fix circle ci config

* Improved Makefile
* Multiarch Docker build (amd64, arm64 and armv7)
* closes #104

.circleci/config.yml

@@ -0,0 +1,92 @@
+version: 2.1
+
+jobs:
+  build-latest:
+    steps:
+      - checkout
+      - restore_cache:
+          keys:
+            - go-mod-latest-v4-{{ checksum "go.sum" }}
+      - run:
+          name: Install Dependencies
+          command: |
+            make build-dependencies
+      - save_cache:
+          key: go-mod-latest-v4-{{ checksum "go.sum" }}
+          paths:
+            - "~/go/pkg/mod"
+      - run:
+          name: Build AMD64
+          command: |
+            VERSION=$CIRCLE_BRANCH
+            if [ ! -z "${CIRCLE_TAG}" ]; then VERSION=$CIRCLE_TAG; fi
+            make ENV_BUILD_IDENTIFIER=$VERSION ENV_BUILD_VERSION=$(echo $CIRCLE_SHA1 | cut -c1-7) build-amd64
+      - run:
+          name: Install Cross-Platform Dependencies
+          command: |
+            sudo apt-get update
+            sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install gcc-aarch64-linux-gnu libc6-dev-arm64-cross
+            sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install gcc-arm-linux-gnueabi libc6-dev-armel-cross gcc-arm-linux-gnueabihf libc6-dev-armhf-cross
+            sudo ln -s /usr/include/asm-generic /usr/include/asm
+      - run:
+          name: Build ARM64
+          command: |
+            VERSION=$CIRCLE_BRANCH
+            if [ ! -z "${CIRCLE_TAG}" ]; then VERSION=$CIRCLE_TAG; fi
+            make ENV_BUILD_IDENTIFIER=$VERSION ENV_BUILD_VERSION=$(echo $CIRCLE_SHA1 | cut -c1-7) build-arm64
+      - run:
+          name: Build ARM
+          command: |
+            VERSION=$CIRCLE_BRANCH
+            if [ ! -z "${CIRCLE_TAG}" ]; then VERSION=$CIRCLE_TAG; fi
+            make ENV_BUILD_IDENTIFIER=$VERSION ENV_BUILD_VERSION=$(echo $CIRCLE_SHA1 | cut -c1-7) build-arm
+      - store_artifacts:
+          path: ~/repo/dist
+      - run:
+          name: "Publish Release on GitHub"
+          command: |
+            if [ ! -z "${CIRCLE_TAG}" ]; then
+               go install github.com/tcnksm/ghr@latest
+               ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} -replace $CIRCLE_TAG ~/repo/dist
+            fi
+    working_directory: ~/repo
+    docker:
+      - image: cimg/go:1.19
+  build-116: # just to validate compatibility with minimum go version
+    steps:
+      - checkout
+      - restore_cache:
+          keys:
+            - go-mod-116-v4-{{ checksum "go.sum" }}
+      - run:
+          name: Install Dependencies
+          command: |
+            make build-dependencies
+      - save_cache:
+          key: go-mod-116-v4-{{ checksum "go.sum" }}
+          paths:
+            - "~/go/pkg/mod"
+      - run:
+          name: Build
+          command: |
+            VERSION=$CIRCLE_BRANCH
+            if [ ! -z "${CIRCLE_TAG}" ]; then VERSION=$CIRCLE_TAG; fi
+            make ENV_BUILD_IDENTIFIER=$VERSION ENV_BUILD_VERSION=$(echo $CIRCLE_SHA1 | cut -c1-7) build
+    working_directory: ~/repo116
+    docker:
+      - image: cimg/go:1.16
+
+workflows:
+  build-and-release:
+    jobs:
+      #--------------- BUILD ---------------#
+      - build-latest:
+          filters:
+            tags:
+              only: /^v.*/
+      - build-116:
+          requires:
+            - build-latest
+          filters:
+            tags:
+              only: /^v.*/

.github/workflows/docker-publish.yml

@@ -0,0 +1,137 @@
+name: Docker
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on:
+  push:
+    branches: [ master ]
+    # Publish vX.X.X tags as releases.
+    tags: [ 'v*.*.*' ]
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
+
+jobs:
+  build-dockerhub:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Get Version
+        shell: bash
+        run: |
+          echo "::set-output name=identifier::$(echo ${GITHUB_REF##*/})"
+          echo "::set-output name=hash::$(echo ${GITHUB_SHA} | cut -c1-7)"
+        id: get_version
+
+      - name: Log in to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: h44z/wg-portal
+          flavor: |
+            latest=true
+            prefix=
+            suffix=
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          build-args: |
+            BUILD_IDENTIFIER=${{ steps.get_version.outputs.identifier }}
+            BUILD_VERSION=${{ steps.get_version.outputs.hash }}
+
+  build-github:
+    name: Push Docker image to Github Container Registry
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Get Version
+        shell: bash
+        run: |
+          echo "::set-output name=identifier::$(echo ${GITHUB_REF##*/})"
+          echo "::set-output name=hash::$(echo ${GITHUB_SHA} | cut -c1-7)"
+        id: get_version
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: |
+            latest=true
+            prefix=
+            suffix=
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          build-args: |
+            BUILD_IDENTIFIER=${{ steps.get_version.outputs.identifier }}
+            BUILD_VERSION=${{ steps.get_version.outputs.hash }}

.gitignore

@@ -28,7 +28,10 @@
 out/
 dist/
 data/
+docker_images/
 ssh.key
 .testCoverage.txt
 wg_portal.db
-go.sum
+swagger.json
+swagger.yaml
+/config.yml

.travis.yml

@@ -1,43 +0,0 @@
-language: go
-dist: bionic
-sudo: required
-go:
-  - 1.16.x # Latest go version
-env:
-  - GO111MODULE=on
-addons:
-  apt:
-    packages:
-      - gcc-multilib
-
-before_install:
-  - # skip
-
-install:
-  - # skip
-
-script:
-  - go get -t -v ./...
-  - diff -u <(echo -n) <(gofmt -d .)
-  - go vet $(go list ./... | grep -v /vendor/)
-  - make build
-  # Switch over GCC to cross compilation (breaks 386, hence why do it here only)
-  - sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install gcc-arm-linux-gnueabi libc6-dev-armel-cross gcc-arm-linux-gnueabihf libc6-dev-armhf-cross gcc-aarch64-linux-gnu libc6-dev-arm64-cross
-  - sudo ln -s /usr/include/asm-generic /usr/include/asm
-  - make build-cross-plat
-
-deploy:
-  provider: releases
-  skip_cleanup: true # Important, otherwise the build output would be purged.
-  api_key:
-    # *encrypted* GitHub key, as the output of the Travis CI CLI tool
-    secure: "uZ7Vg7mEP7aUyaf/Uq5UZt6r3Ig/iOWcf7DZMhAWilOayeqdfW8kp2VzKFgTM6PJJm5Zv+OYV4dniO11QDjIX5sJfS10ApaxvPjw/a4NkqKykfrKZABWRmuvSv/PSjzl7jnWgnPqydBmHCfowsxI6X9j1uivgXZDMYg9BKOnDJtVoakUWJ47GKWr7ZegvF5DwB3EaPwDUmJIAJRiMqO+I2QmuVmLvvzkuhSQ/yuCjel/O7kudJuioJOvsxSHH5Mjh7HZoYayAFikVIGCXJStzMCeLwa+lUHUXoofoDT8SHMmcw2Oil1OpeC1PhvtT6VFLzYl9aphl472F9zP0TlBzR5VJ3+r5dwFVhf0MHp0LflIIg8RGjZg/H60yUUPbGYW7gN3wjdH1l7i66HcqFVs39GgzPCpxNuz8bhhUJOtR6K9FujYpp8AkFCwB327LwGzBLWP3wLGkmhj3ca3FBGJLZhzRdK6gpdp9KgY+33wJ/5R7zsUGtEGTjzsGB1GmBBb887qt0mh/cfm/mdh5HPWvZCif2WTyWd2W8gUiN4oTPhRdE/FRFUqoR1WEZeQrjgj3tThywrXIpRVdigN74UMsnlThSHxPZdJHPLftei2A3b+yfYgxt43sp22MqyuB6K7mT5ximQLWldN2Ibf7kKb5RO9/WX5P8LUj1KXtY3dh2o="
-  file:
-    - dist/wg-portal-amd64
-    - dist/wg-portal-arm64
-    - dist/wg-portal-arm
-    - dist/wg-portal.env
-    - dist/wg-portal.service
-  on:
-    repo: h44z/wg-portal
-    tags: true # The deployment happens only if the commit has a tag.

Dockerfile

@@ -6,6 +6,16 @@
 ######-
 FROM golang:1.16 as builder
 
+ARG BUILD_IDENTIFIER
+ENV ENV_BUILD_IDENTIFIER=$BUILD_IDENTIFIER
+
+ARG BUILD_VERSION
+ENV ENV_BUILD_VERSION=$BUILD_VERSION
+
+# populated by BuildKit
+ARG TARGETPLATFORM
+ENV ENV_TARGETPLATFORM=$TARGETPLATFORM
+
 RUN mkdir /build
 
 # Copy the source from the current directory to the Working Directory inside the container
@@ -14,37 +24,30 @@ ADD . /build/
 # Set the Current Working Directory inside the container
 WORKDIR /build
 
-# Workaround for failing travis-ci builds
-RUN rm -rf ~/go; rm -rf go.sum
-
 # Build the Go app
-RUN go clean -modcache; go mod tidy; make build
+RUN echo "Building version '$ENV_BUILD_IDENTIFIER-$ENV_BUILD_VERSION' for platform $ENV_TARGETPLATFORM"; make build
 
 ######-
 # Here starts the main image
 ######-
-FROM debian:buster
+FROM scratch
 
 # Setup timezone
 ENV TZ=Europe/Vienna
 
-# GOSS for container health checks
+# Import linux stuff from builder.
-ENV GOSS_VERSION v0.3.16
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-RUN apt-get update && apt-get upgrade -y && \
+COPY --from=builder /etc/passwd /etc/passwd
-        apt-get install --no-install-recommends -y moreutils ca-certificates curl && \
+COPY --from=builder /etc/group /etc/group
-        rm -rf /var/cache/apt /var/lib/apt/lists/*; \
-        curl -L https://github.com/aelsabbahy/goss/releases/download/$GOSS_VERSION/goss-linux-amd64 -o /usr/local/bin/goss && \
-        chmod +rx /usr/local/bin/goss && \
-        goss --version
 
-COPY --from=builder /build/dist/wg-portal-amd64 /app/wgportal
+# Copy binaries
-COPY --from=builder /build/scripts /app/
+COPY --from=builder /build/dist/wg-portal /app/wg-portal
+COPY --from=builder /build/dist/hc /app/hc
 
 # Set the Current Working Directory inside the container
 WORKDIR /app
 
 # Command to run the executable
-CMD [ "/app/wgportal" ]
+CMD [ "/app/wg-portal" ]
 
-HEALTHCHECK --interval=1m --timeout=10s \
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD [ "/app/hc", "http://localhost:11223/health" ]
-    CMD /app/docker-healthcheck.sh

Makefile

@@ -6,55 +6,119 @@ BUILDDIR=dist
 BINARIES=$(subst cmd/,,$(wildcard cmd/*))
 IMAGE=h44z/wg-portal
 
-.PHONY: all test clean phony
+all: help
 
-all: dep build
+.PHONY: help
+help:
+	@echo "Usage:"
+	@sed -n 's/^#>//p' ${MAKEFILE_LIST} | column -t -s ':' |  sed -e 's/^/ /'  # user commands (#>)
+	@echo ""
+	@echo "Advanced commands:"
+	@sed -n 's/^#<//p' ${MAKEFILE_LIST} | column -t -s ':' |  sed -e 's/^/ /'  # internal commands (#<)
 
-build: dep $(addsuffix -amd64,$(addprefix $(BUILDDIR)/,$(BINARIES)))
+########################################################################################
-	cp scripts/wg-portal.service $(BUILDDIR)
+##
-	cp scripts/wg-portal.env $(BUILDDIR)
+## DEVELOPER / USER TARGETS
+##
+########################################################################################
 
-build-cross-plat: dep build $(addsuffix -arm,$(addprefix $(BUILDDIR)/,$(BINARIES))) $(addsuffix -arm64,$(addprefix $(BUILDDIR)/,$(BINARIES)))
+#> codegen: Re-generate autogenerated files (like API docs)
-	cp scripts/wg-portal.service $(BUILDDIR)
+.PHONY: codegen
-	cp scripts/wg-portal.env $(BUILDDIR)
+codegen: $(SUBDIRS)
+	cd internal; swag init --propertyStrategy pascalcase --parseInternal --generalInfo server/api.go --output server/docs/
+	$(GOCMD) fmt internal/server/docs/docs.go
 
-dep:
+#> update: Update all dependencies
-	$(GOCMD) mod download
+.PHONY: update
+update:
+	@ $(GOCMD) get -u ./...
+	@ $(GOCMD) mod tidy
 
-validate: dep
+#> format: Re-format the code
-	$(GOCMD) fmt $(GOFILES)
+.PHONY: format
-	$(GOCMD) vet $(GOFILES)
+format:
-	$(GOCMD) test -race $(GOFILES)
+	@echo "Formatting code..."
+	@ $(GOCMD) fmt $(GOFILES)
 
-coverage: dep
+########################################################################################
-	$(GOCMD) fmt $(GOFILES)
+##
-	$(GOCMD) test $(GOFILES) -v -coverprofile .testCoverage.txt
+## TESTING / CODE QUALITY TARGETS
-	$(GOCMD) tool cover -func=.testCoverage.txt  # use total:\s+\(statements\)\s+(\d+.\d+\%) as Gitlab CI regextotal:\s+\(statements\)\s+(\d+.\d+\%)
+##
+########################################################################################
 
-coverage-html: coverage
+#> test: Run all kinds of tests, except for integration tests
-	$(GOCMD) tool cover -html=.testCoverage.txt
+.PHONY: test
+test: test-vet test-race
 
-test: dep
+#< test-vet: Static code analysis
-	$(GOCMD) test $(MODULENAME)/... -v -count=1
+.PHONY: test-vet
+test-vet: build-dependencies
+	@$(GOCMD) vet $(GOFILES)
 
+#< test-race: Race condition test
+.PHONY: test-race
+test-race: build-dependencies
+	@$(GOCMD) test -race -short $(GOFILES)
+
+########################################################################################
+##
+## CI TARGETS
+##
+########################################################################################
+
+#< clean: Delete all generated executables and test files
+.PHONY: clean
 clean:
-	$(GOCMD) clean $(GOFILES)
+	@rm -rf $(BUILDDIR)
-	rm -rf .testCoverage.txt
-	rm -rf $(BUILDDIR)
 
-docker-build:
+#< build: Build all executables (architecture depends on build system)
-	docker build -t $(IMAGE) .
+.PHONY: build
+build: build-dependencies
+	CGO_ENABLED=1 $(GOCMD) build -o $(BUILDDIR)/wg-portal \
+	 -ldflags "-w -s -extldflags \"-static\" -X 'github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}'" \
+	 cmd/wg-portal/main.go
 
-docker-push:
+	CGO_ENABLED=0 $(GOCMD) build -o $(BUILDDIR)/hc \
-	docker push $(IMAGE)
+	 -ldflags "-w -s -extldflags \"-static\"" \
+	 cmd/hc/main.go
 
-$(BUILDDIR)/%-amd64: cmd/%/main.go dep phony
+#< build: Build all executables for AMD64
-	GOOS=linux GOARCH=amd64 $(GOCMD) build -o $@ $<
+.PHONY: build-amd64
+build-amd64: build-dependencies
+	CGO_ENABLED=1 $(GOCMD) build -o $(BUILDDIR)/wg-portal-amd64 \
+	 -ldflags "-w -s -extldflags \"-static\" -X 'github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}'" \
+	 cmd/wg-portal/main.go
 
-# On arch-linux install aarch64-linux-gnu-gcc to crosscompile for arm64
+	CGO_ENABLED=0 $(GOCMD) build -o $(BUILDDIR)/hc-amd64 \
-$(BUILDDIR)/%-arm64: cmd/%/main.go dep phony
+	 -ldflags "-w -s -extldflags \"-static\"" \
-	CGO_ENABLED=1 CC=aarch64-linux-gnu-gcc GOOS=linux GOARCH=arm64 $(GOCMD) build -ldflags "-linkmode external -extldflags -static" -o $@ $<
+	 cmd/hc/main.go
 
-# On arch-linux install arm-linux-gnueabihf-gcc to crosscompile for arm
+#< build-arm64: Build all executables for ARM64
-$(BUILDDIR)/%-arm: cmd/%/main.go dep phony
+.PHONY: build-arm64
-	CGO_ENABLED=1 CC=arm-linux-gnueabi-gcc GOOS=linux GOARCH=arm GOARM=7 $(GOCMD) build -ldflags "-linkmode external -extldflags -static" -o $@ $<
+build-arm64: build-dependencies
+	CGO_ENABLED=1 CC=aarch64-linux-gnu-gcc GOOS=linux GOARCH=arm64 $(GOCMD) build -o $(BUILDDIR)/wg-portal-arm64 \
+	 -ldflags "-w -s -extldflags \"-static\" -X 'github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}'" \
+	 cmd/wg-portal/main.go
+
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GOCMD) build -o $(BUILDDIR)/hc-arm64 \
+	 -ldflags "-w -s -extldflags \"-static\"" \
+	 cmd/hc/main.go
+
+#< build-arm: Build all executables for ARM32
+.PHONY: build-arm
+build-arm: build-dependencies
+	CGO_ENABLED=1 CC=arm-linux-gnueabi-gcc GOOS=linux GOARCH=arm GOARM=7 $(GOCMD) build -o $(BUILDDIR)/wg-portal-arm \
+	 -ldflags "-w -s -extldflags \"-static\" -X 'github.com/h44z/wg-portal/internal/server.Version=${ENV_BUILD_IDENTIFIER}-${ENV_BUILD_VERSION}'" \
+	 cmd/wg-portal/main.go
+
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 $(GOCMD) build -o $(BUILDDIR)/hc-arm \
+	 -ldflags "-w -s -extldflags \"-static\"" \
+	 cmd/hc/main.go
+
+#< build-dependencies: Generate the output directory for compiled executables and download dependencies
+.PHONY: build-dependencies
+build-dependencies:
+	@$(GOCMD) mod download -x
+	@mkdir -p $(BUILDDIR)
+	cp scripts/wg-portal.service $(BUILDDIR)
+	cp scripts/wg-portal.env $(BUILDDIR)

README-RASPBERRYPI.md

@@ -4,16 +4,21 @@ This readme only contains a detailed explanation of how to set up the WireGuard
 
 ## Setup
 
-You can download prebuild binaries from the [release page](https://github.com/h44z/wg-portal/releases). If you want to build the binary yourself,
+You can either download prebuild binaries from the [release page](https://github.com/h44z/wg-portal/releases) or use Docker images for ARM. 
-use the following instructions:
+If you want to build the binary yourself, use the following building instructions.
 
 ### Building
 This section describes how to build the WireGuard Portal code.
 To compile the final binary, use the Makefile provided in the repository.
 As WireGuard Portal is written in Go, **golang >= 1.16** must be installed prior to building.
+If you want to cross compile ARM binaries from AMD64 systems, install *arm-linux-gnueabi-gcc* (armv7) or *aarch64-linux-gnu-gcc* (arm64).
 
 ```
-make build-cross-plat
+# for 64 bit OS
+make build-arm64
+
+# for 32 bit OS
+make build-arm 
 ```
 
 The compiled binary and all necessary assets will be located in the dist folder.

README.md

@@ -8,12 +8,12 @@
 ![GitHub code size in bytes](https://img.shields.io/github/languages/code-size/h44z/wg-portal)
 [![Docker Pulls](https://img.shields.io/docker/pulls/h44z/wg-portal.svg)](https://hub.docker.com/r/h44z/wg-portal/)
 
-A simple, web based configuration portal for [WireGuard](https://wireguard.com). 
+A simple, web based configuration portal for [WireGuard](https://wireguard.com).
-The portal uses the WireGuard [wgctrl](https://github.com/WireGuard/wgctrl-go) library to manage the VPN 
+The portal uses the WireGuard [wgctrl](https://github.com/WireGuard/wgctrl-go) library to manage existing VPN
-interface. This allows for seamless activation or deactivation of new users, without disturbing existing VPN 
+interfaces. This allows for seamless activation or deactivation of new users, without disturbing existing VPN
 connections.
 
-The configuration portal currently supports using SQLite, MySQL as a user source for authentication and profile data.
+The configuration portal currently supports using SQLite and MySQL as a user source for authentication and profile data.
 It also supports LDAP (Active Directory or OpenLDAP) as authentication provider.
 
 ## Features
@@ -30,14 +30,20 @@ It also supports LDAP (Active Directory or OpenLDAP) as authentication provider.
  * One single binary
  * Can be used with existing WireGuard setups
  * Support for multiple WireGuard interfaces
- 
+ * REST API for management and client deployment
+ * Peer Expiry Feature
+
 ![Screenshot](screenshot.png)
 
 ## Setup
+Make sure that your host system has at least one WireGuard interface (for example wg0) available.
+If you did not start up a WireGuard interface yet, take a look at [wg-quick](https://manpages.debian.org/unstable/wireguard-tools/wg-quick.8.en.html) in order to get started.
 
 ### Docker
 The easiest way to run WireGuard Portal is to use the Docker image provided.
 
+HINT: the *latest* tag always refers to the master branch and might contain unstable or incompatible code!
+
 Docker Compose snippet with some sample configuration values:
 ```
 version: '3.6'
@@ -78,22 +84,44 @@ services:
       - LDAP_ADMIN_GROUP=CN=WireGuardAdmins,OU=Users,DC=COMPANY,DC=LOCAL
 ```
 Please note that mapping ```/etc/wireguard``` to ```/etc/wireguard``` inside the docker, will erase your host's current configuration.
-If needed, please make sure to backup your files from ```/etc/wireguard```.
+If needed, please make sure to back up your files from ```/etc/wireguard```.
-For a full list of configuration options take a look at the source file [internal/server/configuration.go](internal/server/configuration.go#L56).
+For a full list of configuration options take a look at the source file [internal/server/configuration.go](internal/server/configuration.go#L58).
 
 ### Standalone
-For a standalone application, use the Makefile provided in the repository to build the application.
+For a standalone application, use the Makefile provided in the repository to build the application. Go version 1.16 or higher has to be installed to build WireGuard Portal.
 
-```
+```shell
+# show all possible make commands
 make
 
-# To build for arm architecture as well use:
+# build wg-portal for current system architecture
-make build-cross-plat
+make build
 ```
 
 The compiled binary will be located in the dist folder.
 A detailed description for using this software with a raspberry pi can be found in the [README-RASPBERRYPI.md](README-RASPBERRYPI.md).
 
+To build the Docker image, Docker (> 20.x) with buildx is required. If you want to build cross-platform images, you need to install qemu.
+On arch linux for example install: `docker-buildx qemu-user-static qemu-user-static-binfmt`.
+
+Once the Docker setup is completed, create a new buildx builder: 
+```shell
+docker buildx create --name wgportalbuilder --platform linux/arm/v7,linux/arm64,linux/amd64
+docker buildx use wgportalbuilder
+docker buildx inspect --bootstrap
+```
+Now you can compile the Docker image:
+```shell
+# multi platform build, can only be exported to tar archives
+docker buildx build --platform linux/arm/v7,linux/arm64,linux/amd64 --output type=local,dest=docker_images \
+  --build-arg BUILD_IDENTIFIER=dev --build-arg BUILD_VERSION=0.1 -t h44z/wg-portal .
+  
+
+# image for current platform only (same as docker build)
+docker buildx build --load \
+  --build-arg BUILD_IDENTIFIER=dev --build-arg BUILD_VERSION=0.1 -t h44z/wg-portal .
+```
+
 ## Configuration
 You can configure WireGuard Portal using either environment variables or a yaml configuration file.
 The filepath of the yaml configuration file defaults to **config.yml** in the working directory of the executable.
@@ -103,54 +131,64 @@ For example: `CONFIG_FILE=/home/test/config.yml ./wg-portal-amd64`.
 ### Configuration Options
 The following configuration options are available:
 
-| environment           | yaml              | yaml_parent | default_value                                   | description                                                                                                                          |
+| environment                | yaml                    | yaml_parent | default_value                                                                                                   | description                                                                                                                                       |
-|-----------------------|-------------------|-------------|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
+|----------------------------|-------------------------|-------------|-----------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|
-| LISTENING_ADDRESS     | listeningAddress  | core        | :8123                                           | The address on which the web server is listening. Optional IP address and port, e.g.: 127.0.0.1:8080.                                |
+| LISTENING_ADDRESS          | listeningAddress        | core        | :8123                                                                                                           | The address on which the web server is listening. Optional IP address and port, e.g.: 127.0.0.1:8080.                                             |
-| EXTERNAL_URL          | externalUrl       | core        | http://localhost:8123                           | The external URL where the web server is reachable. This link is used in emails that are created by the WireGuard Portal.            |
+| EXTERNAL_URL               | externalUrl             | core        | http://localhost:8123                                                                                           | The external URL where the web server is reachable. This link is used in emails that are created by the WireGuard Portal.                         |
-| WEBSITE_TITLE         | title             | core        | WireGuard VPN                                   | The website title.                                                                                                                   |
+| WEBSITE_TITLE              | title                   | core        | WireGuard VPN                                                                                                   | The website title.                                                                                                                                |
-| COMPANY_NAME          | company           | core        | WireGuard Portal                                | The company name (for branding).                                                                                                     |
+| COMPANY_NAME               | company                 | core        | WireGuard Portal                                                                                                | The company name (for branding).                                                                                                                  |
-| MAIL_FROM             | mailFrom          | core        | WireGuard VPN <noreply@company.com>             | The email address from which emails are sent.                                                                                        |
+| MAIL_FROM                  | mailFrom                | core        | WireGuard VPN <noreply@company.com>                                                                             | The email address from which emails are sent.                                                                                                     |
-| ADMIN_USER            | adminUser         | core        | admin@wgportal.local                            | The administrator user. Must be a valid email address.                                                                               |
+| LOGO_URL                   | logoUrl                 | core        | /img/header-logo.png                                                                                            | The logo displayed in the page's header.                                                                                                          |
-| ADMIN_PASS            | adminPass         | core        | wgportal                                        | The administrator password. If unchanged, a random password will be set on first startup.                                            |
+| ADMIN_USER                 | adminUser               | core        | admin@wgportal.local                                                                                            | The administrator user. Must be a valid email address.                                                                                            |
-| EDITABLE_KEYS         | editableKeys      | core        | true                                            | Allow to edit key-pairs in the UI.                                                                                                   |
+| ADMIN_PASS                 | adminPass               | core        | wgportal                                                                                                        | The administrator password. If unchanged, a random password will be set on first startup.                                                         |
-| CREATE_DEFAULT_PEER   | createDefaultPeer | core        | false                                           | If an LDAP user logs in for the first time, a new WireGuard peer will be created on the WG_DEFAULT_DEVICE if this option is enabled. |
+| EDITABLE_KEYS              | editableKeys            | core        | true                                                                                                            | Allow to edit key-pairs in the UI.                                                                                                                |
-| LDAP_ENABLED          | ldapEnabled       | core        | false                                           | Enable or disable the LDAP backend.                                                                                                  |
+| CREATE_DEFAULT_PEER        | createDefaultPeer       | core        | false                                                                                                           | If an LDAP user logs in for the first time, a new WireGuard peer will be created on the WG_DEFAULT_DEVICE if this option is enabled.              |
-| SESSION_SECRET        | sessionSecret     | core        | secret                                          | Use a custom secret to encrypt session data.                                                                                         |
+| SELF_PROVISIONING          | selfProvisioning        | core        | false                                                                                                           | Allow registered users to automatically create peers via the RESTful API.                                                                         |
-| DATABASE_TYPE         | typ               | database    | sqlite                                          | Either mysql or sqlite.                                                                                                              |
+| WG_EXPORTER_FRIENDLY_NAMES | wgExporterFriendlyNames | core        | false                                                                                                           | Enable integration with [prometheus_wireguard_exporter friendly name](https://github.com/MindFlavor/prometheus_wireguard_exporter#friendly-tags). |
-| DATABASE_HOST         | host              | database    |                                                 | The mysql server address.                                                                                                            |
+| LDAP_ENABLED               | ldapEnabled             | core        | false                                                                                                           | Enable or disable the LDAP backend.                                                                                                               |
-| DATABASE_PORT         | port              | database    |                                                 | The mysql server port.                                                                                                               |
+| SESSION_SECRET             | sessionSecret           | core        | secret                                                                                                          | Use a custom secret to encrypt session data.                                                                                                      |
-| DATABASE_NAME         | database          | database    | data/wg_portal.db                               | For sqlite database: the database file-path, otherwise the database name.                                                            |
+| BACKGROUND_TASK_INTERVAL   | backgroundTaskInterval  | core        | 900                                                                                                             | The interval (in seconds) for the background tasks (like peer expiry check).                                                                      |
-| DATABASE_USERNAME     | user              | database    |                                                 | The mysql user.                                                                                                                      |
+| EXPIRY_REENABLE            | expiryReEnable          | core        | false                                                                                                           | Reactivate expired peers if the expiration date is in the future.                                                                                 |
-| DATABASE_PASSWORD     | password          | database    |                                                 | The mysql password.                                                                                                                  |
+| DATABASE_TYPE              | typ                     | database    | sqlite                                                                                                          | Either mysql or sqlite.                                                                                                                           |
-| EMAIL_HOST            | host              | email       | 127.0.0.1                                       | The email server address.                                                                                                            |
+| DATABASE_HOST              | host                    | database    |                                                                                                                 | The mysql server address.                                                                                                                         |
-| EMAIL_PORT            | port              | email       | 25                                              | The email server port.                                                                                                               |
+| DATABASE_PORT              | port                    | database    |                                                                                                                 | The mysql server port.                                                                                                                            |
-| EMAIL_TLS             | tls               | email       | false                                           | Use STARTTLS.                                                                                                                        |
+| DATABASE_NAME              | database                | database    | data/wg_portal.db                                                                                               | For sqlite database: the database file-path, otherwise the database name.                                                                         |
-| EMAIL_CERT_VALIDATION | certcheck         | email       | false                                           | Validate the email server certificate.                                                                                               |
+| DATABASE_USERNAME          | user                    | database    |                                                                                                                 | The mysql user.                                                                                                                                   |
-| EMAIL_USERNAME        | user              | email       |                                                 | An optional username for SMTP authentication.                                                                                        |
+| DATABASE_PASSWORD          | password                | database    |                                                                                                                 | The mysql password.                                                                                                                               |
-| EMAIL_PASSWORD        | pass              | email       |                                                 | An optional password for SMTP authentication.                                                                                        |
+| EMAIL_HOST                 | host                    | email       | 127.0.0.1                                                                                                       | The email server address.                                                                                                                         |
-| WG_DEVICES            | devices           | wg          | wg0                                             | A comma separated list of WireGuard devices.                                                                                         |
+| EMAIL_PORT                 | port                    | email       | 25                                                                                                              | The email server port.                                                                                                                            |
-| WG_DEFAULT_DEVICE     | defaultDevice     | wg          | wg0                                             | This device is used for auto-created peers (if CREATE_DEFAULT_PEER is enabled).                                                      |
+| EMAIL_TLS                  | tls                     | email       | false                                                                                                           | Use STARTTLS. DEPRECATED: use EMAIL_ENCRYPTION instead.                                                                                           |
-| WG_CONFIG_PATH        | configDirectory   | wg          | /etc/wireguard                                  | If set, interface configuration updates will be written to this path, filename: <devicename>.conf.                                   |
+| EMAIL_ENCRYPTION           | encryption              | email       | none                                                                                                            | Either none, tls or starttls.                                                                                                                     |
-| MANAGE_IPS            | manageIPAddresses | wg          | true                                            | Handle IP address setup of interface, only available on linux.                                                                       |
+| EMAIL_CERT_VALIDATION      | certcheck               | email       | false                                                                                                           | Validate the email server certificate.                                                                                                            |
-| LDAP_URL              | url               | ldap        | ldap://srv-ad01.company.local:389               | The LDAP server url.                                                                                                                 |
+| EMAIL_USERNAME             | user                    | email       |                                                                                                                 | An optional username for SMTP authentication.                                                                                                     |
-| LDAP_STARTTLS         | startTLS          | ldap        | true                                            | Use STARTTLS.                                                                                                                        |
+| EMAIL_PASSWORD             | pass                    | email       |                                                                                                                 | An optional password for SMTP authentication.                                                                                                     |
-| LDAP_CERT_VALIDATION  | certcheck         | ldap        | false                                           | Validate the LDAP server certificate.                                                                                                |
+| EMAIL_AUTHTYPE             | auth                    | email       | plain                                                                                                           | Either plain, login or crammd5. If username and password are empty, this value is ignored.                                                        |
-| LDAP_BASEDN           | dn                | ldap        | DC=COMPANY,DC=LOCAL                             | The base DN for searching users.                                                                                                     |
+| WG_DEVICES                 | devices                 | wg          | wg0                                                                                                             | A comma separated list of WireGuard devices.                                                                                                      |
-| LDAP_USER             | user              | ldap        | company\\\\ldap_wireguard                       | The bind user.                                                                                                                       |
+| WG_DEFAULT_DEVICE          | defaultDevice           | wg          | wg0                                                                                                             | This device is used for auto-created peers (if CREATE_DEFAULT_PEER is enabled).                                                                   |
-| LDAP_PASSWORD         | pass              | ldap        | SuperSecret                                     | The bind password.                                                                                                                   |
+| WG_CONFIG_PATH             | configDirectory         | wg          | /etc/wireguard                                                                                                  | If set, interface configuration updates will be written to this path, filename: <devicename>.conf.                                                |
-| LDAP_TYPE             | typ               | ldap        | AD                                              | Either AD or OpenLDAP.                                                                                                               |
+| MANAGE_IPS                 | manageIPAddresses       | wg          | true                                                                                                            | Handle IP address setup of interface, only available on linux.                                                                                    |
-| LDAP_USER_CLASS       | userClass         | ldap        | organizationalPerson                            | The user class that specifies the LDAP object category of users.                                                                     |
+| USER_MANAGE_PEERS          | userManagePeers         | wg          | false                                                                                                           | Logged in user can create or update peers (partially).                                                                                            |
-| LDAP_ADMIN_GROUP      | adminGroup        | ldap        | CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL | Users in this group are marked as administrators.                                                                                    |
+| LDAP_URL                   | url                     | ldap        | ldap://srv-ad01.company.local:389                                                                               | The LDAP server url.                                                                                                                              |
-| LDAP_ATTR_EMAIL       | attrEmail         | ldap        | mail                                            | User email attribute.                                                                                                                |
+| LDAP_STARTTLS              | startTLS                | ldap        | true                                                                                                            | Use STARTTLS.                                                                                                                                     |
-| LDAP_ATTR_FIRSTNAME   | attrFirstname     | ldap        | givenName                                       | User firstname attribute.                                                                                                            |
+| LDAP_CERT_VALIDATION       | certcheck               | ldap        | false                                                                                                           | Validate the LDAP server certificate.                                                                                                             |
-| LDAP_ATTR_LASTNAME    | attrLastname      | ldap        | sn                                              | User lastname attribute.                                                                                                             |
+| LDAP_BASEDN                | dn                      | ldap        | DC=COMPANY,DC=LOCAL                                                                                             | The base DN for searching users.                                                                                                                  |
-| LDAP_ATTR_PHONE       | attrPhone         | ldap        | telephoneNumber                                 | User phone number attribute.                                                                                                         |
+| LDAP_USER                  | user                    | ldap        | company\\\\ldap_wireguard                                                                                       | The bind user.                                                                                                                                    |
-| LDAP_ATTR_GROUPS      | attrGroups        | ldap        | memberOf                                        | User groups attribute.                                                                                                               |
+| LDAP_PASSWORD              | pass                    | ldap        | SuperSecret                                                                                                     | The bind password.                                                                                                                                |
-| LDAP_ATTR_DISABLED    | attrDisabled      | ldap        | userAccountControl                              | User status attribute. This attribute is used to detect deactivated users.                                                           |
+| LDAP_LOGIN_FILTER          | loginFilter             | ldap        | (&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2)) | {{login_identifier}} will be replaced with the login email address.                                                                               |
-| LOG_LEVEL             |                   |             | debug                                           | Specify log level, one of: trace, debug, info, off.                                                                                  |
+| LDAP_SYNC_FILTER           | syncFilter              | ldap        | (&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))                    | The filter string for the LDAP synchronization service.                                                                                           |
-| LOG_JSON              |                   |             | false                                           | Format log output as JSON.                                                                                                           |
+| LDAP_ADMIN_GROUP           | adminGroup              | ldap        | CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL                                                                 | Users in this group are marked as administrators.                                                                                                 |
-| LOG_COLOR             |                   |             | true                                            | Colorize log output.                                                                                                                 |
+| LDAP_ATTR_EMAIL            | attrEmail               | ldap        | mail                                                                                                            | User email attribute.                                                                                                                             |
-| CONFIG_FILE           |                   |             | config.yml                                      | The config file path.                                                                                                                |
+| LDAP_ATTR_FIRSTNAME        | attrFirstname           | ldap        | givenName                                                                                                       | User firstname attribute.                                                                                                                         |
+| LDAP_ATTR_LASTNAME         | attrLastname            | ldap        | sn                                                                                                              | User lastname attribute.                                                                                                                          |
+| LDAP_ATTR_PHONE            | attrPhone               | ldap        | telephoneNumber                                                                                                 | User phone number attribute.                                                                                                                      |
+| LDAP_ATTR_GROUPS           | attrGroups              | ldap        | memberOf                                                                                                        | User groups attribute.                                                                                                                            |
+| LDAP_CERT_CONN             | ldapCertConn            | ldap        | false                                                                                                           | Allow connection with certificate against LDAP server without user/password                                                                       |
+| LDAPTLS_CERT               | ldapTlsCert             | ldap        |                                                                                                                 | The LDAP cert's path                                                                                                                              |
+| LDAPTLS_KEY                | ldapTlsKey              | ldap        |                                                                                                                 | The LDAP key's path                                                                                                                               |
+| LOG_LEVEL                  |                         |             | debug                                                                                                           | Specify log level, one of: trace, debug, info, off.                                                                                               |
+| LOG_JSON                   |                         |             | false                                                                                                           | Format log output as JSON.                                                                                                                        |
+| LOG_COLOR                  |                         |             | true                                                                                                            | Colorize log output.                                                                                                                              |
+| CONFIG_FILE                |                         |             | config.yml                                                                                                      | The config file path.                                                                                                                             |
 
 ### Sample yaml configuration
 config.yml:
@@ -171,7 +209,6 @@ ldap:
   user: wireguard@test.test
   pass: test
   adminGroup: CN=WireGuardAdmins,CN=Users,DC=test,DC=test
-  typ: AD
 database:
   typ: sqlite
   database: data/wg_portal.db
@@ -182,7 +219,7 @@ email:
   user: test@gmail.com
   pass: topsecret
 wg:
-  devices: 
+  devices:
     - wg0
     - wg1
   defaultDevice: wg0
@@ -190,12 +227,19 @@ wg:
   manageIPAddresses: true
 ```
 
-## What is out of scope
+### RESTful API
+WireGuard Portal offers a RESTful API to interact with.
+The API is documented using OpenAPI 2.0, the Swagger UI can be found
+under the URL `http://<your wg-portal ip/domain>/swagger/index.html?displayOperationId=true`.
+
+The [API's unittesting](tests/test_API.py) may serve as an example how to make use of the API with python3 & pyswagger.
+
+## What is out of scope
+ * Creating or removing WireGuard (wgX) interfaces.
+ * Generation or application of any `iptables` or `nftables` rules.
+ * Setting up or changing IP-addresses of the WireGuard interface on operating systems other than linux.
+ * Importing private keys of an existing WireGuard setup.
 
- * Generation or application of any `iptables` or `nftables` rules
- * Setting up or changing IP-addresses of the WireGuard interface on operating systems other than linux
- * Importing private keys of an existing WireGuard setup
- 
 ## Application stack
 
  * [Gin, HTTP web framework written in Go](https://github.com/gin-gonic/gin)
@@ -206,6 +250,6 @@ wg:
 ## License
 
  * MIT License. [MIT](LICENSE.txt) or https://opensource.org/licenses/MIT
- 
 
-This project was inspired by [wg-gen-web](https://github.com/vx3r/wg-gen-web).
+
+This project was inspired by [wg-gen-web](https://github.com/vx3r/wg-gen-web).

assets/css/bootstrap-tokenfield.min.css

@@ -2,4 +2,4 @@
  * bootstrap-tokenfield
  * https://github.com/sliptree/bootstrap-tokenfield
  * Copyright 2013-2014 Sliptree and other contributors; Licensed MIT
- */@-webkit-keyframes 'blink'{0%{border-color:#ededed}100%{border-color:#b94a48}}@-moz-keyframes 'blink'{0%{border-color:#ededed}100%{border-color:#b94a48}}@keyframes 'blink'{0%{border-color:#ededed}100%{border-color:#b94a48}}.tokenfield{height:auto;min-height:34px;padding-bottom:0}.tokenfield.focus{border-color:#66afe9;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6);box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6)}.tokenfield .token{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;display:inline-block;border:1px solid #d9d9d9;background-color:#ededed;white-space:nowrap;margin:-1px 5px 5px 0;height:22px;vertical-align:top;cursor:default}.tokenfield .token:hover{border-color:#b9b9b9}.tokenfield .token.active{border-color:#52a8ec;border-color:rgba(82,168,236,.8)}.tokenfield .token.duplicate{border-color:#ebccd1;-webkit-animation-name:blink;animation-name:blink;-webkit-animation-duration:.1s;animation-duration:.1s;-webkit-animation-direction:normal;animation-direction:normal;-webkit-animation-timing-function:ease;animation-timing-function:ease;-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}.tokenfield .token.invalid{background:0 0;border:1px solid transparent;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;border-bottom:1px dotted #d9534f}.tokenfield .token.invalid.active{background:#ededed;border:1px solid #ededed;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px}.tokenfield .token .token-label{display:inline-block;overflow:hidden;text-overflow:ellipsis;padding-left:4px;vertical-align:top}.tokenfield .token .close{font-family:Arial;display:inline-block;line-height:100%;font-size:1.1em;line-height:1.49em;margin-left:5px;float:none;height:100%;vertical-align:top;padding-right:4px}.tokenfield .token-input{background:0 0;width:60px;min-width:60px;border:0;height:20px;padding:0;margin-bottom:6px;-webkit-box-shadow:none;box-shadow:none}.tokenfield .token-input:focus{border-color:transparent;outline:0;-webkit-box-shadow:none;box-shadow:none}.tokenfield.disabled{cursor:not-allowed;background-color:#eee}.tokenfield.disabled .token-input{cursor:not-allowed}.tokenfield.disabled .token:hover{cursor:not-allowed;border-color:#d9d9d9}.tokenfield.disabled .token:hover .close{cursor:not-allowed;opacity:.2;filter:alpha(opacity=20)}.has-warning .tokenfield.focus{border-color:#66512c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b}.has-error .tokenfield.focus{border-color:#843534;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483}.has-success .tokenfield.focus{border-color:#2b542c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168}.tokenfield.input-sm,.input-group-sm .tokenfield{min-height:30px;padding-bottom:0}.input-group-sm .token,.tokenfield.input-sm .token{height:20px;margin-bottom:4px}.input-group-sm .token-input,.tokenfield.input-sm .token-input{height:18px;margin-bottom:5px}.tokenfield.input-lg,.input-group-lg .tokenfield{min-height:45px;padding-bottom:4px}.input-group-lg .token,.tokenfield.input-lg .token{height:25px}.input-group-lg .token-label,.tokenfield.input-lg .token-label{line-height:23px}.input-group-lg .token .close,.tokenfield.input-lg .token .close{line-height:1.3em}.input-group-lg .token-input,.tokenfield.input-lg .token-input{height:23px;line-height:23px;margin-bottom:6px;vertical-align:top}.tokenfield.rtl{direction:rtl;text-align:right}.tokenfield.rtl .token{margin:-1px 0 5px 5px}.tokenfield.rtl .token .token-label{padding-left:0;padding-right:4px}
+ */@-webkit-keyframes blink{0%{border-color:#ededed}100%{border-color:#b94a48}}@-moz-keyframes blink{0%{border-color:#ededed}100%{border-color:#b94a48}}@keyframes blink{0%{border-color:#ededed}100%{border-color:#b94a48}}.tokenfield{height:auto;min-height:34px;padding-bottom:0}.tokenfield.focus{border-color:#66afe9;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6);box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 8px rgba(102,175,233,.6)}.tokenfield .token{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px;display:inline-block;border:1px solid #d9d9d9;background-color:#ededed;white-space:nowrap;margin:-1px 5px 5px 0;height:22px;vertical-align:top;cursor:default}.tokenfield .token:hover{border-color:#b9b9b9}.tokenfield .token.active{border-color:#52a8ec;border-color:rgba(82,168,236,.8)}.tokenfield .token.duplicate{border-color:#ebccd1;-webkit-animation-name:blink;animation-name:blink;-webkit-animation-duration:.1s;animation-duration:.1s;-webkit-animation-direction:normal;animation-direction:normal;-webkit-animation-timing-function:ease;animation-timing-function:ease;-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}.tokenfield .token.invalid{background:0 0;border:1px solid transparent;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;border-bottom:1px dotted #d9534f}.tokenfield .token.invalid.active{background:#ededed;border:1px solid #ededed;-webkit-border-radius:3px;-moz-border-radius:3px;border-radius:3px}.tokenfield .token .token-label{display:inline-block;overflow:hidden;text-overflow:ellipsis;padding-left:4px;vertical-align:top}.tokenfield .token .close{font-family:Arial;display:inline-block;line-height:100%;font-size:1.1em;line-height:1.49em;margin-left:5px;float:none;height:100%;vertical-align:top;padding-right:4px}.tokenfield .token-input{background:0 0;width:60px;min-width:60px;border:0;height:20px;padding:0;margin-bottom:6px;-webkit-box-shadow:none;box-shadow:none}.tokenfield .token-input:focus{border-color:transparent;outline:0;-webkit-box-shadow:none;box-shadow:none}.tokenfield.disabled{cursor:not-allowed;background-color:#eee}.tokenfield.disabled .token-input{cursor:not-allowed}.tokenfield.disabled .token:hover{cursor:not-allowed;border-color:#d9d9d9}.tokenfield.disabled .token:hover .close{cursor:not-allowed;opacity:.2;filter:alpha(opacity=20)}.has-warning .tokenfield.focus{border-color:#66512c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #c0a16b}.has-error .tokenfield.focus{border-color:#843534;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #ce8483}.has-success .tokenfield.focus{border-color:#2b542c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168;box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 6px #67b168}.tokenfield.input-sm,.input-group-sm .tokenfield{min-height:30px;padding-bottom:0}.input-group-sm .token,.tokenfield.input-sm .token{height:20px;margin-bottom:4px}.input-group-sm .token-input,.tokenfield.input-sm .token-input{height:18px;margin-bottom:5px}.tokenfield.input-lg,.input-group-lg .tokenfield{height:auto;min-height:45px;padding-bottom:4px}.input-group-lg .token,.tokenfield.input-lg .token{height:25px}.input-group-lg .token-label,.tokenfield.input-lg .token-label{line-height:23px}.input-group-lg .token .close,.tokenfield.input-lg .token .close{line-height:1.3em}.input-group-lg .token-input,.tokenfield.input-lg .token-input{height:23px;line-height:23px;margin-bottom:6px;vertical-align:top}.tokenfield.rtl{direction:rtl;text-align:right}.tokenfield.rtl .token{margin:-1px 0 5px 5px}.tokenfield.rtl .token .token-label{padding-left:0;padding-right:4px}

assets/css/custom.css

@@ -64,10 +64,19 @@ pre{background:#f7f7f9}iframe{overflow:hidden;border:none}@media (min-width: 768
     padding: 0.5rem 1rem;
 }
 
+.navbar-brand > img {
+    height: 2rem;
+    width: auto;
+}
+
 .disabled-peer {
     color: #d03131;
 }
 
+.expiring-peer {
+    color: #d09d12;
+}
+
 .tokenfield .token {
     border-radius: 0px;
     border: 1px solid #1a1a1a;
@@ -100,4 +109,10 @@ a.advanced-settings.collapsed:before {
 
 .text-blue {
     color: #0057bb;
+}
+
+@media (min-width: 992px) {
+    .pull-right-lg {
+        float: right;
+    }
 }

assets/css/signin.css

@@ -1,3 +1,8 @@
 .navbar {
     padding: 0.5rem 1rem;
+}
+
+.navbar-brand > img {
+    height: 2rem;
+    width: auto;
 }

assets/js/custom.js

@@ -30,6 +30,10 @@
             this.form.submit();
         });
     });
+    $('[data-toggle=confirmation]').confirmation({
+        rootSelector: '[data-toggle=confirmation]',
+        // other options
+    });
 })(jQuery); // End of use strict
 
 

assets/tpl/admin_create_clients.html

@@ -17,7 +17,7 @@
     {{template "prt_nav.html" .}}
     <div class="container mt-5">
         <h1>Create new clients</h1>
-        <h2>Enter valid LDAP user email addresses to quickly create new accounts.</h2>
+        <h2>Enter valid user email addresses to quickly create new accounts.</h2>
         {{template "prt_flashes.html" .}}
         <form method="post" enctype="multipart/form-data">
             <input type="hidden" name="_csrf" value="{{.Csrf}}">
@@ -40,9 +40,10 @@
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
-    <script src="/js/jquery-ui.min.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/bootstrap-tokenfield.min.js"></script>
     <script src="/js/custom.js"></script>
     <script>$('#inputEmail').on('tokenfield:createdtoken', function (e) {
@@ -52,11 +53,19 @@
             if (!valid) {
                 $(e.relatedTarget).addClass('invalid')
             }
+        }).on('tokenfield:createtoken', function (e) {
+            var existingTokens = $(this).tokenfield('getTokens');
+            $.each(existingTokens, function(index, token) {
+                if (token.value === e.attrs.value)
+                    e.preventDefault();
+            });
         }).tokenfield({
             autocomplete: {
-                source: [{{range $i, $u :=.Users}}{{$u.Email}},{{end}}],
+                source: [{{range $i, $u :=.Users}}{{if ne $i 0}},{{end}}'{{$u.Email}}'{{end}}],
                 delay: 100
             },
+            inputType: 'email',
+            createTokensOnBlur: true,
             showAutocompleteOnFocus: false
         })</script>
 </body>

assets/tpl/admin_edit_client.html

@@ -45,7 +45,7 @@
                 <div class="form-row">
                     <div class="form-group col-md-12">
                         <label for="server_PresharedKey">Preshared Key</label>
-                        <input type="text" name="presharedkey" class="form-control" id="server_PresharedKey" value="{{.Peer.PresharedKey}}" required>
+                        <input type="text" name="presharedkey" class="form-control" id="server_PresharedKey" value="{{.Peer.PresharedKey}}">
                     </div>
                 </div>
             {{else}}
@@ -82,6 +82,12 @@
                     <input type="text" name="allowedip" class="form-control" id="server_AllowedIP" value="{{.Peer.AllowedIPsStr}}">
                 </div>
             </div>
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <label for="server_AllowedIPSrv">Extra Allowed IPs (Server sided)</label>
+                    <input type="text" name="allowedipSrv" class="form-control" id="server_AllowedIPSrv" value="{{.Peer.AllowedIPsSrvStr}}">
+                </div>
+            </div>
             <div class="form-row">
                 <div class="form-group col-md-12 global-config">
                     <label for="server_DNS">Client DNS Servers</label>
@@ -100,7 +106,7 @@
             </div>
 
             <div class="form-row">
-                <div class="form-group col-md-12">
+                <div class="form-group col-md-6">
                     <div class="custom-control custom-switch">
                         <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="server_Disabled" {{if .Peer.DeactivatedAt}}checked{{end}}>
                         <label class="custom-control-label" for="server_Disabled">
@@ -114,6 +120,10 @@
                         </label>
                     </div>
                 </div>
+                <div class="form-group col-md-6">
+                    <label for="expires_at">Expires At</label>
+                    <input type="date" name="expires_at" pattern="\d{4}-\d{2}-\d{2}" class="form-control" id="expires_at" placeholder="" value="{{formatDate .Peer.ExpiresAt}}" min="2022-01-01">
+                </div>
             </div>
 
 
@@ -179,7 +189,7 @@
             </div>
 
             <div class="form-row">
-                <div class="form-group col-md-12">
+                <div class="form-group col-md-6">
                     <div class="custom-control custom-switch">
                         <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="client_Disabled" {{if .Peer.DeactivatedAt}}checked{{end}}>
                         <label class="custom-control-label" for="client_Disabled">
@@ -187,6 +197,10 @@
                         </label>
                     </div>
                 </div>
+                <div class="form-group col-md-6">
+                    <label for="expires_at">Expires At</label>
+                    <input type="date" name="expires_at" pattern="\d{4}-\d{2}-\d{2}" class="form-control" id="expires_at" placeholder="" value="{{formatDate .Peer.ExpiresAt}}" min="2022-01-01">
+                </div>
             </div>
 
 
@@ -197,8 +211,10 @@
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/custom.js"></script>
 </body>
 

assets/tpl/admin_edit_interface.html

@@ -28,7 +28,7 @@
         <div id="configContent" class="tab-content">
             <!-- server mode -->
             <div class="tab-pane fade {{if eq .Device.Type "server"}}active show{{end}}" id="server">
-                <form method="post" enctype="multipart/form-data">
+                <form method="post" enctype="multipart/form-data" name="server">
                     <input type="hidden" name="_csrf" value="{{.Csrf}}">
                     <input type="hidden" name="device" value="{{.Device.DeviceName}}">
                     <input type="hidden" name="devicetype" value="server">
@@ -162,7 +162,7 @@
 
             <!-- client mode -->
             <div class="tab-pane fade {{if eq .Device.Type "client"}}active show{{end}}" id="client">
-                <form method="post" enctype="multipart/form-data">
+                <form method="post" enctype="multipart/form-data" name="client">
                     <input type="hidden" name="_csrf" value="{{.Csrf}}">
                     <input type="hidden" name="device" value="{{.Device.DeviceName}}">
                     <input type="hidden" name="devicetype" value="client">
@@ -253,8 +253,10 @@
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/custom.js"></script>
 </body>
 

assets/tpl/admin_edit_user.html

@@ -11,78 +11,85 @@
 </head>
 
 <body id="page-top" class="d-flex flex-column min-vh-100">
-{{template "prt_nav.html" .}}
+    {{template "prt_nav.html" .}}
-<div class="container mt-5">
+    <div class="container mt-5">
-    {{if eq .User.CreatedAt .Epoch}}
-    <h1>Create a new user</h1>
-    {{else}}
-    <h1>Edit user <strong>{{.User.Email}}</strong></h1>
-    {{end}}
-
-    {{template "prt_flashes.html" .}}
-
-    <form method="post" enctype="multipart/form-data">
-        <input type="hidden" name="_csrf" value="{{.Csrf}}">
         {{if eq .User.CreatedAt .Epoch}}
-        <div class="form-row">
+        <h1>Create a new user</h1>
-            <div class="form-group required col-md-12">
-                <label for="inputEmail">Email</label>
-                <input type="text" name="email" class="form-control" id="inputEmail" value="{{.User.Email}}" required>
-            </div>
-        </div>
         {{else}}
-        <input type="hidden" name="email" value="{{.User.Email}}">
+        <h1>Edit user <strong>{{.User.Email}}</strong></h1>
         {{end}}
-        <div class="form-row">
-            <div class="form-group required col-md-12">
-                <label for="inputFirstname">Firstname</label>
-                <input type="text" name="firstname" class="form-control" id="inputFirstname" value="{{.User.Firstname}}" required>
-            </div>
-        </div>
-        <div class="form-row">
-            <div class="form-group required col-md-12">
-                <label for="inputLastname">Lastname</label>
-                <input type="text" name="lastname" class="form-control" id="inputLastname" value="{{.User.Lastname}}" required>
-            </div>
-        </div>
-        <div class="form-row">
-            <div class="form-group col-md-12">
-                <label for="inputPhone">Phone</label>
-                <input type="text" name="phone" class="form-control" id="inputPhone" value="{{.User.Phone}}">
-            </div>
-        </div>
-        <div class="form-row">
-            <div class="form-group col-md-12 {{if eq .User.CreatedAt .Epoch}}required{{end}}">
-                <label for="inputPassword">Password</label>
-                <input type="password" name="password" class="form-control" id="inputPassword" {{if eq .User.CreatedAt .Epoch}}required{{end}}>
-            </div>
-        </div>
-        <div class="form-row">
-            <div class="form-group col-md-12">
-                <div class="custom-control custom-switch">
-                    <input class="custom-control-input" name="isadmin" type="checkbox" value="true" id="inputAdmin" {{if .User.IsAdmin}}checked{{end}}>
-                    <label class="custom-control-label" for="inputAdmin">
-                        Administrator
-                    </label>
-                </div>
-                <div class="custom-control custom-switch">
-                    <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="inputDisabled" {{if .User.DeletedAt.Valid}}checked{{end}}>
-                    <label class="custom-control-label" for="inputDisabled">
-                        Disabled
-                    </label>
-                </div>
-            </div>
-        </div>
 
-        <button type="submit" class="btn btn-primary">Save</button>
+        {{template "prt_flashes.html" .}}
-        <a href="/admin/users/" class="btn btn-secondary">Cancel</a>
+
-    </form>
+        <form method="post" enctype="multipart/form-data">
-</div>
+            <input type="hidden" name="_csrf" value="{{.Csrf}}">
-{{template "prt_footer.html" .}}
+            {{if eq .User.CreatedAt .Epoch}}
-<script src="/js/jquery.min.js"></script>
+            <div class="form-row">
-<script src="/js/bootstrap.bundle.min.js"></script>
+                <div class="form-group required col-md-12">
-<script src="/js/jquery.easing.js"></script>
+                    <label for="inputEmail">Email</label>
-<script src="/js/custom.js"></script>
+                    <input type="text" name="email" class="form-control" id="inputEmail" value="{{.User.Email}}" required>
+                </div>
+            </div>
+            {{else}}
+            <input type="hidden" name="email" value="{{.User.Email}}">
+            {{end}}
+            <div class="form-row">
+                <div class="form-group required col-md-12">
+                    <label for="inputFirstname">Firstname</label>
+                    <input type="text" name="firstname" class="form-control" id="inputFirstname" value="{{.User.Firstname}}" required>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group required col-md-12">
+                    <label for="inputLastname">Lastname</label>
+                    <input type="text" name="lastname" class="form-control" id="inputLastname" value="{{.User.Lastname}}" required>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <label for="inputPhone">Phone</label>
+                    <input type="text" name="phone" class="form-control" id="inputPhone" value="{{.User.Phone}}">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-12 {{if eq .User.CreatedAt .Epoch}}required{{end}}">
+                    <label for="inputPassword">Password</label>
+                    <input type="password" name="password" class="form-control" id="inputPassword" {{if eq .User.CreatedAt .Epoch}}required{{end}}>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <div class="custom-control custom-switch">
+                        <input class="custom-control-input" name="isadmin" type="checkbox" value="true" id="inputAdmin" {{if .User.IsAdmin}}checked{{end}}>
+                        <label class="custom-control-label" for="inputAdmin">
+                            Administrator
+                        </label>
+                    </div>
+                    <div class="custom-control custom-switch">
+                        <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="inputDisabled" {{if .User.DeletedAt.Valid}}checked{{end}}>
+                        <label class="custom-control-label" for="inputDisabled">
+                            Disabled
+                        </label>
+                    </div>
+                </div>
+            </div>
+
+            <button type="submit" class="btn btn-primary">Save</button>
+            <a href="/admin/users/" class="btn btn-secondary">Cancel</a>
+            {{if eq $.Session.IsAdmin true}}
+            {{if eq .User.Source "db"}}
+            <a href="/admin/users/delete?pkey={{.User.Email}}" data-toggle="confirmation" data-title="Really delete user and associated peers?" title="Delete user and associated peers" class="btn btn-danger float-right">Delete</a>
+            {{end}}
+            {{end}}
+        </form>
+    </div>
+    {{template "prt_footer.html" .}}
+    <script src="/js/jquery.min.js"></script>
+    <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
+    <script src="/js/custom.js"></script>
 </body>
 
 </html>

assets/tpl/admin_index.html

@@ -125,7 +125,7 @@
             </div>
         </div>
         <div class="mt-4 row">
-            <div class="col-sm-10 col-12">
+            <div class="col-sm-8 col-12">
                 {{if eq $.Device.Type "server"}}
                 <h2 class="mt-2">Current VPN Peers</h2>
                 {{end}}
@@ -133,11 +133,12 @@
                 <h2 class="mt-2">Current VPN Endpoints</h2>
                 {{end}}
             </div>
-            <div class="col-sm-2 col-12 text-right">
+            <div class="col-sm-4 col-12 text-right">
+                <a href="/admin/peer/emailall" data-toggle="confirmation" data-title="Send mail to all peers?" title="Send mail to all peers" class="btn btn-light"><i class="fa fa-fw fa-paper-plane"></i></a>
                 {{if eq $.Device.Type "server"}}
-                <a href="/admin/peer/createldap" title="Add multiple peers" class="btn btn-primary"><i class="fa fa-fw fa-user-plus"></i></a>
+                <a href="/admin/peer/createldap" title="Add multiple peers" class="btn btn-primary"><i class="fa fa-fw fa-plus"></i><i class="fa fa-fw fa-users"></i></a>
                 {{end}}
-                <a href="/admin/peer/create" title="Add a peer" class="btn btn-primary"><i class="fa fa-fw fa-plus"></i>M</a>
+                <a href="/admin/peer/create" title="Add a peer" class="btn btn-primary"><i class="fa fa-fw fa-plus"></i><i class="fa fa-fw fa-user"></i></a>
             </div>
         </div>
         <div class="mt-2 table-responsive">
@@ -169,7 +170,7 @@
                             <!-- online check -->
                             <span title="Online status" class="online-status" id="online-{{$p.UID}}" data-pkey="{{$p.PublicKey}}"><i class="fas fa-unlink"></i></span>
                         </th>
-                        <td>{{$p.Identifier}}</td>
+                        <td>{{$p.Identifier}}{{if $p.WillExpire}} <i class="fas fa-hourglass-end expiring-peer" data-toggle="tooltip" data-placement="right" title="" data-original-title="Expires at: {{formatDate $p.ExpiresAt}}"></i>{{end}}</td>
                         <td>{{$p.PublicKey}}</td>
                         {{if eq $.Device.Type "server"}}
                         <td>{{$p.Email}}</td>
@@ -238,12 +239,18 @@
                                     </div>
                                     <div class="col-md-3">
                                         {{if eq $.Device.Type "server"}}
-                                        <img class="list-image-large" src="/user/qrcode?pkey={{$p.PublicKey}}"/>
+                                        <img class="list-image-large" loading="lazy" alt="Configuration QR Code" src="/user/qrcode?pkey={{$p.PublicKey}}"/>
                                         {{end}}
                                     </div>
                                     <div class="col-md-3">
+                                        {{if $p.DeactivatedAt}}
+                                        <div class="pull-right-lg mt-lg-5 disabled-peer">Peer is disabled! <i class="fas fa-comment-dots" data-toggle="tooltip" data-placement="left" title="" data-original-title="Reason: {{$p.DeactivatedReason}}"></i></div>
+                                        {{end}}
+                                        {{if $p.WillExpire}}
+                                        <div class="pull-right-lg mt-lg-5 expiring-peer"><i class="fas fa-exclamation-triangle"></i> Peer will expire on {{ formatDate $p.ExpiresAt}}</div>
+                                        {{end}}
                                         {{if eq $.Device.Type "server"}}
-                                        <div class="float-right mt-5">
+                                        <div class="pull-right-lg mt-lg-5 mt-md-3">
                                         <a href="/admin/peer/download?pkey={{$p.PublicKey}}" class="btn btn-primary" title="Download configuration">Download</a>
                                         <a href="/admin/peer/email?pkey={{$p.PublicKey}}" class="btn btn-primary" title="Send configuration via Email">Email</a>
                                         </div>
@@ -261,8 +268,10 @@
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/custom.js"></script>
 </body>
 

assets/tpl/admin_user_index.html

@@ -59,8 +59,10 @@
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/custom.js"></script>
 </body>
 

assets/tpl/error.html

@@ -11,21 +11,23 @@
 </head>
 
 <body id="page-top">
-{{template "prt_nav.html" .}}
+    {{template "prt_nav.html" .}}
-<div class="container">
+    <div class="container">
-    <div class="text-center mt-5">
+        <div class="text-center mt-5">
-        <div class="error mx-auto" data-text="{{.Data.Code}}">
+            <div class="error mx-auto" data-text="{{.Data.Code}}">
-            <p class="m-0">{{.Data.Code}}</p>
+                <p class="m-0">{{.Data.Code}}</p>
+            </div>
+            <p class="text-dark mb-5 lead">{{.Data.Message}}</p>
+            <p class="text-black-50 mb-0">{{.Data.Details}}</p><a href="/">← Back to Dashboard</a>
         </div>
-        <p class="text-dark mb-5 lead">{{.Data.Message}}</p>
-        <p class="text-black-50 mb-0">{{.Data.Details}}</p><a href="/">← Back to Dashboard</a>
     </div>
-</div>
+    {{template "prt_footer.html" .}}
-{{template "prt_footer.html" .}}
+    <script src="/js/jquery.min.js"></script>
-<script src="/js/jquery.min.js"></script>
+    <script src="/js/jquery.easing.js"></script>
-<script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/popper.min.js"></script>
-<script src="/js/jquery.easing.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
-<script src="/js/custom.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
+    <script src="/js/custom.js"></script>
 </body>
 
 </html>

assets/tpl/index.html

@@ -15,7 +15,7 @@
     {{template "prt_nav.html" .}}
     <div class="container mt-2">
         <div class="page-header">
-            <h1>WireGuard VPN Portal</h1>
+            <h1>{{ .Static.WebsiteTitle }}</h1>
         </div>
         {{template "prt_flashes.html" .}}
         <p class="lead">WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. </p>
@@ -79,8 +79,10 @@
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/custom.js"></script>
 </body>
 

assets/tpl/login.html

@@ -27,11 +27,11 @@
         <div class="card mt-5">
             <div class="card-header">Please sign in</div>
             <div class="card-body">
-                <form class="form-signin" method="post">
+                <form class="form-signin" method="post" name="login">
                     <input type="hidden" name="_csrf" value="{{.Csrf}}">
                     <div class="form-group">
-                        <label for="inputUsername">Email</label>
+                        <label for="inputUsername">Username</label>
-                        <input type="text" name="username" class="form-control" id="inputUsername" aria-describedby="usernameHelp" placeholder="Enter email">
+                        <input type="text" name="username" class="form-control" id="inputUsername" aria-describedby="usernameHelp" placeholder="Enter username or email">
                     </div>
                     <div class="form-group">
                         <label for="inputPassword">Password</label>
@@ -56,8 +56,10 @@
         {{template "prt_flashes.html" .}}
     </div>
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/custom.js"></script>
 </body>
 

assets/tpl/user_create_client.html

@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no">
+    <title>{{ .Static.WebsiteTitle }} - Admin</title>
+    <meta name="description" content="{{ .Static.WebsiteTitle }}">
+    <link rel="stylesheet" href="/css/bootstrap.min.css">
+    <link rel="stylesheet" href="/fonts/fontawesome-all.min.css">
+    <link rel="stylesheet" href="/css/custom.css">
+</head>
+
+<body id="page-top" class="d-flex flex-column min-vh-100">
+    {{template "prt_nav.html" .}}
+    <div class="container mt-5">
+        {{template "prt_flashes.html" .}}
+
+        <!-- server mode -->
+        <h1>Create a new client</h1>
+
+        <form method="post" enctype="multipart/form-data">
+            <input type="hidden" name="_csrf" value="{{.Csrf}}">
+            <input type="hidden" name="uid" value="{{.Peer.UID}}">
+            <div class="form-row">
+                <div class="form-group required col-md-12">
+                    <label for="server_PublicKey">Public Key</label>
+                    <input type="text" name="pubkey" class="form-control" id="server_PublicKey" value="{{.Peer.PublicKey}}" required>
+                </div>
+            </div>
+
+            <button type="submit" class="btn btn-primary">Save</button>
+            <a href="/user/profile" class="btn btn-secondary">Cancel</a>
+        </form>
+    </div>
+    {{template "prt_footer.html" .}}
+    <script src="/js/jquery.min.js"></script>
+    <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
+    <script src="/js/custom.js"></script>
+</body>
+
+</html>

assets/tpl/user_edit_client.html

@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no">
+    <title>{{ .Static.WebsiteTitle }} - Admin</title>
+    <meta name="description" content="{{ .Static.WebsiteTitle }}">
+    <link rel="stylesheet" href="/css/bootstrap.min.css">
+    <link rel="stylesheet" href="/fonts/fontawesome-all.min.css">
+    <link rel="stylesheet" href="/css/custom.css">
+</head>
+
+<body id="page-top" class="d-flex flex-column min-vh-100">
+    {{template "prt_nav.html" .}}
+    <div class="container mt-5">
+        {{template "prt_flashes.html" .}}
+
+        <!-- server mode -->
+        <h1>Edit client: <strong>{{.Peer.Identifier}}</strong></h1>
+
+        <form method="post" enctype="multipart/form-data">
+            <input type="hidden" name="_csrf" value="{{.Csrf}}">
+            <input type="hidden" name="uid"  value="{{.Peer.UID}}">
+            <div class="form-row">
+                <div class="form-group required col-md-12">
+                    <label for="server_PublicKey">Public Key</label>
+                    <input type="text" name="pubkey" class="form-control" id="server_PublicKey" value="{{.Peer.PublicKey}}" required disabled="disabled">
+                </div>
+            </div>
+
+            <div class="form-row">
+                <div class="form-group col-md-12">
+                    <div class="custom-control custom-switch">
+                        <input class="custom-control-input" name="isdisabled" type="checkbox" value="true" id="server_Disabled" {{if .Peer.DeactivatedAt}}disabled="disabled"{{end}} {{if .Peer.DeactivatedAt}}checked{{end}}>
+                        <label class="custom-control-label" for="server_Disabled">
+                            Disabled
+                        </label>
+                    </div>
+                </div>
+            </div>
+            <button type="submit" class="btn btn-primary">Save</button>
+            <a href="/user/profile" class="btn btn-secondary">Cancel</a>
+        </form>
+    </div>
+    {{template "prt_footer.html" .}}
+    <script src="/js/jquery.min.js"></script>
+    <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
+    <script src="/js/custom.js"></script>
+</body>
+
+</html>

assets/tpl/user_index.html

@@ -15,7 +15,16 @@
     <div class="container mt-5">
         <h1>WireGuard VPN User-Portal</h1>
 
-        <h2 class="mt-4">Your VPN Profiles</h2>
+        <div class="mt-4 row">
+            <div class="col-sm-8 col-12">        
+                <h2 class="mt-2">Your VPN Profiles</h2>
+            </div>
+            <div class="col-sm-4 col-12 text-right">
+                {{if eq $.UserManagePeers true}}
+                <a href="/user/peer/create" title="Add a peer" class="btn btn-primary"><i class="fa fa-fw fa-plus"></i><i class="fa fa-fw fa-user"></i></a>
+                {{end}}
+            </div>
+        </div>
         <div class="mt-2 table-responsive">
             <table class="table table-sm" id="userTable">
                 <thead>
@@ -26,6 +35,9 @@
                     <th scope="col"><a href="?sort=mail">E-Mail <i class="fa fa-fw {{.Session.GetSortIcon "userpeers" "mail"}}"></i></a></th>
                     <th scope="col"><a href="?sort=ip">IP's <i class="fa fa-fw {{.Session.GetSortIcon "userpeers" "ip"}}"></i></a></th>
                     <th scope="col"><a href="?sort=handshake">Handshake <i class="fa fa-fw {{.Session.GetSortIcon "userpeers" "handshake"}}"></i></a></th>
+                    {{if eq $.UserManagePeers true}}
+                    <th scope="col"></th>
+                    {{end}}
                 </tr>
                 </thead>
                 <tbody>
@@ -37,11 +49,16 @@
                             <!-- online check -->
                             <span class="online-status" id="online-{{$p.UID}}" data-pkey="{{$p.PublicKey}}"><i class="fas fa-unlink"></i></span>
                         </th>
-                        <td>{{$p.Identifier}}</td>
+                        <td>{{$p.Identifier}}{{if $p.WillExpire}} <i class="fas fa-hourglass-end expiring-peer" data-toggle="tooltip" data-placement="right" title="" data-original-title="Expires at: {{formatDate $p.ExpiresAt}}"></i>{{end}}</td>
                         <td>{{$p.PublicKey}}</td>
                         <td>{{$p.Email}}</td>
                         <td>{{$p.IPsStr}}</td>
                         <td><span data-toggle="tooltip" data-placement="left" title="" data-original-title="{{$p.LastHandshakeTime}}">{{$p.LastHandshake}}</span></td>
+                        {{if eq $.UserManagePeers true}}
+                        <td>
+                            <a href="/user/peer/edit?pkey={{$p.PublicKey}}" title="Edit peer"><i class="fas fa-cog"></i></a>
+                        </td>
+                        {{end}}
                     </tr>
                     <tr class="hiddenRow">
                         <td colspan="6" class="hiddenCell" style="white-space:nowrap">
@@ -85,7 +102,13 @@
                                         <img class="list-image-large" src="/user/qrcode?pkey={{$p.PublicKey}}"/>
                                     </div>
                                     <div class="col-md-3">
-                                        <div class="float-right mt-5">
+                                        {{if $p.DeactivatedAt}}
+                                        <div class="pull-right-lg mt-lg-5 disabled-peer">Peer is disabled! <i class="fas fa-comment-dots" data-toggle="tooltip" data-placement="left" title="" data-original-title="Reason: {{$p.DeactivatedReason}}"></i></div>
+                                        {{end}}
+                                        {{if $p.WillExpire}}
+                                        <div class="pull-right-lg mt-lg-5 expiring-peer"><i class="fas fa-exclamation-triangle"></i> Profile expires on {{ formatDate $p.ExpiresAt}}</div>
+                                        {{end}}
+                                        <div class="pull-right-lg mt-lg-5 mt-md-3">
                                         <a href="/user/download?pkey={{$p.PublicKey}}" class="btn btn-primary" title="Download configuration">Download</a>
                                         <a href="/user/email?pkey={{$p.PublicKey}}" class="btn btn-primary" title="Send configuration via Email">Email</a>
                                         </div>
@@ -102,8 +125,10 @@
     </div>
     {{template "prt_footer.html" .}}
     <script src="/js/jquery.min.js"></script>
-    <script src="/js/bootstrap.bundle.min.js"></script>
     <script src="/js/jquery.easing.js"></script>
+    <script src="/js/popper.min.js"></script>
+    <script src="/js/bootstrap.bundle.min.js"></script>
+    <script src="/js/bootstrap-confirmation.min.js"></script>
     <script src="/js/custom.js"></script>
 </body>
 

cmd/hc/main.go

@@ -0,0 +1,35 @@
+// source taken from https://git.prolicht.digital/golib/healthcheck/-/blob/master/cmd/hc/main.go
+
+package main
+
+import (
+	"net/http"
+	"os"
+	"time"
+)
+
+// main checks the given URL, if the response is not 200, it will return with exit code 1
+// on success, exit code 0 will be returned
+func main() {
+	os.Exit(checkWebEndpointFromArgs())
+}
+
+func checkWebEndpointFromArgs() int {
+	if len(os.Args) < 2 {
+		return 1
+	}
+	if status := checkWebEndpoint(os.Args[1]); !status {
+		return 1
+	}
+	return 0
+}
+
+func checkWebEndpoint(url string) bool {
+	client := &http.Client{
+		Timeout: time.Second * 2,
+	}
+	if resp, err := client.Get(url); err != nil || resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return false
+	}
+	return true
+}

cmd/wg-portal/main.go

@@ -2,30 +2,34 @@ package main
 
 import (
 	"context"
-	"io/ioutil"
+	"io"
 	"os"
 	"os/signal"
+	"runtime"
 	"syscall"
 	"time"
 
+	"git.prolicht.digital/golib/healthcheck"
 	"github.com/h44z/wg-portal/internal/server"
 	"github.com/sirupsen/logrus"
 )
 
-var Version = "unknown (local build)"
-
 func main() {
 	_ = setupLogger(logrus.StandardLogger())
 
 	c := make(chan os.Signal, 1)
 	signal.Notify(c, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
 
-	logrus.Infof("starting WireGuard Portal Server [%s]...", Version)
+	logrus.Infof("sysinfo: os=%s, arch=%s", runtime.GOOS, runtime.GOARCH)
+	logrus.Infof("starting WireGuard Portal Server [%s]...", server.Version)
 
 	// Context for clean shutdown
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
+	// start health check service on port 11223
+	healthcheck.New(healthcheck.ListenOn(":11223")).StartWithContext(ctx)
+
 	service := server.Server{}
 	if err := service.Setup(ctx); err != nil {
 		logrus.Fatalf("setup failed: %v", err)
@@ -70,7 +74,7 @@ func setupLogger(logger *logrus.Logger) error {
 
 	switch level {
 	case "off":
-		logger.SetOutput(ioutil.Discard)
+		logger.SetOutput(io.Discard)
 	case "info":
 		logger.SetLevel(logrus.InfoLevel)
 	case "debug":

docker-compose.yml

@@ -1,9 +1,13 @@
 version: '3.6'
 services:
   wg-portal:
-    image: h44z/wg-portal:latest
+    image: h44z/wg-portal:1.0.16
     container_name: wg-portal
     restart: unless-stopped
+    logging:
+      options:
+        max-size: "10m"
+        max-file: "3"
     cap_add:
       - NET_ADMIN
     network_mode: "host"

go.mod

@@ -3,24 +3,39 @@ module github.com/h44z/wg-portal
 go 1.16
 
 require (
-	github.com/gin-contrib/sessions v0.0.3
+	git.prolicht.digital/golib/healthcheck v1.1.1
-	github.com/gin-gonic/gin v1.6.3
+	github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5 // indirect
-	github.com/go-ldap/ldap/v3 v3.2.4
+	github.com/evanphx/json-patch v0.5.2
-	github.com/go-playground/validator/v10 v10.4.1
+	github.com/gin-contrib/sessions v0.0.5
-	github.com/gorilla/sessions v1.2.1 // indirect
+	github.com/gin-gonic/gin v1.7.7
-	github.com/jordan-wright/email v4.0.1-0.20200917010138-e1c00e156980+incompatible
+	github.com/go-ldap/ldap/v3 v3.4.3
+	github.com/go-openapi/spec v0.20.6 // indirect
+	github.com/go-openapi/swag v0.21.1 // indirect
+	github.com/go-playground/validator/v10 v10.11.0
+	github.com/go-test/deep v1.0.8 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
 	github.com/milosgajdos/tenus v0.0.3
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.8.1
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
+	github.com/swaggo/gin-swagger v1.4.3
+	github.com/swaggo/swag v1.8.2
 	github.com/tatsushid/go-fastping v0.0.0-20160109021039-d7bb493dee3e
 	github.com/toorop/gin-logrus v0.0.0-20210225092905-2c785434f26f
 	github.com/utrack/gin-csrf v0.0.0-20190424104817-40fb8d2c8fca
-	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2
+	github.com/xhit/go-simple-mail/v2 v2.11.0
-	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20200609130330-bd2cb7843e1b
+	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+	golang.org/x/net v0.0.0-20220526153639-5463443f8c37 // indirect
-	gorm.io/driver/mysql v1.0.5
+	golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 // indirect
-	gorm.io/driver/sqlite v1.1.4
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220504211119-3d4a969bb56b
-	gorm.io/gorm v1.21.6
+	google.golang.org/protobuf v1.28.0 // indirect
+	gopkg.in/yaml.v3 v3.0.0
+	gorm.io/driver/mysql v1.4.3
+	gorm.io/driver/sqlite v1.4.3
+	gorm.io/gorm v1.24.0
 )

go.sum

@@ -0,0 +1,467 @@
+git.prolicht.digital/golib/healthcheck v1.1.1 h1:bdx0MuGqAq0PCooPpiuPXsr4/Ok+yfJwq8P9ITq2eLI=
+git.prolicht.digital/golib/healthcheck v1.1.1/go.mod h1:wEqVrqHJ8NsSx5qlFGUlw74wJ/wDSKaA34QoyvsEkdc=
+github.com/Azure/go-ntlmssp v0.0.0-20211209120228-48547f28849e h1:ZU22z/2YRFLyf/P4ZwUYSdNCWsMEI0VeyrFoI2rAhJQ=
+github.com/Azure/go-ntlmssp v0.0.0-20211209120228-48547f28849e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
+github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/agiledragon/gomonkey/v2 v2.3.1/go.mod h1:ap1AmDzcVOAz1YpeJ3TCzIgstoaWLA6jbbgxfB4w2iY=
+github.com/antonlindstrom/pgstore v0.0.0-20200229204646-b08ebf1105e0/go.mod h1:2Ti6VUHVxpC0VSmTZzEvpzysnaGAfGBOoMIz5ykPyyw=
+github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff/go.mod h1:+RTT1BOk5P97fT2CiHkbFQwkK3mjsFAP6zCYV2aXtjw=
+github.com/bos-hieu/mongostore v0.0.2/go.mod h1:8AbbVmDEb0yqJsBrWxZIAZOxIfv/tsP8CDtdHduZHGg=
+github.com/bradfitz/gomemcache v0.0.0-20180710155616-bc664df96737/go.mod h1:PmM6Mmwb0LSuEubjR8N7PtNe1KxZLtOUHtbeikc5h60=
+github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b/go.mod h1:H0wQNHz2YrLsuXOZozoeDmnHXkNCRmMW0gwFWDfEZDA=
+github.com/bradleypeabody/gorilla-sessions-memcache v0.0.0-20181103040241-659414f458e1/go.mod h1:dkChI7Tbtx7H1Tj7TqGSZMOeGpMP5gLHtjroHd4agiI=
+github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dchest/uniuri v0.0.0-20160212164326-8902c56451e9/go.mod h1:GgB8SF9nRG+GqaDtLcwJZsQFhcogVCJ79j4EdT0c2V4=
+github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5 h1:RAV05c0xOkJ3dZGS0JFybxFKZ2WMLabgx3uXnd7rpGs=
+github.com/dchest/uniuri v0.0.0-20200228104902-7aecb25e1fe5/go.mod h1:GgB8SF9nRG+GqaDtLcwJZsQFhcogVCJ79j4EdT0c2V4=
+github.com/docker/libcontainer v2.2.1+incompatible h1:++SbbkCw+X8vAd4j2gOCzZ2Nn7s2xFALTf7LZKmM1/0=
+github.com/docker/libcontainer v2.2.1+incompatible/go.mod h1:osvj61pYsqhNCMLGX31xr7klUBhHb/ZBuXS0o1Fvwbw=
+github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
+github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
+github.com/garyburd/redigo v1.6.0/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gin-contrib/gzip v0.0.5 h1:mhnVU32YnnBh2LPH2iqRqsA/eR7SAqRaD388jL2s/j0=
+github.com/gin-contrib/gzip v0.0.5/go.mod h1:OPIK6HR0Um2vNmBUTlayD7qle4yVVRZT0PyhdUigrKk=
+github.com/gin-contrib/sessions v0.0.0-20190101140330-dc5246754963/go.mod h1:4lkInX8nHSR62NSmhXM3xtPeMSyfiR58NaEz+om1lHM=
+github.com/gin-contrib/sessions v0.0.5 h1:CATtfHmLMQrMNpJRgzjWXD7worTh7g7ritsQfmF+0jE=
+github.com/gin-contrib/sessions v0.0.5/go.mod h1:vYAuaUPqie3WUSsft6HUlCjlwwoJQs97miaG2+7neKY=
+github.com/gin-contrib/sse v0.0.0-20170109093832-22d885f9ecc7/go.mod h1:VJ0WA2NBN22VlZ2dKZQPAPnyWw5XTlK1KymzLKsr59s=
+github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-gonic/gin v1.3.0/go.mod h1:7cKuhb5qV2ggCFctp2fJQ+ErvciLZrIeoOSOm6mUr7Y=
+github.com/gin-gonic/gin v1.7.4/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY=
+github.com/gin-gonic/gin v1.7.7 h1:3DoBmSbJbZAWqXJC3SLjAPfutPJJRN1U5pALB7EeTTs=
+github.com/gin-gonic/gin v1.7.7/go.mod h1:axIBovoeJpVj8S3BwE0uPMTeReE4+AfFtqpqaZ1qq1U=
+github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
+github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
+github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-ldap/ldap/v3 v3.4.3 h1:JCKUtJPIcyOuG7ctGabLKMgIlKnGumD/iGjuWeEruDI=
+github.com/go-ldap/ldap/v3 v3.4.3/go.mod h1:7LdHfVt6iIOESVEe3Bs4Jp2sHEKgDeduAhgM1/f9qmo=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
+github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
+github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
+github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
+github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
+github.com/go-openapi/spec v0.20.6 h1:ich1RQ3WDbfoeTqTAb+5EIxNmpKVJZWBNah9RAT0jIQ=
+github.com/go-openapi/spec v0.20.6/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-openapi/swag v0.21.1 h1:wm0rhTb5z7qpJRHBdPOMuY4QjVUMbF6/kwoYeRAOrKU=
+github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBYNjji3q3A=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
+github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
+github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
+github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
+github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/jYrnRPArHwAcmLoJZxyho=
+github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
+github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
+github.com/go-playground/validator/v10 v10.11.0 h1:0W+xRM511GY47Yy3bZUbJVitCNg2BOGlCyvTqsp/xIw=
+github.com/go-playground/validator/v10 v10.11.0/go.mod h1:i+3WkQ1FvaUjjxh1kSvIA4dMGDBiPU55YFDl0WbKdWU=
+github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
+github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/gomodule/redigo v2.0.0+incompatible/go.mod h1:B4C85qUVwatsJoIUNIfCRsp7qO0iAmpGFZ4EELWSbC4=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
+github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.1.1/go.mod h1:8KCfur6+4Mqcc6S0FEfKuN15Vl5MgXW92AE8ovaJD0w=
+github.com/gorilla/sessions v1.1.3/go.mod h1:8KCfur6+4Mqcc6S0FEfKuN15Vl5MgXW92AE8ovaJD0w=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
+github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
+github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
+github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
+github.com/jackc/pgconn v1.4.0/go.mod h1:Y2O3ZDF0q4mMacyWV3AstPJpeHXWGEetiFttmq5lahk=
+github.com/jackc/pgconn v1.5.0/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
+github.com/jackc/pgconn v1.5.1-0.20200601181101-fa742c524853/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
+github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
+github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
+github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
+github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.0.7/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
+github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
+github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
+github.com/jackc/pgtype v1.2.0/go.mod h1:5m2OfMh1wTK7x+Fk952IDmI4nw3nPrvtQdM0ZT4WpC0=
+github.com/jackc/pgtype v1.3.1-0.20200510190516-8cd94a14c75a/go.mod h1:vaogEUkALtxZMCH411K+tKzNpwzCKU+AnPzBKZ+I+Po=
+github.com/jackc/pgtype v1.3.1-0.20200606141011-f6355165a91c/go.mod h1:cvk9Bgu/VzJ9/lxTO5R5sf80p0DiucVtN7ZxvaC4GmQ=
+github.com/jackc/pgtype v1.6.2/go.mod h1:JCULISAZBFGrHaOXIIFiyfzW5VY0GRitRr8NeJsrdig=
+github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
+github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
+github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
+github.com/jackc/pgx/v4 v4.5.0/go.mod h1:EpAKPLdnTorwmPUUsqrPxy5fphV18j9q3wrfRXgo+kA=
+github.com/jackc/pgx/v4 v4.6.1-0.20200510190926-94ba730bb1e9/go.mod h1:t3/cdRQl6fOLDxqtlyhe9UWgfIi9R8+8v8GKV5TRA/o=
+github.com/jackc/pgx/v4 v4.6.1-0.20200606145419-4e5062306904/go.mod h1:ZDaNWkt9sW1JMiNn0kdYBaLelIhw7Pg4qd+Vk6tw7Hg=
+github.com/jackc/pgx/v4 v4.10.1/go.mod h1:QlrWebbs3kqEZPHCTGyxecvzG6tvIsYu+A5b1raylkA=
+github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/josharian/native v1.0.0 h1:Ts/E8zCSEsG17dUqv7joXJFybuMLjQfWE04tsBODTxk=
+github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
+github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
+github.com/kidstuff/mongostore v0.0.0-20181113001930-e650cd85ee4b/go.mod h1:g2nVr8KZVXJSS97Jo8pJ0jgq29P6H7dG0oplUA86MQw=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
+github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
+github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
+github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.9.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.3/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
+github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-sqlite3 v1.14.5/go.mod h1:WVKg1VTActs4Qso6iwGbiFih2UIHo0ENGwNd0Lj+XmI=
+github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-sqlite3 v2.0.3+incompatible h1:gXHsfypPkaMZrKbD5209QV9jbUTJKjyR5WD3HYQSd+U=
+github.com/mattn/go-sqlite3 v2.0.3+incompatible/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
+github.com/mdlayher/genetlink v1.2.0 h1:4yrIkRV5Wfk1WfpWTcoOlGmsWgQj3OtQN9ZsbrE+XtU=
+github.com/mdlayher/genetlink v1.2.0/go.mod h1:ra5LDov2KrUCZJiAtEvXXZBxGMInICMXIwshlJ+qRxQ=
+github.com/mdlayher/netlink v1.6.0 h1:rOHX5yl7qnlpiVkFWoqccueppMtXzeziFjWAjLg6sz0=
+github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA=
+github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
+github.com/mdlayher/socket v0.2.3 h1:XZA2X2TjdOwNoNPVPclRCURoX/hokBY8nkTmRZFEheM=
+github.com/mdlayher/socket v0.2.3/go.mod h1:bz12/FozYNH/VbvC3q7TRIK/Y6dH1kCKsXaUeXi/FmY=
+github.com/memcachier/mc v2.0.1+incompatible/go.mod h1:7bkvFE61leUBvXz+yxsOnGBQSZpBSPIMUQSmmSHvuXc=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
+github.com/milosgajdos/tenus v0.0.3 h1:jmaJzwaY1DUyYVD0lM4U+uvP2kkEg1VahDqRFxIkVBE=
+github.com/milosgajdos/tenus v0.0.3/go.mod h1:eIjx29vNeDOYWJuCnaHY2r4fq5egetV26ry3on7p8qY=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/otiai10/copy v1.7.0/go.mod h1:rmRl6QPdJj6EiUqXQ/4Nn2lLXoNQjFCQbbNrxgc/t3U=
+github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
+github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
+github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
+github.com/otiai10/mint v1.3.3/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quasoft/memstore v0.0.0-20180925164028-84a050167438/go.mod h1:wTPjTepVu7uJBYgZ0SdWHQlIas582j6cn2jgk4DDdlg=
+github.com/quasoft/memstore v0.0.0-20191010062613-2bce066d2b0b h1:aUNXCGgukb4gtY99imuIeoh8Vr0GSwAlYxPAhqZrpFc=
+github.com/quasoft/memstore v0.0.0-20191010062613-2bce066d2b0b/go.mod h1:wTPjTepVu7uJBYgZ0SdWHQlIas582j6cn2jgk4DDdlg=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
+github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
+github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
+github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
+github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
+github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
+github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/swaggo/files v0.0.0-20210815190702-a29dd2bc99b2/go.mod h1:lKJPbtWzJ9JhsTN1k1gZgleJWY/cqq0psdoMmaThG3w=
+github.com/swaggo/gin-swagger v1.4.3 h1:mHJz+yzJne0udgYnC5qlDf4e7KuxUbVNX2dhD/cw2rU=
+github.com/swaggo/gin-swagger v1.4.3/go.mod h1:hBg6tGeKJsUu/P79BH+WGUR8nq2LuGE0O160+s4iefo=
+github.com/swaggo/swag v1.8.1/go.mod h1:ugemnJsPZm/kRwFUnzBlbHRd0JY9zE1M4F+uy2pAaPQ=
+github.com/swaggo/swag v1.8.2 h1:D4aBiVS2a65zhyk3WFqOUz7Rz0sOaUcgeErcid5uGL4=
+github.com/swaggo/swag v1.8.2/go.mod h1:jMLeXOOmYyjk8PvHTsXBdrubsNd9gUJTTCzL5iBnseg=
+github.com/tatsushid/go-fastping v0.0.0-20160109021039-d7bb493dee3e h1:nt2877sKfojlHCTOBXbpWjBkuWKritFaGIfgQwbQUls=
+github.com/tatsushid/go-fastping v0.0.0-20160109021039-d7bb493dee3e/go.mod h1:B4+Kq1u5FlULTjFSM707Q6e/cOHFv0z/6QRoxubDIQ8=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/toorop/gin-logrus v0.0.0-20210225092905-2c785434f26f h1:oqdnd6OGlOUu1InG37hWcCB3a+Jy3fwjylyVboaNMwY=
+github.com/toorop/gin-logrus v0.0.0-20210225092905-2c785434f26f/go.mod h1:X3Dd1SB8Gt1V968NTzpKFjMM6O8ccta2NPC6MprOxZQ=
+github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208 h1:PM5hJF7HVfNWmCjMdEfbuOBNXSVF2cMFGgQTPdKCbwM=
+github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208/go.mod h1:BzWtXXrXzZUvMacR0oF/fbDDgUPO8L36tDMmRAf14ns=
+github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
+github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
+github.com/ugorji/go/codec v0.0.0-20181209151446-772ced7fd4c2/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
+github.com/ugorji/go/codec v1.1.7 h1:2SvQaVZ1ouYrrKKwoSk2pzd4A9evlKJb9oTL+OaLUSs=
+github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
+github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
+github.com/utrack/gin-csrf v0.0.0-20190424104817-40fb8d2c8fca h1:lpvAjPK+PcxnbcB8H7axIb4fMNwjX9bE4DzwPjGg8aE=
+github.com/utrack/gin-csrf v0.0.0-20190424104817-40fb8d2c8fca/go.mod h1:XXKxNbpoLihvvT7orUZbs/iZayg1n4ip7iJakJPAwA8=
+github.com/wader/gormstore/v2 v2.0.0/go.mod h1:3BgNKFxRdVo2E4pq3e/eiim8qRDZzaveaIcIvu2T8r0=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
+github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
+github.com/xhit/go-simple-mail/v2 v2.11.0 h1:o/056V50zfkO3Mm5tVdo9rG3ryg4ZmJ2XW5GMinHfVs=
+github.com/xhit/go-simple-mail/v2 v2.11.0/go.mod h1:b7P5ygho6SYE+VIqpxA6QkYfv4teeyG4MKqB3utRu98=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
+go.mongodb.org/mongo-driver v1.9.0/go.mod h1:0sQWfOeY63QTntERDJJ/0SuKK0T1uVSgKCuAROlKEPY=
+go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e h1:T8NU3HyQ8ClP4SEE+KbFlg6n0NhuTsN4MyznaarGsZM=
+golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 h1:kQgndtyPBW/JIYERgdxfwMYh3AVStj88WQTlNDi2a+o=
+golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
+golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220418201149-a630d4f3e7a2/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220526153639-5463443f8c37 h1:lUkvobShwKsOesNfWWlCS5q7fnbG1MEliIzwu886fn8=
+golang.org/x/net v0.0.0-20220526153639-5463443f8c37/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 h1:w8s32wxx3sY+OjLlv9qltkLU5yvJzxjjgiHWLjdIcw4=
+golang.org/x/sync v0.0.0-20220513210516-0976fa681c29/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181228144115-9a3f9b0469bb/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210420072515-93ed5bcd2bfe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211103235746-7861aae1554b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a h1:dGzPydgVsqGcTRVwiLJ1jVbufYwmzD3LfVPLKsKg+0k=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190531172133-b3315ee88b7d/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo=
+golang.org/x/tools v0.1.10 h1:QjFRCZxdOhBJ/UNgnBZLbNV13DlbnK0quyivTnXJM20=
+golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
+golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20220407013110-ef5c587f782d h1:q4JksJ2n0fmbXC0Aj0eOs6E0AcPqnKglxWXWFqGD6x0=
+golang.zx2c4.com/wireguard v0.0.0-20220407013110-ef5c587f782d/go.mod h1:bVQfyl2sCM/QIIGHpWbFGfHPuDvqnCNkT6MQLTCjO/U=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220504211119-3d4a969bb56b h1:9JncmKXcUwE918my+H6xmjBdhK2jM/UTUNXxhRG1BAk=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220504211119-3d4a969bb56b/go.mod h1:yp4gl6zOlnDGOZeWeDfMwQcsdOIQnMdhuPx9mwwWBL4=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
+gopkg.in/go-playground/validator.v8 v8.18.2/go.mod h1:RX2a/7Ha8BgOhfk7j780h4/u/RRjR0eouCJSH80/M2Y=
+gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
+gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0 h1:hjy8E9ON/egN1tAYqKb61G10WtihqetD4sz2H+8nIeA=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/mysql v1.0.4/go.mod h1:MEgp8tk2n60cSBCq5iTcPDw3ns8Gs+zOva9EUhkknTs=
+gorm.io/driver/mysql v1.4.3 h1:/JhWJhO2v17d8hjApTltKNADm7K7YI2ogkR7avJUL3k=
+gorm.io/driver/mysql v1.4.3/go.mod h1:sSIebwZAVPiT+27jK9HIwvsqOGKx3YMPmrA3mBJR10c=
+gorm.io/driver/postgres v1.0.8/go.mod h1:4eOzrI1MUfm6ObJU/UcmbXyiHSs8jSwH95G5P5dxcAg=
+gorm.io/driver/sqlite v1.1.4/go.mod h1:mJCeTFr7+crvS+TRnWc5Z3UvwxUN1BGBLMrf5LA9DYw=
+gorm.io/driver/sqlite v1.4.3 h1:HBBcZSDnWi5BW3B3rwvVTc510KGkBkexlOg0QrmLUuU=
+gorm.io/driver/sqlite v1.4.3/go.mod h1:0Aq3iPO+v9ZKbcdiz8gLWRw5VOPcBOPUQJFLq5e2ecI=
+gorm.io/gorm v1.20.7/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
+gorm.io/gorm v1.20.12/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
+gorm.io/gorm v1.23.8/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.24.0 h1:j/CoiSm6xpRpmzbFJsQHYj+I8bGYWLXVHeYEyyKlF74=
+gorm.io/gorm v1.24.0/go.mod h1:DVrVomtaYTbqs7gB/x2uVvqnXzv0nqjB396B8cG4dBA=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=

hooks/build

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# File needs to be called /hooks/build relative to the Dockerfile.
+# Some environment variables are injected into the build hook, see: https://docs.docker.com/docker-hub/builds/advanced/.
+
+GIT_SHORT_HASH=$(echo $SOURCE_COMMIT | cut -c1-7)
+echo "Build hook running for git hash $GIT_SHORT_HASH"
+docker build --build-arg BUILD_IDENTIFIER=$DOCKER_TAG \
+             --build-arg BUILD_VERSION=$GIT_SHORT_HASH \
+             -t $IMAGE_NAME .

internal/authentication/providers/ldap/provider.go

@@ -2,7 +2,7 @@ package ldap
 
 import (
 	"crypto/tls"
-	"fmt"
+	"os"
 	"strings"
 
 	"github.com/gin-gonic/gin"
@@ -48,8 +48,8 @@ func (Provider) GetPriority() int {
 	return 1 // LDAP password provider
 }
 
-func (provider Provider) SetupRoutes(routes *gin.RouterGroup) {
+func (provider Provider) SetupRoutes(_ *gin.RouterGroup) {
-	// nothing todo here
+	// nothing here
 }
 
 func (provider Provider) Login(ctx *authentication.AuthContext) (string, error) {
@@ -69,13 +69,11 @@ func (provider Provider) Login(ctx *authentication.AuthContext) (string, error)
 
 	// Search for the given username
 	attrs := []string{"dn", provider.config.EmailAttribute}
-	if provider.config.DisabledAttribute != "" {
+	loginFilter := strings.Replace(provider.config.LoginFilter, "{{login_identifier}}", username, -1)
-		attrs = append(attrs, provider.config.DisabledAttribute)
-	}
 	searchRequest := ldap.NewSearchRequest(
 		provider.config.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(&(objectClass=%s)(%s=%s))", provider.config.UserClass, provider.config.EmailAttribute, username),
+		loginFilter,
 		attrs,
 		nil,
 	)
@@ -89,24 +87,8 @@ func (provider Provider) Login(ctx *authentication.AuthContext) (string, error)
 		return "", errors.Errorf("invalid amount of ldap entries (%d)", len(sr.Entries))
 	}
 
-	userDN := sr.Entries[0].DN
-
-	// Check if user is disabled, if so deny login
-	if provider.config.DisabledAttribute != "" {
-		uac := sr.Entries[0].GetAttributeValue(provider.config.DisabledAttribute)
-		switch provider.config.Type {
-		case ldapconfig.TypeActiveDirectory:
-			if ldapconfig.IsActiveDirectoryUserDisabled(uac) {
-				return "", errors.New("user is disabled")
-			}
-		case ldapconfig.TypeOpenLDAP:
-			if ldapconfig.IsOpenLdapUserDisabled(uac) {
-				return "", errors.New("user is disabled")
-			}
-		}
-	}
-
 	// Bind as the user to verify their password
+	userDN := sr.Entries[0].DN
 	err = client.Bind(userDN, password)
 	if err != nil {
 		return "", errors.Wrapf(err, "invalid credentials")
@@ -115,8 +97,8 @@ func (provider Provider) Login(ctx *authentication.AuthContext) (string, error)
 	return sr.Entries[0].GetAttributeValue(provider.config.EmailAttribute), nil
 }
 
-func (provider Provider) Logout(context *authentication.AuthContext) error {
+func (provider Provider) Logout(_ *authentication.AuthContext) error {
-	return nil // nothing todo here
+	return nil // nothing here
 }
 
 func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authentication.User, error) {
@@ -136,13 +118,11 @@ func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authent
 	// Search for the given username
 	attrs := []string{"dn", provider.config.EmailAttribute, provider.config.FirstNameAttribute, provider.config.LastNameAttribute,
 		provider.config.PhoneAttribute, provider.config.GroupMemberAttribute}
-	if provider.config.DisabledAttribute != "" {
+	loginFilter := strings.Replace(provider.config.LoginFilter, "{{login_identifier}}", username, -1)
-		attrs = append(attrs, provider.config.DisabledAttribute)
-	}
 	searchRequest := ldap.NewSearchRequest(
 		provider.config.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(&(objectClass=%s)(%s=%s))", provider.config.UserClass, provider.config.EmailAttribute, username),
+		loginFilter,
 		attrs,
 		nil,
 	)
@@ -175,22 +155,49 @@ func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authent
 }
 
 func (provider Provider) open() (*ldap.Conn, error) {
-	conn, err := ldap.DialURL(provider.config.URL)
+	var tlsConfig *tls.Config
+
+	if provider.config.LdapCertConn {
+
+		certPlain, err := os.ReadFile(provider.config.LdapTlsCert)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed to load the certificate")
+
+		}
+
+		key, err := os.ReadFile(provider.config.LdapTlsKey)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed to load the key")
+		}
+
+		certX509, err := tls.X509KeyPair(certPlain, key)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed X509")
+
+		}
+		tlsConfig = &tls.Config{Certificates: []tls.Certificate{certX509}}
+
+	} else {
+
+		tlsConfig = &tls.Config{InsecureSkipVerify: !provider.config.CertValidation}
+	}
+
+	conn, err := ldap.DialURL(provider.config.URL, ldap.DialWithTLSConfig(tlsConfig))
 	if err != nil {
-		return nil, err
+		return nil, errors.WithMessage(err, "failed to connect to LDAP")
 	}
 
 	if provider.config.StartTLS {
 		// Reconnect with TLS
-		err = conn.StartTLS(&tls.Config{InsecureSkipVerify: !provider.config.CertValidation})
+		err = conn.StartTLS(tlsConfig)
 		if err != nil {
-			return nil, err
+			return nil, errors.WithMessage(err, "failed to start TLS session")
 		}
 	}
 
 	err = conn.Bind(provider.config.BindUser, provider.config.BindPass)
 	if err != nil {
-		return nil, err
+		return nil, errors.WithMessage(err, "failed to bind user")
 	}
 
 	return conn, nil

internal/authentication/providers/password/provider.go

@@ -7,10 +7,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/h44z/wg-portal/internal/common"
-
 	"github.com/gin-gonic/gin"
 	"github.com/h44z/wg-portal/internal/authentication"
+	"github.com/h44z/wg-portal/internal/common"
 	"github.com/h44z/wg-portal/internal/users"
 	"github.com/pkg/errors"
 	"golang.org/x/crypto/bcrypt"
@@ -51,8 +50,8 @@ func (Provider) GetPriority() int {
 	return 0 // DB password provider = highest prio
 }
 
-func (provider Provider) SetupRoutes(routes *gin.RouterGroup) {
+func (provider Provider) SetupRoutes(_ *gin.RouterGroup) {
-	// nothing todo here
+	// nothing here
 }
 
 func (provider Provider) Login(ctx *authentication.AuthContext) (string, error) {
@@ -80,8 +79,8 @@ func (provider Provider) Login(ctx *authentication.AuthContext) (string, error)
 	return user.Email, nil
 }
 
-func (provider Provider) Logout(context *authentication.AuthContext) error {
+func (provider Provider) Logout(_ *authentication.AuthContext) error {
-	return nil // nothing todo here
+	return nil // nothing here
 }
 
 func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authentication.User, error) {
@@ -109,6 +108,7 @@ func (provider Provider) GetUserModel(ctx *authentication.AuthContext) (*authent
 }
 
 func (provider Provider) InitializeAdmin(email, password string) error {
+	email = strings.ToLower(email)
 	if !emailRegex.MatchString(email) {
 		return errors.New("admin username must be an email address")
 	}
@@ -136,7 +136,7 @@ func (provider Provider) InitializeAdmin(email, password string) error {
 		}
 
 		admin.Email = email
-		admin.Password = string(hashedPassword)
+		admin.Password = users.PrivateString(hashedPassword)
 		admin.Firstname = "WireGuard"
 		admin.Lastname = "Administrator"
 		admin.CreatedAt = time.Now()
@@ -170,7 +170,7 @@ func (provider Provider) InitializeAdmin(email, password string) error {
 			return errors.Wrap(err, "failed to hash admin password")
 		}
 
-		admin.Password = string(hashedPassword)
+		admin.Password = users.PrivateString(hashedPassword)
 		admin.IsAdmin = true
 		admin.UpdatedAt = time.Now()
 

internal/common/db.go

@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
+	"strings"
 	"time"
 
 	"github.com/pkg/errors"
@@ -14,6 +16,63 @@ import (
 	"gorm.io/gorm/logger"
 )
 
+func init() {
+	migrations = append(migrations, Migration{
+		version: "1.0.7",
+		migrateFn: func(db *gorm.DB) error {
+			if err := db.Exec("UPDATE users SET email = LOWER(email)").Error; err != nil {
+				return errors.Wrap(err, "failed to convert user emails to lower case")
+			}
+			if err := db.Exec("UPDATE peers SET email = LOWER(email)").Error; err != nil {
+				return errors.Wrap(err, "failed to convert peer emails to lower case")
+			}
+			logrus.Infof("upgraded database format to version 1.0.7")
+			return nil
+		},
+	})
+	migrations = append(migrations, Migration{
+		version: "1.0.8",
+		migrateFn: func(db *gorm.DB) error {
+			logrus.Infof("upgraded database format to version 1.0.8")
+			return nil
+		},
+	})
+
+	migrations = append(migrations, Migration{
+		version: "1.0.9",
+		migrateFn: func(db *gorm.DB) error {
+			if db.Dialector.Name() != (sqlite.Dialector{}).Name() {
+				logrus.Infof("upgraded database format to version 1.0.9")
+				return nil // only perform migration for sqlite
+			}
+
+			type sqlIndex struct {
+				Name  string `gorm:"column:name"`
+				Table string `gorm:"column:tbl_name"`
+			}
+			var indices []sqlIndex
+			if err := db.Raw("SELECT name, tbl_name FROM sqlite_master WHERE type == 'index'").Scan(&indices).Error; err != nil {
+				return errors.Wrap(err, "failed to fetch indices")
+			}
+
+			for _, index := range indices {
+				if index.Table != "devices" && index.Table != "peers" && index.Table != "users" {
+					continue
+				}
+				if strings.Contains(index.Name, "autoindex") {
+					continue
+				}
+				if err := db.Exec("DROP INDEX " + index.Name).Error; err != nil {
+					return errors.Wrap(err, "failed to drop index "+index.Name)
+				}
+			}
+
+			logrus.Infof("upgraded database format to version 1.0.9")
+			return nil
+		},
+	})
+}
+
 type SupportedDatabase string
 
 const (
@@ -80,16 +139,18 @@ type DatabaseMigrationInfo struct {
 	Applied time.Time
 }
 
+type Migration struct {
+	version   string
+	migrateFn func(db *gorm.DB) error
+}
+
+var migrations []Migration
+
 func MigrateDatabase(db *gorm.DB, version string) error {
 	if err := db.AutoMigrate(&DatabaseMigrationInfo{}); err != nil {
 		return errors.Wrap(err, "failed to migrate version database")
 	}
 
-	newVersion := DatabaseMigrationInfo{
-		Version: version,
-		Applied: time.Now(),
-	}
-
 	existingMigration := DatabaseMigrationInfo{}
 	db.Where("version = ?", version).FirstOrInit(&existingMigration)
 
@@ -97,11 +158,36 @@ func MigrateDatabase(db *gorm.DB, version string) error {
 		lastVersion := DatabaseMigrationInfo{}
 		db.Order("applied desc, version desc").FirstOrInit(&lastVersion)
 
-		// TODO: migrate database
+		if lastVersion.Version == "" {
+			// fresh database, no migrations to apply
+			res := db.Create(&DatabaseMigrationInfo{
+				Version: version,
+				Applied: time.Now(),
+			})
+			if res.Error != nil {
+				return errors.Wrapf(res.Error, "failed to write version %s to database", version)
+			}
+			return nil
+		}
 
-		res := db.Create(&newVersion)
+		sort.Slice(migrations, func(i, j int) bool {
-		if res.Error != nil {
+			return migrations[i].version < migrations[j].version
-			return errors.Wrap(res.Error, "failed to write version to database")
+		})
+
+		for _, migration := range migrations {
+			if migration.version > lastVersion.Version {
+				if err := migration.migrateFn(db); err != nil {
+					return errors.Wrapf(err, "failed to migrate to version %s", migration.version)
+				}
+
+				res := db.Create(&DatabaseMigrationInfo{
+					Version: migration.version,
+					Applied: time.Now(),
+				})
+				if res.Error != nil {
+					return errors.Wrapf(res.Error, "failed to write version %s to database", migration.version)
+				}
+			}
 		}
 	}
 

internal/common/email.go

@@ -3,20 +3,37 @@ package common
 import (
 	"crypto/tls"
 	"io"
-	"net/smtp"
+	"time"
-	"strconv"
-	"strings"
 
-	"github.com/jordan-wright/email"
+	"github.com/pkg/errors"
+	mail "github.com/xhit/go-simple-mail/v2"
+)
+
+type MailEncryption string
+
+const (
+	MailEncryptionNone     MailEncryption = "none"
+	MailEncryptionTLS      MailEncryption = "tls"
+	MailEncryptionStartTLS MailEncryption = "starttls"
+)
+
+type MailAuthType string
+
+const (
+	MailAuthPlain   MailAuthType = "plain"
+	MailAuthLogin   MailAuthType = "login"
+	MailAuthCramMD5 MailAuthType = "crammd5"
 )
 
 type MailConfig struct {
-	Host           string `yaml:"host" envconfig:"EMAIL_HOST"`
+	Host           string         `yaml:"host" envconfig:"EMAIL_HOST"`
-	Port           int    `yaml:"port" envconfig:"EMAIL_PORT"`
+	Port           int            `yaml:"port" envconfig:"EMAIL_PORT"`
-	TLS            bool   `yaml:"tls" envconfig:"EMAIL_TLS"`
+	TLS            bool           `yaml:"tls" envconfig:"EMAIL_TLS"` // Deprecated, use MailConfig.Encryption instead.
-	CertValidation bool   `yaml:"certcheck" envconfig:"EMAIL_CERT_VALIDATION"`
+	Encryption     MailEncryption `yaml:"encryption" envconfig:"EMAIL_ENCRYPTION"`
-	Username       string `yaml:"user" envconfig:"EMAIL_USERNAME"`
+	CertValidation bool           `yaml:"certcheck" envconfig:"EMAIL_CERT_VALIDATION"`
-	Password       string `yaml:"pass" envconfig:"EMAIL_PASSWORD"`
+	Username       string         `yaml:"user" envconfig:"EMAIL_USERNAME"`
+	Password       string         `yaml:"pass" envconfig:"EMAIL_PASSWORD"`
+	AuthType       MailAuthType   `yaml:"auth" envconfig:"EMAIL_AUTHTYPE"`
 }
 
 type MailAttachment struct {
@@ -27,53 +44,73 @@ type MailAttachment struct {
 }
 
 // SendEmailWithAttachments sends a mail with optional attachments.
-func SendEmailWithAttachments(cfg MailConfig, sender, replyTo, subject, body string, htmlBody string, receivers []string, attachments []MailAttachment) error {
+func SendEmailWithAttachments(cfg MailConfig, sender, replyTo, subject, body, htmlBody string, receivers []string, attachments []MailAttachment) error {
-	e := email.NewEmail()
+	srv := mail.NewSMTPClient()
+
+	srv.ConnectTimeout = 30 * time.Second
+	srv.SendTimeout = 30 * time.Second
+	srv.Host = cfg.Host
+	srv.Port = cfg.Port
+	srv.Username = cfg.Username
+	srv.Password = cfg.Password
+
+	// TODO: remove this once the deprecated MailConfig.TLS config option has been removed
+	if cfg.TLS {
+		cfg.Encryption = MailEncryptionStartTLS
+	}
+	switch cfg.Encryption {
+	case MailEncryptionTLS:
+		srv.Encryption = mail.EncryptionSSLTLS
+	case MailEncryptionStartTLS:
+		srv.Encryption = mail.EncryptionSTARTTLS
+	default: // MailEncryptionNone
+		srv.Encryption = mail.EncryptionNone
+	}
+	srv.TLSConfig = &tls.Config{ServerName: srv.Host, InsecureSkipVerify: !cfg.CertValidation}
+	switch cfg.AuthType {
+	case MailAuthPlain:
+		srv.Authentication = mail.AuthPlain
+	case MailAuthLogin:
+		srv.Authentication = mail.AuthLogin
+	case MailAuthCramMD5:
+		srv.Authentication = mail.AuthCRAMMD5
+	}
+
+	client, err := srv.Connect()
+	if err != nil {
+		return errors.Wrap(err, "failed to connect via SMTP")
+	}
 
-	hostname := cfg.Host + ":" + strconv.Itoa(cfg.Port)
-	subject = strings.Trim(subject, "\n\r\t")
-	sender = strings.Trim(sender, "\n\r\t")
-	replyTo = strings.Trim(replyTo, "\n\r\t")
 	if replyTo == "" {
 		replyTo = sender
 	}
 
-	var auth smtp.Auth
+	email := mail.NewMSG()
-	if cfg.Username == "" {
+	email.SetFrom(sender).
-		auth = nil
+		AddTo(receivers...).
-	} else {
+		SetReplyTo(replyTo).
-		// Set up authentication information.
+		SetSubject(subject)
-		auth = smtp.PlainAuth(
-			"",
-			cfg.Username,
-			cfg.Password,
-			cfg.Host,
-		)
-	}
 
-	// Set email data.
+	email.SetBody(mail.TextHTML, htmlBody)
-	e.From = sender
+	email.AddAlternative(mail.TextPlain, body)
-	e.To = receivers
-	e.ReplyTo = []string{replyTo}
-	e.Subject = subject
-	e.Text = []byte(body)
-	if htmlBody != "" {
-		e.HTML = []byte(htmlBody)
-	}
 
 	for _, attachment := range attachments {
-		a, err := e.Attach(attachment.Data, attachment.Name, attachment.ContentType)
+		attachmentData, err := io.ReadAll(attachment.Data)
 		if err != nil {
-			return err
+			return errors.Wrapf(err, "failed to read attachment data for %s", attachment.Name)
 		}
+
 		if attachment.Embedded {
-			a.HTMLRelated = true
+			email.AddInlineData(attachmentData, attachment.Name, attachment.ContentType)
+		} else {
+			email.AddAttachmentData(attachmentData, attachment.Name, attachment.ContentType)
 		}
 	}
 
-	if cfg.TLS {
+	// Call Send and pass the client
-		return e.SendWithStartTLS(hostname, auth, &tls.Config{InsecureSkipVerify: !cfg.CertValidation})
+	err = email.Send(client)
-	} else {
+	if err != nil {
-		return e.Send(hostname, auth)
+		return errors.Wrapf(err, "failed to send email")
 	}
+	return nil
 }

internal/common/util.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"strings"
+	"time"
 )
 
 // BroadcastAddr returns the last address in the given network, or the broadcast address.
@@ -21,7 +22,7 @@ func BroadcastAddr(n *net.IPNet) net.IP {
 	return broadcast
 }
 
-//  http://play.golang.org/p/m8TNTtygK0
+// http://play.golang.org/p/m8TNTtygK0
 func IncreaseIP(ip net.IP) {
 	for j := len(ip) - 1; j >= 0; j-- {
 		ip[j]++
@@ -84,3 +85,11 @@ func ByteCountSI(b int64) string {
 	return fmt.Sprintf("%.1f %cB",
 		float64(b)/float64(div), "kMGTPE"[exp])
 }
+
+func FormatDateHTML(t *time.Time) string {
+	if t == nil {
+		return ""
+	}
+
+	return t.Format("2006-01-02")
+}

internal/ldap/config.go

@@ -1,5 +1,9 @@
 package ldap
 
+import (
+	gldap "github.com/go-ldap/ldap/v3"
+)
+
 type Type string
 
 const (
@@ -15,14 +19,18 @@ type Config struct {
 	BindUser       string `yaml:"user" envconfig:"LDAP_USER"`
 	BindPass       string `yaml:"pass" envconfig:"LDAP_PASSWORD"`
 
-	Type                 Type   `yaml:"typ" envconfig:"LDAP_TYPE"` // AD for active directory, OpenLDAP for OpenLDAP
-	UserClass            string `yaml:"userClass" envconfig:"LDAP_USER_CLASS"`
 	EmailAttribute       string `yaml:"attrEmail" envconfig:"LDAP_ATTR_EMAIL"`
 	FirstNameAttribute   string `yaml:"attrFirstname" envconfig:"LDAP_ATTR_FIRSTNAME"`
 	LastNameAttribute    string `yaml:"attrLastname" envconfig:"LDAP_ATTR_LASTNAME"`
 	PhoneAttribute       string `yaml:"attrPhone" envconfig:"LDAP_ATTR_PHONE"`
 	GroupMemberAttribute string `yaml:"attrGroups" envconfig:"LDAP_ATTR_GROUPS"`
-	DisabledAttribute    string `yaml:"attrDisabled" envconfig:"LDAP_ATTR_DISABLED"`
 
-	AdminLdapGroup string `yaml:"adminGroup" envconfig:"LDAP_ADMIN_GROUP"` // Members of this group receive admin rights in WG-Portal
+	LoginFilter     string    `yaml:"loginFilter" envconfig:"LDAP_LOGIN_FILTER"` // {{login_identifier}} gets replaced with the login email address
+	SyncFilter      string    `yaml:"syncFilter" envconfig:"LDAP_SYNC_FILTER"`
+	AdminLdapGroup  string    `yaml:"adminGroup" envconfig:"LDAP_ADMIN_GROUP"` // Members of this group receive admin rights in WG-Portal
+	AdminLdapGroup_ *gldap.DN `yaml:"-"`
+	EveryoneAdmin   bool      `yaml:"everyoneAdmin" envconfig:"LDAP_EVERYONE_ADMIN"`
+	LdapCertConn    bool      `yaml:"ldapCertConn" envconfig:"LDAP_CERT_CONN"`
+	LdapTlsCert     string    `yaml:"ldapTlsCert" envconfig:"LDAPTLS_CERT"`
+	LdapTlsKey      string    `yaml:"ldapTlsKey" envconfig:"LDAPTLS_KEY"`
 }

internal/ldap/ldap.go

@@ -2,8 +2,7 @@ package ldap
 
 import (
 	"crypto/tls"
-	"fmt"
+	"os"
-	"strconv"
 
 	"github.com/go-ldap/ldap/v3"
 	"github.com/pkg/errors"
@@ -16,14 +15,41 @@ type RawLdapData struct {
 }
 
 func Open(cfg *Config) (*ldap.Conn, error) {
-	conn, err := ldap.DialURL(cfg.URL)
+	var tlsConfig *tls.Config
+
+	if cfg.LdapCertConn {
+
+		certPlain, err := os.ReadFile(cfg.LdapTlsCert)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed to load the certificate")
+
+		}
+
+		key, err := os.ReadFile(cfg.LdapTlsKey)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed to load the key")
+		}
+
+		certX509, err := tls.X509KeyPair(certPlain, key)
+		if err != nil {
+			return nil, errors.WithMessage(err, "failed X509")
+
+		}
+		tlsConfig = &tls.Config{Certificates: []tls.Certificate{certX509}}
+
+	} else {
+
+		tlsConfig = &tls.Config{InsecureSkipVerify: !cfg.CertValidation}
+	}
+
+	conn, err := ldap.DialURL(cfg.URL, ldap.DialWithTLSConfig(tlsConfig))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to connect to LDAP")
 	}
 
 	if cfg.StartTLS {
 		// Reconnect with TLS
-		err = conn.StartTLS(&tls.Config{InsecureSkipVerify: !cfg.CertValidation})
+		err = conn.StartTLS(tlsConfig)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to star TLS on connection")
 		}
@@ -53,13 +79,10 @@ func FindAllUsers(cfg *Config) ([]RawLdapData, error) {
 	// Search all users
 	attrs := []string{"dn", cfg.EmailAttribute, cfg.EmailAttribute, cfg.FirstNameAttribute, cfg.LastNameAttribute,
 		cfg.PhoneAttribute, cfg.GroupMemberAttribute}
-	if cfg.DisabledAttribute != "" {
-		attrs = append(attrs, cfg.DisabledAttribute)
-	}
 	searchRequest := ldap.NewSearchRequest(
 		cfg.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(objectClass=%s)", cfg.UserClass), attrs, nil,
+		cfg.SyncFilter, attrs, nil,
 	)
 
 	sr, err := client.Search(searchRequest)
@@ -86,27 +109,3 @@ func FindAllUsers(cfg *Config) ([]RawLdapData, error) {
 
 	return tmpData, nil
 }
-
-func IsActiveDirectoryUserDisabled(userAccountControl string) bool {
-	if userAccountControl == "" {
-		return false
-	}
-
-	uacInt, err := strconv.ParseInt(userAccountControl, 10, 32)
-	if err != nil {
-		return true
-	}
-	if int32(uacInt)&0x2 != 0 {
-		return true // bit 2 set means account is disabled
-	}
-
-	return false
-}
-
-func IsOpenLdapUserDisabled(pwdAccountLockedTime string) bool {
-	if pwdAccountLockedTime != "" {
-		return true
-	}
-
-	return false
-}

internal/server/api.go

@@ -0,0 +1,947 @@
+package server
+
+// go get -u github.com/swaggo/swag/cmd/swag
+// run: swag init --parseDependency --parseInternal --generalInfo api.go
+// in the internal/server folder
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	"github.com/gin-gonic/gin"
+	"github.com/h44z/wg-portal/internal/common"
+	"github.com/h44z/wg-portal/internal/users"
+	"github.com/h44z/wg-portal/internal/wireguard"
+)
+
+// @title WireGuard Portal API
+// @version 1.0
+// @description WireGuard Portal API for managing users and peers.
+
+// @license.name MIT
+// @license.url https://github.com/h44z/wg-portal/blob/master/LICENSE.txt
+
+// @contact.name WireGuard Portal Project
+// @contact.url https://github.com/h44z/wg-portal
+
+// @securityDefinitions.basic ApiBasicAuth
+// @in header
+// @name Authorization
+// @scope.admin Admin access required
+
+// @securityDefinitions.basic GeneralBasicAuth
+// @in header
+// @name Authorization
+// @scope.user User access required
+
+// @BasePath /api/v1
+
+// ApiServer is a simple wrapper struct so that we can have fresh member function names.
+type ApiServer struct {
+	s *Server
+}
+
+type ApiError struct {
+	Message string
+}
+
+// GetUsers godoc
+// @Tags Users
+// @Summary Retrieves all users
+// @ID GetUsers
+// @Produce json
+// @Success 200 {object} []users.User
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/users [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetUsers(c *gin.Context) {
+	allUsers := s.s.users.GetUsersUnscoped()
+
+	c.JSON(http.StatusOK, allUsers)
+}
+
+// GetUser godoc
+// @Tags Users
+// @Summary Retrieves user based on given Email
+// @ID GetUser
+// @Produce json
+// @Param Email query string true "User Email"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/user [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("Email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "Email parameter must be specified"})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// PostUser godoc
+// @Tags Users
+// @Summary Creates a new user based on the given user model
+// @ID PostUser
+// @Accept  json
+// @Produce json
+// @Param User body users.User true "User Model"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/users [post]
+// @Security ApiBasicAuth
+func (s *ApiServer) PostUser(c *gin.Context) {
+	newUser := users.User{}
+	if err := c.ShouldBindJSON(&newUser); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	if user := s.s.users.GetUserUnscoped(newUser.Email); user != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "user already exists"})
+		return
+	}
+
+	if err := s.s.CreateUser(newUser, s.s.wg.Cfg.GetDefaultDeviceName()); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(newUser.Email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// PutUser godoc
+// @Tags Users
+// @Summary Updates a user based on the given user model
+// @ID PutUser
+// @Accept  json
+// @Produce json
+// @Param Email query string true "User Email"
+// @Param User body users.User true "User Model"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/user [put]
+// @Security ApiBasicAuth
+func (s *ApiServer) PutUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("Email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "Email parameter must be specified"})
+		return
+	}
+
+	updateUser := users.User{}
+	if err := c.ShouldBindJSON(&updateUser); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	// Changing email address is not allowed
+	if email != updateUser.Email {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "Email parameter must match the model email address"})
+		return
+	}
+
+	if user := s.s.users.GetUserUnscoped(email); user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user does not exist"})
+		return
+	}
+
+	if err := s.s.UpdateUser(updateUser); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// PatchUser godoc
+// @Tags Users
+// @Summary Updates a user based on the given partial user model
+// @ID PatchUser
+// @Accept  json
+// @Produce json
+// @Param Email query string true "User Email"
+// @Param User body users.User true "User Model"
+// @Success 200 {object} users.User
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/user [patch]
+// @Security ApiBasicAuth
+func (s *ApiServer) PatchUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("Email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must be specified"})
+		return
+	}
+
+	patch, err := c.GetRawData()
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	user := s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user does not exist"})
+		return
+	}
+	userData, err := json.Marshal(user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	mergedUserData, err := jsonpatch.MergePatch(userData, patch)
+	var mergedUser users.User
+	err = json.Unmarshal(mergedUserData, &mergedUser)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	// CHanging email address is not allowed
+	if email != mergedUser.Email {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must match the model email address"})
+		return
+	}
+
+	if err := s.s.UpdateUser(mergedUser); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	user = s.s.users.GetUserUnscoped(email)
+	if user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user not found"})
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// DeleteUser godoc
+// @Tags Users
+// @Summary Deletes the specified user
+// @ID DeleteUser
+// @Produce json
+// @Param Email query string true "User Email"
+// @Success 204 "No content"
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/user [delete]
+// @Security ApiBasicAuth
+func (s *ApiServer) DeleteUser(c *gin.Context) {
+	email := strings.ToLower(strings.TrimSpace(c.Query("Email")))
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "email parameter must be specified"})
+		return
+	}
+
+	var user *users.User
+	if user = s.s.users.GetUserUnscoped(email); user == nil {
+		c.JSON(http.StatusNotFound, ApiError{Message: "user does not exist"})
+		return
+	}
+
+	if err := s.s.DeleteUser(*user); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+// GetPeers godoc
+// @Tags Peers
+// @Summary Retrieves all peers for the given interface
+// @ID GetPeers
+// @Produce json
+// @Param DeviceName query string true "Device Name"
+// @Success 200 {object} []wireguard.Peer
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/peers [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetPeers(c *gin.Context) {
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("DeviceName")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "DeviceName parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	peers := s.s.peers.GetAllPeers(deviceName)
+	c.JSON(http.StatusOK, peers)
+}
+
+// GetPeer godoc
+// @Tags Peers
+// @Summary Retrieves the peer for the given public key
+// @ID GetPeer
+// @Produce json
+// @Param PublicKey query string true "Public Key (Base 64)"
+// @Success 200 {object} wireguard.Peer
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/peer [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetPeer(c *gin.Context) {
+	pkey := c.Query("PublicKey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "PublicKey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// PostPeer godoc
+// @Tags Peers
+// @Summary Creates a new peer based on the given peer model
+// @ID PostPeer
+// @Accept  json
+// @Produce json
+// @Param DeviceName query string true "Device Name"
+// @Param Peer body wireguard.Peer true "Peer Model"
+// @Success 200 {object} wireguard.Peer
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peers [post]
+// @Security ApiBasicAuth
+func (s *ApiServer) PostPeer(c *gin.Context) {
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("DeviceName")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "DeviceName parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	newPeer := wireguard.Peer{}
+	if err := c.ShouldBindJSON(&newPeer); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	if peer := s.s.peers.GetPeerByKey(newPeer.PublicKey); peer.IsValid() {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "peer already exists"})
+		return
+	}
+
+	if err := s.s.CreatePeer(deviceName, newPeer); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(newPeer.PublicKey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// PutPeer godoc
+// @Tags Peers
+// @Summary Updates the given peer based on the given peer model
+// @ID PutPeer
+// @Accept  json
+// @Produce json
+// @Param PublicKey query string true "Public Key"
+// @Param Peer body wireguard.Peer true "Peer Model"
+// @Success 200 {object} wireguard.Peer
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peer [put]
+// @Security ApiBasicAuth
+func (s *ApiServer) PutPeer(c *gin.Context) {
+	updatePeer := wireguard.Peer{}
+	if err := c.ShouldBindJSON(&updatePeer); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	pkey := c.Query("PublicKey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "PublicKey parameter must be specified"})
+		return
+	}
+
+	if peer := s.s.peers.GetPeerByKey(pkey); !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	// Changing public key is not allowed
+	if pkey != updatePeer.PublicKey {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "PublicKey parameter must match the model public key"})
+		return
+	}
+
+	now := time.Now()
+	if updatePeer.DeactivatedAt != nil {
+		updatePeer.DeactivatedAt = &now
+		updatePeer.DeactivatedReason = wireguard.DeactivatedReasonApiEdit
+	}
+	if err := s.s.UpdatePeer(updatePeer, now); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(updatePeer.PublicKey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// PatchPeer godoc
+// @Tags Peers
+// @Summary Updates the given peer based on the given partial peer model
+// @ID PatchPeer
+// @Accept  json
+// @Produce json
+// @Param PublicKey query string true "Public Key"
+// @Param Peer body wireguard.Peer true "Peer Model"
+// @Success 200 {object} wireguard.Peer
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peer [patch]
+// @Security ApiBasicAuth
+func (s *ApiServer) PatchPeer(c *gin.Context) {
+	patch, err := c.GetRawData()
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	pkey := c.Query("PublicKey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "pkey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	peerData, err := json.Marshal(peer)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	mergedPeerData, err := jsonpatch.MergePatch(peerData, patch)
+	var mergedPeer wireguard.Peer
+	err = json.Unmarshal(mergedPeerData, &mergedPeer)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	if !mergedPeer.IsValid() {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "invalid peer model"})
+		return
+	}
+
+	// Changing public key is not allowed
+	if pkey != mergedPeer.PublicKey {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "PublicKey parameter must match the model public key"})
+		return
+	}
+
+	now := time.Now()
+	if mergedPeer.DeactivatedAt != nil {
+		mergedPeer.DeactivatedAt = &now
+		mergedPeer.DeactivatedReason = wireguard.DeactivatedReasonApiEdit
+	}
+	if err := s.s.UpdatePeer(mergedPeer, now); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	peer = s.s.peers.GetPeerByKey(mergedPeer.PublicKey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+	c.JSON(http.StatusOK, peer)
+}
+
+// DeletePeer godoc
+// @Tags Peers
+// @Summary Updates the given peer based on the given partial peer model
+// @ID DeletePeer
+// @Produce json
+// @Param PublicKey query string true "Public Key"
+// @Success 204 "No Content"
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/peer [delete]
+// @Security ApiBasicAuth
+func (s *ApiServer) DeletePeer(c *gin.Context) {
+	pkey := c.Query("PublicKey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "PublicKey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if peer.PublicKey == "" {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	if err := s.s.DeletePeer(peer); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+// GetDevices godoc
+// @Tags Interface
+// @Summary Get all devices
+// @ID GetDevices
+// @Produce json
+// @Success 200 {object} []wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/devices [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetDevices(c *gin.Context) {
+	var devices []wireguard.Device
+	for _, deviceName := range s.s.config.WG.DeviceNames {
+		device := s.s.peers.GetDevice(deviceName)
+		if !device.IsValid() {
+			continue
+		}
+		devices = append(devices, device)
+	}
+
+	c.JSON(http.StatusOK, devices)
+}
+
+// GetDevice godoc
+// @Tags Interface
+// @Summary Get the given device
+// @ID GetDevice
+// @Produce json
+// @Param DeviceName query string true "Device Name"
+// @Success 200 {object} wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /backend/device [get]
+// @Security ApiBasicAuth
+func (s *ApiServer) GetDevice(c *gin.Context) {
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("DeviceName")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "DeviceName parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(deviceName)
+	if !device.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "device not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, device)
+}
+
+// PutDevice godoc
+// @Tags Interface
+// @Summary Updates the given device based on the given device model (UNIMPLEMENTED)
+// @ID PutDevice
+// @Accept  json
+// @Produce json
+// @Param DeviceName query string true "Device Name"
+// @Param Device body wireguard.Device true "Device Model"
+// @Success 200 {object} wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/device [put]
+// @Security ApiBasicAuth
+func (s *ApiServer) PutDevice(c *gin.Context) {
+	updateDevice := wireguard.Device{}
+	if err := c.ShouldBindJSON(&updateDevice); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("DeviceName")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "DeviceName parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(deviceName)
+	if !device.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+
+	// Changing device name is not allowed
+	if deviceName != updateDevice.DeviceName {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "DeviceName parameter must match the model device name"})
+		return
+	}
+
+	// TODO: implement
+
+	c.JSON(http.StatusNotImplemented, device)
+}
+
+// PatchDevice godoc
+// @Tags Interface
+// @Summary Updates the given device based on the given partial device model (UNIMPLEMENTED)
+// @ID PatchDevice
+// @Accept  json
+// @Produce json
+// @Param DeviceName query string true "Device Name"
+// @Param Device body wireguard.Device true "Device Model"
+// @Success 200 {object} wireguard.Device
+// @Failure 400 {object} ApiError
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Failure 500 {object} ApiError
+// @Router /backend/device [patch]
+// @Security ApiBasicAuth
+func (s *ApiServer) PatchDevice(c *gin.Context) {
+	patch, err := c.GetRawData()
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	deviceName := strings.ToLower(strings.TrimSpace(c.Query("DeviceName")))
+	if deviceName == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "DeviceName parameter must be specified"})
+		return
+	}
+
+	// validate device name
+	if !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		c.JSON(http.StatusNotFound, ApiError{Message: "unknown device"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(deviceName)
+	if !device.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer not found"})
+		return
+	}
+
+	deviceData, err := json.Marshal(device)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	mergedDeviceData, err := jsonpatch.MergePatch(deviceData, patch)
+	var mergedDevice wireguard.Device
+	err = json.Unmarshal(mergedDeviceData, &mergedDevice)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	if !mergedDevice.IsValid() {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "invalid device model"})
+		return
+	}
+
+	// Changing device name is not allowed
+	if deviceName != mergedDevice.DeviceName {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "DeviceName parameter must match the model device name"})
+		return
+	}
+
+	// TODO: implement
+
+	c.JSON(http.StatusNotImplemented, device)
+}
+
+type PeerDeploymentInformation struct {
+	PublicKey        string
+	Identifier       string
+	Device           string
+	DeviceIdentifier string
+}
+
+// GetPeerDeploymentInformation godoc
+// @Tags Provisioning
+// @Summary Retrieves all active peers for the given email address
+// @ID GetPeerDeploymentInformation
+// @Produce json
+// @Param Email query string true "Email Address"
+// @Success 200 {object} []PeerDeploymentInformation "All active WireGuard peers"
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /provisioning/peers [get]
+// @Security GeneralBasicAuth
+func (s *ApiServer) GetPeerDeploymentInformation(c *gin.Context) {
+	email := c.Query("Email")
+	if email == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "Email parameter must be specified"})
+		return
+	}
+
+	// Get authenticated user to check permissions
+	username, _, _ := c.Request.BasicAuth()
+	user := s.s.users.GetUser(username)
+
+	if !user.IsAdmin && user.Email != email {
+		c.JSON(http.StatusForbidden, ApiError{Message: "not enough permissions to access this resource"})
+		return
+	}
+
+	peers := s.s.peers.GetPeersByMail(email)
+	result := make([]PeerDeploymentInformation, 0, len(peers))
+	for i := range peers {
+		if peers[i].DeactivatedAt != nil {
+			continue // skip deactivated peers
+		}
+
+		device := s.s.peers.GetDevice(peers[i].DeviceName)
+		if device.Type != wireguard.DeviceTypeServer {
+			continue // Skip peers on non-server devices
+		}
+
+		result = append(result, PeerDeploymentInformation{
+			PublicKey:        peers[i].PublicKey,
+			Identifier:       peers[i].Identifier,
+			Device:           device.DeviceName,
+			DeviceIdentifier: device.DisplayName,
+		})
+	}
+
+	c.JSON(http.StatusOK, result)
+}
+
+// GetPeerDeploymentConfig godoc
+// @Tags Provisioning
+// @Summary Retrieves the peer config for the given public key
+// @ID GetPeerDeploymentConfig
+// @Produce plain
+// @Param PublicKey query string true "Public Key (Base 64)"
+// @Success 200 {object} string "The WireGuard configuration file"
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /provisioning/peer [get]
+// @Security GeneralBasicAuth
+func (s *ApiServer) GetPeerDeploymentConfig(c *gin.Context) {
+	pkey := c.Query("PublicKey")
+	if pkey == "" {
+		c.JSON(http.StatusBadRequest, ApiError{Message: "PublicKey parameter must be specified"})
+		return
+	}
+
+	peer := s.s.peers.GetPeerByKey(pkey)
+	if !peer.IsValid() {
+		c.JSON(http.StatusNotFound, ApiError{Message: "peer does not exist"})
+		return
+	}
+
+	// Get authenticated user to check permissions
+	username, _, _ := c.Request.BasicAuth()
+	user := s.s.users.GetUser(username)
+
+	if !user.IsAdmin && user.Email != peer.Email {
+		c.JSON(http.StatusForbidden, ApiError{Message: "not enough permissions to access this resource"})
+		return
+	}
+
+	device := s.s.peers.GetDevice(peer.DeviceName)
+	config, err := peer.GetConfigFile(device)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Data(http.StatusOK, "text/plain", config)
+}
+
+type ProvisioningRequest struct {
+	// DeviceName is optional, if not specified, the configured default device will be used.
+	DeviceName string `json:",omitempty"`
+	Identifier string `binding:"required"`
+	Email      string `binding:"required"`
+
+	// Client specific and optional settings
+
+	AllowedIPsStr       string `binding:"cidrlist" json:",omitempty"`
+	PersistentKeepalive int    `binding:"gte=0" json:",omitempty"`
+	DNSStr              string `binding:"iplist" json:",omitempty"`
+	Mtu                 int    `binding:"gte=0,lte=1500" json:",omitempty"`
+}
+
+// PostPeerDeploymentConfig godoc
+// @Tags Provisioning
+// @Summary Creates the requested peer config and returns the config file
+// @ID PostPeerDeploymentConfig
+// @Accept  json
+// @Produce plain
+// @Param ProvisioningRequest body ProvisioningRequest true "Provisioning Request Model"
+// @Success 200 {object} string "The WireGuard configuration file"
+// @Failure 401 {object} ApiError
+// @Failure 403 {object} ApiError
+// @Failure 404 {object} ApiError
+// @Router /provisioning/peers [post]
+// @Security GeneralBasicAuth
+func (s *ApiServer) PostPeerDeploymentConfig(c *gin.Context) {
+	req := ProvisioningRequest{}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ApiError{Message: err.Error()})
+		return
+	}
+
+	// Get authenticated user to check permissions
+	username, _, _ := c.Request.BasicAuth()
+	user := s.s.users.GetUser(username)
+
+	if !user.IsAdmin && !s.s.config.Core.SelfProvisioningAllowed {
+		c.JSON(http.StatusForbidden, ApiError{Message: "peer provisioning service disabled"})
+		return
+	}
+
+	if !user.IsAdmin && user.Email != req.Email {
+		c.JSON(http.StatusForbidden, ApiError{Message: "not enough permissions to access this resource"})
+		return
+	}
+
+	deviceName := req.DeviceName
+	if deviceName == "" || !common.ListContains(s.s.config.WG.DeviceNames, deviceName) {
+		deviceName = s.s.config.WG.GetDefaultDeviceName()
+	}
+	device := s.s.peers.GetDevice(deviceName)
+	if device.Type != wireguard.DeviceTypeServer {
+		c.JSON(http.StatusForbidden, ApiError{Message: "invalid device, provisioning disabled"})
+		return
+	}
+
+	// check if private/public keys are set, if so check database for existing entries
+	peer, err := s.s.PrepareNewPeer(deviceName)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+	peer.Email = req.Email
+	peer.Identifier = req.Identifier
+
+	if req.AllowedIPsStr != "" {
+		peer.AllowedIPsStr = req.AllowedIPsStr
+	}
+	if req.PersistentKeepalive != 0 {
+		peer.PersistentKeepalive = req.PersistentKeepalive
+	}
+	if req.DNSStr != "" {
+		peer.DNSStr = req.DNSStr
+	}
+	if req.Mtu != 0 {
+		peer.Mtu = req.Mtu
+	}
+
+	if err := s.s.CreatePeer(deviceName, peer); err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	config, err := peer.GetConfigFile(device)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ApiError{Message: err.Error()})
+		return
+	}
+
+	c.Data(http.StatusOK, "text/plain", config)
+}

internal/server/configuration.go

@@ -12,6 +12,8 @@ import (
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"gopkg.in/yaml.v3"
+
+	gldap "github.com/go-ldap/ldap/v3"
 )
 
 var ErrInvalidSpecification = errors.New("specification must be a struct pointer")
@@ -55,17 +57,22 @@ func loadConfigEnv(cfg interface{}) error {
 
 type Config struct {
 	Core struct {
-		ListeningAddress  string `yaml:"listeningAddress" envconfig:"LISTENING_ADDRESS"`
+		ListeningAddress        string `yaml:"listeningAddress" envconfig:"LISTENING_ADDRESS"`
-		ExternalUrl       string `yaml:"externalUrl" envconfig:"EXTERNAL_URL"`
+		ExternalUrl             string `yaml:"externalUrl" envconfig:"EXTERNAL_URL"`
-		Title             string `yaml:"title" envconfig:"WEBSITE_TITLE"`
+		Title                   string `yaml:"title" envconfig:"WEBSITE_TITLE"`
-		CompanyName       string `yaml:"company" envconfig:"COMPANY_NAME"`
+		CompanyName             string `yaml:"company" envconfig:"COMPANY_NAME"`
-		MailFrom          string `yaml:"mailFrom" envconfig:"MAIL_FROM"`
+		MailFrom                string `yaml:"mailFrom" envconfig:"MAIL_FROM"`
-		AdminUser         string `yaml:"adminUser" envconfig:"ADMIN_USER"` // must be an email address
+		AdminUser               string `yaml:"adminUser" envconfig:"ADMIN_USER"` // must be an email address
-		AdminPassword     string `yaml:"adminPass" envconfig:"ADMIN_PASS"`
+		AdminPassword           string `yaml:"adminPass" envconfig:"ADMIN_PASS"`
-		EditableKeys      bool   `yaml:"editableKeys" envconfig:"EDITABLE_KEYS"`
+		EditableKeys            bool   `yaml:"editableKeys" envconfig:"EDITABLE_KEYS"`
-		CreateDefaultPeer bool   `yaml:"createDefaultPeer" envconfig:"CREATE_DEFAULT_PEER"`
+		CreateDefaultPeer       bool   `yaml:"createDefaultPeer" envconfig:"CREATE_DEFAULT_PEER"`
-		LdapEnabled       bool   `yaml:"ldapEnabled" envconfig:"LDAP_ENABLED"`
+		SelfProvisioningAllowed bool   `yaml:"selfProvisioning" envconfig:"SELF_PROVISIONING"`
-		SessionSecret     string `yaml:"sessionSecret" envconfig:"SESSION_SECRET"`
+		WGExporterFriendlyNames bool   `yaml:"wgExporterFriendlyNames" envconfig:"WG_EXPORTER_FRIENDLY_NAMES"`
+		LdapEnabled             bool   `yaml:"ldapEnabled" envconfig:"LDAP_ENABLED"`
+		SessionSecret           string `yaml:"sessionSecret" envconfig:"SESSION_SECRET"`
+		LogoUrl                 string `yaml:"logoUrl" envconfig:"LOGO_URL"`
+		BackgroundTaskInterval  int    `yaml:"backgroundTaskInterval" envconfig:"BACKGROUND_TASK_INTERVAL"` // in seconds
+		ExpiryReEnable          bool   `yaml:"expiryReEnable" envconfig:"EXPIRY_REENABLE"`
 	} `yaml:"core"`
 	Database common.DatabaseConfig `yaml:"database"`
 	Email    common.MailConfig     `yaml:"email"`
@@ -80,13 +87,16 @@ func NewConfig() *Config {
 	cfg.Core.ListeningAddress = ":8123"
 	cfg.Core.Title = "WireGuard VPN"
 	cfg.Core.CompanyName = "WireGuard Portal"
+	cfg.Core.LogoUrl = "/img/header-logo.png"
 	cfg.Core.ExternalUrl = "http://localhost:8123"
 	cfg.Core.MailFrom = "WireGuard VPN <noreply@company.com>"
 	cfg.Core.AdminUser = "admin@wgportal.local"
 	cfg.Core.AdminPassword = "wgportal"
 	cfg.Core.LdapEnabled = false
 	cfg.Core.EditableKeys = true
+	cfg.Core.WGExporterFriendlyNames = false
 	cfg.Core.SessionSecret = "secret"
+	cfg.Core.BackgroundTaskInterval = 15 * 60 // 15 minutes
 
 	cfg.Database.Typ = "sqlite"
 	cfg.Database.Database = "data/wg_portal.db"
@@ -96,22 +106,24 @@ func NewConfig() *Config {
 	cfg.LDAP.StartTLS = true
 	cfg.LDAP.BindUser = "company\\\\ldap_wireguard"
 	cfg.LDAP.BindPass = "SuperSecret"
-	cfg.LDAP.Type = "AD"
-	cfg.LDAP.UserClass = "organizationalPerson"
 	cfg.LDAP.EmailAttribute = "mail"
 	cfg.LDAP.FirstNameAttribute = "givenName"
 	cfg.LDAP.LastNameAttribute = "sn"
 	cfg.LDAP.PhoneAttribute = "telephoneNumber"
 	cfg.LDAP.GroupMemberAttribute = "memberOf"
-	cfg.LDAP.DisabledAttribute = "userAccountControl"
 	cfg.LDAP.AdminLdapGroup = "CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL"
+	cfg.LDAP.LoginFilter = "(&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2))"
+	cfg.LDAP.SyncFilter = "(&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))"
 
 	cfg.WG.DeviceNames = []string{"wg0"}
 	cfg.WG.DefaultDeviceName = "wg0"
 	cfg.WG.ConfigDirectoryPath = "/etc/wireguard"
 	cfg.WG.ManageIPAddresses = true
+	cfg.WG.UserManagePeers = false
 	cfg.Email.Host = "127.0.0.1"
 	cfg.Email.Port = 25
+	cfg.Email.Encryption = common.MailEncryptionNone
+	cfg.Email.AuthType = common.MailAuthPlain
 
 	// Load config from file and environment
 	cfgFile, ok := os.LookupEnv("CONFIG_FILE")
@@ -126,6 +138,10 @@ func NewConfig() *Config {
 	if err != nil {
 		logrus.Warnf("unable to load environment config: %v", err)
 	}
+	cfg.LDAP.AdminLdapGroup_, err = gldap.ParseDN(cfg.LDAP.AdminLdapGroup)
+	if err != nil {
+		logrus.Warnf("Parsing AdminLDAPGroup failed: %v", err)
+	}
 
 	if cfg.WG.ManageIPAddresses && runtime.GOOS != "linux" {
 		logrus.Warnf("managing IP addresses only works on linux, feature disabled...")

internal/server/handlers_auth.go

@@ -4,12 +4,13 @@ import (
 	"net/http"
 	"strings"
 
-	csrf "github.com/utrack/gin-csrf"
+	"github.com/pkg/errors"
 
 	"github.com/gin-gonic/gin"
 	"github.com/h44z/wg-portal/internal/authentication"
 	"github.com/h44z/wg-portal/internal/users"
 	"github.com/sirupsen/logrus"
+	csrf "github.com/utrack/gin-csrf"
 )
 
 func (s *Server) GetLogin(c *gin.Context) {
@@ -54,65 +55,15 @@ func (s *Server) PostLogin(c *gin.Context) {
 		return
 	}
 
-	// Check user database for an matching entry
+	// Check all available auth backends
-	var loginProvider authentication.AuthProvider
+	user, err := s.checkAuthentication(username, password)
-	email := ""
+	if err != nil {
-	user := s.users.GetUser(username) // retrieve active candidate user from db
+		s.GetHandleError(c, http.StatusInternalServerError, "login error", err.Error())
-	if user != nil {                  // existing user
+		return
-		loginProvider = s.auth.GetProvider(string(user.Source))
-		if loginProvider == nil {
-			s.GetHandleError(c, http.StatusInternalServerError, "login error", "login provider unavailable")
-			return
-		}
-		authEmail, err := loginProvider.Login(&authentication.AuthContext{
-			Username: username,
-			Password: password,
-		})
-		if err == nil {
-			email = authEmail
-		}
-	} else { // possible new user
-		// Check all available auth backends
-		for _, provider := range s.auth.GetProvidersForType(authentication.AuthProviderTypePassword) {
-			// try to log in to the given provider
-			authEmail, err := provider.Login(&authentication.AuthContext{
-				Username: username,
-				Password: password,
-			})
-			if err != nil {
-				continue
-			}
-
-			email = authEmail
-			loginProvider = provider
-
-			// create new user in the database (or reactivate him)
-			userData, err := loginProvider.GetUserModel(&authentication.AuthContext{
-				Username: email,
-			})
-			if err != nil {
-				s.GetHandleError(c, http.StatusInternalServerError, "login error", err.Error())
-				return
-			}
-			if err := s.CreateUser(users.User{
-				Email:     userData.Email,
-				Source:    users.UserSource(loginProvider.GetName()),
-				IsAdmin:   userData.IsAdmin,
-				Firstname: userData.Firstname,
-				Lastname:  userData.Lastname,
-				Phone:     userData.Phone,
-			}, s.wg.Cfg.GetDefaultDeviceName()); err != nil {
-				s.GetHandleError(c, http.StatusInternalServerError, "login error", "failed to update user data")
-				return
-			}
-
-			user = s.users.GetUser(username)
-			break
-		}
 	}
 
 	// Check if user is authenticated
-	if email == "" || loginProvider == nil || user == nil {
+	if user == nil {
 		c.Redirect(http.StatusSeeOther, "/auth/login?err=authfail")
 		return
 	}
@@ -153,3 +104,48 @@ func (s *Server) GetLogout(c *gin.Context) {
 	}
 	c.Redirect(http.StatusSeeOther, "/")
 }
+
+func (s *Server) checkAuthentication(username, password string) (*users.User, error) {
+	var user *users.User
+
+	// Check all available auth backends
+	for _, provider := range s.auth.GetProvidersForType(authentication.AuthProviderTypePassword) {
+		// try to log in to the given provider
+		authEmail, err := provider.Login(&authentication.AuthContext{
+			Username: username,
+			Password: password,
+		})
+		if err != nil {
+			continue
+		}
+
+		// Login succeeded
+		user = s.users.GetUser(authEmail)
+		if user != nil {
+			break // user exists, nothing more to do...
+		}
+
+		// create new user in the database (or reactivate him)
+		userData, err := provider.GetUserModel(&authentication.AuthContext{
+			Username: username,
+		})
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to get user model")
+		}
+		if err := s.CreateUser(users.User{
+			Email:     userData.Email,
+			Source:    users.UserSource(provider.GetName()),
+			IsAdmin:   userData.IsAdmin,
+			Firstname: userData.Firstname,
+			Lastname:  userData.Lastname,
+			Phone:     userData.Phone,
+		}, s.wg.Cfg.GetDefaultDeviceName()); err != nil {
+			return nil, errors.Wrap(err, "failed to update user data")
+		}
+
+		user = s.users.GetUser(authEmail)
+		break
+	}
+
+	return user, nil
+}

internal/server/handlers_common.go

@@ -135,15 +135,16 @@ func (s *Server) GetUserIndex(c *gin.Context) {
 	peers := s.peers.GetSortedPeersForEmail(currentSession.SortedBy["userpeers"], currentSession.SortDirection["userpeers"], currentSession.Email)
 
 	c.HTML(http.StatusOK, "user_index.html", gin.H{
-		"Route":       c.Request.URL.Path,
+		"Route":           c.Request.URL.Path,
-		"Alerts":      GetFlashes(c),
+		"Alerts":          GetFlashes(c),
-		"Session":     currentSession,
+		"Session":         currentSession,
-		"Static":      s.getStaticData(),
+		"Static":          s.getStaticData(),
-		"Peers":       peers,
+		"Peers":           peers,
-		"TotalPeers":  len(peers),
+		"TotalPeers":      len(peers),
-		"Users":       []users.User{*s.users.GetUser(currentSession.Email)},
+		"Users":           []users.User{*s.users.GetUser(currentSession.Email)},
-		"Device":      s.peers.GetDevice(currentSession.DeviceName),
+		"Device":          s.peers.GetDevice(currentSession.DeviceName),
-		"DeviceNames": s.GetDeviceNames(),
+		"DeviceNames":     s.GetDeviceNames(),
+		"UserManagePeers": s.config.WG.UserManagePeers,
 	})
 }
 
@@ -192,3 +193,10 @@ func (s *Server) setFormInSession(c *gin.Context, formData interface{}) (Session
 
 	return currentSession, nil
 }
+
+func (s *Server) isUserStillValid(email string) bool {
+	if s.users.GetUser(email) == nil {
+		return false
+	}
+	return true
+}

internal/server/handlers_interface.go

@@ -112,7 +112,7 @@ func (s *Server) GetInterfaceConfig(c *gin.Context) {
 	currentSession := GetSessionData(c)
 	device := s.peers.GetDevice(currentSession.DeviceName)
 	peers := s.peers.GetActivePeers(device.DeviceName)
-	cfg, err := device.GetConfigFile(peers)
+	cfg, err := device.GetConfigFile(peers, s.config.Core.WGExporterFriendlyNames)
 	if err != nil {
 		s.GetHandleError(c, http.StatusInternalServerError, "ConfigFile error", err.Error())
 		return

internal/server/handlers_peer.go

@@ -12,6 +12,7 @@ import (
 	"github.com/h44z/wg-portal/internal/common"
 	"github.com/h44z/wg-portal/internal/users"
 	"github.com/h44z/wg-portal/internal/wireguard"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/tatsushid/go-fastping"
 	csrf "github.com/utrack/gin-csrf"
@@ -64,13 +65,21 @@ func (s *Server) PostAdminEditPeer(c *gin.Context) {
 	// Clean list input
 	formPeer.IPsStr = common.ListToString(common.ParseStringList(formPeer.IPsStr))
 	formPeer.AllowedIPsStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsStr))
+	formPeer.AllowedIPsSrvStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsSrvStr))
 
 	disabled := c.PostForm("isdisabled") != ""
 	now := time.Now()
 	if disabled && currentPeer.DeactivatedAt == nil {
 		formPeer.DeactivatedAt = &now
+		formPeer.DeactivatedReason = wireguard.DeactivatedReasonAdminEdit
 	} else if !disabled {
 		formPeer.DeactivatedAt = nil
+		formPeer.DeactivatedReason = ""
+		// If a peer was deactivated due to expiry, remove the expires-at date to avoid
+		// unwanted re-expiry.
+		if currentPeer.DeactivatedReason == wireguard.DeactivatedReasonExpired {
+			formPeer.ExpiresAt = nil
+		}
 	}
 
 	// Update in database
@@ -121,11 +130,13 @@ func (s *Server) PostAdminCreatePeer(c *gin.Context) {
 	// Clean list input
 	formPeer.IPsStr = common.ListToString(common.ParseStringList(formPeer.IPsStr))
 	formPeer.AllowedIPsStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsStr))
+	formPeer.AllowedIPsSrvStr = common.ListToString(common.ParseStringList(formPeer.AllowedIPsSrvStr))
 
 	disabled := c.PostForm("isdisabled") != ""
 	now := time.Now()
 	if disabled {
 		formPeer.DeactivatedAt = &now
+		formPeer.DeactivatedReason = wireguard.DeactivatedReasonAdminCreate
 	}
 
 	if err := s.CreatePeer(currentSession.DeviceName, formPeer); err != nil {
@@ -186,7 +197,7 @@ func (s *Server) PostAdminCreateLdapPeers(c *gin.Context) {
 	logrus.Infof("creating %d ldap peers", len(emails))
 
 	for i := range emails {
-		if err := s.CreatePeerByEmail(currentSession.DeviceName, emails[i], formData.Identifier, false); err != nil {
+		if err := s.CreatePeerByEmail(currentSession.DeviceName, emails[i], formData.Identifier); err != nil {
 			_ = s.updateFormInSession(c, formData)
 			SetFlashMessage(c, "failed to add user: "+err.Error(), "danger")
 			c.Redirect(http.StatusSeeOther, "/admin/peer/createldap?formerr=create")
@@ -233,7 +244,7 @@ func (s *Server) GetPeerConfig(c *gin.Context) {
 		return
 	}
 
-	cfg, err := peer.GetConfigFile(s.peers.GetDevice(currentSession.DeviceName))
+	cfg, err := peer.GetConfigFile(s.peers.GetDevice(peer.DeviceName))
 	if err != nil {
 		s.GetHandleError(c, http.StatusInternalServerError, "ConfigFile error", err.Error())
 		return
@@ -252,52 +263,7 @@ func (s *Server) GetPeerConfigMail(c *gin.Context) {
 		return
 	}
 
-	user := s.users.GetUser(peer.Email)
+	if err := s.sendPeerConfigMail(peer); err != nil {
-
-	cfg, err := peer.GetConfigFile(s.peers.GetDevice(currentSession.DeviceName))
-	if err != nil {
-		s.GetHandleError(c, http.StatusInternalServerError, "ConfigFile error", err.Error())
-		return
-	}
-	png, err := peer.GetQRCode()
-	if err != nil {
-		s.GetHandleError(c, http.StatusInternalServerError, "QRCode error", err.Error())
-		return
-	}
-	// Apply mail template
-	var tplBuff bytes.Buffer
-	if err := s.mailTpl.Execute(&tplBuff, struct {
-		Peer          wireguard.Peer
-		User          *users.User
-		QrcodePngName string
-		PortalUrl     string
-	}{
-		Peer:          peer,
-		User:          user,
-		QrcodePngName: "wireguard-config.png",
-		PortalUrl:     s.config.Core.ExternalUrl,
-	}); err != nil {
-		s.GetHandleError(c, http.StatusInternalServerError, "Template error", err.Error())
-		return
-	}
-
-	// Send mail
-	attachments := []common.MailAttachment{
-		{
-			Name:        peer.GetConfigFileName(),
-			ContentType: "application/config",
-			Data:        bytes.NewReader(cfg),
-		},
-		{
-			Name:        "wireguard-config.png",
-			ContentType: "image/png",
-			Data:        bytes.NewReader(png),
-		},
-	}
-
-	if err := common.SendEmailWithAttachments(s.config.Email, s.config.Core.MailFrom, "", "WireGuard VPN Configuration",
-		"Your mail client does not support HTML. Please find the configuration attached to this mail.", tplBuff.String(),
-		[]string{peer.Email}, attachments); err != nil {
 		s.GetHandleError(c, http.StatusInternalServerError, "Email error", err.Error())
 		return
 	}
@@ -358,3 +324,198 @@ func (s *Server) GetPeerStatus(c *gin.Context) {
 	c.JSON(http.StatusOK, isOnline)
 	return
 }
+
+func (s *Server) GetAdminSendEmails(c *gin.Context) {
+	currentSession := GetSessionData(c)
+	if !currentSession.IsAdmin {
+		s.GetHandleError(c, http.StatusUnauthorized, "No permissions", "You don't have permissions to view this resource!")
+		return
+	}
+
+	peers := s.peers.GetActivePeers(currentSession.DeviceName)
+	for _, peer := range peers {
+		if err := s.sendPeerConfigMail(peer); err != nil {
+			s.GetHandleError(c, http.StatusInternalServerError, "Email error", err.Error())
+			return
+		}
+	}
+
+	SetFlashMessage(c, "emails sent successfully", "success")
+	c.Redirect(http.StatusSeeOther, "/admin")
+}
+
+func (s *Server) sendPeerConfigMail(peer wireguard.Peer) error {
+	user := s.users.GetUser(peer.Email)
+
+	cfg, err := peer.GetConfigFile(s.peers.GetDevice(peer.DeviceName))
+	if err != nil {
+		return errors.Wrap(err, "failed to get config file")
+	}
+	png, err := peer.GetQRCode()
+	if err != nil {
+		return errors.Wrap(err, "failed to get qr-code")
+	}
+	// Apply mail template
+	qrcodeFileName := "wireguard-qrcode.png"
+	var tplBuff bytes.Buffer
+	if err := s.mailTpl.Execute(&tplBuff, struct {
+		Peer          wireguard.Peer
+		User          *users.User
+		QrcodePngName string
+		PortalUrl     string
+	}{
+		Peer:          peer,
+		User:          user,
+		QrcodePngName: qrcodeFileName,
+		PortalUrl:     s.config.Core.ExternalUrl,
+	}); err != nil {
+		return errors.Wrap(err, "failed to execute mail template")
+	}
+
+	// Send mail
+	attachments := []common.MailAttachment{
+		{
+			Name:        peer.GetConfigFileName(),
+			ContentType: "application/config",
+			Data:        bytes.NewReader(cfg),
+		},
+		{
+			Name:        qrcodeFileName,
+			ContentType: "image/png",
+			Data:        bytes.NewReader(png),
+			Embedded:    true,
+		},
+		{
+			Name:        qrcodeFileName,
+			ContentType: "image/png",
+			Data:        bytes.NewReader(png),
+		},
+	}
+
+	if err := common.SendEmailWithAttachments(s.config.Email, s.config.Core.MailFrom, "", "WireGuard VPN Configuration",
+		"Your mail client does not support HTML. Please find the configuration attached to this mail.", tplBuff.String(),
+		[]string{peer.Email}, attachments); err != nil {
+		return errors.Wrap(err, "failed to send email")
+	}
+
+	return nil
+}
+
+func (s *Server) GetUserCreatePeer(c *gin.Context) {
+	currentSession, err := s.setNewPeerFormInSession(c)
+	if err != nil {
+		s.GetHandleError(c, http.StatusInternalServerError, "Session error", err.Error())
+		return
+	}
+	c.HTML(http.StatusOK, "user_create_client.html", gin.H{
+		"Route":        c.Request.URL.Path,
+		"Alerts":       GetFlashes(c),
+		"Session":      currentSession,
+		"Static":       s.getStaticData(),
+		"Peer":         currentSession.FormData.(wireguard.Peer),
+		"EditableKeys": s.config.Core.EditableKeys,
+		"Device":       s.peers.GetDevice(currentSession.DeviceName),
+		"DeviceNames":  s.GetDeviceNames(),
+		"AdminEmail":   s.config.Core.AdminUser,
+		"Csrf":         csrf.GetToken(c),
+	})
+}
+
+func (s *Server) PostUserCreatePeer(c *gin.Context) {
+	currentSession := GetSessionData(c)
+	var formPeer wireguard.Peer
+	if currentSession.FormData != nil {
+		formPeer = currentSession.FormData.(wireguard.Peer)
+	}
+
+	formPeer.Email = currentSession.Email
+	formPeer.Identifier = currentSession.Email
+	formPeer.DeviceType = wireguard.DeviceTypeServer
+
+	if err := c.ShouldBind(&formPeer); err != nil {
+		_ = s.updateFormInSession(c, formPeer)
+		SetFlashMessage(c, "failed to bind form data: "+err.Error(), "danger")
+		c.Redirect(http.StatusSeeOther, "/user/peer/create?formerr=bind")
+		return
+	}
+
+	// if public key was manually set, remove the incorrect private key
+	if formPeer.PublicKey != currentSession.FormData.(wireguard.Peer).PublicKey {
+		formPeer.PrivateKey = ""
+	}
+
+	disabled := c.PostForm("isdisabled") != ""
+	now := time.Now()
+	if disabled {
+		formPeer.DeactivatedAt = &now
+		formPeer.DeactivatedReason = wireguard.DeactivatedReasonUserCreate
+	}
+
+	if err := s.CreatePeer(currentSession.DeviceName, formPeer); err != nil {
+		_ = s.updateFormInSession(c, formPeer)
+		SetFlashMessage(c, "failed to add user: "+err.Error(), "danger")
+		c.Redirect(http.StatusSeeOther, "/user/peer/create?formerr=create")
+		return
+	}
+
+	SetFlashMessage(c, "client created successfully", "success")
+	c.Redirect(http.StatusSeeOther, "/user/profile")
+}
+
+func (s *Server) GetUserEditPeer(c *gin.Context) {
+	peer := s.peers.GetPeerByKey(c.Query("pkey"))
+
+	currentSession, err := s.setFormInSession(c, peer)
+	if err != nil {
+		s.GetHandleError(c, http.StatusInternalServerError, "Session error", err.Error())
+		return
+	}
+
+	if peer.Email != currentSession.Email {
+		s.GetHandleError(c, http.StatusUnauthorized, "No permissions", "You don't have permissions to view this resource!")
+		return
+	}
+
+	c.HTML(http.StatusOK, "user_edit_client.html", gin.H{
+		"Route":        c.Request.URL.Path,
+		"Alerts":       GetFlashes(c),
+		"Session":      currentSession,
+		"Static":       s.getStaticData(),
+		"Peer":         currentSession.FormData.(wireguard.Peer),
+		"EditableKeys": s.config.Core.EditableKeys,
+		"Device":       s.peers.GetDevice(currentSession.DeviceName),
+		"DeviceNames":  s.GetDeviceNames(),
+		"AdminEmail":   s.config.Core.AdminUser,
+		"Csrf":         csrf.GetToken(c),
+	})
+}
+
+func (s *Server) PostUserEditPeer(c *gin.Context) {
+	currentPeer := s.peers.GetPeerByKey(c.Query("pkey"))
+	urlEncodedKey := url.QueryEscape(c.Query("pkey"))
+
+	currentSession := GetSessionData(c)
+
+	if currentPeer.Email != currentSession.Email {
+		s.GetHandleError(c, http.StatusUnauthorized, "No permissions", "You don't have permissions to view this resource!")
+		return
+	}
+
+	disabled := c.PostForm("isdisabled") != ""
+	now := time.Now()
+	if disabled && currentPeer.DeactivatedAt == nil {
+		currentPeer.DeactivatedAt = &now
+		currentPeer.DeactivatedReason = wireguard.DeactivatedReasonUserEdit
+	}
+
+	// Update in database
+	if err := s.UpdatePeer(currentPeer, now); err != nil {
+		_ = s.updateFormInSession(c, currentPeer)
+		SetFlashMessage(c, "failed to update user: "+err.Error(), "danger")
+		c.Redirect(http.StatusSeeOther, "/user/peer/edit?pkey="+urlEncodedKey+"&formerr=update")
+		return
+	}
+
+	SetFlashMessage(c, "changes applied successfully", "success")
+	c.Redirect(http.StatusSeeOther, "/user/peer/edit?pkey="+urlEncodedKey)
+}

internal/server/handlers_user.go

@@ -8,7 +8,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/h44z/wg-portal/internal/users"
 	csrf "github.com/utrack/gin-csrf"
-	"golang.org/x/crypto/bcrypt"
 	"gorm.io/gorm"
 )
 
@@ -84,6 +83,26 @@ func (s *Server) GetAdminUsersEdit(c *gin.Context) {
 	})
 }
 
+func (s *Server) GetAdminUsersDelete(c *gin.Context) {
+	user := s.users.GetUserUnscoped(c.Query("pkey"))
+	if user == nil {
+		SetFlashMessage(c, "invalid user", "danger")
+		c.Redirect(http.StatusSeeOther, "/admin/users/")
+		return
+	}
+
+	urlEncodedKey := url.QueryEscape(c.Query("pkey"))
+
+	if err := s.HardDeleteUser(*user); err != nil {
+		SetFlashMessage(c, "failed to delete user: "+err.Error(), "danger")
+		c.Redirect(http.StatusSeeOther, "/admin/users/edit?pkey="+urlEncodedKey+"&formerr=delete")
+		return
+	}
+
+	SetFlashMessage(c, "user deleted successfully", "success")
+	c.Redirect(http.StatusSeeOther, "/admin/users/")
+}
+
 func (s *Server) PostAdminUsersEdit(c *gin.Context) {
 	currentUser := s.users.GetUserUnscoped(c.Query("pkey"))
 	if currentUser == nil {
@@ -105,19 +124,6 @@ func (s *Server) PostAdminUsersEdit(c *gin.Context) {
 		return
 	}
 
-	if formUser.Password != "" {
-		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(formUser.Password), bcrypt.DefaultCost)
-		if err != nil {
-			_ = s.updateFormInSession(c, formUser)
-			SetFlashMessage(c, "failed to hash admin password", "danger")
-			c.Redirect(http.StatusSeeOther, "/admin/users/edit?pkey="+urlEncodedKey+"&formerr=bind")
-			return
-		}
-		formUser.Password = string(hashedPassword)
-	} else {
-		formUser.Password = currentUser.Password
-	}
-
 	disabled := c.PostForm("isdisabled") != ""
 	if disabled {
 		formUser.DeletedAt = gorm.DeletedAt{
@@ -127,7 +133,7 @@ func (s *Server) PostAdminUsersEdit(c *gin.Context) {
 	} else {
 		formUser.DeletedAt = gorm.DeletedAt{}
 	}
-	formUser.IsAdmin = c.PostForm("isadmin") == "true"
+	formUser.IsAdmin = c.PostForm("isadmin") != ""
 
 	if err := s.UpdateUser(formUser); err != nil {
 		_ = s.updateFormInSession(c, formUser)
@@ -175,15 +181,7 @@ func (s *Server) PostAdminUsersCreate(c *gin.Context) {
 		return
 	}
 
-	if formUser.Password != "" {
+	if formUser.Password == "" {
-		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(formUser.Password), bcrypt.DefaultCost)
-		if err != nil {
-			SetFlashMessage(c, "failed to hash admin password", "danger")
-			c.Redirect(http.StatusSeeOther, "/admin/users/create?formerr=bind")
-			return
-		}
-		formUser.Password = string(hashedPassword)
-	} else {
 		_ = s.updateFormInSession(c, formUser)
 		SetFlashMessage(c, "invalid password", "danger")
 		c.Redirect(http.StatusSeeOther, "/admin/users/create?formerr=create")

internal/server/ldapsync.go

@@ -1,12 +1,17 @@
 package server
 
 import (
+	"strings"
 	"time"
 
+	"github.com/h44z/wg-portal/internal/wireguard"
+
 	"github.com/h44z/wg-portal/internal/ldap"
 	"github.com/h44z/wg-portal/internal/users"
 	"github.com/sirupsen/logrus"
 	"gorm.io/gorm"
+
+	gldap "github.com/go-ldap/ldap/v3"
 )
 
 func (s *Server) SyncLdapWithUserDatabase() {
@@ -30,121 +35,137 @@ func (s *Server) SyncLdapWithUserDatabase() {
 			logrus.Errorf("failed to fetch users from ldap: %v", err)
 			continue
 		}
+		logrus.Tracef("found %d users in ldap", len(ldapUsers))
 
-		for i := range ldapUsers {
+		// Update existing LDAP users
-			// prefilter
+		s.updateLdapUsers(ldapUsers)
-			if ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute] == "" ||
-				ldapUsers[i].Attributes[s.config.LDAP.FirstNameAttribute] == "" ||
-				ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute] == "" {
-				continue
-			}
 
-			user, err := s.users.GetOrCreateUserUnscoped(ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute])
+		// Disable missing LDAP users
-			if err != nil {
+		s.disableMissingLdapUsers(ldapUsers)
-				logrus.Errorf("failed to get/create user %s in database: %v", ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute], err)
-			}
-
-			// check if user should be deactivated
-			ldapDeactivated := false
-			switch s.config.LDAP.Type {
-			case ldap.TypeActiveDirectory:
-				ldapDeactivated = ldap.IsActiveDirectoryUserDisabled(ldapUsers[i].Attributes[s.config.LDAP.DisabledAttribute])
-			case ldap.TypeOpenLDAP:
-				ldapDeactivated = ldap.IsOpenLdapUserDisabled(ldapUsers[i].Attributes[s.config.LDAP.DisabledAttribute])
-			}
-
-			// check if user has been disabled in ldap, update peers accordingly
-			if ldapDeactivated != user.DeletedAt.Valid {
-				if ldapDeactivated {
-					// disable all peers for the given user
-					for _, peer := range s.peers.GetPeersByMail(user.Email) {
-						now := time.Now()
-						peer.DeactivatedAt = &now
-						if err = s.UpdatePeer(peer, now); err != nil {
-							logrus.Errorf("failed to update deactivated peer %s: %v", peer.PublicKey, err)
-						}
-					}
-				} else {
-					// enable all peers for the given user
-					for _, peer := range s.peers.GetPeersByMail(user.Email) {
-						now := time.Now()
-						peer.DeactivatedAt = nil
-						if err = s.UpdatePeer(peer, now); err != nil {
-							logrus.Errorf("failed to update activated peer %s: %v", peer.PublicKey, err)
-						}
-					}
-				}
-			}
-
-			// Sync attributes from ldap
-			if s.UserChangedInLdap(user, &ldapUsers[i]) {
-				user.Firstname = ldapUsers[i].Attributes[s.config.LDAP.FirstNameAttribute]
-				user.Lastname = ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute]
-				user.Email = ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute]
-				user.Phone = ldapUsers[i].Attributes[s.config.LDAP.PhoneAttribute]
-				user.IsAdmin = false
-				user.Source = users.UserSourceLdap
-				user.DeletedAt = gorm.DeletedAt{} // Not deleted
-
-				for _, group := range ldapUsers[i].RawAttributes[s.config.LDAP.GroupMemberAttribute] {
-					if string(group) == s.config.LDAP.AdminLdapGroup {
-						user.IsAdmin = true
-						break
-					}
-				}
-
-				if err = s.users.UpdateUser(user); err != nil {
-					logrus.Errorf("failed to update ldap user %s in database: %v", user.Email, err)
-					continue
-				}
-
-				if ldapDeactivated {
-					if err = s.users.DeleteUser(user); err != nil {
-						logrus.Errorf("failed to delete deactivated user %s in database: %v", user.Email, err)
-						continue
-					}
-				}
-			}
-		}
 	}
 	logrus.Info("ldap user synchronization stopped")
 }
 
-func (s Server) UserChangedInLdap(user *users.User, ldapData *ldap.RawLdapData) bool {
+func (s Server) userIsInAdminGroup(ldapData *ldap.RawLdapData) bool {
+	if s.config.LDAP.EveryoneAdmin {
+		return true
+	}
+	if s.config.LDAP.AdminLdapGroup_ == nil {
+		return false
+	}
+	for _, group := range ldapData.RawAttributes[s.config.LDAP.GroupMemberAttribute] {
+		var dn, _ = gldap.ParseDN(string(group))
+		if s.config.LDAP.AdminLdapGroup_.Equal(dn) {
+			return true
+		}
+	}
+	return false
+}
+
+func (s Server) userChangedInLdap(user *users.User, ldapData *ldap.RawLdapData) bool {
 	if user.Firstname != ldapData.Attributes[s.config.LDAP.FirstNameAttribute] {
 		return true
 	}
 	if user.Lastname != ldapData.Attributes[s.config.LDAP.LastNameAttribute] {
 		return true
 	}
-	if user.Email != ldapData.Attributes[s.config.LDAP.EmailAttribute] {
+	if user.Email != strings.ToLower(ldapData.Attributes[s.config.LDAP.EmailAttribute]) {
 		return true
 	}
 	if user.Phone != ldapData.Attributes[s.config.LDAP.PhoneAttribute] {
 		return true
 	}
-
+	if user.Source != users.UserSourceLdap {
-	ldapDeactivated := false
-	switch s.config.LDAP.Type {
-	case ldap.TypeActiveDirectory:
-		ldapDeactivated = ldap.IsActiveDirectoryUserDisabled(ldapData.Attributes[s.config.LDAP.DisabledAttribute])
-	case ldap.TypeOpenLDAP:
-		ldapDeactivated = ldap.IsOpenLdapUserDisabled(ldapData.Attributes[s.config.LDAP.DisabledAttribute])
-	}
-	if ldapDeactivated != user.DeletedAt.Valid {
 		return true
 	}
 
-	ldapAdmin := false
+	if user.DeletedAt.Valid {
-	for _, group := range ldapData.RawAttributes[s.config.LDAP.GroupMemberAttribute] {
+		return true
-		if string(group) == s.config.LDAP.AdminLdapGroup {
-			ldapAdmin = true
-			break
-		}
 	}
-	if user.IsAdmin != ldapAdmin {
+
+	if user.IsAdmin != s.userIsInAdminGroup(ldapData) {
 		return true
 	}
 
 	return false
 }
+
+func (s *Server) disableMissingLdapUsers(ldapUsers []ldap.RawLdapData) {
+	// Disable missing LDAP users
+	activeUsers := s.users.GetUsers()
+	for i := range activeUsers {
+		if activeUsers[i].Source != users.UserSourceLdap {
+			continue
+		}
+
+		existsInLDAP := false
+		for j := range ldapUsers {
+			if activeUsers[i].Email == strings.ToLower(ldapUsers[j].Attributes[s.config.LDAP.EmailAttribute]) {
+				existsInLDAP = true
+				break
+			}
+		}
+
+		if existsInLDAP {
+			continue
+		}
+
+		// disable all peers for the given user
+		for _, peer := range s.peers.GetPeersByMail(activeUsers[i].Email) {
+			now := time.Now()
+			peer.DeactivatedAt = &now
+			peer.DeactivatedReason = wireguard.DeactivatedReasonLdapMissing
+			if err := s.UpdatePeer(peer, now); err != nil {
+				logrus.Errorf("failed to update deactivated peer %s: %v", peer.PublicKey, err)
+			}
+		}
+
+		if err := s.users.DeleteUser(&activeUsers[i], true); err != nil {
+			logrus.Errorf("failed to delete deactivated user %s in database: %v", activeUsers[i].Email, err)
+		}
+	}
+}
+
+func (s *Server) updateLdapUsers(ldapUsers []ldap.RawLdapData) {
+	for i := range ldapUsers {
+		if ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute] == "" {
+			logrus.Tracef("skipping sync of %s, empty email attribute", ldapUsers[i].DN)
+			continue
+		}
+
+		user, err := s.users.GetOrCreateUserUnscoped(ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute])
+		if err != nil {
+			logrus.Errorf("failed to get/create user %s in database: %v", ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute], err)
+		}
+
+		// re-enable LDAP user if the user was disabled
+		if user.DeletedAt.Valid {
+			// enable all peers for the given user
+			for _, peer := range s.peers.GetPeersByMail(user.Email) {
+				now := time.Now()
+				peer.DeactivatedAt = nil
+				peer.DeactivatedReason = ""
+				if err = s.UpdatePeer(peer, now); err != nil {
+					logrus.Errorf("failed to update activated peer %s: %v", peer.PublicKey, err)
+				}
+			}
+		}
+
+		// Sync attributes from ldap
+		if s.userChangedInLdap(user, &ldapUsers[i]) {
+			logrus.Debugf("updating ldap user %s", user.Email)
+			user.Firstname = ldapUsers[i].Attributes[s.config.LDAP.FirstNameAttribute]
+			user.Lastname = ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute]
+			user.Email = ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute]
+			user.Phone = ldapUsers[i].Attributes[s.config.LDAP.PhoneAttribute]
+			user.IsAdmin = s.userIsInAdminGroup(&ldapUsers[i])
+			user.Source = users.UserSourceLdap
+			user.DeletedAt = gorm.DeletedAt{} // Not deleted
+
+			if err = s.users.UpdateUser(user); err != nil {
+				logrus.Errorf("failed to update ldap user %s in database: %v", user.Email, err)
+				continue
+			}
+		}
+	}
+}

internal/server/routes.go

@@ -2,12 +2,25 @@ package server
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 	wgportal "github.com/h44z/wg-portal"
+	_ "github.com/h44z/wg-portal/internal/server/docs" // docs is generated by Swag CLI, you have to import it.
+	ginSwagger "github.com/swaggo/gin-swagger"
+	"github.com/swaggo/gin-swagger/swaggerFiles"
+	csrf "github.com/utrack/gin-csrf"
 )
 
 func SetupRoutes(s *Server) {
+	csrfMiddleware := csrf.Middleware(csrf.Options{
+		Secret: s.config.Core.SessionSecret,
+		ErrorFunc: func(c *gin.Context) {
+			c.String(400, "CSRF token mismatch")
+			c.Abort()
+		},
+	})
+
 	// Startpage
 	s.server.GET("/", s.GetIndex)
 	s.server.GET("/favicon.ico", func(c *gin.Context) {
@@ -21,12 +34,14 @@ func SetupRoutes(s *Server) {
 
 	// Auth routes
 	auth := s.server.Group("/auth")
+	auth.Use(csrfMiddleware)
 	auth.GET("/login", s.GetLogin)
 	auth.POST("/login", s.PostLogin)
 	auth.GET("/logout", s.GetLogout)
 
 	// Admin routes
 	admin := s.server.Group("/admin")
+	admin.Use(csrfMiddleware)
 	admin.Use(s.RequireAuthentication("admin"))
 	admin.GET("/", s.GetAdminIndex)
 	admin.GET("/device/edit", s.GetAdminEditInterface)
@@ -43,21 +58,69 @@ func SetupRoutes(s *Server) {
 	admin.GET("/peer/delete", s.GetAdminDeletePeer)
 	admin.GET("/peer/download", s.GetPeerConfig)
 	admin.GET("/peer/email", s.GetPeerConfigMail)
+	admin.GET("/peer/emailall", s.GetAdminSendEmails)
 
 	admin.GET("/users/", s.GetAdminUsersIndex)
 	admin.GET("/users/create", s.GetAdminUsersCreate)
 	admin.POST("/users/create", s.PostAdminUsersCreate)
 	admin.GET("/users/edit", s.GetAdminUsersEdit)
+	admin.GET("/users/delete", s.GetAdminUsersDelete)
 	admin.POST("/users/edit", s.PostAdminUsersEdit)
 
 	// User routes
 	user := s.server.Group("/user")
+	user.Use(csrfMiddleware)
 	user.Use(s.RequireAuthentication("")) // empty scope = all logged in users
 	user.GET("/qrcode", s.GetPeerQRCode)
 	user.GET("/profile", s.GetUserIndex)
 	user.GET("/download", s.GetPeerConfig)
 	user.GET("/email", s.GetPeerConfigMail)
 	user.GET("/status", s.GetPeerStatus)
+
+	if s.config.WG.UserManagePeers {
+		user.GET("/peer/create", s.GetUserCreatePeer)
+		user.POST("/peer/create", s.PostUserCreatePeer)
+		user.GET("/peer/edit", s.GetUserEditPeer)
+		user.POST("/peer/edit", s.PostUserEditPeer)
+	}
+}
+
+func SetupApiRoutes(s *Server) {
+	api := ApiServer{s: s}
+
+	// Admin authenticated routes
+	apiV1Backend := s.server.Group("/api/v1/backend")
+	apiV1Backend.Use(s.RequireApiAuthentication("admin"))
+
+	apiV1Backend.GET("/users", api.GetUsers)
+	apiV1Backend.POST("/users", api.PostUser)
+	apiV1Backend.GET("/user", api.GetUser)
+	apiV1Backend.PUT("/user", api.PutUser)
+	apiV1Backend.PATCH("/user", api.PatchUser)
+	apiV1Backend.DELETE("/user", api.DeleteUser)
+
+	apiV1Backend.GET("/peers", api.GetPeers)
+	apiV1Backend.POST("/peers", api.PostPeer)
+	apiV1Backend.GET("/peer", api.GetPeer)
+	apiV1Backend.PUT("/peer", api.PutPeer)
+	apiV1Backend.PATCH("/peer", api.PatchPeer)
+	apiV1Backend.DELETE("/peer", api.DeletePeer)
+
+	apiV1Backend.GET("/devices", api.GetDevices)
+	apiV1Backend.GET("/device", api.GetDevice)
+	apiV1Backend.PUT("/device", api.PutDevice)
+	apiV1Backend.PATCH("/device", api.PatchDevice)
+
+	// Simple authenticated routes
+	apiV1Deployment := s.server.Group("/api/v1/provisioning")
+	apiV1Deployment.Use(s.RequireApiAuthentication(""))
+
+	apiV1Deployment.GET("/peers", api.GetPeerDeploymentInformation)
+	apiV1Deployment.GET("/peer", api.GetPeerDeploymentConfig)
+	apiV1Deployment.POST("/peers", api.PostPeerDeploymentConfig)
+
+	// Swagger doc/ui
+	s.server.GET("/swagger/*any", ginSwagger.WrapHandler(swaggerFiles.Handler))
 }
 
 func (s *Server) RequireAuthentication(scope string) gin.HandlerFunc {
@@ -78,7 +141,7 @@ func (s *Server) RequireAuthentication(scope string) gin.HandlerFunc {
 			return
 		}
 
-		// default case if some randome scope was set...
+		// default case if some random scope was set...
 		if scope != "" && !session.IsAdmin {
 			// Abort the request with the appropriate error code
 			c.Abort()
@@ -86,6 +149,66 @@ func (s *Server) RequireAuthentication(scope string) gin.HandlerFunc {
 			return
 		}
 
+		// Check if logged-in user is still valid
+		if !s.isUserStillValid(session.Email) {
+			_ = DestroySessionData(c)
+			c.Abort()
+			s.GetHandleError(c, http.StatusUnauthorized, "unauthorized", "session no longer available")
+			return
+		}
+
+		// Continue down the chain to handler etc
+		c.Next()
+	}
+}
+
+func (s *Server) RequireApiAuthentication(scope string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		username, password, hasAuth := c.Request.BasicAuth()
+		if !hasAuth {
+			c.Abort()
+			c.JSON(http.StatusUnauthorized, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// Validate form input
+		if strings.Trim(username, " ") == "" || strings.Trim(password, " ") == "" {
+			c.Abort()
+			c.JSON(http.StatusUnauthorized, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// Check all available auth backends
+		user, err := s.checkAuthentication(username, password)
+		if err != nil {
+			c.Abort()
+			c.JSON(http.StatusInternalServerError, ApiError{Message: "login error"})
+			return
+		}
+
+		// Check if user is authenticated
+		if user == nil {
+			c.Abort()
+			c.JSON(http.StatusUnauthorized, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// Check admin scope
+		if scope == "admin" && !user.IsAdmin {
+			// Abort the request with the appropriate error code
+			c.Abort()
+			c.JSON(http.StatusForbidden, ApiError{Message: "unauthorized"})
+			return
+		}
+
+		// default case if some random scope was set...
+		if scope != "" && !user.IsAdmin {
+			// Abort the request with the appropriate error code
+			c.Abort()
+			c.JSON(http.StatusForbidden, ApiError{Message: "unauthorized"})
+			return
+		}
+
 		// Continue down the chain to handler etc
 		c.Next()
 	}

internal/server/server.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"encoding/gob"
 	"html/template"
+	"io"
 	"io/fs"
-	"io/ioutil"
 	"math/rand"
 	"net/http"
 	"net/url"
@@ -26,7 +26,6 @@ import (
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	ginlogrus "github.com/toorop/gin-logrus"
-	csrf "github.com/utrack/gin-csrf"
 	"gorm.io/gorm"
 )
 
@@ -104,28 +103,31 @@ func (s *Server) Setup(ctx context.Context) error {
 	if err != nil {
 		return errors.WithMessage(err, "database setup failed")
 	}
-	err = common.MigrateDatabase(s.db, Version)
+	err = common.MigrateDatabase(s.db, DatabaseVersion)
 	if err != nil {
 		return errors.WithMessage(err, "database migration failed")
 	}
 
 	// Setup http server
 	gin.SetMode(gin.DebugMode)
-	gin.DefaultWriter = ioutil.Discard
+	gin.DefaultWriter = io.Discard
 	s.server = gin.New()
 	if logrus.GetLevel() == logrus.TraceLevel {
 		s.server.Use(ginlogrus.Logger(logrus.StandardLogger()))
 	}
 	s.server.Use(gin.Recovery())
-	s.server.Use(sessions.Sessions("authsession", memstore.NewStore([]byte(s.config.Core.SessionSecret))))
+
-	s.server.Use(csrf.Middleware(csrf.Options{
+	// Authentication cookies
-		Secret: s.config.Core.SessionSecret,
+	cookieStore := memstore.NewStore([]byte(s.config.Core.SessionSecret))
-		ErrorFunc: func(c *gin.Context) {
+	cookieStore.Options(sessions.Options{
-			c.String(400, "CSRF token mismatch")
+		Path:     "/",
-			c.Abort()
+		MaxAge:   86400, // auth session is valid for 1 day
-		},
+		Secure:   strings.HasPrefix(s.config.Core.ExternalUrl, "https"),
-	}))
+		HttpOnly: true,
+	})
+	s.server.Use(sessions.Sessions("authsession", cookieStore))
 	s.server.SetFuncMap(template.FuncMap{
+		"formatDate":  common.FormatDateHTML,
 		"formatBytes": common.ByteCountSI,
 		"urlEncode":   url.QueryEscape,
 		"startsWith":  strings.HasPrefix,
@@ -151,6 +153,7 @@ func (s *Server) Setup(ctx context.Context) error {
 
 	// Setup all routes
 	SetupRoutes(s)
+	SetupApiRoutes(s)
 
 	// Setup user database (also needed for database authentication)
 	s.users, err = users.NewManager(s.db)
@@ -213,6 +216,8 @@ func (s *Server) Run() {
 		go s.SyncLdapWithUserDatabase()
 	}
 
+	go s.RunBackgroundTasks(s.ctx)
+
 	// Run web service
 	srv := &http.Server{
 		Addr:    s.config.Core.ListeningAddress,
@@ -251,7 +256,7 @@ func (s *Server) getExecutableDirectory() string {
 func (s *Server) getStaticData() StaticData {
 	return StaticData{
 		WebsiteTitle: s.config.Core.Title,
-		WebsiteLogo:  "/img/header-logo.png",
+		WebsiteLogo:  s.config.Core.LogoUrl,
 		CompanyName:  s.config.Core.CompanyName,
 		Year:         time.Now().Year(),
 		Version:      Version,

internal/server/server_helper.go

@@ -1,9 +1,10 @@
 package server
 
 import (
+	"context"
 	"crypto/md5"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"path"
 	"syscall"
 	"time"
@@ -12,6 +13,7 @@ import (
 	"github.com/h44z/wg-portal/internal/wireguard"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
+	"golang.org/x/crypto/bcrypt"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"gorm.io/gorm"
 )
@@ -52,6 +54,7 @@ func (s *Server) PrepareNewPeer(device string) (wireguard.Peer, error) {
 		peer.PersistentKeepalive = dev.DefaultPersistentKeepalive
 		peer.AllowedIPsStr = dev.DefaultAllowedIPsStr
 		peer.Mtu = dev.Mtu
+		peer.DeviceName = device
 	case wireguard.DeviceTypeClient:
 		peer.UID = "newendpoint"
 	}
@@ -60,7 +63,7 @@ func (s *Server) PrepareNewPeer(device string) (wireguard.Peer, error) {
 }
 
 // CreatePeerByEmail creates a new peer for the given email.
-func (s *Server) CreatePeerByEmail(device, email, identifierSuffix string, disabled bool) error {
+func (s *Server) CreatePeerByEmail(device, email, identifierSuffix string) error {
 	user := s.users.GetUser(email)
 
 	peer, err := s.PrepareNewPeer(device)
@@ -73,10 +76,6 @@ func (s *Server) CreatePeerByEmail(device, email, identifierSuffix string, disab
 	} else {
 		peer.Identifier = fmt.Sprintf("%s (%s)", email, identifierSuffix)
 	}
-	now := time.Now()
-	if disabled {
-		peer.DeactivatedAt = &now
-	}
 
 	return s.CreatePeer(device, peer)
 }
@@ -101,21 +100,29 @@ func (s *Server) CreatePeer(device string, peer wireguard.Peer) error {
 		}
 		peer.SetIPAddresses(peerIPs...)
 	}
-	if peer.PrivateKey == "" && dev.Type == wireguard.DeviceTypeServer { // if private key is empty create a new one
+	if peer.PresharedKey == "" && dev.Type == wireguard.DeviceTypeServer { // if preshared key is empty create a new one
+
 		psk, err := wgtypes.GenerateKey()
 		if err != nil {
 			return errors.Wrap(err, "failed to generate key")
 		}
+		peer.PresharedKey = psk.String()
+	}
+
+	if peer.PrivateKey == "" && peer.PublicKey == "" && dev.Type == wireguard.DeviceTypeServer { // if private key is empty create a new one
+
 		key, err := wgtypes.GeneratePrivateKey()
 		if err != nil {
 			return errors.Wrap(err, "failed to generate private key")
 		}
-		peer.PresharedKey = psk.String()
 		peer.PrivateKey = key.String()
 		peer.PublicKey = key.PublicKey().String()
 	}
 	peer.DeviceName = dev.DeviceName
 	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
+	if peer.ExpiresAt != nil && peer.ExpiresAt.IsZero() { // convert 01-01-0001 to nil
+		peer.ExpiresAt = nil
+	}
 
 	// Create WireGuard interface
 	if peer.DeactivatedAt == nil {
@@ -137,6 +144,13 @@ func (s *Server) UpdatePeer(peer wireguard.Peer, updateTime time.Time) error {
 	currentPeer := s.peers.GetPeerByKey(peer.PublicKey)
 	dev := s.peers.GetDevice(peer.DeviceName)
 
+	// Check if expiry date is in the future, an reactivate the peer in case.
+	if s.config.Core.ExpiryReEnable && currentPeer.DeactivatedReason == wireguard.DeactivatedReasonExpired &&
+		peer.ExpiresAt != nil && peer.ExpiresAt.After(time.Now()) {
+		peer.DeactivatedAt = nil
+		peer.DeactivatedReason = ""
+	}
+
 	// Update WireGuard device
 	var err error
 	switch {
@@ -152,6 +166,9 @@ func (s *Server) UpdatePeer(peer wireguard.Peer, updateTime time.Time) error {
 	}
 
 	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
+	if peer.ExpiresAt != nil && peer.ExpiresAt.IsZero() { // convert 01-01-0001 to nil
+		peer.ExpiresAt = nil
+	}
 
 	// Update in database
 	if err := s.peers.UpdatePeer(peer); err != nil {
@@ -202,12 +219,12 @@ func (s *Server) WriteWireGuardConfigFile(device string) error {
 	}
 
 	dev := s.peers.GetDevice(device)
-	cfg, err := dev.GetConfigFile(s.peers.GetActivePeers(device))
+	cfg, err := dev.GetConfigFile(s.peers.GetActivePeers(device), s.config.Core.WGExporterFriendlyNames)
 	if err != nil {
 		return errors.WithMessage(err, "failed to get config file")
 	}
 	filePath := path.Join(s.config.WG.ConfigDirectoryPath, dev.DeviceName+".conf")
-	if err := ioutil.WriteFile(filePath, cfg, 0644); err != nil {
+	if err := os.WriteFile(filePath, cfg, 0644); err != nil {
 		return errors.Wrap(err, "failed to write WireGuard config file")
 	}
 	return nil
@@ -225,6 +242,15 @@ func (s *Server) CreateUser(user users.User, device string) error {
 		return s.UpdateUser(user)
 	}
 
+	// Hash user password (if set)
+	if user.Password != "" {
+		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
+		if err != nil {
+			return errors.Wrap(err, "unable to hash password")
+		}
+		user.Password = users.PrivateString(hashedPassword)
+	}
+
 	// Create user in database
 	if err := s.users.CreateUser(&user); err != nil {
 		return errors.WithMessage(err, "failed to create user in manager")
@@ -237,22 +263,35 @@ func (s *Server) CreateUser(user users.User, device string) error {
 // UpdateUser updates the user in the database. If the user is marked as deleted, it will get remove from the database.
 // Also, if the user is re-enabled, all it's linked WireGuard peers will be activated again.
 func (s *Server) UpdateUser(user users.User) error {
-	if user.DeletedAt.Valid {
-		return s.DeleteUser(user)
-	}
-
 	currentUser := s.users.GetUserUnscoped(user.Email)
 
+	// Hash user password (if set)
+	if user.Password != "" {
+		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
+		if err != nil {
+			return errors.Wrap(err, "unable to hash password")
+		}
+		user.Password = users.PrivateString(hashedPassword)
+	} else {
+		user.Password = currentUser.Password // keep current password
+	}
+
 	// Update in database
 	if err := s.users.UpdateUser(&user); err != nil {
 		return errors.WithMessage(err, "failed to update user in manager")
 	}
 
-	// If user was deleted (disabled), reactivate it's peers
+	// Set to deleted (disabled) if user's deletedAt date is not empty
+	if user.DeletedAt.Valid {
+		return s.DeleteUser(user)
+	}
+
+	// Otherwise, if user was deleted (disabled), reactivate it's peers
 	if currentUser.DeletedAt.Valid {
 		for _, peer := range s.peers.GetPeersByMail(user.Email) {
 			now := time.Now()
 			peer.DeactivatedAt = nil
+			peer.DeactivatedReason = ""
 			if err := s.UpdatePeer(peer, now); err != nil {
 				logrus.Errorf("failed to update (re)activated peer %s for %s: %v", peer.PublicKey, user.Email, err)
 			}
@@ -262,24 +301,39 @@ func (s *Server) UpdateUser(user users.User) error {
 	return nil
 }
 
-// DeleteUser removes the user from the database.
+// DeleteUser soft-deletes the user from the database (disable the user).
 // Also, if the user has linked WireGuard peers, they will be deactivated.
 func (s *Server) DeleteUser(user users.User) error {
-	currentUser := s.users.GetUserUnscoped(user.Email)
-
 	// Update in database
-	if err := s.users.DeleteUser(&user); err != nil {
+	if err := s.users.DeleteUser(&user, true); err != nil {
+		return errors.WithMessage(err, "failed to disable user in manager")
+	}
+
+	// Disable users peers
+	for _, peer := range s.peers.GetPeersByMail(user.Email) {
+		now := time.Now()
+		peer.DeactivatedAt = &now
+		peer.DeactivatedReason = wireguard.DeactivatedReasonUserMissing
+		if err := s.UpdatePeer(peer, now); err != nil {
+			logrus.Errorf("failed to update deactivated peer %s for %s: %v", peer.PublicKey, user.Email, err)
+		}
+	}
+
+	return nil
+}
+
+// HardDeleteUser removes the user from the database.
+// Also, if the user has linked WireGuard peers, they will be deleted.
+func (s *Server) HardDeleteUser(user users.User) error {
+	// Update in database
+	if err := s.users.DeleteUser(&user, false); err != nil {
 		return errors.WithMessage(err, "failed to delete user in manager")
 	}
 
-	// If user was active, disable it's peers
+	// remove all linked peers
-	if !currentUser.DeletedAt.Valid {
+	for _, peer := range s.peers.GetPeersByMail(user.Email) {
-		for _, peer := range s.peers.GetPeersByMail(user.Email) {
+		if err := s.DeletePeer(peer); err != nil {
-			now := time.Now()
+			logrus.Errorf("failed to delete peer %s for %s: %v", peer.PublicKey, user.Email, err)
-			peer.DeactivatedAt = &now
-			if err := s.UpdatePeer(peer, now); err != nil {
-				logrus.Errorf("failed to update deactivated peer %s for %s: %v", peer.PublicKey, user.Email, err)
-			}
 		}
 	}
 
@@ -287,6 +341,11 @@ func (s *Server) DeleteUser(user users.User) error {
 }
 
 func (s *Server) CreateUserDefaultPeer(email, device string) error {
+	// Check if automatic peer creation is enabled
+	if !s.config.Core.CreateDefaultPeer {
+		return nil
+	}
+
 	// Check if user is active, if not, quit
 	var existingUser *users.User
 	if existingUser = s.users.GetUser(email); existingUser == nil {
@@ -294,18 +353,26 @@ func (s *Server) CreateUserDefaultPeer(email, device string) error {
 	}
 
 	// Check if user already has a peer setup, if not, create one
-	if s.config.Core.CreateDefaultPeer {
+	peers := s.peers.GetPeersByMail(email)
-		peers := s.peers.GetPeersByMail(email)
+	if len(peers) != 0 {
-		if len(peers) == 0 { // Create default vpn peer
+		return nil
-			if err := s.CreatePeer(device, wireguard.Peer{
+	}
-				Identifier: existingUser.Firstname + " " + existingUser.Lastname + " (Default)",
+
-				Email:      existingUser.Email,
+	// Create default vpn peer
-				CreatedBy:  existingUser.Email,
+	peer, err := s.PrepareNewPeer(device)
-				UpdatedBy:  existingUser.Email,
+	if err != nil {
-			}); err != nil {
+		return errors.WithMessage(err, "failed to prepare new peer")
-				return errors.WithMessagef(err, "failed to automatically create vpn peer for %s", email)
+	}
-			}
+	peer.Email = email
-		}
+	if existingUser.Firstname != "" && existingUser.Lastname != "" {
+		peer.Identifier = fmt.Sprintf("%s %s (%s)", existingUser.Firstname, existingUser.Lastname, "Default")
+	} else {
+		peer.Identifier = fmt.Sprintf("%s (%s)", existingUser.Email, "Default")
+	}
+	peer.CreatedBy = existingUser.Email
+	peer.UpdatedBy = existingUser.Email
+	if err := s.CreatePeer(device, peer); err != nil {
+		return errors.WithMessagef(err, "failed to automatically create vpn peer for %s", email)
 	}
 
 	return nil
@@ -321,3 +388,60 @@ func (s *Server) GetDeviceNames() map[string]string {
 
 	return devNames
 }
+
+func (s *Server) RunBackgroundTasks(ctx context.Context) {
+	running := true
+	for running {
+		select {
+		case <-ctx.Done():
+			running = false
+			continue
+		case <-time.After(time.Duration(s.config.Core.BackgroundTaskInterval) * time.Second):
+			// sleep completed, select will stop blocking
+		}
+
+		logrus.Debug("running periodic background tasks...")
+
+		err := s.checkExpiredPeers()
+		if err != nil {
+			logrus.Errorf("failed to check expired peers: %v", err)
+		}
+	}
+}
+
+func (s *Server) checkExpiredPeers() error {
+	now := time.Now()
+
+	for _, devName := range s.wg.Cfg.DeviceNames {
+		changed := false
+		peers := s.peers.GetAllPeers(devName)
+		for _, peer := range peers {
+			if peer.IsExpired() && !peer.IsDeactivated() {
+				changed = true
+
+				peer.UpdatedAt = now
+				peer.DeactivatedAt = &now
+				peer.DeactivatedReason = wireguard.DeactivatedReasonExpired
+
+				res := s.db.Save(&peer)
+				if res.Error != nil {
+					return fmt.Errorf("failed save expired peer %s: %w", peer.PublicKey, res.Error)
+				}
+
+				err := s.wg.RemovePeer(peer.DeviceName, peer.PublicKey)
+				if err != nil {
+					return fmt.Errorf("failed to expire peer %s: %w", peer.PublicKey, err)
+				}
+			}
+		}
+
+		if changed {
+			err := s.WriteWireGuardConfigFile(devName)
+			if err != nil {
+				return fmt.Errorf("failed to persist config for interface %s: %w", devName, err)
+			}
+		}
+	}
+
+	return nil
+}

internal/server/version.go

@@ -1,3 +1,4 @@
 package server
 
-var Version = "1.0.6"
+var Version = "testbuild"
+var DatabaseVersion = "1.0.9"

internal/users/manager.go

@@ -51,6 +51,8 @@ func (m Manager) UserExists(email string) bool {
 }
 
 func (m Manager) GetUser(email string) *User {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Where("email = ?", email).First(&user)
 
@@ -62,6 +64,8 @@ func (m Manager) GetUser(email string) *User {
 }
 
 func (m Manager) GetUserUnscoped(email string) *User {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Unscoped().Where("email = ?", email).First(&user)
 
@@ -93,6 +97,8 @@ func (m Manager) GetFilteredAndSortedUsersUnscoped(sortKey, sortDirection, searc
 }
 
 func (m Manager) GetOrCreateUser(email string) (*User, error) {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Where("email = ?", email).FirstOrInit(&user)
 
@@ -113,6 +119,8 @@ func (m Manager) GetOrCreateUser(email string) (*User, error) {
 }
 
 func (m Manager) GetOrCreateUserUnscoped(email string) (*User, error) {
+	email = strings.ToLower(email)
+
 	user := User{}
 	m.db.Unscoped().Where("email = ?", email).FirstOrInit(&user)
 
@@ -133,6 +141,8 @@ func (m Manager) GetOrCreateUserUnscoped(email string) (*User, error) {
 }
 
 func (m Manager) CreateUser(user *User) error {
+	user.Email = strings.ToLower(user.Email)
+	user.Source = UserSourceDatabase
 	res := m.db.Create(user)
 	if res.Error != nil {
 		return errors.Wrapf(res.Error, "failed to create user %s", user.Email)
@@ -142,6 +152,7 @@ func (m Manager) CreateUser(user *User) error {
 }
 
 func (m Manager) UpdateUser(user *User) error {
+	user.Email = strings.ToLower(user.Email)
 	res := m.db.Save(user)
 	if res.Error != nil {
 		return errors.Wrapf(res.Error, "failed to update user %s", user.Email)
@@ -150,8 +161,14 @@ func (m Manager) UpdateUser(user *User) error {
 	return nil
 }
 
-func (m Manager) DeleteUser(user *User) error {
+func (m Manager) DeleteUser(user *User, soft bool) error {
-	res := m.db.Delete(user)
+	user.Email = strings.ToLower(user.Email)
+	var res *gorm.DB
+	if soft {
+		res = m.db.Delete(user)
+	} else {
+		res = m.db.Unscoped().Delete(user)
+	}
 	if res.Error != nil {
 		return errors.Wrapf(res.Error, "failed to update user %s", user.Email)
 	}
@@ -200,7 +217,7 @@ func filterUsers(users []User, search string) []User {
 
 	filteredUsers := make([]User, 0, len(users))
 	for i := range users {
-		if strings.Contains(users[i].Email, search) ||
+		if strings.Contains(users[i].Email, strings.ToLower(search)) ||
 			strings.Contains(users[i].Firstname, search) ||
 			strings.Contains(users[i].Lastname, search) ||
 			strings.Contains(string(users[i].Source), search) ||

internal/users/user.go

@@ -11,15 +11,24 @@ type UserSource string
 const (
 	UserSourceLdap     UserSource = "ldap" // LDAP / ActiveDirectory
 	UserSourceDatabase UserSource = "db"   // sqlite / mysql database
-	UserSourceOIDC     UserSource = "oidc" // open id connect, TODO: implement
 )
 
+type PrivateString string
+
+func (PrivateString) MarshalJSON() ([]byte, error) {
+	return []byte(`""`), nil
+}
+
+func (PrivateString) String() string {
+	return ""
+}
+
 // User is the user model that gets linked to peer entries, by default an empty usermodel with only the email address is created
 type User struct {
 	// required fields
 	Email   string `gorm:"primaryKey" form:"email" binding:"required,email"`
 	Source  UserSource
-	IsAdmin bool
+	IsAdmin bool `form:"isadmin"`
 
 	// optional fields
 	Firstname string `form:"firstname" binding:"required"`
@@ -27,10 +36,10 @@ type User struct {
 	Phone     string `form:"phone" binding:"omitempty"`
 
 	// optional, integrated password authentication
-	Password string `form:"password" binding:"omitempty"`
+	Password PrivateString `form:"password" binding:"omitempty"`
 
 	// database internal fields
 	CreatedAt time.Time
 	UpdatedAt time.Time
-	DeletedAt gorm.DeletedAt `gorm:"index"`
+	DeletedAt gorm.DeletedAt `gorm:"index" json:",omitempty" swaggertype:"string"`
 }

internal/wireguard/config.go

@@ -3,10 +3,11 @@ package wireguard
 import "github.com/h44z/wg-portal/internal/common"
 
 type Config struct {
-	DeviceNames         []string `yaml:"devices" envconfig:"WG_DEVICES"`              // managed devices
+	DeviceNames         []string `yaml:"devices" envconfig:"WG_DEVICES"`                // managed devices
-	DefaultDeviceName   string   `yaml:"defaultDevice" envconfig:"WG_DEFAULT_DEVICE"` // this device is used for auto-created peers, use GetDefaultDeviceName() to access this field
+	DefaultDeviceName   string   `yaml:"defaultDevice" envconfig:"WG_DEFAULT_DEVICE"`   // this device is used for auto-created peers, use GetDefaultDeviceName() to access this field
-	ConfigDirectoryPath string   `yaml:"configDirectory" envconfig:"WG_CONFIG_PATH"`  // optional, if set, updates will be written to this path, filename: <devicename>.conf
+	ConfigDirectoryPath string   `yaml:"configDirectory" envconfig:"WG_CONFIG_PATH"`    // optional, if set, updates will be written to this path, filename: <devicename>.conf
-	ManageIPAddresses   bool     `yaml:"manageIPAddresses" envconfig:"MANAGE_IPS"`    // handle ip-address setup of interface
+	ManageIPAddresses   bool     `yaml:"manageIPAddresses" envconfig:"MANAGE_IPS"`      // handle ip-address setup of interface
+	UserManagePeers     bool     `yaml:"userManagePeers" envconfig:"USER_MANAGE_PEERS"` // user can manage own peers
 }
 
 func (c Config) GetDefaultDeviceName() string {

internal/wireguard/manager.go

@@ -4,7 +4,6 @@ import (
 	"sync"
 
 	"github.com/pkg/errors"
-
 	"golang.zx2c4.com/wireguard/wgctrl"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )

internal/wireguard/manager_net.go

@@ -4,9 +4,8 @@ import (
 	"fmt"
 	"net"
 
-	"github.com/pkg/errors"
-
 	"github.com/milosgajdos/tenus"
+	"github.com/pkg/errors"
 )
 
 const DefaultMTU = 1420

internal/wireguard/peermanager.go

@@ -13,7 +13,6 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
-
 	"github.com/gin-gonic/gin/binding"
 	"github.com/go-playground/validator/v10"
 	"github.com/h44z/wg-portal/internal/common"
@@ -24,9 +23,19 @@ import (
 	"gorm.io/gorm"
 )
 
-//
+const (
+	DeactivatedReasonExpired     = "expired"
+	DeactivatedReasonUserEdit    = "user edit action"
+	DeactivatedReasonUserCreate  = "user create action"
+	DeactivatedReasonAdminEdit   = "admin edit action"
+	DeactivatedReasonAdminCreate = "admin create action"
+	DeactivatedReasonApiEdit     = "api edit action"
+	DeactivatedReasonApiCreate   = "api create action"
+	DeactivatedReasonLdapMissing = "missing in ldap"
+	DeactivatedReasonUserMissing = "missing user"
+)
+
 // CUSTOM VALIDATORS ----------------------------------------------------------------------------
-//
 var cidrList validator.Func = func(fl validator.FieldLevel) bool {
 	cidrListStr := fl.Field().String()
 
@@ -40,6 +49,22 @@ var cidrList validator.Func = func(fl validator.FieldLevel) bool {
 	return true
 }
 
+var dnsList validator.Func = func(fl validator.FieldLevel) bool {
+	dnsListStr := fl.Field().String()
+	dnsList := common.ParseStringList(dnsListStr)
+	validate := binding.Validator.Engine().(*validator.Validate)
+	for i := range dnsList {
+		ip := net.ParseIP(dnsList[i])
+		if ip == nil {
+			err := validate.Var(dnsList[i], "fqdn")
+			if err != nil {
+				return false
+			}
+		}
+	}
+	return true
+}
+
 var ipList validator.Func = func(fl validator.FieldLevel) bool {
 	ipListStr := fl.Field().String()
 	ipList := common.ParseStringList(ipListStr)
@@ -56,6 +81,7 @@ func init() {
 	if v, ok := binding.Validator.Engine().(*validator.Validate); ok {
 		_ = v.RegisterValidation("cidrlist", cidrList)
 		_ = v.RegisterValidation("iplist", ipList)
+		_ = v.RegisterValidation("dnsList", dnsList)
 	}
 }
 
@@ -64,9 +90,8 @@ func init() {
 //
 
 type Peer struct {
-	Peer   *wgtypes.Peer `gorm:"-"`                                 // WireGuard peer
+	Peer   *wgtypes.Peer `gorm:"-" json:"-"` // WireGuard peer
-	Device *Device       `gorm:"foreignKey:DeviceName" binding:"-"` // linked WireGuard device
+	Config string        `gorm:"-" json:"-"`
-	Config string        `gorm:"-"`
 
 	UID                  string     `form:"uid" binding:"required,alphanum"` // uid for html identification
 	DeviceName           string     `gorm:"index" form:"device" binding:"required"`
@@ -75,30 +100,35 @@ type Peer struct {
 	Email                string     `gorm:"index" form:"mail" binding:"required,email"`
 	IgnoreGlobalSettings bool       `form:"ignoreglobalsettings"`
 
-	IsOnline          bool   `gorm:"-"`
+	IsOnline          bool   `gorm:"-" json:"-"`
-	IsNew             bool   `gorm:"-"`
+	IsNew             bool   `gorm:"-" json:"-"`
-	LastHandshake     string `gorm:"-"`
+	LastHandshake     string `gorm:"-" json:"-"`
-	LastHandshakeTime string `gorm:"-"`
+	LastHandshakeTime string `gorm:"-" json:"-"`
 
 	// Core WireGuard Settings
 	PublicKey           string `gorm:"primaryKey" form:"pubkey" binding:"required,base64"` // the public key of the peer itself
 	PresharedKey        string `form:"presharedkey" binding:"omitempty,base64"`
-	AllowedIPsStr       string `form:"allowedip" binding:"cidrlist"` // a comma separated list of IPs that are used in the client config file
+	AllowedIPsStr       string `form:"allowedip" binding:"cidrlist"`    // a comma separated list of IPs that are used in the client config file
+	AllowedIPsSrvStr    string `form:"allowedipSrv" binding:"cidrlist"` // a comma separated list of IPs that are used in the server config file
 	Endpoint            string `form:"endpoint" binding:"omitempty,hostname_port"`
 	PersistentKeepalive int    `form:"keepalive" binding:"gte=0"`
 
 	// Misc. WireGuard Settings
 	PrivateKey string `form:"privkey" binding:"omitempty,base64"`
 	IPsStr     string `form:"ip" binding:"cidrlist,required_if=DeviceType server"` // a comma separated list of IPs of the client
-	DNSStr     string `form:"dns" binding:"iplist"`                                // comma separated list of the DNS servers for the client
+	DNSStr     string `form:"dns" binding:"dnsList"`                               // comma separated list of the DNS servers for the client
 	// Global Device Settings (can be ignored, only make sense if device is in server mode)
 	Mtu int `form:"mtu" binding:"gte=0,lte=1500"`
 
-	DeactivatedAt *time.Time
+	DeactivatedAt     *time.Time `json:",omitempty"`
-	CreatedBy     string
+	DeactivatedReason string     `json:",omitempty"`
-	UpdatedBy     string
+
-	CreatedAt     time.Time
+	ExpiresAt *time.Time `json:",omitempty" form:"expires_at" binding:"omitempty" time_format:"2006-01-02"`
-	UpdatedAt     time.Time
+
+	CreatedBy string
+	UpdatedBy string
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
 func (p *Peer) SetIPAddresses(addresses ...string) {
@@ -125,7 +155,11 @@ func (p Peer) GetAllowedIPs() []string {
 	return common.ParseStringList(p.AllowedIPsStr)
 }
 
-func (p Peer) GetConfig(_ *Device) wgtypes.PeerConfig {
+func (p Peer) GetAllowedIPsSrv() []string {
+	return common.ParseStringList(p.AllowedIPsSrvStr)
+}
+
+func (p Peer) GetConfig(dev *Device) wgtypes.PeerConfig {
 	publicKey, _ := wgtypes.ParseKey(p.PublicKey)
 
 	var presharedKey *wgtypes.Key
@@ -135,7 +169,7 @@ func (p Peer) GetConfig(_ *Device) wgtypes.PeerConfig {
 	}
 
 	var endpoint *net.UDPAddr
-	if p.Endpoint != "" {
+	if p.Endpoint != "" && dev.Type == DeviceTypeClient {
 		addr, err := net.ResolveUDPAddr("udp", p.Endpoint)
 		if err == nil {
 			endpoint = addr
@@ -148,12 +182,19 @@ func (p Peer) GetConfig(_ *Device) wgtypes.PeerConfig {
 		keepAlive = &keepAliveDuration
 	}
 
-	peerAllowedIPs := p.GetAllowedIPs()
+	allowedIPs := make([]net.IPNet, 0)
-	allowedIPs := make([]net.IPNet, len(peerAllowedIPs))
+	var peerAllowedIPs []string
-	for i, ip := range peerAllowedIPs {
+	switch dev.Type {
+	case DeviceTypeClient:
+		peerAllowedIPs = p.GetAllowedIPs()
+	case DeviceTypeServer:
+		peerAllowedIPs = p.GetIPAddresses()
+		peerAllowedIPs = append(peerAllowedIPs, p.GetAllowedIPsSrv()...)
+	}
+	for _, ip := range peerAllowedIPs {
 		_, ipNet, err := net.ParseCIDR(ip)
 		if err == nil {
-			allowedIPs[i] = *ipNet
+			allowedIPs = append(allowedIPs, *ipNet)
 		}
 	}
 
@@ -187,12 +228,21 @@ func (p Peer) GetConfigFile(device Device) ([]byte, error) {
 
 func (p Peer) GetQRCode() ([]byte, error) {
 	png, err := qrcode.Encode(p.Config, qrcode.Medium, 250)
-	if err != nil {
+	if err == nil {
-		logrus.WithFields(logrus.Fields{
+		return png, nil
-			"err": err,
+	}
-		}).Error("failed to create qrcode")
+
+	if err.Error() != "content too long to encode" {
+		logrus.Errorf("failed to create qrcode: %v", err)
 		return nil, errors.Wrap(err, "failed to encode qrcode")
 	}
+
+	png, err = qrcode.Encode(p.Config, qrcode.Low, 250)
+	if err != nil {
+		logrus.Errorf("failed to create qrcode: %v", err)
+		return nil, errors.Wrap(err, "failed to encode qrcode")
+	}
+
 	return png, nil
 }
 
@@ -204,6 +254,33 @@ func (p Peer) IsValid() bool {
 	return true
 }
 
+func (p Peer) WillExpire() bool {
+	if p.ExpiresAt == nil {
+		return false
+	}
+	if p.DeactivatedAt != nil {
+		return false // already deactivated...
+	}
+	if p.ExpiresAt.After(time.Now()) {
+		return true
+	}
+	return false
+}
+
+func (p Peer) IsExpired() bool {
+	if p.ExpiresAt == nil {
+		return false
+	}
+	if p.ExpiresAt.Before(time.Now()) {
+		return true
+	}
+	return false
+}
+
+func (p Peer) IsDeactivated() bool {
+	return p.DeactivatedAt != nil
+}
+
 func (p Peer) GetConfigFileName() string {
 	reg := regexp.MustCompile("[^a-zA-Z0-9_-]+")
 	return reg.ReplaceAllString(strings.ReplaceAll(p.Identifier, " ", "-"), "") + ".conf"
@@ -221,10 +298,11 @@ const (
 )
 
 type Device struct {
-	Interface *wgtypes.Device `gorm:"-"`
+	Interface *wgtypes.Device `gorm:"-" json:"-"`
+	Peers     []Peer          `gorm:"foreignKey:DeviceName" binding:"-" json:"-"` // linked WireGuard peers
 
 	Type        DeviceType `form:"devicetype" binding:"required,oneof=client server"`
-	DeviceName  string     `form:"device" gorm:"primaryKey" binding:"required,alphanum"`
+	DeviceName  string     `form:"device" gorm:"primaryKey" binding:"required" validator:"regexp=[0-9a-zA-Z\\-]+"`
 	DisplayName string     `form:"displayname" binding:"omitempty,max=200"`
 
 	// Core WireGuard Settings (Interface section)
@@ -235,7 +313,7 @@ type Device struct {
 	PublicKey    string `form:"pubkey" binding:"required,base64"`
 	Mtu          int    `form:"mtu" binding:"gte=0,lte=1500"`   // the interface MTU, wg-quick addition
 	IPsStr       string `form:"ip" binding:"required,cidrlist"` // comma separated list of the IPs of the client, wg-quick addition
-	DNSStr       string `form:"dns" binding:"iplist"`           // comma separated list of the DNS servers of the client, wg-quick addition
+	DNSStr       string `form:"dns" binding:"dnsList"`          // comma separated list of the DNS servers of the client, wg-quick addition
 	RoutingTable string `form:"routingtable"`                   // the routing table, wg-quick addition
 	PreUp        string `form:"preup"`                          // pre up script, wg-quick addition
 	PostUp       string `form:"postup"`                         // post up script, wg-quick addition
@@ -318,12 +396,13 @@ func (d Device) GetConfig() wgtypes.Config {
 	return cfg
 }
 
-func (d Device) GetConfigFile(peers []Peer) ([]byte, error) {
+func (d Device) GetConfigFile(peers []Peer, friendlyNames bool) ([]byte, error) {
 	var tplBuff bytes.Buffer
 
 	err := templateCache.ExecuteTemplate(&tplBuff, "interface.tpl", gin.H{
-		"Peers":     peers,
+		"Peers":         peers,
-		"Interface": d,
+		"Interface":     d,
+		"FriendlyNames": friendlyNames,
 	})
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to execute server template")
@@ -361,7 +440,7 @@ func NewPeerManager(db *gorm.DB, wg *Manager) (*PeerManager, error) {
 		}
 	}
 
-	if err := pm.db.AutoMigrate(&Peer{}, &Device{}); err != nil {
+	if err := pm.db.AutoMigrate(&Device{}, &Peer{}); err != nil {
 		return nil, errors.WithMessage(err, "failed to migrate peer database")
 	}
 
@@ -605,7 +684,7 @@ func (m *PeerManager) GetFilteredAndSortedPeers(device, sortKey, sortDirection,
 		m.populatePeerData(&peers[i])
 
 		if search == "" ||
-			strings.Contains(peers[i].Email, search) ||
+			strings.Contains(peers[i].Email, strings.ToLower(search)) ||
 			strings.Contains(peers[i].Identifier, search) ||
 			strings.Contains(peers[i].PublicKey, search) {
 			filteredPeers = append(filteredPeers, peers[i])
@@ -618,6 +697,7 @@ func (m *PeerManager) GetFilteredAndSortedPeers(device, sortKey, sortDirection,
 }
 
 func (m *PeerManager) GetSortedPeersForEmail(sortKey, sortDirection, email string) []Peer {
+	email = strings.ToLower(email)
 	peers := make([]Peer, 0)
 	m.db.Where("email = ?", email).Find(&peers)
 
@@ -686,6 +766,7 @@ func (m *PeerManager) GetPeerByKey(publicKey string) Peer {
 }
 
 func (m *PeerManager) GetPeersByMail(mail string) []Peer {
+	mail = strings.ToLower(mail)
 	var peers []Peer
 	m.db.Where("email = ?", mail).Find(&peers)
 	for i := range peers {
@@ -701,6 +782,7 @@ func (m *PeerManager) CreatePeer(peer Peer) error {
 	peer.UID = fmt.Sprintf("u%x", md5.Sum([]byte(peer.PublicKey)))
 	peer.UpdatedAt = time.Now()
 	peer.CreatedAt = time.Now()
+	peer.Email = strings.ToLower(peer.Email)
 
 	res := m.db.Create(&peer)
 	if res.Error != nil {
@@ -713,6 +795,7 @@ func (m *PeerManager) CreatePeer(peer Peer) error {
 
 func (m *PeerManager) UpdatePeer(peer Peer) error {
 	peer.UpdatedAt = time.Now()
+	peer.Email = strings.ToLower(peer.Email)
 
 	res := m.db.Save(&peer)
 	if res.Error != nil {

internal/wireguard/tpl/interface.tpl

@@ -56,12 +56,15 @@ PostDown = {{ .Interface.PostDown }}
 # -WGP- PrivateKey: {{.PrivateKey}}
 {{- end}}
 [Peer]
+{{- if $.FriendlyNames}}
+# friendly_name = {{ .Identifier }}
+{{- end}}
 PublicKey = {{ .PublicKey }}
 {{- if .PresharedKey}}
 PresharedKey = {{ .PresharedKey }}
 {{- end}}
 {{- if eq $.Interface.Type "server"}}
-AllowedIPs = {{ .IPsStr }}
+AllowedIPs = {{ .IPsStr }}{{if ne .AllowedIPsSrvStr ""}}, {{ .AllowedIPsSrvStr }}{{end}}
 {{- end}}
 {{- if eq $.Interface.Type "client"}}
 {{- if .AllowedIPsStr}}
@@ -75,4 +78,4 @@ Endpoint = {{ .Endpoint }}
 PersistentKeepalive = {{ .PersistentKeepalive }}
 {{- end}}
 {{- end}}
-{{end}}
+{{end}}

internal/wireguard/tpl/peer.tpl

@@ -5,7 +5,8 @@
 [Interface]
 
 # Core settings
-PrivateKey = {{ .Peer.PrivateKey }}
+
+PrivateKey = {{or .Peer.PrivateKey "<please-insert-your-private-key>" }}
 Address = {{ .Peer.IPsStr }}
 
 # Misc. settings (optional)

scripts/docker-healthcheck.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-set -e
-
-goss -g /app/goss/wgportal/goss.yaml validate --format json_oneline
-
-exit 0

scripts/goss/wgportal/goss-wait.yaml

@@ -1,3 +0,0 @@
-process:
-  wgportal:
-    running: true

scripts/goss/wgportal/goss.yaml

@@ -1,3 +0,0 @@
-process:
-  wgportal:
-    running: true

tests/README.md

@@ -0,0 +1,59 @@
+# pyswagger unittests for the API & UI
+
+## Requirements
+
+```
+wg-quick up conf/wg-example0.conf
+sudo LOG_LEVEL=debug CONFIG_FILE=conf/config.yml ../dist/wg-portal-amd64 
+
+python3 -m venv ~/venv/apitest
+~/venv/apitest/bin/pip install pyswagger mechanize requests pytest PyYAML
+```
+
+## Running
+
+### API
+```
+~/venv/apitest/bin/python3 -m unittest test_API.TestAPI 
+```
+
+### UI
+```
+~/venv/lsl/bin/pytest pytest_UI.py 
+```
+
+
+## Debugging
+Debugging for requests http request/response is included for the API unittesting.
+To use, adjust the log level for "api" logger to DEBUG
+
+```python
+log.setLevel(logging.DEBUG)
+<action>
+log.setLevel(logging.INFO)
+```
+This will provide:
+```
+2021-09-29 14:55:15,585 DEBUG api HTTP
+---------------- request ----------------
+GET http://localhost:8123/api/v1/provisioning/peers?Email=test%2Bn4gbm7%40example.org
+User-Agent: python-requests/2.26.0
+Accept-Encoding: gzip, deflate
+Accept: application/json
+Connection: keep-alive
+Authorization: Basic d2dAZXhhbXBsZS5vcmc6YWJhZGNob2ljZQ==
+
+None
+---------------- response ----------------
+200 OK http://localhost:8123/api/v1/provisioning/peers?Email=test%2Bn4gbm7%40example.org
+Content-Type: application/json; charset=utf-8
+Date: Wed, 29 Sep 2021 12:55:15 GMT
+Content-Length: 285
+
+[{"PublicKey":"hO3pxnft/8QL6nbE+79HN464Z+L4+D/JjUvNE+8LmTs=",
+"Identifier":"Test User (Default)","Device":"wg-example0","DeviceIdentifier":"example0"},
+{"PublicKey":"RVS2gsdRpFjyOpr1nAlEkrs194lQytaPHhaxL5amQxY=",
+"Identifier":"debug","Device":"wg-example0","DeviceIdentifier":"example0"}]
+```
+
+

tests/conf/config.yml

@@ -0,0 +1,27 @@
+core:
+  listeningAddress: :8123
+  externalUrl: https://wg.example.org
+  title: Example WireGuard VPN
+  company: Example.org
+  mailFrom: WireGuard VPN <noreply+wg@example.org>
+  logoUrl: /img/logo.png
+  adminUser: wg@example.org
+  adminPass: abadchoice
+  editableKeys: true
+  createDefaultPeer: true
+  selfProvisioning: true
+  ldapEnabled: false
+database:
+  typ: sqlite
+  database: test.db
+# :memory: does not work
+email:
+  host: 127.0.0.1
+  port: 25
+  tls: false
+wg:
+  devices:
+    - wg-example0
+  defaultDevice: wg-example0
+  configDirectory: /etc/wireguard
+  manageIPAddresses: true

tests/conf/wg-example0.conf

@@ -0,0 +1,16 @@
+# AUTOGENERATED FILE - DO NOT EDIT
+# -WGP- Interface: wg-example / Updated: 2021-09-27 08:52:05.537618409 +0000 UTC / Created: 2021-09-24 10:06:46.903674496 +0000 UTC
+# -WGP- Interface display name: TheInterface
+# -WGP- Interface mode: server
+# -WGP- PublicKey = HIgo9xNzJMWLKASShiTqIybxZ0U3wGLiUeJ1PKf8ykw=
+
+[Interface]
+
+# Core settings
+PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=
+Address = 10.0.0.0/24
+
+# Misc. settings (optional)
+ListenPort = 51820
+FwMark = 1
+SaveConfig = true

tests/pytest_UI.py

@@ -0,0 +1,214 @@
+import logging.config
+import http.cookiejar
+import random
+import string
+
+import mechanize
+import yaml
+import pytest
+
+
+@pytest.fixture(scope="function")
+def browser():
+    # Fake Cookie Policy to send the Secure cookies via http
+    class InSecureCookiePolicy(http.cookiejar.DefaultCookiePolicy):
+        def set_ok(self, cookie, request):
+            return True
+
+        def return_ok(self, cookie, request):
+            return True
+
+        def domain_return_ok(self, domain, request):
+            return True
+
+        def path_return_ok(self, path, request):
+            return True
+
+    b = mechanize.Browser()
+    b.set_cookiejar(http.cookiejar.CookieJar(InSecureCookiePolicy()))
+    b.set_handle_robots(False)
+    b.set_debug_http(True)
+    return b
+
+
+@pytest.fixture
+def config():
+    cfg = yaml.load(open('conf/config.yml', 'r'))
+    return cfg
+
+
+@pytest.fixture()
+def admin(browser, config):
+    auth = (c := config['core'])['adminUser'], c['adminPass']
+    return _login(browser, auth)
+
+def _create_user(admin, values):
+    b = admin
+    b.follow_link(text="User Management")
+    b.follow_link(predicate=has_attr('Add a user'))
+
+    # FIXME name form
+    b.select_form(predicate=lambda x: x.method == 'post')
+    for k, v in values.items():
+        b.form.set_value(v, k)
+    b.submit()
+    alert = b._factory.root.findall('body/div/div[@role="alert"]')
+    assert len(alert) == 1 and alert[0].text.strip() == "user created successfully"
+    return values["email"],values["password"]
+
+def _destroy_user(admin, uid):
+    b = admin
+    b.follow_link(text="User Management")
+    for user in b._factory.root.findall('body/div/div/table[@id="userTable"]/tbody/'):
+        email,*_ = list(map(lambda x: x.text.strip() if x.text else '', list(user)))
+        if email == uid:
+            break
+    else:
+        assert False
+    a = user.findall('td/a[@title="Edit user"]')
+    assert len(a) == 1
+    b.follow_link(url=a[0].attrib['href'])
+
+    # FIXME name form
+    b.select_form(predicate=lambda x: x.method == 'post')
+    disabled = b.find_control("isdisabled")
+    disabled.set_single("true")
+    b.submit()
+
+def _destroy_peer(admin, uid):
+    b = admin
+    b.follow_link(text="Administration")
+    peers = b._factory.root.findall('body/div/div/table[@id="userTable"]/tbody/tr')
+    for idx,peer in enumerate(peers):
+        if idx % 2 == 1:
+            continue
+        head, Identifier, PublicKey, EMail, IPs, Handshake, tail = list(map(lambda x: x.text.strip() if x.text else x, list(peer)))
+        print(Identifier)
+        if EMail != uid:
+            continue
+        peer = peers[idx+1]
+        a = peer.findall('.//a[@title="Delete peer"]')
+        assert len(a) == 1
+        b.follow_link(url=a[0].attrib['href'])
+
+
+def _list_peers(user):
+    r = []
+    b = user
+    b.follow_link(predicate=has_attr('User-Profile'))
+    profiles = b._factory.root.findall('body/div/div/table[@id="userTable"]/tbody/tr')
+    for idx,profile in enumerate(profiles):
+        if idx % 2 == 1:
+            continue
+        head, Identifier, PublicKey, EMail, IPs, Handshake = list(map(lambda x: x.text.strip() if x.text else x, list(profile)))
+        profile = profiles[idx+1]
+        pre = profile.findall('.//pre')
+        assert len(pre) == 1
+        r.append((PublicKey, pre))
+    return r
+
+
+@pytest.fixture(scope="session")
+def user_data():
+    values = {
+        "email": f"test+{randstr()}@example.org",
+        "password": randstr(12),
+        "firstname": randstr(8),
+        "lastname": randstr(12)
+    }
+    return values
+
+@pytest.fixture
+def user(admin, user_data, config):
+    b = admin
+    auth = _create_user(b, user_data)
+    _logout(b)
+    _login(b, auth)
+    assert b.find_link(predicate=has_attr('User-Profile'))
+    yield b
+    _logout(b)
+    auth = (c := config['core'])['adminUser'], c['adminPass']
+    _login(b, auth)
+    _destroy_user(b, user_data["email"])
+    _destroy_peer(b, user_data["email"])
+
+@pytest.fixture
+def peer(admin, user, user_data):
+    pass
+
+def _login(browser, auth):
+    b = browser
+    b.open("http://localhost:8123/")
+
+    b.follow_link(text="Login")
+
+    b.select_form(name="login")
+    username, password = auth
+    b.form.set_value(username, "username")
+    b.form.set_value(password, "password")
+    b.submit()
+    return b
+
+def _logout(browser):
+    browser.follow_link(text="Logout")
+    return browser
+
+def has_attr(value, attr='title'):
+    def find_attr(x):
+        return any([a == (attr, value) for a in x.attrs])
+    return find_attr
+
+
+def _server(browser, addr):
+    b = browser
+    b.follow_link(text="Administration")
+    b.follow_link(predicate=has_attr('Edit interface settings'))
+    b.select_form("server")
+
+    values = {
+        "displayname": "example0",
+        "endpoint": "wg.example.org:51280",
+        "ip": addr
+    }
+    for k, v in values.items():
+        b.form.set_value(v, k)
+
+    b.submit()
+    return b
+
+@pytest.fixture
+def server(admin):
+    return _server(admin, "10.0.0.0/24")
+
+def randstr(l=6):
+    return ''.join([random.choice(string.ascii_lowercase + string.digits) for i in range(l)])
+
+
+def test_admin_login(admin):
+    b = admin
+    b.find_link("Administration")
+
+
+def test_admin_server(admin):
+    ip = "10.0.0.0/28"
+    b = _server(admin, ip)
+    b.select_form("server")
+    assert ip == b.form.get_value("ip")
+
+
+def test_admin_create_peer(server, user_data):
+    auth = _create_user(server, user_data)
+
+
+def test_admin_create_user(admin, user_data):
+    auth = _create_user(admin, user_data)
+
+
+def test_user_login(server, user):
+    b = user
+    b.follow_link(predicate=has_attr('User-Profile'))
+
+def test_user_config(server, user):
+    b = user
+    peers = _list_peers(b)
+    assert len(peers) >= 1

tests/test_API.py

@@ -0,0 +1,484 @@
+import ipaddress
+import collections
+import string
+import unittest
+import datetime
+import re
+import uuid
+import subprocess
+import random
+
+import logging
+import logging.config
+
+import mechanize
+
+from pyswagger import App, Security
+from pyswagger.contrib.client.requests import Client
+
+
+log = logging.getLogger("api")
+
+class HttpFormatter(logging.Formatter):
+
+    def _formatHeaders(self, d):
+        return '\n'.join(f'{k}: {v}' for k, v in d.items())
+
+    def formatMessage(self, record):
+        result = super().formatMessage(record)
+        if record.name == 'api':
+            result += '''
+---------------- request ----------------
+{req.method} {req.url}
+{reqhdrs}
+
+{req.body}
+---------------- response ----------------
+{res.status_code} {res.reason} {res.url}
+{reshdrs}
+
+{res.text}
+---------------- end ----------------
+'''.format(req=record.req, res=record.res, reqhdrs=self._formatHeaders(record.req.headers),
+                reshdrs=self._formatHeaders(record.res.headers), )
+
+        return result
+
+
+logging.config.dictConfig(
+    {
+        "version": 1,
+        "formatters": {
+            "http": {
+                "()": HttpFormatter,
+                "format": "{asctime} {levelname} {name} {message}",
+                "style":'{',
+            },
+            "detailed": {
+                "class": "logging.Formatter",
+                "format": "%(asctime)s %(name)-9s %(levelname)-4s %(message)s",
+            },
+            "plain": {
+                "class": "logging.Formatter",
+                "format": "%(message)s",
+            }
+        },
+        "handlers": {
+            "console": {
+                "class": "logging.StreamHandler",
+                "level": "DEBUG",
+                "formatter": "detailed",
+            },
+            "console_http": {
+                "class": "logging.StreamHandler",
+                "level": "DEBUG",
+                "formatter": "http",
+            },
+        },
+        "root": {
+            "level": "DEBUG",
+            "handlers": ["console"],
+            "propagate": True
+        },
+        'loggers': {
+            'api': {
+                "level": "INFO",
+                "handlers": ["console_http"]
+            },
+            "requests.packages.urllib3": {
+                "level": "DEBUG",
+                "handlers": ["console"],
+                "propagate": True
+            },
+        },
+    }
+)
+
+log = logging.getLogger("api")
+
+class ApiError(Exception):
+    pass
+
+
+
+def logHttp(response, *args, **kwargs):
+    extra = {'req': response.request, 'res': response}
+    log.debug('HTTP', extra=extra)
+
+class WGPClient:
+    def __init__(self, url, *auths):
+        app = App._create_(url)
+        auth = Security(app)
+        for t, cred in auths:
+            auth.update_with(t, cred)
+
+        client = Client(auth)
+        self.app, self.client = app, client
+
+        self.client._Client__s.hooks['response'] = logHttp
+
+    def call(self, name, **kwargs):
+        #        print(f"{name} {kwargs}")
+        op = self.app.op[name]
+        req, resp = op(**kwargs)
+        now = datetime.datetime.now()
+        resp = self.client.request((req, resp))
+        then = datetime.datetime.now()
+        delta = then - now
+        #        print(f"{resp.status} {delta}")
+
+        if 200 <= resp.status <= 299:
+            pass
+        elif 400 <= resp.status <= 499:
+            raise ApiError(resp.data["Message"])
+        elif 500 == resp.status:
+            raise ValueError(resp.data["Message"])
+        elif 501 == resp.status:
+            raise NotImplementedError(name)
+        elif 502 <= resp.status <= 599:
+            raise ApiError(resp.data["Message"])
+        return resp
+
+    def GetDevice(self, **kwargs):
+        return self.call("GetDevice", **kwargs).data
+
+    def PatchDevice(self, **kwargs):
+        return self.call("PatchDevice", **kwargs).data
+
+    def PutDevice(self, **kwargs):
+        return self.call("PutDevice", **kwargs).data
+
+    def GetDevices(self, **kwargs):
+        # FIXME - could return empty list?
+        return self.call("GetDevices", **kwargs).data or []
+
+    def DeletePeer(self, **kwargs):
+        return self.call("DeletePeer", **kwargs).data
+
+    def GetPeer(self, **kwargs):
+        return self.call("GetPeer", **kwargs).data
+
+    def PatchPeer(self, **kwargs):
+        return self.call("PatchPeer", **kwargs).data
+
+    def PostPeer(self, **kwargs):
+        return self.call("PostPeer", **kwargs).data
+
+    def PutPeer(self, **kwargs):
+        return self.call("PutPeer", **kwargs).data
+
+    def GetPeerDeploymentConfig(self, **kwargs):
+        return self.call("GetPeerDeploymentConfig", **kwargs).data
+
+    def PostPeerDeploymentConfig(self, **kwargs):
+        return self.call("PostPeerDeploymentConfig", **kwargs).raw
+
+    def GetPeerDeploymentInformation(self, **kwargs):
+        return self.call("GetPeerDeploymentInformation", **kwargs).data
+
+    def GetPeers(self, **kwargs):
+        return self.call("GetPeers", **kwargs).data
+
+    def DeleteUser(self, **kwargs):
+        return self.call("DeleteUser", **kwargs).data
+
+    def GetUser(self, **kwargs):
+        return self.call("GetUser", **kwargs).data
+
+    def PatchUser(self, **kwargs):
+        return self.call("PatchUser", **kwargs).data
+
+    def PostUser(self, **kwargs):
+        return self.call("PostUser", **kwargs).data
+
+    def PutUser(self, **kwargs):
+        return self.call("PutUser", **kwargs).data
+
+    def GetUsers(self, **kwargs):
+        return self.call("GetUsers", **kwargs).data
+
+
+def generate_wireguard_keys():
+    """
+    Generate a WireGuard private & public key
+    Requires that the 'wg' command is available on PATH
+    Returns (private_key, public_key), both strings
+    """
+    privkey = subprocess.check_output("wg genkey", shell=True).decode("utf-8").strip()
+    pubkey = subprocess.check_output(f"echo '{privkey}' | wg pubkey", shell=True).decode("utf-8").strip()
+    return (privkey, pubkey)
+
+
+KeyTuple = collections.namedtuple("Keys", "private public")
+
+
+class TestAPI(unittest.TestCase):
+    URL = 'http://localhost:8123/swagger/doc.json'
+    AUTH = {
+        "api": ('ApiBasicAuth', ("wg@example.org", "abadchoice")),
+        "general": ('GeneralBasicAuth', ("wg@example.org", "abadchoice"))
+    }
+    DEVICE = "wg-example0"
+    IFADDR = "10.17.0.0/24"
+    log = logging.getLogger("TestAPI")
+
+
+    def _client(self, *auth):
+        auth = ["general"] if auth is None else auth
+        self.c = WGPClient(self.URL, *[self.AUTH[i] for i in auth])
+
+    @property
+    def randmail(self):
+        return 'test+' + ''.join(
+            [random.choice(string.ascii_lowercase + string.digits) for i in range(6)]) + '@example.org'
+
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.finishInstallation()
+
+    @classmethod
+    def finishInstallation(cls) -> None:
+        import http.cookiejar
+
+        # Fake Cookie Policy to send the Secure cookies via http
+        class InSecureCookiePolicy(http.cookiejar.DefaultCookiePolicy):
+            def set_ok(self, cookie, request):
+                return True
+
+            def return_ok(self, cookie, request):
+                return True
+
+            def domain_return_ok(self, domain, request):
+                return True
+
+            def path_return_ok(self, path, request):
+                return True
+
+        b = mechanize.Browser()
+        b.set_cookiejar(http.cookiejar.CookieJar(InSecureCookiePolicy()))
+        b.set_handle_robots(False)
+        b.open("http://localhost:8123/")
+
+        b.follow_link(text="Login")
+
+        b.select_form(name="login")
+        username, password = cls.AUTH['api'][1]
+        b.form.set_value(username, "username")
+        b.form.set_value(password, "password")
+
+        b.submit()
+
+        b.follow_link(text="Administration")
+        b.follow_link(predicate=lambda x: any([a == ('title', 'Edit interface settings') for a in x.attrs]))
+        b.select_form("server")
+
+        values = {
+            "displayname": "example0",
+            "endpoint": "wg.example.org:51280",
+            "ip": cls.IFADDR
+        }
+        for k, v in values.items():
+            b.form.set_value(v, k)
+
+        b.submit()
+
+        b.select_form("server")
+#        cls.log.debug(b.form.get_value("ip"))
+
+    def setUp(self) -> None:
+        self._client('api')
+        self.user = self.randmail
+
+        # create a user …
+        self.c.PostUser(User={"Firstname": "Test", "Lastname": "User", "Email": self.user})
+
+        self.keys = KeyTuple(*generate_wireguard_keys())
+
+
+    def _test_generate(self):
+        def key_of(op):
+            a, *b = list(filter(lambda x: len(x), re.split("([A-Z][a-z]+)", op.operationId)))
+            return ''.join(b), a
+
+        for op in sorted(self.c.app.op.values(), key=key_of):
+            print(f"""
+        def {op.operationId}(self, **kwargs):
+            return self. call("{op.operationId}", **kwargs)
+                """)
+
+    def test_ops(self):
+        for op in sorted(self.c.app.op.values(), key=lambda op: op.operationId):
+            self.assertTrue(hasattr(self.c, op.operationId), f"{op.operationId} is missing")
+
+    def test_Device(self):
+        # FIXME device has to be completed via webif to be valid before it can be used via API
+        devices = self.c.GetDevices()
+        self.assertTrue(len(devices) > 0)
+
+        for device in devices:
+            dev = self.c.GetDevice(DeviceName=device.DeviceName)
+            with self.assertRaises(NotImplementedError):
+                new = self.c.PutDevice(DeviceName=dev.DeviceName,
+                                       Device={
+                                           "DeviceName": dev.DeviceName,
+                                           "IPsStr": dev.IPsStr,
+                                           "PrivateKey": dev.PrivateKey,
+                                           "Type": "client",
+                                           "PublicKey": dev.PublicKey}
+                                       )
+            with self.assertRaises(NotImplementedError):
+                new = self.c.PatchDevice(DeviceName=dev.DeviceName,
+                                         Device={
+                                             "DeviceName": dev.DeviceName,
+                                             "IPsStr": dev.IPsStr,
+                                             "PrivateKey": dev.PrivateKey,
+                                             "Type": "client",
+                                             "PublicKey": dev.PublicKey}
+                                         )
+            break
+
+    def easy_peer(self):
+        data = self.c.PostPeerDeploymentConfig(ProvisioningRequest={"Email": self.user, "Identifier": "debug"})
+        data = data.decode()
+        pubkey = re.search("# -WGP- PublicKey: (?P<pubkey>[^\n]+)\n", data, re.MULTILINE)['pubkey']
+        privkey = re.search("PrivateKey = (?P<key>[^\n]+)\n", data, re.MULTILINE)['key']
+        self.keys = KeyTuple(privkey, pubkey)
+
+    def test_Peers(self):
+
+        privkey, pubkey = generate_wireguard_keys()
+        peer = {"UID": uuid.uuid4().hex,
+                "Identifier": uuid.uuid4().hex,
+                "DeviceName": self.DEVICE,
+                "PublicKey": pubkey,
+                "DeviceType": "client",
+                "IPsStr": str(self.IFADDR),
+                "Email": self.user}
+
+        # keypair is created server side if private key is not submitted
+        with self.assertRaisesRegex(ApiError, "peer not found"):
+            self.c.PostPeer(DeviceName=self.DEVICE, Peer=peer)
+
+        # create
+        peer["PrivateKey"] = privkey
+        p = self.c.PostPeer(DeviceName=self.DEVICE, Peer=peer)
+        self.assertListEqual([p.PrivateKey, p.PublicKey], [privkey, pubkey])
+
+        # lookup created peer
+        for p in self.c.GetPeers(DeviceName=self.DEVICE):
+            if pubkey == p.PublicKey:
+                break
+        else:
+            self.assertTrue(False)
+
+        # get
+        gp = self.c.GetPeer(PublicKey=p.PublicKey)
+        self.assertListEqual([gp.PrivateKey, gp.PublicKey], [p.PrivateKey, p.PublicKey])
+
+        # change?
+        peer['Identifier'] = 'changed'
+        n = self.c.PatchPeer(PublicKey=p.PublicKey, Peer=peer)
+        self.assertListEqual([n.PrivateKey, n.PublicKey], [privkey, pubkey])
+
+        # change ?
+        peer['Identifier'] = 'changedagain'
+        n = self.c.PutPeer(PublicKey=p.PublicKey, Peer=peer)
+        self.assertListEqual([n.PrivateKey, n.PublicKey], [privkey, pubkey])
+
+        # invalid change operations
+        n = peer.copy()
+        n['PrivateKey'], n['PublicKey'] = generate_wireguard_keys()
+        with self.assertRaisesRegex(ApiError, "PublicKey parameter must match the model public key"):
+            self.c.PutPeer(PublicKey=p.PublicKey, Peer=n)
+
+        with self.assertRaisesRegex(ApiError, "PublicKey parameter must match the model public key"):
+            self.c.PatchPeer(PublicKey=p.PublicKey, Peer=n)
+
+        n = self.c.DeletePeer(PublicKey=p.PublicKey)
+
+    def test_Deployment(self):
+        log.setLevel(logging.DEBUG)
+        self._client("general")
+        self.easy_peer()
+
+        self.c.GetPeerDeploymentConfig(PublicKey=self.keys.public)
+        self.c.GetPeerDeploymentInformation(Email=self.user)
+        log.setLevel(logging.INFO)
+
+    def test_User(self):
+        u = self.c.PostUser(User={"Firstname": "Test", "Lastname": "User", "Email": self.randmail})
+        for i in self.c.GetUsers():
+            if i.Email == u.Email:
+                break
+        else:
+            self.assertTrue(False)
+
+        u = self.c.GetUser(Email=u.Email)
+        self.c.PutUser(Email=u.Email, User={"Firstname": "Test", "Lastname": "User", "Email": u.Email})
+        self.c.PatchUser(Email=u.Email, User={"Firstname": "Test", "Lastname": "User", "Email": u.Email})
+
+        # list a deleted user
+        self.c.DeleteUser(Email=u.Email)
+
+        for i in self.c.GetUsers():
+            break
+
+
+    def _clear_peers(self):
+        for p in self.c.GetPeers(DeviceName=self.DEVICE):
+            self.c.DeletePeer(PublicKey=p.PublicKey)
+
+    def _clear_users(self):
+        for p in self.c.GetUsers():
+            if p.Email == self.AUTH['api'][1][0]:
+                continue
+            self.c.DeleteUser(Email=p.Email)
+
+
+    def _createPeer(self):
+        privkey, pubkey = generate_wireguard_keys()
+        peer = {"UID": uuid.uuid4().hex,
+                "Identifier": uuid.uuid4().hex,
+                "DeviceName": self.DEVICE,
+                "PublicKey": pubkey,
+                "PrivateKey": privkey,
+                "DeviceType": "client",
+                #                    "IPsStr": str(self.ifaddr),
+                "Email": self.user}
+        self.c.PostPeer(DeviceName=self.DEVICE, Peer=peer)
+        return pubkey
+
+    def test_address_exhaustion(self):
+        global log
+        self._clear_peers()
+        self._clear_users()
+
+        self.NETWORK = ipaddress.ip_network("10.0.0.0/29")
+        addr = ipaddress.ip_address(
+            random.randrange(int(self.NETWORK.network_address) + 1, int(self.NETWORK.broadcast_address) - 1))
+        self.__class__.IFADDR = str(ipaddress.ip_interface(f"{addr}/{self.NETWORK.prefixlen}"))
+
+        # reconfigure via web ui - set the ifaddr with less addrs in pool
+        self.finishInstallation()
+
+        keys = set()
+        EADDRESSEXHAUSTED = "failed to get available IP addresses: no more available address from cidr"
+        with self.assertRaisesRegex(ValueError, EADDRESSEXHAUSTED):
+            for i in range(self.NETWORK.num_addresses + 1):
+                keys.add(self._createPeer())
+
+        n = keys.pop()
+        self.c.DeletePeer(PublicKey=n)
+        self._createPeer()
+
+        with self.assertRaisesRegex(ValueError, EADDRESSEXHAUSTED):
+            self._createPeer()
+
+        # expand network
+        self.NETWORK = ipaddress.ip_network("10.0.0.0/28")
+        addr = ipaddress.ip_address(
+            random.randrange(int(self.NETWORK.network_address) + 1, int(self.NETWORK.broadcast_address) - 1))
+        self.__class__.IFADDR = str(ipaddress.ip_interface(f"{addr}/{self.NETWORK.prefixlen}"))
+        self.finishInstallation()
+        self._createPeer()
+