOrInit(&user)
 
@@ -133,6 +141,8 @@ func (m Manager) GetOrCreateUserUnscoped(email string) (*User, error) {
 }
 
 func (m Manager) CreateUser(user *User) error {
+	user.Email = strings.ToLower(user.Email)
+	user.Source = UserSourceDatabase
 	res := m.db.Create(user)
 	if res.Error != nil {
 		return errors.Wrapf(res.Error, "failed to create user %s", user.Email)
@@ -142,6 +152,7 @@ func (m Manager) CreateUser(user *User) error {
 }
 
 func (m Manager) UpdateUser(user *User) error {
+	user.Email = strings.ToLower(user.Email)
 	res := m.db.Save(user)
 	if res.Error != nil {
 		return errors.Wrapf(res.Error, "failed to update user %s", user.Email)
@@ -151,6 +162,7 @@ func (m Manager) UpdateUser(user *User) error {
 }
 
 func (m Manager) DeleteUser(user *User) error {
+	user.Email = strings.ToLower(user.Email)
 	res := m.db.Delete(user)
 	if res.Error != nil {
 		return errors.Wrapf(res.Error, "failed to update user %s", user.Email)
@@ -200,7 +212,7 @@ func filterUsers(users []User, search string) []User {
 
 	filteredUsers := make([]User, 0, len(users))
 	for i := range users {
-		if strings.Contains(users[i].Email, search) ||
+		if strings.Contains(users[i].Email, strings.ToLower(search)) ||
 			strings.Contains(users[i].Firstname, search) ||
 			strings.Contains(users[i].Lastname, search) ||
 			strings.Contains(string(users[i].Source), search) ||

internal/users/user.go

@@ -14,6 +14,16 @@ const (
 	UserSourceOIDC     UserSource = "oidc" // open id connect, TODO: implement
 )
 
+type PrivateString string
+
+func (PrivateString) MarshalJSON() ([]byte, error) {
+	return []byte(`""`), nil
+}
+
+func (PrivateString) String() string {
+	return ""
+}
+
 // User is the user model that gets linked to peer entries, by default an empty usermodel with only the email address is created
 type User struct {
 	// required fields
@@ -27,10 +37,10 @@ type User struct {
 	Phone     string `form:"phone" binding:"omitempty"`
 
 	// optional, integrated password authentication
-	Password string `form:"password" binding:"omitempty"`
+	Password PrivateString `form:"password" binding:"omitempty"`
 
 	// database internal fields
 	CreatedAt time.Time
 	UpdatedAt time.Time
-	DeletedAt gorm.DeletedAt `gorm:"index"`
+	DeletedAt gorm.DeletedAt `gorm:"index" json:",omitempty"`
 }

internal/wireguard/config.go

@@ -3,10 +3,10 @@ package wireguard
 import "github.com/h44z/wg-portal/internal/common"
 
 type Config struct {
-	DeviceNames         []string `yaml:"devices" envconfig:"WG_DEVICES"`             // managed devices
-	DefaultDeviceName   string   `yaml:"devices" envconfig:"WG_DEFAULT_DEVICE"`      // this device is used for auto-created peers, use GetDefaultDeviceName() to access this field
-	ConfigDirectoryPath string   `yaml:"configDirectory" envconfig:"WG_CONFIG_PATH"` // optional, if set, updates will be written to this path, filename: <devicename>.conf
-	ManageIPAddresses   bool     `yaml:"manageIPAddresses" envconfig:"MANAGE_IPS"`   // handle ip-address setup of interface
+	DeviceNames         []string `yaml:"devices" envconfig:"WG_DEVICES"`              // managed devices
+	DefaultDeviceName   string   `yaml:"defaultDevice" envconfig:"WG_DEFAULT_DEVICE"` // this device is used for auto-created peers, use GetDefaultDeviceName() to access this field
+	ConfigDirectoryPath string   `yaml:"configDirectory" envconfig:"WG_CONFIG_PATH"`  // optional, if set, updates will be written to this path, filename: <devicename>.conf
+	ManageIPAddresses   bool     `yaml:"manageIPAddresses" envconfig:"MANAGE_IPS"`    // handle ip-address setup of interface
 }
 
 func (c Config) GetDefaultDeviceName() string {

internal/wireguard/manager.go

@@ -4,7 +4,6 @@ import (
 	"sync"
 
 	"github.com/pkg/errors"
-
 	"golang.zx2c4.com/wireguard/wgctrl"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )

internal/wireguard/manager_net.go

@@ -4,9 +4,8 @@ import (
 	"fmt"
 	"net"
 
-	"github.com/pkg/errors"
-
 	"github.com/milosgajdos/tenus"
+	"github.com/pkg/errors"
 )
 
 const DefaultMTU = 1420

internal/wireguard/peermanager.go

@@ -1,17 +1,18 @@
 package wireguard
 
+// WireGuard documentation: https://manpages.debian.org/unstable/wireguard-tools/wg.8.en.html
+
 import (
 	"bytes"
 	"crypto/md5"
 	"fmt"
 	"net"
-	"reflect"
 	"regexp"
 	"sort"
 	"strings"
-	"text/template"
 	"time"
 
+	"github.com/gin-gonic/gin"
 	"github.com/gin-gonic/gin/binding"
 	"github.com/go-playground/validator/v10"
 	"github.com/h44z/wg-portal/internal/common"
@@ -40,7 +41,6 @@ var cidrList validator.Func = func(fl validator.FieldLevel) bool {
 
 var ipList validator.Func = func(fl validator.FieldLevel) bool {
 	ipListStr := fl.Field().String()
-
 	ipList := common.ParseStringList(ipListStr)
 	for i := range ipList {
 		ip := net.ParseIP(ipList[i])
@@ -63,76 +63,130 @@ func init() {
 //
 
 type Peer struct {
-	Peer   *wgtypes.Peer `gorm:"-"` // WireGuard peer
-	Config string        `gorm:"-"`
+	Peer   *wgtypes.Peer `gorm:"-" json:"-"` // WireGuard peer
+	Config string        `gorm:"-" json:"-"`
 
-	UID               string `form:"uid" binding:"alphanum"` // uid for html identification
-	IsOnline          bool   `gorm:"-"`
-	IsNew             bool   `gorm:"-"`
-	Identifier        string `form:"identifier" binding:"required,lt=64"` // Identifier AND Email make a WireGuard peer unique
-	Email             string `gorm:"index" form:"mail" binding:"required,email"`
-	LastHandshake     string `gorm:"-"`
-	LastHandshakeTime string `gorm:"-"`
+	UID                  string     `form:"uid" binding:"required,alphanum" json:"-"` // uid for html identification
+	DeviceName           string     `gorm:"index" form:"device" binding:"required"`
+	DeviceType           DeviceType `gorm:"-" form:"devicetype" binding:"required,oneof=client server" json:"-"`
+	Identifier           string     `form:"identifier" binding:"required,max=64"` // Identifier AND Email make a WireGuard peer unique
+	Email                string     `gorm:"index" form:"mail" binding:"required,email"`
+	IgnoreGlobalSettings bool       `form:"ignoreglobalsettings"`
 
-	IgnorePersistentKeepalive bool     `form:"ignorekeepalive"`
-	PresharedKey              string   `form:"presharedkey" binding:"omitempty,base64"`
-	AllowedIPsStr             string   `form:"allowedip" binding:"cidrlist"`
-	IPsStr                    string   `form:"ip" binding:"cidrlist"`
-	AllowedIPs                []string `gorm:"-"` // IPs that are used in the client config file
-	IPs                       []string `gorm:"-"` // The IPs of the client
-	PrivateKey                string   `form:"privkey" binding:"omitempty,base64"`
-	PublicKey                 string   `gorm:"primaryKey" form:"pubkey" binding:"required,base64"`
-	DeviceName                string   `gorm:"index"`
+	IsOnline          bool   `gorm:"-" json:"-"`
+	IsNew             bool   `gorm:"-" json:"-"`
+	LastHandshake     string `gorm:"-" json:"-"`
+	LastHandshakeTime string `gorm:"-" json:"-"`
 
-	DeactivatedAt *time.Time
+	// Core WireGuard Settings
+	PublicKey           string `gorm:"primaryKey" form:"pubkey" binding:"required,base64"` // the public key of the peer itself
+	PresharedKey        string `form:"presharedkey" binding:"omitempty,base64"`
+	AllowedIPsStr       string `form:"allowedip" binding:"cidrlist"`    // a comma separated list of IPs that are used in the client config file
+	AllowedIPsSrvStr    string `form:"allowedipSrv" binding:"cidrlist"` // a comma separated list of IPs that are used in the server config file
+	Endpoint            string `form:"endpoint" binding:"omitempty,hostname_port"`
+	PersistentKeepalive int    `form:"keepalive" binding:"gte=0"`
+
+	// Misc. WireGuard Settings
+	PrivateKey string `form:"privkey" binding:"omitempty,base64"`
+	IPsStr     string `form:"ip" binding:"cidrlist,required_if=DeviceType server"` // a comma separated list of IPs of the client
+	DNSStr     string `form:"dns" binding:"iplist"`                                // comma separated list of the DNS servers for the client
+	// Global Device Settings (can be ignored, only make sense if device is in server mode)
+	Mtu int `form:"mtu" binding:"gte=0,lte=1500"`
+
+	DeactivatedAt *time.Time `json:",omitempty"`
 	CreatedBy     string
 	UpdatedBy     string
 	CreatedAt     time.Time
 	UpdatedAt     time.Time
 }
 
-func (p Peer) GetConfig() wgtypes.PeerConfig {
+func (p *Peer) SetIPAddresses(addresses ...string) {
+	p.IPsStr = common.ListToString(addresses)
+}
+
+func (p Peer) GetIPAddresses() []string {
+	return common.ParseStringList(p.IPsStr)
+}
+
+func (p *Peer) SetDNSServers(addresses ...string) {
+	p.DNSStr = common.ListToString(addresses)
+}
+
+func (p Peer) GetDNSServers() []string {
+	return common.ParseStringList(p.DNSStr)
+}
+
+func (p *Peer) SetAllowedIPs(addresses ...string) {
+	p.AllowedIPsStr = common.ListToString(addresses)
+}
+
+func (p Peer) GetAllowedIPs() []string {
+	return common.ParseStringList(p.AllowedIPsStr)
+}
+
+func (p Peer) GetAllowedIPsSrv() []string {
+	return common.ParseStringList(p.AllowedIPsSrvStr)
+}
+
+func (p Peer) GetConfig(dev *Device) wgtypes.PeerConfig {
 	publicKey, _ := wgtypes.ParseKey(p.PublicKey)
+
 	var presharedKey *wgtypes.Key
 	if p.PresharedKey != "" {
 		presharedKeyTmp, _ := wgtypes.ParseKey(p.PresharedKey)
 		presharedKey = &presharedKeyTmp
 	}
 
+	var endpoint *net.UDPAddr
+	if p.Endpoint != "" && dev.Type == DeviceTypeClient {
+		addr, err := net.ResolveUDPAddr("udp", p.Endpoint)
+		if err == nil {
+			endpoint = addr
+		}
+	}
+
+	var keepAlive *time.Duration
+	if p.PersistentKeepalive != 0 {
+		keepAliveDuration := time.Duration(p.PersistentKeepalive) * time.Second
+		keepAlive = &keepAliveDuration
+	}
+
+	allowedIPs := make([]net.IPNet, 0)
+	var peerAllowedIPs []string
+	switch dev.Type {
+	case DeviceTypeClient:
+		peerAllowedIPs = p.GetAllowedIPs()
+	case DeviceTypeServer:
+		peerAllowedIPs = p.GetIPAddresses()
+		peerAllowedIPs = append(peerAllowedIPs, p.GetAllowedIPsSrv()...)
+	}
+	for _, ip := range peerAllowedIPs {
+		_, ipNet, err := net.ParseCIDR(ip)
+		if err == nil {
+			allowedIPs = append(allowedIPs, *ipNet)
+		}
+	}
+
 	cfg := wgtypes.PeerConfig{
 		PublicKey:                   publicKey,
 		Remove:                      false,
 		UpdateOnly:                  false,
 		PresharedKey:                presharedKey,
-		Endpoint:                    nil,
-		PersistentKeepaliveInterval: nil,
+		Endpoint:                    endpoint,
+		PersistentKeepaliveInterval: keepAlive,
 		ReplaceAllowedIPs:           true,
-		AllowedIPs:                  make([]net.IPNet, len(p.IPs)),
-	}
-	for i, ip := range p.IPs {
-		_, ipNet, err := net.ParseCIDR(ip)
-		if err == nil {
-			cfg.AllowedIPs[i] = *ipNet
-		}
+		AllowedIPs:                  allowedIPs,
 	}
 
 	return cfg
 }
 
 func (p Peer) GetConfigFile(device Device) ([]byte, error) {
-	tpl, err := template.New("client").Funcs(template.FuncMap{"StringsJoin": strings.Join}).Parse(ClientCfgTpl)
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to parse client template")
-	}
-
 	var tplBuff bytes.Buffer
 
-	err = tpl.Execute(&tplBuff, struct {
-		Client Peer
-		Server Device
-	}{
-		Client: p,
-		Server: device,
+	err := templateCache.ExecuteTemplate(&tplBuff, "peer.tpl", gin.H{
+		"Peer":      p,
+		"Interface": device,
 	})
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to execute client template")
@@ -143,12 +197,21 @@ func (p Peer) GetConfigFile(device Device) ([]byte, error) {
 
 func (p Peer) GetQRCode() ([]byte, error) {
 	png, err := qrcode.Encode(p.Config, qrcode.Medium, 250)
-	if err != nil {
-		logrus.WithFields(logrus.Fields{
-			"err": err,
-		}).Error("failed to create qrcode")
+	if err == nil {
+		return png, nil
+	}
+
+	if err.Error() != "content too long to encode" {
+		logrus.Errorf("failed to create qrcode: %v", err)
 		return nil, errors.Wrap(err, "failed to encode qrcode")
 	}
+
+	png, err = qrcode.Encode(p.Config, qrcode.Low, 250)
+	if err != nil {
+		logrus.Errorf("failed to create qrcode: %v", err)
+		return nil, errors.Wrap(err, "failed to encode qrcode")
+	}
+
 	return png, nil
 }
 
@@ -160,26 +223,6 @@ func (p Peer) IsValid() bool {
 	return true
 }
 
-func (p Peer) ToMap() map[string]string {
-	out := make(map[string]string)
-
-	v := reflect.ValueOf(p)
-	if v.Kind() == reflect.Ptr {
-		v = v.Elem()
-	}
-
-	typ := v.Type()
-	for i := 0; i < v.NumField(); i++ {
-		// gets us a StructField
-		fi := typ.Field(i)
-		if tagv := fi.Tag.Get("form"); tagv != "" {
-			// set key of map to value in struct field
-			out[tagv] = v.Field(i).String()
-		}
-	}
-	return out
-}
-
 func (p Peer) GetConfigFileName() string {
 	reg := regexp.MustCompile("[^a-zA-Z0-9_-]+")
 	return reg.ReplaceAllString(strings.ReplaceAll(p.Identifier, " ", "-"), "") + ".conf"
@@ -189,44 +232,94 @@ func (p Peer) GetConfigFileName() string {
 //  DEVICE --------------------------------------------------------------------------------------
 //
 
-type Device struct {
-	Interface *wgtypes.Device `gorm:"-"`
+type DeviceType string
 
-	DeviceName          string   `form:"device" gorm:"primaryKey" binding:"required,alphanum"`
-	PrivateKey          string   `form:"privkey" binding:"required,base64"`
-	PublicKey           string   `form:"pubkey" binding:"required,base64"`
-	PersistentKeepalive int      `form:"keepalive" binding:"gte=0"`
-	ListenPort          int      `form:"port" binding:"required,gt=0"`
-	Mtu                 int      `form:"mtu" binding:"gte=0,lte=1500"`
-	Endpoint            string   `form:"endpoint" binding:"required,hostname_port"`
-	AllowedIPsStr       string   `form:"allowedip" binding:"cidrlist"`
-	IPsStr              string   `form:"ip" binding:"required,cidrlist"`
-	AllowedIPs          []string `gorm:"-"` // IPs that are used in the client config file
-	IPs                 []string `gorm:"-"` // The IPs of the client
-	DNSStr              string   `form:"dns" binding:"iplist"`
-	DNS                 []string `gorm:"-"` // The DNS servers of the client
-	PreUp               string   `form:"preup"`
-	PostUp              string   `form:"postup"`
-	PreDown             string   `form:"predown"`
-	PostDown            string   `form:"postdown"`
-	CreatedAt           time.Time
-	UpdatedAt           time.Time
+const (
+	DeviceTypeServer DeviceType = "server"
+	DeviceTypeClient DeviceType = "client"
+)
+
+type Device struct {
+	Interface *wgtypes.Device `gorm:"-" json:"-"`
+	Peers     []Peer          `gorm:"foreignKey:DeviceName" binding:"-" json:"-"` // linked WireGuard peers
+
+	Type        DeviceType `form:"devicetype" binding:"required,oneof=client server"`
+	DeviceName  string     `form:"device" gorm:"primaryKey" binding:"required,alphanum"`
+	DisplayName string     `form:"displayname" binding:"omitempty,max=200"`
+
+	// Core WireGuard Settings (Interface section)
+	PrivateKey   string `form:"privkey" binding:"required,base64"`
+	ListenPort   int    `form:"port" binding:"required_if=Type server,omitempty,gt=0,lt=65535"`
+	FirewallMark int32  `form:"firewallmark" binding:"gte=0"`
+	// Misc. WireGuard Settings
+	PublicKey    string `form:"pubkey" binding:"required,base64"`
+	Mtu          int    `form:"mtu" binding:"gte=0,lte=1500"`   // the interface MTU, wg-quick addition
+	IPsStr       string `form:"ip" binding:"required,cidrlist"` // comma separated list of the IPs of the client, wg-quick addition
+	DNSStr       string `form:"dns" binding:"iplist"`           // comma separated list of the DNS servers of the client, wg-quick addition
+	RoutingTable string `form:"routingtable"`                   // the routing table, wg-quick addition
+	PreUp        string `form:"preup"`                          // pre up script, wg-quick addition
+	PostUp       string `form:"postup"`                         // post up script, wg-quick addition
+	PreDown      string `form:"predown"`                        // pre down script, wg-quick addition
+	PostDown     string `form:"postdown"`                       // post down script, wg-quick addition
+	SaveConfig   bool   `form:"saveconfig"`                     // if set to `true', the configuration is saved from the current state of the interface upon shutdown, wg-quick addition
+
+	// Settings that are applied to all peer by default
+	DefaultEndpoint            string `form:"endpoint" binding:"required_if=Type server,omitempty,hostname_port"`
+	DefaultAllowedIPsStr       string `form:"allowedip" binding:"cidrlist"` // comma separated list  of IPs that are used in the client config file
+	DefaultPersistentKeepalive int    `form:"keepalive" binding:"gte=0"`
+
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
 func (d Device) IsValid() bool {
-	if d.PublicKey == "" {
-		return false
-	}
-	if len(d.IPs) == 0 {
-		return false
-	}
-	if d.Endpoint == "" {
-		return false
+	switch d.Type {
+	case DeviceTypeServer:
+		if d.PublicKey == "" {
+			return false
+		}
+		if len(d.GetIPAddresses()) == 0 {
+			return false
+		}
+		if d.DefaultEndpoint == "" {
+			return false
+		}
+	case DeviceTypeClient:
+		if d.PublicKey == "" {
+			return false
+		}
+		if len(d.GetIPAddresses()) == 0 {
+			return false
+		}
 	}
 
 	return true
 }
 
+func (d *Device) SetIPAddresses(addresses ...string) {
+	d.IPsStr = common.ListToString(addresses)
+}
+
+func (d Device) GetIPAddresses() []string {
+	return common.ParseStringList(d.IPsStr)
+}
+
+func (d *Device) SetDNSServers(addresses ...string) {
+	d.DNSStr = common.ListToString(addresses)
+}
+
+func (d Device) GetDNSServers() []string {
+	return common.ParseStringList(d.DNSStr)
+}
+
+func (d *Device) SetDefaultAllowedIPs(addresses ...string) {
+	d.DefaultAllowedIPsStr = common.ListToString(addresses)
+}
+
+func (d Device) GetDefaultAllowedIPs() []string {
+	return common.ParseStringList(d.DefaultAllowedIPsStr)
+}
+
 func (d Device) GetConfig() wgtypes.Config {
 	var privateKey *wgtypes.Key
 	if d.PrivateKey != "" {
@@ -234,28 +327,23 @@ func (d Device) GetConfig() wgtypes.Config {
 		privateKey = &pKey
 	}
 
+	fwMark := int(d.FirewallMark)
+
 	cfg := wgtypes.Config{
-		PrivateKey: privateKey,
-		ListenPort: &d.ListenPort,
+		PrivateKey:   privateKey,
+		ListenPort:   &d.ListenPort,
+		FirewallMark: &fwMark,
 	}
 
 	return cfg
 }
 
 func (d Device) GetConfigFile(peers []Peer) ([]byte, error) {
-	tpl, err := template.New("server").Funcs(template.FuncMap{"StringsJoin": strings.Join}).Parse(DeviceCfgTpl)
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to parse server template")
-	}
-
 	var tplBuff bytes.Buffer
 
-	err = tpl.Execute(&tplBuff, struct {
-		Clients []Peer
-		Server  Device
-	}{
-		Clients: peers,
-		Server:  d,
+	err := templateCache.ExecuteTemplate(&tplBuff, "interface.tpl", gin.H{
+		"Peers":     peers,
+		"Interface": d,
 	})
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to execute server template")
@@ -276,10 +364,31 @@ type PeerManager struct {
 func NewPeerManager(db *gorm.DB, wg *Manager) (*PeerManager, error) {
 	pm := &PeerManager{db: db, wg: wg}
 
-	if err := pm.db.AutoMigrate(&Peer{}, &Device{}); err != nil {
+	// check if old device table exists (from version <= 1.0.3), if so migrate it.
+	if db.Migrator().HasColumn(&Device{}, "endpoint") {
+		if err := db.Migrator().RenameColumn(&Device{}, "endpoint", "default_endpoint"); err != nil {
+			return nil, errors.Wrapf(err, "failed to migrate old database structure for column endpoint")
+		}
+	}
+	if db.Migrator().HasColumn(&Device{}, "allowed_ips_str") {
+		if err := db.Migrator().RenameColumn(&Device{}, "allowed_ips_str", "default_allowed_ips_str"); err != nil {
+			return nil, errors.Wrapf(err, "failed to migrate old database structure for column allowed_ips_str")
+		}
+	}
+	if db.Migrator().HasColumn(&Device{}, "persistent_keepalive") {
+		if err := db.Migrator().RenameColumn(&Device{}, "persistent_keepalive", "default_persistent_keepalive"); err != nil {
+			return nil, errors.Wrapf(err, "failed to migrate old database structure for column persistent_keepalive")
+		}
+	}
+
+	if err := pm.db.AutoMigrate(&Device{}, &Peer{}); err != nil {
 		return nil, errors.WithMessage(err, "failed to migrate peer database")
 	}
 
+	if err := pm.initFromPhysicalInterface(); err != nil {
+		return nil, errors.WithMessagef(err, "unable to initialize peer manager")
+	}
+
 	// check if peers without device name exist (from version <= 1.0.3), if so assign them to the default device.
 	peers := make([]Peer, 0)
 	pm.db.Find(&peers)
@@ -290,12 +399,23 @@ func NewPeerManager(db *gorm.DB, wg *Manager) (*PeerManager, error) {
 		}
 	}
 
+	// validate and update existing peers if needed
+	for _, deviceName := range wg.Cfg.DeviceNames {
+		dev := pm.GetDevice(deviceName)
+		peers := pm.GetAllPeers(deviceName)
+		for i := range peers {
+			if err := pm.fixPeerDefaultData(&peers[i], &dev); err != nil {
+				return nil, errors.WithMessagef(err, "unable to fix peers for interface %s", deviceName)
+			}
+		}
+	}
+
 	return pm, nil
 }
 
-// InitFromPhysicalInterface read all WireGuard peers from the WireGuard interface configuration. If a peer does not
+// initFromPhysicalInterface read all WireGuard peers from the WireGuard interface configuration. If a peer does not
 // exist in the local database, it gets created.
-func (m *PeerManager) InitFromPhysicalInterface() error {
+func (m *PeerManager) initFromPhysicalInterface() error {
 	for _, deviceName := range m.wg.Cfg.DeviceNames {
 		peers, err := m.wg.GetPeerList(deviceName)
 		if err != nil {
@@ -316,43 +436,53 @@ func (m *PeerManager) InitFromPhysicalInterface() error {
 			}
 		}
 
-		// Check if entries already exist in database, if not create them
+		// Check if device already exists in database, if not, create it
+		if err := m.validateOrCreateDevice(*device, ipAddresses, mtu); err != nil {
+			return errors.WithMessagef(err, "failed to validate device %s", device.Name)
+		}
+
+		// Check if entries already exist in database, if not, create them
 		for _, peer := range peers {
 			if err := m.validateOrCreatePeer(deviceName, peer); err != nil {
 				return errors.WithMessagef(err, "failed to validate peer %s for device %s", peer.PublicKey, deviceName)
 			}
 		}
-		if err := m.validateOrCreateDevice(*device, ipAddresses, mtu); err != nil {
-			return errors.WithMessagef(err, "failed to validate device %s", device.Name)
-		}
 	}
 
 	return nil
 }
 
 // validateOrCreatePeer checks if the given WireGuard peer already exists in the database, if not, the peer entry will be created
+// assumption: server mode is used
 func (m *PeerManager) validateOrCreatePeer(device string, wgPeer wgtypes.Peer) error {
 	peer := Peer{}
 	m.db.Where("public_key = ?", wgPeer.PublicKey.String()).FirstOrInit(&peer)
 
+	dev := m.GetDevice(device)
+
 	if peer.PublicKey == "" { // peer not found, create
 		peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(wgPeer.PublicKey.String())))
-		peer.PublicKey = wgPeer.PublicKey.String()
-		peer.PrivateKey = "" // UNKNOWN
+		if dev.Type == DeviceTypeServer {
+			peer.PublicKey = wgPeer.PublicKey.String()
+			peer.Identifier = "Autodetected Client (" + peer.PublicKey[0:8] + ")"
+		} else if dev.Type == DeviceTypeClient {
+			peer.PublicKey = wgPeer.PublicKey.String()
+			if wgPeer.Endpoint != nil {
+				peer.Endpoint = wgPeer.Endpoint.String()
+			}
+			peer.Identifier = "Autodetected Endpoint (" + peer.PublicKey[0:8] + ")"
+		}
 		if wgPeer.PresharedKey != (wgtypes.Key{}) {
 			peer.PresharedKey = wgPeer.PresharedKey.String()
 		}
 		peer.Email = "autodetected@example.com"
-		peer.Identifier = "Autodetected (" + peer.PublicKey[0:8] + ")"
 		peer.UpdatedAt = time.Now()
 		peer.CreatedAt = time.Now()
-		peer.AllowedIPs = make([]string, 0) // UNKNOWN
-		peer.IPs = make([]string, len(wgPeer.AllowedIPs))
+		IPs := make([]string, len(wgPeer.AllowedIPs)) // use allowed IP's as the peer IP's
 		for i, ip := range wgPeer.AllowedIPs {
-			peer.IPs[i] = ip.String()
+			IPs[i] = ip.String()
 		}
-		peer.AllowedIPsStr = strings.Join(peer.AllowedIPs, ", ")
-		peer.IPsStr = strings.Join(peer.IPs, ", ")
+		peer.SetIPAddresses(IPs...)
 		peer.DeviceName = device
 
 		res := m.db.Create(&peer)
@@ -361,6 +491,14 @@ func (m *PeerManager) validateOrCreatePeer(device string, wgPeer wgtypes.Peer) e
 		}
 	}
 
+	if peer.DeviceName == "" {
+		peer.DeviceName = device
+		res := m.db.Save(&peer)
+		if res.Error != nil {
+			return errors.Wrapf(res.Error, "failed to update autodetected peer %s", peer.PublicKey)
+		}
+	}
+
 	return nil
 }
 
@@ -370,12 +508,14 @@ func (m *PeerManager) validateOrCreateDevice(dev wgtypes.Device, ipAddresses []s
 	m.db.Where("device_name = ?", dev.Name).FirstOrInit(&device)
 
 	if device.PublicKey == "" { // device not found, create
+		device.Type = DeviceTypeServer // imported device, we assume that server mode is used
 		device.PublicKey = dev.PublicKey.String()
 		device.PrivateKey = dev.PrivateKey.String()
 		device.DeviceName = dev.Name
 		device.ListenPort = dev.ListenPort
+		device.FirewallMark = int32(dev.FirewallMark)
 		device.Mtu = 0
-		device.PersistentKeepalive = 16 // Default
+		device.DefaultPersistentKeepalive = 16 // Default
 		device.IPsStr = strings.Join(ipAddresses, ", ")
 		if mtu == DefaultMTU {
 			mtu = 0
@@ -388,13 +528,20 @@ func (m *PeerManager) validateOrCreateDevice(dev wgtypes.Device, ipAddresses []s
 		}
 	}
 
+	if device.Type == "" {
+		device.Type = DeviceTypeServer // from version <= 1.0.3, only server mode devices were supported
+
+		res := m.db.Save(&device)
+		if res.Error != nil {
+			return errors.Wrapf(res.Error, "failed to update autodetected device")
+		}
+	}
+
 	return nil
 }
 
 // populatePeerData enriches the peer struct with WireGuard live data like last handshake, ...
 func (m *PeerManager) populatePeerData(peer *Peer) {
-	peer.AllowedIPs = strings.Split(peer.AllowedIPsStr, ", ")
-	peer.IPs = strings.Split(peer.IPsStr, ", ")
 	// Set config file
 	tmpCfg, _ := peer.GetConfigFile(m.GetDevice(peer.DeviceName))
 	peer.Config = string(tmpCfg)
@@ -421,12 +568,28 @@ func (m *PeerManager) populatePeerData(peer *Peer) {
 	peer.IsOnline = false
 }
 
+// fixPeerDefaultData tries to fill all required fields for the given peer
+// also tries to migrate data if the database schema changed
+func (m *PeerManager) fixPeerDefaultData(peer *Peer, device *Device) error {
+	updatePeer := false
+
+	switch device.Type {
+	case DeviceTypeServer:
+		if peer.Endpoint == "" {
+			peer.Endpoint = device.DefaultEndpoint
+			updatePeer = true
+		}
+	case DeviceTypeClient:
+	}
+
+	if updatePeer {
+		return m.UpdatePeer(*peer)
+	}
+	return nil
+}
+
 // populateDeviceData enriches the device struct with WireGuard live data like interface information
 func (m *PeerManager) populateDeviceData(device *Device) {
-	device.AllowedIPs = strings.Split(device.AllowedIPsStr, ", ")
-	device.IPs = strings.Split(device.IPsStr, ", ")
-	device.DNS = strings.Split(device.DNSStr, ", ")
-
 	// set data from WireGuard interface
 	device.Interface, _ = m.wg.GetDeviceInfo(device.DeviceName)
 }
@@ -462,51 +625,20 @@ func (m *PeerManager) GetFilteredAndSortedPeers(device, sortKey, sortDirection,
 		m.populatePeerData(&peers[i])
 
 		if search == "" ||
-			strings.Contains(peers[i].Email, search) ||
+			strings.Contains(peers[i].Email, strings.ToLower(search)) ||
 			strings.Contains(peers[i].Identifier, search) ||
 			strings.Contains(peers[i].PublicKey, search) {
 			filteredPeers = append(filteredPeers, peers[i])
 		}
 	}
 
-	sort.Slice(filteredPeers, func(i, j int) bool {
-		var sortValueLeft string
-		var sortValueRight string
-
-		switch sortKey {
-		case "id":
-			sortValueLeft = filteredPeers[i].Identifier
-			sortValueRight = filteredPeers[j].Identifier
-		case "pubKey":
-			sortValueLeft = filteredPeers[i].PublicKey
-			sortValueRight = filteredPeers[j].PublicKey
-		case "mail":
-			sortValueLeft = filteredPeers[i].Email
-			sortValueRight = filteredPeers[j].Email
-		case "ip":
-			sortValueLeft = filteredPeers[i].IPsStr
-			sortValueRight = filteredPeers[j].IPsStr
-		case "handshake":
-			if filteredPeers[i].Peer == nil {
-				return false
-			} else if filteredPeers[j].Peer == nil {
-				return true
-			}
-			sortValueLeft = filteredPeers[i].Peer.LastHandshakeTime.Format(time.RFC3339)
-			sortValueRight = filteredPeers[j].Peer.LastHandshakeTime.Format(time.RFC3339)
-		}
-
-		if sortDirection == "asc" {
-			return sortValueLeft < sortValueRight
-		} else {
-			return sortValueLeft > sortValueRight
-		}
-	})
+	sortPeers(sortKey, sortDirection, filteredPeers)
 
 	return filteredPeers
 }
 
 func (m *PeerManager) GetSortedPeersForEmail(sortKey, sortDirection, email string) []Peer {
+	email = strings.ToLower(email)
 	peers := make([]Peer, 0)
 	m.db.Where("email = ?", email).Find(&peers)
 
@@ -514,6 +646,12 @@ func (m *PeerManager) GetSortedPeersForEmail(sortKey, sortDirection, email strin
 		m.populatePeerData(&peers[i])
 	}
 
+	sortPeers(sortKey, sortDirection, peers)
+
+	return peers
+}
+
+func sortPeers(sortKey string, sortDirection string, peers []Peer) {
 	sort.Slice(peers, func(i, j int) bool {
 		var sortValueLeft string
 		var sortValueRight string
@@ -531,6 +669,9 @@ func (m *PeerManager) GetSortedPeersForEmail(sortKey, sortDirection, email strin
 		case "ip":
 			sortValueLeft = peers[i].IPsStr
 			sortValueRight = peers[j].IPsStr
+		case "endpoint":
+			sortValueLeft = peers[i].Endpoint
+			sortValueRight = peers[j].Endpoint
 		case "handshake":
 			if peers[i].Peer == nil {
 				return true
@@ -547,8 +688,6 @@ func (m *PeerManager) GetSortedPeersForEmail(sortKey, sortDirection, email strin
 			return sortValueLeft > sortValueRight
 		}
 	})
-
-	return peers
 }
 
 func (m *PeerManager) GetDevice(device string) Device {
@@ -568,6 +707,7 @@ func (m *PeerManager) GetPeerByKey(publicKey string) Peer {
 }
 
 func (m *PeerManager) GetPeersByMail(mail string) []Peer {
+	mail = strings.ToLower(mail)
 	var peers []Peer
 	m.db.Where("email = ?", mail).Find(&peers)
 	for i := range peers {
@@ -583,8 +723,7 @@ func (m *PeerManager) CreatePeer(peer Peer) error {
 	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
 	peer.UpdatedAt = time.Now()
 	peer.CreatedAt = time.Now()
-	peer.AllowedIPsStr = strings.Join(peer.AllowedIPs, ", ")
-	peer.IPsStr = strings.Join(peer.IPs, ", ")
+	peer.Email = strings.ToLower(peer.Email)
 
 	res := m.db.Create(&peer)
 	if res.Error != nil {
@@ -597,8 +736,7 @@ func (m *PeerManager) CreatePeer(peer Peer) error {
 
 func (m *PeerManager) UpdatePeer(peer Peer) error {
 	peer.UpdatedAt = time.Now()
-	peer.AllowedIPsStr = strings.Join(peer.AllowedIPs, ", ")
-	peer.IPsStr = strings.Join(peer.IPs, ", ")
+	peer.Email = strings.ToLower(peer.Email)
 
 	res := m.db.Save(&peer)
 	if res.Error != nil {
@@ -621,9 +759,6 @@ func (m *PeerManager) DeletePeer(peer Peer) error {
 
 func (m *PeerManager) UpdateDevice(device Device) error {
 	device.UpdatedAt = time.Now()
-	device.AllowedIPsStr = strings.Join(device.AllowedIPs, ", ")
-	device.IPsStr = strings.Join(device.IPs, ", ")
-	device.DNSStr = strings.Join(device.DNS, ", ")
 
 	res := m.db.Save(&device)
 	if res.Error != nil {
@@ -640,7 +775,7 @@ func (m *PeerManager) GetAllReservedIps(device string) ([]string, error) {
 	reservedIps := make([]string, 0)
 	peers := m.GetAllPeers(device)
 	for _, user := range peers {
-		for _, cidr := range user.IPs {
+		for _, cidr := range user.GetIPAddresses() {
 			if cidr == "" {
 				continue
 			}
@@ -653,7 +788,7 @@ func (m *PeerManager) GetAllReservedIps(device string) ([]string, error) {
 	}
 
 	dev := m.GetDevice(device)
-	for _, cidr := range dev.IPs {
+	for _, cidr := range dev.GetIPAddresses() {
 		if cidr == "" {
 			continue
 		}

internal/wireguard/template.go

@@ -1,53 +1,20 @@
 package wireguard
 
-var (
-	ClientCfgTpl = `#{{ .Client.Identifier }}
-[Interface]
-Address = {{ .Client.IPsStr }}
-PrivateKey = {{ .Client.PrivateKey }}
-{{- if .Server.DNSStr}}
-DNS = {{ .Server.DNSStr }}
-{{- end}}
-{{- if ne .Server.Mtu 0}}
-MTU = {{.Server.Mtu}}
-{{- end}}
-
-[Peer]
-PublicKey = {{ .Server.PublicKey }}
-{{- if .Client.PresharedKey}}
-PresharedKey = {{ .Client.PresharedKey }}
-{{- end}}
-AllowedIPs = {{ .Client.AllowedIPsStr }}
-Endpoint = {{ .Server.Endpoint }}
-{{- if and (ne .Server.PersistentKeepalive 0) (not .Client.IgnorePersistentKeepalive)}}
-PersistentKeepalive = {{.Server.PersistentKeepalive}}
-{{- end}}
-`
-	DeviceCfgTpl = `# AUTOGENERATED FILE - DO NOT EDIT
-# Updated: {{ .Server.UpdatedAt }} / Created: {{ .Server.CreatedAt }}
-[Interface]
-{{- range .Server.IPs}}
-Address = {{ . }}
-{{- end}}
-ListenPort = {{ .Server.ListenPort }}
-PrivateKey = {{ .Server.PrivateKey }}
-{{- if ne .Server.Mtu 0}}
-MTU = {{.Server.Mtu}}
-{{- end}}
-PreUp = {{ .Server.PreUp }}
-PostUp = {{ .Server.PostUp }}
-PreDown = {{ .Server.PreDown }}
-PostDown = {{ .Server.PostDown }}
-
-{{range .Clients}}
-{{if not .DeactivatedAt -}}
-# {{.Identifier}} / {{.Email}} / Updated: {{.UpdatedAt}} / Created: {{.CreatedAt}}
-[Peer]
-PublicKey = {{ .PublicKey }}
-{{- if .PresharedKey}}
-PresharedKey = {{ .PresharedKey }}
-{{- end}}
-AllowedIPs = {{ StringsJoin .IPs ", " }}
-{{- end}}
-{{end}}`
+import (
+	"embed"
+	"strings"
+	"text/template"
 )
+
+//go:embed tpl/*
+var Templates embed.FS
+
+var templateCache *template.Template
+
+func init() {
+	var err error
+	templateCache, err = template.New("server").Funcs(template.FuncMap{"StringsJoin": strings.Join}).ParseFS(Templates, "tpl/*.tpl")
+	if err != nil {
+		panic(err)
+	}
+}

internal/wireguard/tpl/interface.tpl

@@ -0,0 +1,78 @@
+# AUTOGENERATED FILE - DO NOT EDIT
+# -WGP- Interface: {{ .Interface.DeviceName }} / Updated: {{ .Interface.UpdatedAt }} / Created: {{ .Interface.CreatedAt }}
+# -WGP- Interface display name: {{ .Interface.DisplayName }}
+# -WGP- Interface mode: {{ .Interface.Type }}
+# -WGP- PublicKey = {{ .Interface.PublicKey }}
+
+[Interface]
+
+# Core settings
+PrivateKey = {{ .Interface.PrivateKey }}
+Address = {{ .Interface.IPsStr }}
+
+# Misc. settings (optional)
+{{- if ne .Interface.ListenPort 0}}
+ListenPort = {{ .Interface.ListenPort }}
+{{- end}}
+{{- if ne .Interface.Mtu 0}}
+MTU = {{.Interface.Mtu}}
+{{- end}}
+{{- if and (ne .Interface.DNSStr "") (eq $.Interface.Type "client")}}
+DNS = {{ .Interface.DNSStr }}
+{{- end}}
+{{- if ne .Interface.FirewallMark 0}}
+FwMark = {{.Interface.FirewallMark}}
+{{- end}}
+{{- if ne .Interface.RoutingTable ""}}
+Table = {{.Interface.RoutingTable}}
+{{- end}}
+{{- if .Interface.SaveConfig}}
+SaveConfig = true
+{{- end}}
+
+# Interface hooks (optional)
+{{- if .Interface.PreUp}}
+PreUp = {{ .Interface.PreUp }}
+{{- end}}
+{{- if .Interface.PostUp}}
+PostUp = {{ .Interface.PostUp }}
+{{- end}}
+{{- if .Interface.PreDown}}
+PreDown = {{ .Interface.PreDown }}
+{{- end}}
+{{- if .Interface.PostDown}}
+PostDown = {{ .Interface.PostDown }}
+{{- end}}
+
+#
+# Peers
+#
+
+{{range .Peers}}
+{{- if not .DeactivatedAt}}
+# -WGP- Peer: {{.Identifier}} / Updated: {{.UpdatedAt}} / Created: {{.CreatedAt}}
+# -WGP- Peer email: {{.Email}}
+{{- if .PrivateKey}}
+# -WGP- PrivateKey: {{.PrivateKey}}
+{{- end}}
+[Peer]
+PublicKey = {{ .PublicKey }}
+{{- if .PresharedKey}}
+PresharedKey = {{ .PresharedKey }}
+{{- end}}
+{{- if eq $.Interface.Type "server"}}
+AllowedIPs = {{ .IPsStr }}{{if ne .AllowedIPsSrvStr ""}}, {{ .AllowedIPsSrvStr }}{{end}}
+{{- end}}
+{{- if eq $.Interface.Type "client"}}
+{{- if .AllowedIPsStr}}
+AllowedIPs = {{ .AllowedIPsStr }}
+{{- end}}
+{{- end}}
+{{- if and (ne .Endpoint "") (eq $.Interface.Type "client")}}
+Endpoint = {{ .Endpoint }}
+{{- end}}
+{{- if ne .PersistentKeepalive 0}}
+PersistentKeepalive = {{ .PersistentKeepalive }}
+{{- end}}
+{{- end}}
+{{end}}

internal/wireguard/tpl/peer.tpl

@@ -0,0 +1,30 @@
+# AUTOGENERATED FILE - PROVIDED BY WIREGUARD PORTAL
+# WireGuard configuration: {{ .Peer.Identifier }}
+# -WGP- PublicKey: {{ .Peer.PublicKey }}
+
+[Interface]
+
+# Core settings
+PrivateKey = {{ .Peer.PrivateKey }}
+Address = {{ .Peer.IPsStr }}
+
+# Misc. settings (optional)
+{{- if .Peer.DNSStr}}
+DNS = {{ .Peer.DNSStr }}
+{{- end}}
+{{- if ne .Peer.Mtu 0}}
+MTU = {{.Peer.Mtu}}
+{{- end}}
+
+[Peer]
+PublicKey = {{ .Interface.PublicKey }}
+Endpoint = {{ .Peer.Endpoint }}
+{{- if .Peer.AllowedIPsStr}}
+AllowedIPs = {{ .Peer.AllowedIPsStr }}
+{{- end}}
+{{- if .Peer.PresharedKey}}
+PresharedKey = {{ .Peer.PresharedKey }}
+{{- end}}
+{{- if ne .Peer.PersistentKeepalive 0}}
+PersistentKeepalive = {{.Peer.PersistentKeepalive}}
+{{- end}}

scripts/docker-healthcheck.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-set -e
-
-goss -g /app/goss/wgportal/goss.yaml validate --format json_oneline
-
-exit 0

scripts/goss/wgportal/goss-wait.yaml

@@ -1,3 +0,0 @@
-process:
-  wgportal:
-    running: true

scripts/goss/wgportal/goss.yaml

@@ -1,3 +0,0 @@
-process:
-  wgportal:
-    running: true