add dark mode (#482)

.github/workflows/chart.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'pull_request' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -60,7 +60,7 @@ jobs:
     permissions:
       packages: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
 
       - uses: docker/login-action@v3
         with:

.github/workflows/docker-publish.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -66,6 +66,10 @@ jobs:
             type=semver,pattern={{major}}
             type=semver,pattern=v{{major}}.{{minor}}
             type=semver,pattern=v{{major}}
+            # add v{{major}} tag, even for beta or release-canidate releases
+            type=match,pattern=(v\d),group=1,enable=${{ contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
+            # add {{major}} tag, even for beta releases or release-canidate releases
+            type=match,pattern=v(\d),group=1,enable=${{ contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
@@ -110,7 +114,7 @@ jobs:
       contents: write
     steps:
       - name: Download binaries
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v4
         with:
           name: binaries
 

.github/workflows/pages.yml

@@ -15,7 +15,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 

Dockerfile

@@ -20,7 +20,7 @@ RUN npm run build
 ######
 # Build backend
 ######
-FROM --platform=${BUILDPLATFORM} golang:1.25-alpine AS builder
+FROM --platform=${BUILDPLATFORM} golang:1.24-alpine AS builder
 # Set the working directory
 WORKDIR /build
 # Download dependencies

README.md

@@ -32,7 +32,6 @@ The configuration portal supports using a database (SQLite, MySQL, MsSQL, or Pos
 * Docker ready
 * Can be used with existing WireGuard setups
 * Support for multiple WireGuard interfaces
-* Supports multiple WireGuard backends (wgctrl or MikroTik [BETA])
 * Peer Expiry Feature
 * Handles route and DNS settings like wg-quick does
 * Exposes Prometheus metrics for monitoring and alerting

cmd/wg-portal/main.go

@@ -50,8 +50,7 @@ func main() {
 	database, err := adapters.NewSqlRepository(rawDb)
 	internal.AssertNoError(err)
 
-	wireGuard, err := wireguard.NewControllerManager(cfg)
+	wireGuard := adapters.NewWireGuardRepository()
-	internal.AssertNoError(err)
 
 	wgQuick := adapters.NewWgQuickRepo()
 
@@ -135,7 +134,7 @@ func main() {
 	apiV0EndpointUsers := handlersV0.NewUserEndpoint(cfg, apiV0Auth, validatorManager, apiV0BackendUsers)
 	apiV0EndpointInterfaces := handlersV0.NewInterfaceEndpoint(cfg, apiV0Auth, validatorManager, apiV0BackendInterfaces)
 	apiV0EndpointPeers := handlersV0.NewPeerEndpoint(cfg, apiV0Auth, validatorManager, apiV0BackendPeers)
-	apiV0EndpointConfig := handlersV0.NewConfigEndpoint(cfg, apiV0Auth, wireGuard)
+	apiV0EndpointConfig := handlersV0.NewConfigEndpoint(cfg, apiV0Auth)
 	apiV0EndpointTest := handlersV0.NewTestEndpoint(apiV0Auth)
 
 	apiFrontend := handlersV0.NewRestApi(apiV0Session,

docs/documentation/configuration/overview.md

@@ -25,9 +25,6 @@ core:
   import_existing: true
   restore_state: true
 
-backend:
-  default: local
-
 advanced:
   log_level: info
   log_pretty: false
@@ -105,7 +102,6 @@ webhook:
 
 Below you will find sections like
 [`core`](#core),
-[`backend`](#backend),
 [`advanced`](#advanced),
 [`database`](#database),
 [`statistics`](#statistics),
@@ -169,65 +165,6 @@ More advanced options are found in the subsequent `Advanced` section.
 
 ---
 
-## Backend
-
-Configuration options for the WireGuard backend, which manages the WireGuard interfaces and peers.
-The current MikroTik backend is in **BETA** and may not support all features.
-
-### `default`
-- **Default:** `local`
-- **Description:** The default backend to use for managing WireGuard interfaces. 
-  Valid options are: `local`, or other backend id's configured in the `mikrotik` section.
-
-### Mikrotik
-
-The `mikrotik` array contains a list of MikroTik backend definitions. Each entry describes how to connect to a MikroTik RouterOS instance that hosts WireGuard interfaces.
-
-Below are the properties for each entry inside `backend.mikrotik`:
-
-#### `id`
-- **Default:** *(empty)*
-- **Description:** A unique identifier for this backend. 
-  This value can be referenced by `backend.default` to use this backend as default.
-  The identifier must be unique across all backends and must not use the reserved keyword `local`.
-
-#### `display_name`
-- **Default:** *(empty)*
-- **Description:** A human-friendly display name for this backend. If omitted, the `id` will be used as the display name.
-
-#### `api_url`
-- **Default:** *(empty)*
-- **Description:** Base URL of the MikroTik REST API, including scheme and path, e.g., `https://10.10.10.10:8729/rest`.
-
-#### `api_user`
-- **Default:** *(empty)*
-- **Description:** Username for authenticating against the MikroTik API.
-  Ensure that the user has sufficient permissions to manage WireGuard interfaces and peers.
-
-#### `api_password`
-- **Default:** *(empty)*
-- **Description:** Password for the specified API user.
-
-#### `api_verify_tls`
-- **Default:** `false`
-- **Description:** Whether to verify the TLS certificate of the MikroTik API endpoint. Set to `false` to allow self-signed certificates (not recommended for production).
-
-#### `api_timeout`
-- **Default:** `30s`
-- **Description:** Timeout for API requests to the MikroTik device. Uses Go duration format (e.g., `10s`, `1m`). If omitted, a default of 30 seconds is used.
-
-#### `concurrency`
-- **Default:** `5`
-- **Description:** Maximum number of concurrent API requests the backend will issue when enumerating interfaces and their details. If `0` or negative, a sane default of `5` is used.
-
-#### `debug`
-- **Default:** `false`
-- **Description:** Enable verbose debug logging for the MikroTik backend.
-
-For more details on configuring the MikroTik backend, see the [Backends](../usage/backends.md) documentation.
-
----
-
 ## Advanced
 
 Additional or more specialized configuration options for logging and interface creation details.

docs/documentation/rest-api/swagger.yaml

@@ -403,12 +403,6 @@ definitions:
         type: object
     models.ProvisioningRequest:
         properties:
-            DisplayName:
-                description: |-
-                    DisplayName is an optional name for the new peer.
-                    If unset, a default template value (e.g., "API Peer ...") will be assigned.
-                example: API Peer xyz
-                type: string
             InterfaceIdentifier:
                 description: InterfaceIdentifier is the identifier of the WireGuard interface the peer should be linked to.
                 example: wg0

docs/documentation/usage/backends.md

@@ -1,57 +0,0 @@
-# Backends
-
-WireGuard Portal can manage WireGuard interfaces and peers on different backends. 
-Each backend represents a system where interfaces actually live. 
-You can register multiple backends and choose which one to use per interface. 
-A global default backend determines where newly created interfaces go (unless you explicitly choose another in the UI).
-
-**Supported backends:**
-- **Local** (default): Manages interfaces on the host running WireGuard Portal (Linux WireGuard via wgctrl). Use this when the portal should directly configure wg devices on the same server.
-- **MikroTik** RouterOS (_beta_): Manages interfaces and peers on MikroTik devices via the RouterOS REST API. Use this to control WG interfaces on RouterOS v7+.
-
-How backend selection works:
-- The default backend is configured at `backend.default` (_local_ or the id of a defined MikroTik backend). 
-  New interfaces created in the UI will use this backend by default.
-- Each interface stores its backend. You can select a different backend when creating a new interface.
-
-## Configuring MikroTik backends (RouterOS v7+)
-
-> :warning: The MikroTik backend is currently marked beta. While basic functionality is implemented, some advanced features are not yet implemented or contain bugs. Please test carefully before using in production.
-
-The MikroTik backend uses the [REST API](https://help.mikrotik.com/docs/spaces/ROS/pages/47579162/REST+API) under a base URL ending with /rest. 
-You can register one or more MikroTik devices as backends for a single WireGuard Portal instance.
-
-### Prerequisites on MikroTik:
-- RouterOS v7 with WireGuard support.
-- REST API enabled and reachable over HTTP(S). A typical base URL is https://<router-address>:8729/rest or https://<router-address>/rest depending on your service setup.
-- A dedicated RouterOS user with the following group permissions:
-  - **api** (for logging in via REST API)
-  - **rest-api** (for logging in via REST API)
-  - **read** (to read interface and peer data)
-  - **write** (to create/update interfaces and peers)
-  - **test** (to perform ping checks)
-  - **sensitive** (to read private keys)
-- TLS certificate on the device is recommended. If you use a self-signed certificate during testing, set `api_verify_tls`: _false_ in wg-portal (not recommended for production).
-
-Example WireGuard Portal configuration (config/config.yaml):
-
-```yaml
-backend:
-  # default backend decides where new interfaces are created
-  default: mikrotik-prod
-
-  mikrotik:
-    - id: mikrotik-prod              # unique id, not "local"
-      display_name: RouterOS RB5009  # optional nice name
-      api_url: https://10.10.10.10/rest
-      api_user: wgportal
-      api_password: a-super-secret-password
-      api_verify_tls: true         # set to false only if using self-signed during testing
-      api_timeout: 30s             # maximum request duration
-      concurrency: 5               # limit parallel REST calls to device
-      debug: false                 # verbose logging for this backend
-```
-
-### Known limitations:
-- The MikroTik backend is still in beta. Some features may not work as expected.
-- Not all WireGuard Portal features are supported yet (e.g., no support for interface hooks)

frontend/src/components/InterfaceEditModal.vue

@@ -10,13 +10,11 @@ import isCidr from "is-cidr";
 import {isIP} from 'is-ip';
 import { freshInterface } from '@/helpers/models';
 import {peerStore} from "@/stores/peers";
-import {settingsStore} from "@/stores/settings";
 
 const { t } = useI18n()
 
 const interfaces = interfaceStore()
 const peers = peerStore()
-const settings = settingsStore()
 
 const props = defineProps({
   interfaceId: String,
@@ -50,26 +48,6 @@ const currentTags = ref({
   PeerDefDnsSearch: ""
 })
 const formData = ref(freshInterface())
-const isSaving = ref(false)
-const isDeleting = ref(false)
-const isApplyingDefaults = ref(false)
-
-const isBackendValid = computed(() => {
-  if (!props.visible || !selectedInterface.value) {
-    return true // if modal is not visible or no interface is selected, we don't care about backend validity
-  }
-
-  let backendId = selectedInterface.value.Backend
-
-  let valid = false
-  let availableBackends = settings.Setting('AvailableBackends') || []
-  availableBackends.forEach(backend => {
-    if (backend.Id === backendId) {
-      valid = true
-    }
-  })
-  return valid
-})
 
 // functions
 
@@ -83,7 +61,6 @@ watch(() => props.visible, async (newValue, oldValue) => {
           formData.value.Identifier = interfaces.Prepared.Identifier
           formData.value.DisplayName = interfaces.Prepared.DisplayName
           formData.value.Mode = interfaces.Prepared.Mode
-          formData.value.Backend = interfaces.Prepared.Backend
 
           formData.value.PublicKey = interfaces.Prepared.PublicKey
           formData.value.PrivateKey = interfaces.Prepared.PrivateKey
@@ -122,7 +99,6 @@ watch(() => props.visible, async (newValue, oldValue) => {
           formData.value.Identifier = selectedInterface.value.Identifier
           formData.value.DisplayName = selectedInterface.value.DisplayName
           formData.value.Mode = selectedInterface.value.Mode
-          formData.value.Backend = selectedInterface.value.Backend
 
           formData.value.PublicKey = selectedInterface.value.PublicKey
           formData.value.PrivateKey = selectedInterface.value.PrivateKey
@@ -261,8 +237,6 @@ function handleChangePeerDefDnsSearch(tags) {
 }
 
 async function save() {
-  if (isSaving.value) return
-  isSaving.value = true
   try {
     if (props.interfaceId!=='#NEW#') {
       await interfaces.UpdateInterface(selectedInterface.value.Identifier, formData.value)
@@ -277,8 +251,6 @@ async function save() {
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isSaving.value = false
   }
 }
 
@@ -287,8 +259,6 @@ async function applyPeerDefaults() {
     return; // do nothing for new interfaces
   }
 
-  if (isApplyingDefaults.value) return
-  isApplyingDefaults.value = true
   try {
     await interfaces.ApplyPeerDefaults(selectedInterface.value.Identifier, formData.value)
 
@@ -306,14 +276,10 @@ async function applyPeerDefaults() {
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isApplyingDefaults.value = false
   }
 }
 
 async function del() {
-  if (isDeleting.value) return
-  isDeleting.value = true
   try {
     await interfaces.DeleteInterface(selectedInterface.value.Identifier)
     close()
@@ -324,8 +290,6 @@ async function del() {
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isDeleting.value = false
   }
 }
 
@@ -350,22 +314,13 @@ async function del() {
               <label class="form-label mt-4">{{ $t('modals.interface-edit.identifier.label') }}</label>
               <input v-model="formData.Identifier" class="form-control" :placeholder="$t('modals.interface-edit.identifier.placeholder')" type="text">
             </div>
-            <div class="row">
+            <div class="form-group">
-              <div class="form-group col-md-6">
+              <label class="form-label mt-4">{{ $t('modals.interface-edit.mode.label') }}</label>
-                <label class="form-label mt-4">{{ $t('modals.interface-edit.mode.label') }}</label>
+              <select v-model="formData.Mode" class="form-select">
-                <select v-model="formData.Mode" class="form-select">
+                <option value="server">{{ $t('modals.interface-edit.mode.server') }}</option>
-                  <option value="server">{{ $t('modals.interface-edit.mode.server') }}</option>
+                <option value="client">{{ $t('modals.interface-edit.mode.client') }}</option>
-                  <option value="client">{{ $t('modals.interface-edit.mode.client') }}</option>
+                <option value="any">{{ $t('modals.interface-edit.mode.any') }}</option>
-                  <option value="any">{{ $t('modals.interface-edit.mode.any') }}</option>
+              </select>
-                </select>
-              </div>
-              <div class="form-group col-md-6">
-                <label class="form-label mt-4" for="ifaceBackendSelector">{{ $t('modals.interface-edit.backend.label') }}</label>
-                <select id="ifaceBackendSelector" v-model="formData.Backend" class="form-select" aria-describedby="backendHelp">
-                  <option v-for="backend in settings.Setting('AvailableBackends')" :value="backend.Id">{{ backend.Id === 'local' ? $t(backend.Name) : backend.Name }}</option>
-                </select>
-                <small v-if="!isBackendValid" id="backendHelp" class="form-text text-warning">{{ $t('modals.interface-edit.backend.invalid-label') }}</small>
-              </div>
             </div>
             <div class="form-group">
               <label class="form-label mt-4">{{ $t('modals.interface-edit.display-name.label') }}</label>
@@ -430,14 +385,12 @@ async function del() {
                 <label class="form-label mt-4">{{ $t('modals.interface-edit.mtu.label') }}</label>
                 <input v-model="formData.Mtu" class="form-control" :placeholder="$t('modals.interface-edit.mtu.placeholder')" type="number">
               </div>
-              <div class="form-group col-md-6" v-if="formData.Backend==='local'">
+              <div class="form-group col-md-6">
                 <label class="form-label mt-4">{{ $t('modals.interface-edit.firewall-mark.label') }}</label>
                 <input v-model="formData.FirewallMark" class="form-control" :placeholder="$t('modals.interface-edit.firewall-mark.placeholder')" type="number">
               </div>
-              <div class="form-group col-md-6" v-else>
-              </div>
             </div>
-            <div class="row" v-if="formData.Backend==='local'">
+            <div class="row">
               <div class="form-group col-md-6">
                 <label class="form-label mt-4">{{ $t('modals.interface-edit.routing-table.label') }}</label>
                 <input v-model="formData.RoutingTable" aria-describedby="routingTableHelp" class="form-control" :placeholder="$t('modals.interface-edit.routing-table.placeholder')" type="text">
@@ -577,25 +530,16 @@ async function del() {
           </fieldset>
           <fieldset v-if="props.interfaceId!=='#NEW#'" class="text-end">
             <hr class="mt-4">
-            <button class="btn btn-primary me-1" type="button" @click.prevent="applyPeerDefaults" :disabled="isApplyingDefaults">
+            <button class="btn btn-primary me-1" type="button" @click.prevent="applyPeerDefaults">{{ $t('modals.interface-edit.button-apply-defaults') }}</button>
-              <span v-if="isApplyingDefaults" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-              {{ $t('modals.interface-edit.button-apply-defaults') }}
-            </button>
           </fieldset>
         </div>
       </div>
     </template>
     <template #footer>
       <div class="flex-fill text-start">
-        <button v-if="props.interfaceId!=='#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del" :disabled="isDeleting">
+        <button v-if="props.interfaceId!=='#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del">{{ $t('general.delete') }}</button>
-          <span v-if="isDeleting" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-          {{ $t('general.delete') }}
-        </button>
       </div>
-      <button class="btn btn-primary me-1" type="button" @click.prevent="save" :disabled="isSaving">
+      <button class="btn btn-primary me-1" type="button" @click.prevent="save">{{ $t('general.save') }}</button>
-        <span v-if="isSaving" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-        {{ $t('general.save') }}
-      </button>
       <button class="btn btn-secondary" type="button" @click.prevent="close">{{ $t('general.close') }}</button>
     </template>
   </Modal>

frontend/src/components/PeerEditModal.vue

@@ -73,8 +73,6 @@ const currentTags = ref({
   DnsSearch: ""
 })
 const formData = ref(freshPeer())
-const isSaving = ref(false)
-const isDeleting = ref(false)
 
 // functions
 
@@ -272,8 +270,6 @@ function handleChangeDnsSearch(tags) {
 }
 
 async function save() {
-  if (isSaving.value) return
-  isSaving.value = true
   try {
     if (props.peerId !== '#NEW#') {
       await peers.UpdatePeer(selectedPeer.value.Identifier, formData.value)
@@ -282,30 +278,26 @@ async function save() {
     }
     close()
   } catch (e) {
+    // console.log(e)
     notify({
       title: "Failed to save peer!",
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isSaving.value = false
   }
 }
 
 async function del() {
-  if (isDeleting.value) return
-  isDeleting.value = true
   try {
     await peers.DeletePeer(selectedPeer.value.Identifier)
     close()
   } catch (e) {
+    // console.log(e)
     notify({
       title: "Failed to delete peer!",
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isDeleting.value = false
   }
 }
 
@@ -478,15 +470,10 @@ async function del() {
     </template>
     <template #footer>
       <div class="flex-fill text-start">
-        <button v-if="props.peerId !== '#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del" :disabled="isDeleting">
+        <button v-if="props.peerId !== '#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del">{{
-          <span v-if="isDeleting" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
+          $t('general.delete') }}</button>
-          {{ $t('general.delete') }}
-        </button>
       </div>
-      <button class="btn btn-primary me-1" type="button" @click.prevent="save" :disabled="isSaving">
+      <button class="btn btn-primary me-1" type="button" @click.prevent="save">{{ $t('general.save') }}</button>
-        <span v-if="isSaving" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-        {{ $t('general.save') }}
-      </button>
       <button class="btn btn-secondary" type="button" @click.prevent="close">{{ $t('general.close') }}</button>
     </template>
   </Modal>

frontend/src/components/PeerMultiCreateModal.vue

@@ -32,13 +32,12 @@ const selectedInterface = computed(() => {
 function freshForm() {
   return {
     Identifiers: [],
-    Prefix: "",
+    Suffix: "",
   }
 }
 
 const currentTag = ref("")
 const formData = ref(freshForm())
-const isSaving = ref(false)
 
 const title = computed(() => {
   if (!props.visible) {
@@ -61,15 +60,12 @@ function handleChangeUserIdentifiers(tags) {
 }
 
 async function save() {
-  if (isSaving.value) return
-  isSaving.value = true
   if (formData.value.Identifiers.length === 0) {
     notify({
       title: "Missing Identifiers",
       text: "At least one identifier is required to create a new peer.",
       type: 'error',
     })
-    isSaving.value = false
     return
   }
 
@@ -83,8 +79,6 @@ async function save() {
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isSaving.value = false
   }
 }
 
@@ -108,16 +102,13 @@ async function save() {
         </div>
         <div class="form-group">
           <label class="form-label mt-4">{{ $t('modals.peer-multi-create.prefix.label') }}</label>
-          <input type="text" class="form-control" :placeholder="$t('modals.peer-multi-create.prefix.placeholder')" v-model="formData.Prefix">
+          <input type="text" class="form-control" :placeholder="$t('modals.peer-multi-create.prefix.placeholder')" v-model="formData.Suffix">
           <small class="form-text text-muted">{{ $t('modals.peer-multi-create.prefix.description') }}</small>
         </div>
       </fieldset>
     </template>
     <template #footer>
-      <button class="btn btn-primary me-1" type="button" @click.prevent="save" :disabled="isSaving">
+      <button class="btn btn-primary me-1" type="button" @click.prevent="save">{{ $t('general.save') }}</button>
-        <span v-if="isSaving" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-        {{ $t('general.save') }}
-      </button>
       <button class="btn btn-secondary" type="button" @click.prevent="close">{{ $t('general.close') }}</button>
     </template>
   </Modal>

frontend/src/components/UserEditModal.vue

@@ -34,8 +34,6 @@ const title = computed(() => {
 })
 
 const formData = ref(freshUser())
-const isSaving = ref(false)
-const isDeleting = ref(false)
 
 const passwordWeak = computed(() => {
   return formData.value.Password && formData.value.Password.length > 0 && formData.value.Password.length < settings.Setting('MinPasswordLength')
@@ -91,8 +89,6 @@ function close() {
 }
 
 async function save() {
-  if (isSaving.value) return
-  isSaving.value = true
   try {
     if (props.userId!=='#NEW#') {
       await users.UpdateUser(selectedUser.value.Identifier, formData.value)
@@ -106,14 +102,10 @@ async function save() {
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isSaving.value = false
   }
 }
 
 async function del() {
-  if (isDeleting.value) return
-  isDeleting.value = true
   try {
     await users.DeleteUser(selectedUser.value.Identifier)
     close()
@@ -123,8 +115,6 @@ async function del() {
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isDeleting.value = false
   }
 }
 
@@ -203,15 +193,9 @@ async function del() {
     </template>
     <template #footer>
       <div class="flex-fill text-start">
-        <button v-if="props.userId!=='#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del" :disabled="isDeleting">
+        <button v-if="props.userId!=='#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del">{{ $t('general.delete') }}</button>
-          <span v-if="isDeleting" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-          {{ $t('general.delete') }}
-        </button>
       </div>
-      <button class="btn btn-primary me-1" type="button" @click.prevent="save" :disabled="!formValid || isSaving">
+      <button class="btn btn-primary me-1" type="button" @click.prevent="save" :disabled="!formValid">{{ $t('general.save') }}</button>
-        <span v-if="isSaving" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-        {{ $t('general.save') }}
-      </button>
       <button class="btn btn-secondary" type="button" @click.prevent="close">{{ $t('general.close') }}</button>
     </template>
   </Modal>

frontend/src/components/UserPeerEditModal.vue

@@ -55,8 +55,6 @@ const title = computed(() => {
 })
 
 const formData = ref(freshPeer())
-const isSaving = ref(false)
-const isDeleting = ref(false)
 
 // functions
 
@@ -165,8 +163,6 @@ function close() {
 }
 
 async function save() {
-  if (isSaving.value) return
-  isSaving.value = true
   try {
     if (props.peerId !== '#NEW#') {
       await peers.UpdatePeer(selectedPeer.value.Identifier, formData.value)
@@ -175,30 +171,26 @@ async function save() {
     }
     close()
   } catch (e) {
+    // console.log(e)
     notify({
       title: "Failed to save peer!",
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isSaving.value = false
   }
 }
 
 async function del() {
-  if (isDeleting.value) return
-  isDeleting.value = true
   try {
     await peers.DeletePeer(selectedPeer.value.Identifier)
     close()
   } catch (e) {
+    // console.log(e)
     notify({
       title: "Failed to delete peer!",
       text: e.toString(),
       type: 'error',
     })
-  } finally {
-    isDeleting.value = false
   }
 }
 
@@ -291,15 +283,10 @@ async function del() {
     </template>
     <template #footer>
       <div class="flex-fill text-start">
-        <button v-if="props.peerId !== '#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del" :disabled="isDeleting">
+        <button v-if="props.peerId !== '#NEW#'" class="btn btn-danger me-1" type="button" @click.prevent="del">{{
-          <span v-if="isDeleting" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
+          $t('general.delete') }}</button>
-          {{ $t('general.delete') }}
-        </button>
       </div>
-      <button class="btn btn-primary me-1" type="button" @click.prevent="save" :disabled="isSaving">
+      <button class="btn btn-primary me-1" type="button" @click.prevent="save">{{ $t('general.save') }}</button>
-        <span v-if="isSaving" class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
-        {{ $t('general.save') }}
-      </button>
       <button class="btn btn-secondary" type="button" @click.prevent="close">{{ $t('general.close') }}</button>
     </template>
   </Modal>

frontend/src/helpers/models.js

@@ -5,7 +5,6 @@ export function freshInterface() {
     DisplayName: "",
     Identifier: "",
     Mode: "server",
-    Backend: "local",
 
     PublicKey: "",
     PrivateKey: "",

frontend/src/lang/translations/de.json

@@ -102,9 +102,7 @@
     },
     "interface": {
       "headline": "Schnittstellenstatus für",
-      "backend": "Backend",
+      "mode": "Modus",
-      "unknown-backend": "Unbekannt",
-      "wrong-backend": "Ungültiges Backend, das lokale WireGuard Backend wird stattdessen verwendet!",
       "key": "Öffentlicher Schlüssel",
       "endpoint": "Öffentlicher Endpunkt",
       "port": "Port",
@@ -359,11 +357,6 @@
         "client": "Client-Modus",
         "any": "Unbekannter Modus"
       },
-      "backend": {
-        "label": "Schnittstellenbackend",
-        "invalid-label": "Ursprüngliches Backend ist ungültig, das lokale WireGuard Backend wird stattdessen verwendet!",
-        "local": "Lokales WireGuard Backend"
-      },
       "display-name": {
         "label": "Anzeigename",
         "placeholder": "Der beschreibende Name für die Schnittstelle"

frontend/src/lang/translations/en.json

@@ -102,9 +102,7 @@
     },
     "interface": {
       "headline": "Interface status for",
-      "backend": "Backend",
+      "mode": "mode",
-      "unknown-backend": "Unknown",
-      "wrong-backend": "Invalid backend, using local WireGuard backend instead!",
       "key": "Public Key",
       "endpoint": "Public Endpoint",
       "port": "Listening Port",
@@ -359,11 +357,6 @@
         "client": "Client Mode",
         "any": "Unknown Mode"
       },
-      "backend": {
-        "label": "Interface Backend",
-        "invalid-label": "Original backend is no longer available, using local WireGuard backend instead!",
-        "local": "Local WireGuard Backend"
-      },
       "display-name": {
         "label": "Display Name",
         "placeholder": "The descriptive name for the interface"

frontend/src/lang/translations/fr.json

@@ -99,7 +99,7 @@
     },
     "interface": {
       "headline": "État de l'interface pour",
-      "backend": "backend",
+      "mode": "mode",
       "key": "Clé publique",
       "endpoint": "Point de terminaison public",
       "port": "Port d'écoute",

frontend/src/lang/translations/ko.json

@@ -100,7 +100,7 @@
       },
       "interface": {
         "headline": "인터페이스 상태:",
-        "backend": "백엔드",
+        "mode": "모드",
         "key": "공개 키",
         "endpoint": "공개 엔드포인트",
         "port": "수신 포트",

frontend/src/lang/translations/pt.json

@@ -101,7 +101,7 @@
     },
     "interface": {
       "headline": "Status da interface para",
-      "mode": "backend",
+      "mode": "modo",
       "key": "Chave Pública",
       "endpoint": "Endpoint Público",
       "port": "Porta de Escuta",

frontend/src/lang/translations/ru.json

@@ -99,7 +99,7 @@
     },
     "interface": {
       "headline": "Статус интерфейса для",
-      "backend": "бэкэнд",
+      "mode": "режим",
       "key": "Публичный ключ",
       "endpoint": "Публичная конечная точка",
       "port": "Порт прослушивания",

frontend/src/lang/translations/uk.json

@@ -99,7 +99,7 @@
     },
     "interface": {
       "headline": "Статус інтерфейсу для",
-      "backend": "бекенд",
+      "mode": "режим",
       "key": "Публічний ключ",
       "endpoint": "Публічна кінцева точка",
       "port": "Порт прослуховування",

frontend/src/lang/translations/vi.json

@@ -98,7 +98,7 @@
     },
     "interface": {
       "headline": "Trạng thái giao diện cho",
-      "backend": "phần sau",
+      "mode": "chế độ",
       "key": "Khóa Công khai",
       "endpoint": "Điểm cuối Công khai",
       "port": "Cổng Nghe",

frontend/src/lang/translations/zh.json

@@ -98,7 +98,7 @@
       },
       "interface": {
         "headline": "接口状态",
-        "backend": "后端",
+        "mode": "模式",
         "key": "公钥",
         "endpoint": "公开节点",
         "port": "监听端口",

frontend/src/views/InterfaceView.vue

@@ -5,20 +5,17 @@ import PeerMultiCreateModal from "../components/PeerMultiCreateModal.vue";
 import InterfaceEditModal from "../components/InterfaceEditModal.vue";
 import InterfaceViewModal from "../components/InterfaceViewModal.vue";
 
-import {computed, onMounted, ref} from "vue";
+import {onMounted, ref} from "vue";
 import {peerStore} from "@/stores/peers";
 import {interfaceStore} from "@/stores/interfaces";
 import {notify} from "@kyvg/vue3-notification";
 import {settingsStore} from "@/stores/settings";
 import {humanFileSize} from '@/helpers/utils';
-import {useI18n} from "vue-i18n";
 
 const settings = settingsStore()
 const interfaces = interfaceStore()
 const peers = peerStore()
 
-const { t } = useI18n()
-
 const viewedPeerId = ref("")
 const editPeerId = ref("")
 const multiCreatePeerId = ref("")
@@ -48,33 +45,6 @@ function calculateInterfaceName(id, name) {
   return result
 }
 
-const calculateBackendName = computed(() => {
-  let backendId = interfaces.GetSelected.Backend
-
-  let backendName = t('interfaces.interface.unknown-backend')
-  let availableBackends = settings.Setting('AvailableBackends') || []
-  availableBackends.forEach(backend => {
-    if (backend.Id === backendId) {
-      backendName = backend.Id === 'local' ? t(backend.Name) : backend.Name
-    }
-  })
-  return backendName
-})
-
-const isBackendValid = computed(() => {
-  let backendId = interfaces.GetSelected.Backend
-
-  let valid = false
-  let availableBackends = settings.Setting('AvailableBackends') || []
-  availableBackends.forEach(backend => {
-    if (backend.Id === backendId) {
-      valid = true
-    }
-  })
-  return valid
-})
-
-
 async function download() {
   await interfaces.LoadInterfaceConfig(interfaces.GetSelected.Identifier)
 
@@ -171,7 +141,7 @@ onMounted(async () => {
         <div class="card-header">
           <div class="row">
             <div class="col-12 col-lg-8">
-              {{ $t('interfaces.interface.headline') }} <strong>{{interfaces.GetSelected.Identifier}}</strong> ({{ $t('modals.interface-edit.mode.' + interfaces.GetSelected.Mode )}} | {{ $t('interfaces.interface.backend') + ": " + calculateBackendName }}<span v-if="!isBackendValid" :title="t('interfaces.interface.wrong-backend')" class="ms-1 me-1"><i class="fa-solid fa-triangle-exclamation"></i></span>)
+              {{ $t('interfaces.interface.headline') }} <strong>{{interfaces.GetSelected.Identifier}}</strong> ({{interfaces.GetSelected.Mode}} {{ $t('interfaces.interface.mode') }})
               <span v-if="interfaces.GetSelected.Disabled" class="text-danger"><i class="fa fa-circle-xmark" :title="interfaces.GetSelected.DisabledReason"></i></span>
             </div>
             <div class="col-12 col-lg-4 text-lg-end">

go.mod

@@ -5,31 +5,31 @@ go 1.24.0
 require (
 	github.com/a8m/envsubst v1.4.3
 	github.com/alexedwards/scs/v2 v2.9.0
-	github.com/coreos/go-oidc/v3 v3.15.0
+	github.com/coreos/go-oidc/v3 v3.14.1
 	github.com/glebarez/sqlite v1.11.0
 	github.com/go-ldap/ldap/v3 v3.4.11
-	github.com/go-pkgz/routegroup v1.5.3
+	github.com/go-pkgz/routegroup v1.4.1
 	github.com/go-playground/validator/v10 v10.27.0
 	github.com/go-webauthn/webauthn v0.13.4
 	github.com/google/uuid v1.6.0
 	github.com/prometheus-community/pro-bing v0.7.0
-	github.com/prometheus/client_golang v1.23.0
+	github.com/prometheus/client_golang v1.22.0
 	github.com/stretchr/testify v1.10.0
-	github.com/swaggo/swag v1.16.6
+	github.com/swaggo/swag v1.16.5
 	github.com/vardius/message-bus v1.1.5
 	github.com/vishvananda/netlink v1.3.1
 	github.com/xhit/go-simple-mail/v2 v2.16.0
 	github.com/yeqown/go-qrcode/v2 v2.2.5
 	github.com/yeqown/go-qrcode/writer/compressed v1.0.1
-	golang.org/x/crypto v0.41.0
+	golang.org/x/crypto v0.40.0
 	golang.org/x/oauth2 v0.30.0
-	golang.org/x/sys v0.35.0
+	golang.org/x/sys v0.34.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.6.0
 	gorm.io/driver/postgres v1.6.0
 	gorm.io/driver/sqlserver v1.6.1
-	gorm.io/gorm v1.30.2
+	gorm.io/gorm v1.30.0
 )
 
 require (
@@ -45,13 +45,13 @@ require (
 	github.com/glebarez/go-sqlite v1.22.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.0 // indirect
-	github.com/go-openapi/jsonpointer v0.21.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/spec v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-sql-driver/mysql v1.9.3 // indirect
+	github.com/go-sql-driver/mysql v1.9.2 // indirect
 	github.com/go-test/deep v1.1.1 // indirect
 	github.com/go-webauthn/x v0.1.23 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.3 // indirect
@@ -61,7 +61,7 @@ require (
 	github.com/google/go-tpm v0.9.5 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/pgx/v5 v5.7.4 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
@@ -73,30 +73,30 @@ require (
 	github.com/mdlayher/genetlink v1.3.2 // indirect
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
-	github.com/microsoft/go-mssqldb v1.9.2 // indirect
+	github.com/microsoft/go-mssqldb v1.8.2 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
-	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/prometheus/procfs v0.16.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/toorop/go-dkim v0.0.0-20250226130143-9025cce95817 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yeqown/reedsolomon v1.0.0 // indirect
-	golang.org/x/exp v0.0.0-20250808145144-a408d31f581a // indirect
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
-	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/mod v0.25.0 // indirect
-	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/net v0.41.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
+	golang.org/x/tools v0.34.0 // indirect
-	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect
+	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
-	modernc.org/libc v1.66.6 // indirect
+	modernc.org/libc v1.63.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
+	modernc.org/memory v1.10.0 // indirect
-	modernc.org/sqlite v1.38.2 // indirect
+	modernc.org/sqlite v1.37.0 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )

go.sum

@@ -2,30 +2,24 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.1/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 h1:E+OJmp2tPvt1W+amx48v1eqbjDYsgN+RzP4q16yV5eM=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1/go.mod h1:a6xsAQUZg+VsS3TJ05SRp524Hs4pZ/AeFSr5ENf0Yjo=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.1/go.mod h1:uE9zaUfEQT/nbQjVi2IblCG9iaLtZsuYZ8ne+PuQ02M=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0 h1:U2rTu3Ef+7w9FHKIAXM6ZyqF3UOWJZ12zIm8zECAFfg=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1 h1:B+blDbyVIG3WaikNxPnhPiJ1MThR03b3vKGtER95TP4=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1/go.mod h1:JdM5psgjfBf5fo2uWOZhflPWyDBZ/O/CNAH9CtsuZE4=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0/go.mod h1:okt5dMMTOFjX/aovMlrjvvXoPMBVSPzk9185BT0+eZM=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2/go.mod h1:yInRyqWXAuaPrgI7p70+lDDgh3mlBohis29jGMISnmc=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 h1:jBQA3cKT4L2rWMpgE7Yt3Hwh2aUj8KXjIGLxjHeYNNo=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0/go.mod h1:4OG6tQ9EOP/MT0NMjDlRzWoVFxfu9rN9B2X+tlSVktg=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 h1:FPKJS1T+clwv+OLGt13a8UjqeRuh0O4SJ3lUriThc+4=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1 h1:MyVTgWR8qd/Jw1Le0NZebGBUCLbtak3bJ3z1OlqZBpw=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1/go.mod h1:j2chePtV91HrC22tGoRX3sGY42uF13WzmmV80/OdVAA=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1/go.mod h1:GpPjLhVR9dnUoJMyHWSPy71xY9/lcmpzIPZXmF0FCVY=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1 h1:Wgf5rZba3YZqeTNJPtvqZoBu1sBN/L4sry+u2U3Y75w=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0 h1:D3occbWoio4EBLkbkevetNMAVX197GkzbUMtqjGWn80=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1/go.mod h1:xxCBG/f/4Vbmh2XQJBsOmNdxWUY5j/s27jujKPbQf14=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0/go.mod h1:bTSOgj05NGRuHHhQwAdPnYr9TOdNmKlZTgGLL6nyAdI=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 h1:bFWuoEKg+gImo7pvkiQEFAc8ocibADgXeiLAxWhWmkI=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1/go.mod h1:Vih/3yc6yac2JzU4hzpaDupBJP0Flaia9rXXrU8xyww=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.1.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
 github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=
@@ -38,8 +32,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/coreos/go-oidc/v3 v3.15.0 h1:R6Oz8Z4bqWR7VFQ+sPSvZPQv4x8M+sJkDO5ojgwlyAg=
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
-github.com/coreos/go-oidc/v3 v3.15.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -62,16 +56,16 @@ github.com/go-jose/go-jose/v4 v4.1.0 h1:cYSYxd3pw5zd2FSXk2vGdn9igQU2PS8MuxrCOCl0
 github.com/go-jose/go-jose/v4 v4.1.0/go.mod h1:GG/vqmYm3Von2nYiB2vGTXzdoNKE5tix5tuc6iAd+sw=
 github.com/go-ldap/ldap/v3 v3.4.11 h1:4k0Yxweg+a3OyBLjdYn5OKglv18JNvfDykSoI8bW0gU=
 github.com/go-ldap/ldap/v3 v3.4.11/go.mod h1:bY7t0FLK8OAVpp/vV6sSlpz3EQDGcQwc8pF0ujLgKvM=
-github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
-github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
 github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
-github.com/go-pkgz/routegroup v1.5.3 h1:IvH1KLcQkMap9jucQGBlef3IBloxSAe8USUFvxShFqs=
+github.com/go-pkgz/routegroup v1.4.1 h1:iw1yW3lXuurZZOv/DF9fY8Mkpvy6J9UjBiP1oDIQE/s=
-github.com/go-pkgz/routegroup v1.5.3/go.mod h1:Pmu04fhgWhRtBMIJ8HXppnnzOPjnL/IEPBIdO2zmeqg=
+github.com/go-pkgz/routegroup v1.4.1/go.mod h1:kDDPDRLRiRY1vnENrZJw1jQAzQX7fvsbsHGRQFNQfKc=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -80,8 +74,8 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4=
 github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.2 h1:4cNKDYQ1I84SXslGddlsrMhc8k4LeDVj6Ad6WRjiHuU=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-sql-driver/mysql v1.9.2/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-webauthn/webauthn v0.13.4 h1:q68qusWPcqHbg9STSxBLBHnsKaLxNO0RnVKaAqMuAuQ=
@@ -117,8 +111,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.7.5 h1:JHGfMnQY+IEtGM63d+NGMjoRpysB2JBwDr5fsngwmJs=
+github.com/jackc/pgx/v5 v5.7.4 h1:9wKznZrhWa2QiHL+NjTSPP6yjl3451BX3imWDnokYlg=
-github.com/jackc/pgx/v5 v5.7.5/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/pgx/v5 v5.7.4/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -164,9 +158,8 @@ github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
+github.com/microsoft/go-mssqldb v1.8.2 h1:236sewazvC8FvG6Dr3bszrVhMkAl4KYImryLkRMCd0I=
 github.com/microsoft/go-mssqldb v1.8.2/go.mod h1:vp38dT33FGfVotRiTmDo3bFyaHq+p3LektQrjTULowo=
-github.com/microsoft/go-mssqldb v1.9.2 h1:nY8TmFMQOHpm2qVWo6y4I2mAmVdZqlGiMGAYt64Ibbs=
-github.com/microsoft/go-mssqldb v1.9.2/go.mod h1:GBbW9ASTiDC+mpgWDGKdm3FnFLTUsLYN3iFL90lQ+PA=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
@@ -185,14 +178,14 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus-community/pro-bing v0.7.0 h1:KFYFbxC2f2Fp6c+TyxbCOEarf7rbnzr9Gw8eIb0RfZA=
 github.com/prometheus-community/pro-bing v0.7.0/go.mod h1:Moob9dvlY50Bfq6i88xIwfyw7xLFHH69LUgx9n5zqCE=
-github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
-github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.0 h1:xh6oHhKwnOJKMYiYBDWmkHqQPyiY40sny36Cmx2bbsM=
-github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/prometheus/procfs v0.16.0/go.mod h1:8veyXUu3nGP7oaCxhX6yeaM5u4stL2FeMXnCqhDthZg=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
@@ -212,8 +205,8 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/swaggo/swag v1.16.6 h1:qBNcx53ZaX+M5dxVyTrgQ0PJ/ACK+NzhwcbieTt+9yI=
+github.com/swaggo/swag v1.16.5 h1:nMf2fEV1TetMTJb4XzD0Lz7jFfKJmJKGTygEey8NSxM=
-github.com/swaggo/swag v1.16.6/go.mod h1:ngP2etMK5a0P3QBizic5MEwpRmluJZPHjXcMoj4Xesg=
+github.com/swaggo/swag v1.16.5/go.mod h1:ngP2etMK5a0P3QBizic5MEwpRmluJZPHjXcMoj4Xesg=
 github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208/go.mod h1:BzWtXXrXzZUvMacR0oF/fbDDgUPO8L36tDMmRAf14ns=
 github.com/toorop/go-dkim v0.0.0-20250226130143-9025cce95817 h1:q0hKh5a5FRkhuTb5JNfgjzpzvYLHjH0QOgPZPYnRWGA=
 github.com/toorop/go-dkim v0.0.0-20250226130143-9025cce95817/go.mod h1:BzWtXXrXzZUvMacR0oF/fbDDgUPO8L36tDMmRAf14ns=
@@ -234,8 +227,6 @@ github.com/yeqown/go-qrcode/writer/compressed v1.0.1/go.mod h1:BJScsGUIKM+eg0CCL
 github.com/yeqown/reedsolomon v1.0.0 h1:x1h/Ej/uJnNu8jaX7GLHBWmZKCAWjEJTetkqaabr4B0=
 github.com/yeqown/reedsolomon v1.0.0/go.mod h1:P76zpcn2TCuL0ul1Fso373qHRc69LKwAw/Iy6g1WiiM=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
@@ -248,18 +239,18 @@ golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOM
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
-golang.org/x/exp v0.0.0-20250808145144-a408d31f581a h1:Y+7uR/b1Mw2iSXZ3G//1haIiSElDQZ8KWh0h+sZPG90=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
-golang.org/x/exp v0.0.0-20250808145144-a408d31f581a/go.mod h1:rT6SFzZ7oxADUDx58pcaKFTcZ+inxAa9fTrYx/uVYwg=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
@@ -277,8 +268,8 @@ golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -310,8 +301,8 @@ golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -340,19 +331,19 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=
-golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
@@ -373,31 +364,28 @@ gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
 gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
 gorm.io/driver/sqlserver v1.6.1 h1:XWISFsu2I2pqd1KJhhTZNJMx1jNQ+zVL/Q8ovDcUjtY=
 gorm.io/driver/sqlserver v1.6.1/go.mod h1:VZeNn7hqX1aXoN5TPAFGWvxWG90xtA8erGn2gQmpc6U=
+gorm.io/gorm v1.30.0 h1:qbT5aPv1UH8gI99OsRlvDToLxW5zR7FzS9acZDOZcgs=
 gorm.io/gorm v1.30.0/go.mod h1:8Z33v652h4//uMA76KjeDH8mJXPm1QNCYrMeatR0DOE=
-gorm.io/gorm v1.30.2 h1:f7bevlVoVe4Byu3pmbWPVHnPsLoWaMjEb7/clyr9Ivs=
+modernc.org/cc/v4 v4.26.0 h1:QMYvbVduUGH0rrO+5mqF/PSPPRZNpRtg2CLELy7vUpA=
-gorm.io/gorm v1.30.2/go.mod h1:8Z33v652h4//uMA76KjeDH8mJXPm1QNCYrMeatR0DOE=
+modernc.org/cc/v4 v4.26.0/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/cc/v4 v4.26.3 h1:yEN8dzrkRFnn4PUUKXLYIqVf2PJYAEjMTFjO3BDGc3I=
+modernc.org/ccgo/v4 v4.26.0 h1:gVzXaDzGeBYJ2uXTOpR8FR7OlksDOe9jxnjhIKCsiTc=
-modernc.org/cc/v4 v4.26.3/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.26.0/go.mod h1:Sem8f7TFUtVXkG2fiaChQtyyfkqhJBg/zjEJBkmuAVY=
-modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
+modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
-modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
+modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
-modernc.org/fileutil v1.3.8 h1:qtzNm7ED75pd1C7WgAGcK4edm4fvhtBsEiI/0NQ54YM=
-modernc.org/fileutil v1.3.8/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/libc v1.63.0 h1:wKzb61wOGCzgahQBORb1b0dZonh8Ufzl/7r4Yf1D5YA=
-modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.63.0/go.mod h1:wDzH1mgz1wUIEwottFt++POjGRO9sgyQKrpXaz3x89E=
-modernc.org/libc v1.66.6 h1:RyQpwAhM/19nXD8y3iejM/AjmKwY2TjxZTlUWTsWw2U=
-modernc.org/libc v1.66.6/go.mod h1:j8z0EYAuumoMQ3+cWXtmw6m+LYn3qm8dcZDFtFTSq+M=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.10.0 h1:fzumd51yQ1DxcOxSO+S6X7+QTuVU+n8/Aj7swYjFfC4=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.10.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.38.2 h1:Aclu7+tgjgcQVShZqim41Bbw9Cho0y/7WzYptXqkEek=
+modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
-modernc.org/sqlite v1.38.2/go.mod h1:cPTJYSlgg3Sfg046yBShXENNtPrWrDX8bsbAQBzgQ5E=
+modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/adapters/wgcontroller/local.go

@@ -1,864 +0,0 @@
-package wgcontroller
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"os"
-	"os/exec"
-	"strings"
-	"time"
-
-	probing "github.com/prometheus-community/pro-bing"
-	"github.com/vishvananda/netlink"
-	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/wgctrl"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/h44z/wg-portal/internal"
-	"github.com/h44z/wg-portal/internal/config"
-	"github.com/h44z/wg-portal/internal/domain"
-	"github.com/h44z/wg-portal/internal/lowlevel"
-)
-
-// region dependencies
-
-// WgCtrlRepo is used to control local WireGuard devices via the wgctrl-go library.
-type WgCtrlRepo interface {
-	io.Closer
-	Devices() ([]*wgtypes.Device, error)
-	Device(name string) (*wgtypes.Device, error)
-	ConfigureDevice(name string, cfg wgtypes.Config) error
-}
-
-// A NetlinkClient is a type which can control a netlink device.
-type NetlinkClient interface {
-	LinkAdd(link netlink.Link) error
-	LinkDel(link netlink.Link) error
-	LinkByName(name string) (netlink.Link, error)
-	LinkSetUp(link netlink.Link) error
-	LinkSetDown(link netlink.Link) error
-	LinkSetMTU(link netlink.Link, mtu int) error
-	AddrReplace(link netlink.Link, addr *netlink.Addr) error
-	AddrAdd(link netlink.Link, addr *netlink.Addr) error
-	AddrList(link netlink.Link) ([]netlink.Addr, error)
-	AddrDel(link netlink.Link, addr *netlink.Addr) error
-	RouteAdd(route *netlink.Route) error
-	RouteDel(route *netlink.Route) error
-	RouteReplace(route *netlink.Route) error
-	RouteList(link netlink.Link, family int) ([]netlink.Route, error)
-	RouteListFiltered(family int, filter *netlink.Route, filterMask uint64) ([]netlink.Route, error)
-	RuleAdd(rule *netlink.Rule) error
-	RuleDel(rule *netlink.Rule) error
-	RuleList(family int) ([]netlink.Rule, error)
-}
-
-// endregion dependencies
-
-type LocalController struct {
-	cfg *config.Config
-
-	wg WgCtrlRepo
-	nl NetlinkClient
-
-	shellCmd              string
-	resolvConfIfacePrefix string
-}
-
-// NewLocalController creates a new local controller instance.
-// This repository is used to interact with the WireGuard kernel or userspace module.
-func NewLocalController(cfg *config.Config) (*LocalController, error) {
-	wg, err := wgctrl.New()
-	if err != nil {
-		return nil, fmt.Errorf("failed to create wgctrl client: %w", err)
-	}
-
-	nl := &lowlevel.NetlinkManager{}
-
-	repo := &LocalController{
-		cfg: cfg,
-
-		wg: wg,
-		nl: nl,
-
-		shellCmd:              "bash", // we only support bash at the moment
-		resolvConfIfacePrefix: "tun.", // WireGuard interfaces have a tun. prefix in resolvconf
-	}
-
-	return repo, nil
-}
-
-func (c LocalController) GetId() domain.InterfaceBackend {
-	return config.LocalBackendName
-}
-
-// region wireguard-related
-
-func (c LocalController) GetInterfaces(_ context.Context) ([]domain.PhysicalInterface, error) {
-	devices, err := c.wg.Devices()
-	if err != nil {
-		return nil, fmt.Errorf("device list error: %w", err)
-	}
-
-	interfaces := make([]domain.PhysicalInterface, 0, len(devices))
-	for _, device := range devices {
-		interfaceModel, err := c.convertWireGuardInterface(device)
-		if err != nil {
-			return nil, fmt.Errorf("interface convert failed for %s: %w", device.Name, err)
-		}
-		interfaces = append(interfaces, interfaceModel)
-	}
-
-	return interfaces, nil
-}
-
-func (c LocalController) GetInterface(_ context.Context, id domain.InterfaceIdentifier) (
-	*domain.PhysicalInterface,
-	error,
-) {
-	return c.getInterface(id)
-}
-
-func (c LocalController) convertWireGuardInterface(device *wgtypes.Device) (domain.PhysicalInterface, error) {
-	// read data from wgctrl interface
-
-	iface := domain.PhysicalInterface{
-		Identifier: domain.InterfaceIdentifier(device.Name),
-		KeyPair: domain.KeyPair{
-			PrivateKey: device.PrivateKey.String(),
-			PublicKey:  device.PublicKey.String(),
-		},
-		ListenPort:    device.ListenPort,
-		Addresses:     nil,
-		Mtu:           0,
-		FirewallMark:  uint32(device.FirewallMark),
-		DeviceUp:      false,
-		ImportSource:  domain.ControllerTypeLocal,
-		DeviceType:    device.Type.String(),
-		BytesUpload:   0,
-		BytesDownload: 0,
-	}
-
-	// read data from netlink interface
-
-	lowLevelInterface, err := c.nl.LinkByName(device.Name)
-	if err != nil {
-		return domain.PhysicalInterface{}, fmt.Errorf("netlink error for %s: %w", device.Name, err)
-	}
-	ipAddresses, err := c.nl.AddrList(lowLevelInterface)
-	if err != nil {
-		return domain.PhysicalInterface{}, fmt.Errorf("ip read error for %s: %w", device.Name, err)
-	}
-
-	for _, addr := range ipAddresses {
-		iface.Addresses = append(iface.Addresses, domain.CidrFromNetlinkAddr(addr))
-	}
-	iface.Mtu = lowLevelInterface.Attrs().MTU
-	iface.DeviceUp = lowLevelInterface.Attrs().OperState == netlink.OperUnknown // wg only supports unknown
-	if stats := lowLevelInterface.Attrs().Statistics; stats != nil {
-		iface.BytesUpload = stats.TxBytes
-		iface.BytesDownload = stats.RxBytes
-	}
-
-	return iface, nil
-}
-
-func (c LocalController) GetPeers(_ context.Context, deviceId domain.InterfaceIdentifier) (
-	[]domain.PhysicalPeer,
-	error,
-) {
-	device, err := c.wg.Device(string(deviceId))
-	if err != nil {
-		return nil, fmt.Errorf("device error: %w", err)
-	}
-
-	peers := make([]domain.PhysicalPeer, 0, len(device.Peers))
-	for _, peer := range device.Peers {
-		peerModel, err := c.convertWireGuardPeer(&peer)
-		if err != nil {
-			return nil, fmt.Errorf("peer convert failed for %v: %w", peer.PublicKey, err)
-		}
-		peers = append(peers, peerModel)
-	}
-
-	return peers, nil
-}
-
-func (c LocalController) convertWireGuardPeer(peer *wgtypes.Peer) (domain.PhysicalPeer, error) {
-	peerModel := domain.PhysicalPeer{
-		Identifier: domain.PeerIdentifier(peer.PublicKey.String()),
-		Endpoint:   "",
-		AllowedIPs: nil,
-		KeyPair: domain.KeyPair{
-			PublicKey: peer.PublicKey.String(),
-		},
-		PresharedKey:        "",
-		PersistentKeepalive: int(peer.PersistentKeepaliveInterval.Seconds()),
-		LastHandshake:       peer.LastHandshakeTime,
-		ProtocolVersion:     peer.ProtocolVersion,
-		BytesUpload:         uint64(peer.ReceiveBytes),
-		BytesDownload:       uint64(peer.TransmitBytes),
-		ImportSource:        domain.ControllerTypeLocal,
-	}
-
-	// Set local extras - local peers are never disabled in the kernel
-	peerModel.SetExtras(domain.LocalPeerExtras{
-		Disabled: false,
-	})
-
-	for _, addr := range peer.AllowedIPs {
-		peerModel.AllowedIPs = append(peerModel.AllowedIPs, domain.CidrFromIpNet(addr))
-	}
-	if peer.Endpoint != nil {
-		peerModel.Endpoint = peer.Endpoint.String()
-	}
-	if peer.PresharedKey != (wgtypes.Key{}) {
-		peerModel.PresharedKey = domain.PreSharedKey(peer.PresharedKey.String())
-	}
-
-	return peerModel, nil
-}
-
-func (c LocalController) SaveInterface(
-	_ context.Context,
-	id domain.InterfaceIdentifier,
-	updateFunc func(pi *domain.PhysicalInterface) (*domain.PhysicalInterface, error),
-) error {
-	physicalInterface, err := c.getOrCreateInterface(id)
-	if err != nil {
-		return err
-	}
-
-	if updateFunc != nil {
-		physicalInterface, err = updateFunc(physicalInterface)
-		if err != nil {
-			return err
-		}
-	}
-
-	if err := c.updateLowLevelInterface(physicalInterface); err != nil {
-		return err
-	}
-	if err := c.updateWireGuardInterface(physicalInterface); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c LocalController) getOrCreateInterface(id domain.InterfaceIdentifier) (*domain.PhysicalInterface, error) {
-	device, err := c.getInterface(id)
-	if err == nil {
-		return device, nil // interface exists
-	}
-	if !errors.Is(err, os.ErrNotExist) {
-		return nil, fmt.Errorf("device error: %w", err) // unknown error
-	}
-
-	// create new device
-	if err := c.createLowLevelInterface(id); err != nil {
-		return nil, err
-	}
-
-	device, err = c.getInterface(id)
-	return device, err
-}
-
-func (c LocalController) getInterface(id domain.InterfaceIdentifier) (*domain.PhysicalInterface, error) {
-	device, err := c.wg.Device(string(id))
-	if err != nil {
-		return nil, err
-	}
-
-	pi, err := c.convertWireGuardInterface(device)
-	return &pi, err
-}
-
-func (c LocalController) createLowLevelInterface(id domain.InterfaceIdentifier) error {
-	link := &netlink.GenericLink{
-		LinkAttrs: netlink.LinkAttrs{
-			Name: string(id),
-		},
-		LinkType: "wireguard",
-	}
-	err := c.nl.LinkAdd(link)
-	if err != nil {
-		return fmt.Errorf("link add failed: %w", err)
-	}
-
-	return nil
-}
-
-func (c LocalController) updateLowLevelInterface(pi *domain.PhysicalInterface) error {
-	link, err := c.nl.LinkByName(string(pi.Identifier))
-	if err != nil {
-		return err
-	}
-	if pi.Mtu != 0 {
-		if err := c.nl.LinkSetMTU(link, pi.Mtu); err != nil {
-			return fmt.Errorf("mtu error: %w", err)
-		}
-	}
-
-	for _, addr := range pi.Addresses {
-		err := c.nl.AddrReplace(link, addr.NetlinkAddr())
-		if err != nil {
-			return fmt.Errorf("failed to set ip %s: %w", addr.String(), err)
-		}
-	}
-
-	// Remove unwanted IP addresses
-	rawAddresses, err := c.nl.AddrList(link)
-	if err != nil {
-		return fmt.Errorf("failed to fetch interface ips: %w", err)
-	}
-	for _, rawAddr := range rawAddresses {
-		netlinkAddr := domain.CidrFromNetlinkAddr(rawAddr)
-		remove := true
-		for _, addr := range pi.Addresses {
-			if addr == netlinkAddr {
-				remove = false
-				break
-			}
-		}
-
-		if !remove {
-			continue
-		}
-
-		err := c.nl.AddrDel(link, &rawAddr)
-		if err != nil {
-			return fmt.Errorf("failed to remove deprecated ip %s: %w", netlinkAddr.String(), err)
-		}
-	}
-
-	// Update link state
-	if pi.DeviceUp {
-		if err := c.nl.LinkSetUp(link); err != nil {
-			return fmt.Errorf("failed to bring up device: %w", err)
-		}
-	} else {
-		if err := c.nl.LinkSetDown(link); err != nil {
-			return fmt.Errorf("failed to bring down device: %w", err)
-		}
-	}
-
-	return nil
-}
-
-func (c LocalController) updateWireGuardInterface(pi *domain.PhysicalInterface) error {
-	pKey, err := wgtypes.NewKey(pi.KeyPair.GetPrivateKeyBytes())
-	if err != nil {
-		return err
-	}
-
-	var fwMark *int
-	if pi.FirewallMark != 0 {
-		intFwMark := int(pi.FirewallMark)
-		fwMark = &intFwMark
-	}
-	err = c.wg.ConfigureDevice(string(pi.Identifier), wgtypes.Config{
-		PrivateKey:   &pKey,
-		ListenPort:   &pi.ListenPort,
-		FirewallMark: fwMark,
-		ReplacePeers: false,
-	})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c LocalController) DeleteInterface(_ context.Context, id domain.InterfaceIdentifier) error {
-	if err := c.deleteLowLevelInterface(id); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c LocalController) deleteLowLevelInterface(id domain.InterfaceIdentifier) error {
-	link, err := c.nl.LinkByName(string(id))
-	if err != nil {
-		var linkNotFoundError netlink.LinkNotFoundError
-		if errors.As(err, &linkNotFoundError) {
-			return nil // ignore not found error
-		}
-		return fmt.Errorf("unable to find low level interface: %w", err)
-	}
-
-	err = c.nl.LinkDel(link)
-	if err != nil {
-		return fmt.Errorf("failed to delete low level interface: %w", err)
-	}
-
-	return nil
-}
-
-func (c LocalController) SavePeer(
-	_ context.Context,
-	deviceId domain.InterfaceIdentifier,
-	id domain.PeerIdentifier,
-	updateFunc func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error),
-) error {
-	physicalPeer, err := c.getOrCreatePeer(deviceId, id)
-	if err != nil {
-		return err
-	}
-
-	physicalPeer, err = updateFunc(physicalPeer)
-	if err != nil {
-		return err
-	}
-
-	// Check if the peer is disabled by looking at the backend extras
-	// For local controller, disabled peers should be deleted
-	if physicalPeer.GetExtras() != nil {
-		switch extras := physicalPeer.GetExtras().(type) {
-		case domain.LocalPeerExtras:
-			if extras.Disabled {
-				// Delete the peer instead of updating it
-				return c.deletePeer(deviceId, id)
-			}
-		}
-	}
-
-	if err := c.updatePeer(deviceId, physicalPeer); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c LocalController) getOrCreatePeer(deviceId domain.InterfaceIdentifier, id domain.PeerIdentifier) (
-	*domain.PhysicalPeer,
-	error,
-) {
-	peer, err := c.getPeer(deviceId, id)
-	if err == nil {
-		return peer, nil // peer exists
-	}
-	if !errors.Is(err, os.ErrNotExist) {
-		return nil, fmt.Errorf("peer error: %w", err) // unknown error
-	}
-
-	// create new peer
-	err = c.wg.ConfigureDevice(string(deviceId), wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{
-			{
-				PublicKey: id.ToPublicKey(),
-			},
-		},
-	})
-	if err != nil {
-		return nil, fmt.Errorf("peer create error for %s: %w", id.ToPublicKey(), err)
-	}
-
-	peer, err = c.getPeer(deviceId, id)
-	if err != nil {
-		return nil, fmt.Errorf("peer error after create: %w", err)
-	}
-	return peer, nil
-}
-
-func (c LocalController) getPeer(deviceId domain.InterfaceIdentifier, id domain.PeerIdentifier) (
-	*domain.PhysicalPeer,
-	error,
-) {
-	if !id.IsPublicKey() {
-		return nil, errors.New("invalid public key")
-	}
-
-	device, err := c.wg.Device(string(deviceId))
-	if err != nil {
-		return nil, err
-	}
-
-	publicKey := id.ToPublicKey()
-	for _, peer := range device.Peers {
-		if peer.PublicKey != publicKey {
-			continue
-		}
-
-		peerModel, err := c.convertWireGuardPeer(&peer)
-		return &peerModel, err
-	}
-
-	return nil, os.ErrNotExist
-}
-
-func (c LocalController) updatePeer(deviceId domain.InterfaceIdentifier, pp *domain.PhysicalPeer) error {
-	cfg := wgtypes.PeerConfig{
-		PublicKey:                   pp.GetPublicKey(),
-		Remove:                      false,
-		UpdateOnly:                  true,
-		PresharedKey:                pp.GetPresharedKey(),
-		Endpoint:                    pp.GetEndpointAddress(),
-		PersistentKeepaliveInterval: pp.GetPersistentKeepaliveTime(),
-		ReplaceAllowedIPs:           true,
-		AllowedIPs:                  pp.GetAllowedIPs(),
-	}
-
-	err := c.wg.ConfigureDevice(string(deviceId), wgtypes.Config{ReplacePeers: false, Peers: []wgtypes.PeerConfig{cfg}})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c LocalController) DeletePeer(
-	_ context.Context,
-	deviceId domain.InterfaceIdentifier,
-	id domain.PeerIdentifier,
-) error {
-	if !id.IsPublicKey() {
-		return errors.New("invalid public key")
-	}
-
-	err := c.deletePeer(deviceId, id)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c LocalController) deletePeer(deviceId domain.InterfaceIdentifier, id domain.PeerIdentifier) error {
-	cfg := wgtypes.PeerConfig{
-		PublicKey: id.ToPublicKey(),
-		Remove:    true,
-	}
-
-	err := c.wg.ConfigureDevice(string(deviceId), wgtypes.Config{ReplacePeers: false, Peers: []wgtypes.PeerConfig{cfg}})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// endregion wireguard-related
-
-// region wg-quick-related
-
-func (c LocalController) ExecuteInterfaceHook(id domain.InterfaceIdentifier, hookCmd string) error {
-	if hookCmd == "" {
-		return nil
-	}
-
-	slog.Debug("executing interface hook", "interface", id, "hook", hookCmd)
-	err := c.exec(hookCmd, id)
-	if err != nil {
-		return fmt.Errorf("failed to exec hook: %w", err)
-	}
-
-	return nil
-}
-
-func (c LocalController) SetDNS(id domain.InterfaceIdentifier, dnsStr, dnsSearchStr string) error {
-	if dnsStr == "" && dnsSearchStr == "" {
-		return nil
-	}
-
-	dnsServers := internal.SliceString(dnsStr)
-	dnsSearchDomains := internal.SliceString(dnsSearchStr)
-
-	dnsCommand := "resolvconf -a %resPref%i -m 0 -x"
-	dnsCommandInput := make([]string, 0, len(dnsServers)+len(dnsSearchDomains))
-
-	for _, dnsServer := range dnsServers {
-		dnsCommandInput = append(dnsCommandInput, fmt.Sprintf("nameserver %s", dnsServer))
-	}
-	for _, searchDomain := range dnsSearchDomains {
-		dnsCommandInput = append(dnsCommandInput, fmt.Sprintf("search %s", searchDomain))
-	}
-
-	err := c.exec(dnsCommand, id, dnsCommandInput...)
-	if err != nil {
-		return fmt.Errorf(
-			"failed to set dns settings (is resolvconf available?, for systemd create this symlink: ln -s /usr/bin/resolvectl /usr/local/bin/resolvconf): %w",
-			err,
-		)
-	}
-
-	return nil
-}
-
-func (c LocalController) UnsetDNS(id domain.InterfaceIdentifier) error {
-	dnsCommand := "resolvconf -d %resPref%i -f"
-
-	err := c.exec(dnsCommand, id)
-	if err != nil {
-		return fmt.Errorf("failed to unset dns settings: %w", err)
-	}
-
-	return nil
-}
-
-func (c LocalController) replaceCommandPlaceHolders(command string, interfaceId domain.InterfaceIdentifier) string {
-	command = strings.ReplaceAll(command, "%resPref", c.resolvConfIfacePrefix)
-	return strings.ReplaceAll(command, "%i", string(interfaceId))
-}
-
-func (c LocalController) exec(command string, interfaceId domain.InterfaceIdentifier, stdin ...string) error {
-	commandWithInterfaceName := c.replaceCommandPlaceHolders(command, interfaceId)
-	cmd := exec.Command(c.shellCmd, "-ce", commandWithInterfaceName)
-	if len(stdin) > 0 {
-		b := &bytes.Buffer{}
-		for _, ln := range stdin {
-			if _, err := fmt.Fprint(b, ln); err != nil {
-				return err
-			}
-		}
-		cmd.Stdin = b
-	}
-	out, err := cmd.CombinedOutput() // execute and wait for output
-	if err != nil {
-		return fmt.Errorf("failed to exexute shell command %s: %w", commandWithInterfaceName, err)
-	}
-	slog.Debug("executed shell command",
-		"command", commandWithInterfaceName,
-		"output", string(out))
-	return nil
-}
-
-// endregion wg-quick-related
-
-// region routing-related
-
-func (c LocalController) SyncRouteRules(_ context.Context, rules []domain.RouteRule) error {
-	// update fwmark rules
-	if err := c.setFwMarkRules(rules); err != nil {
-		return err
-	}
-
-	// update main rule
-	if err := c.setMainRule(rules); err != nil {
-		return err
-	}
-
-	// cleanup old main rules
-	if err := c.cleanupMainRule(rules); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c LocalController) setFwMarkRules(rules []domain.RouteRule) error {
-	for _, rule := range rules {
-		existingRules, err := c.nl.RuleList(int(rule.IpFamily))
-		if err != nil {
-			return fmt.Errorf("failed to get existing rules for family %s: %w", rule.IpFamily, err)
-		}
-
-		ruleExists := false
-		for _, existingRule := range existingRules {
-			if rule.FwMark == existingRule.Mark && rule.Table == existingRule.Table {
-				ruleExists = true
-				break
-			}
-		}
-
-		if ruleExists {
-			continue // rule already exists, no need to recreate it
-		}
-
-		// create a missing rule
-		if err := c.nl.RuleAdd(&netlink.Rule{
-			Family:            int(rule.IpFamily),
-			Table:             rule.Table,
-			Mark:              rule.FwMark,
-			Invert:            true,
-			SuppressIfgroup:   -1,
-			SuppressPrefixlen: -1,
-			Priority:          c.getRulePriority(existingRules),
-			Mask:              nil,
-			Goto:              -1,
-			Flow:              -1,
-		}); err != nil {
-			return fmt.Errorf("failed to setup %s rule for fwmark %d and table %d: %w",
-				rule.IpFamily, rule.FwMark, rule.Table, err)
-		}
-	}
-	return nil
-}
-
-func (c LocalController) getRulePriority(existingRules []netlink.Rule) int {
-	prio := 32700 // linux main rule has a priority of 32766
-	for {
-		isFresh := true
-		for _, existingRule := range existingRules {
-			if existingRule.Priority == prio {
-				isFresh = false
-				break
-			}
-		}
-		if isFresh {
-			break
-		} else {
-			prio--
-		}
-	}
-	return prio
-}
-
-func (c LocalController) setMainRule(rules []domain.RouteRule) error {
-	var family domain.IpFamily
-	shouldHaveMainRule := false
-	for _, rule := range rules {
-		family = rule.IpFamily
-		if rule.HasDefault == true {
-			shouldHaveMainRule = true
-			break
-		}
-	}
-	if !shouldHaveMainRule {
-		return nil
-	}
-
-	existingRules, err := c.nl.RuleList(int(family))
-	if err != nil {
-		return fmt.Errorf("failed to get existing rules for family %s: %w", family, err)
-	}
-
-	ruleExists := false
-	for _, existingRule := range existingRules {
-		if existingRule.Table == unix.RT_TABLE_MAIN && existingRule.SuppressPrefixlen == 0 {
-			ruleExists = true
-			break
-		}
-	}
-
-	if ruleExists {
-		return nil // rule already exists, skip re-creation
-	}
-
-	if err := c.nl.RuleAdd(&netlink.Rule{
-		Family:            int(family),
-		Table:             unix.RT_TABLE_MAIN,
-		SuppressIfgroup:   -1,
-		SuppressPrefixlen: 0,
-		Priority:          c.getMainRulePriority(existingRules),
-		Mark:              0,
-		Mask:              nil,
-		Goto:              -1,
-		Flow:              -1,
-	}); err != nil {
-		return fmt.Errorf("failed to setup rule for main table: %w", err)
-	}
-
-	return nil
-}
-
-func (c LocalController) getMainRulePriority(existingRules []netlink.Rule) int {
-	priority := c.cfg.Advanced.RulePrioOffset
-	for {
-		isFresh := true
-		for _, existingRule := range existingRules {
-			if existingRule.Priority == priority {
-				isFresh = false
-				break
-			}
-		}
-		if isFresh {
-			break
-		} else {
-			priority++
-		}
-	}
-	return priority
-}
-
-func (c LocalController) cleanupMainRule(rules []domain.RouteRule) error {
-	var family domain.IpFamily
-	for _, rule := range rules {
-		family = rule.IpFamily
-		break
-	}
-
-	existingRules, err := c.nl.RuleList(int(family))
-	if err != nil {
-		return fmt.Errorf("failed to get existing rules for family %s: %w", family, err)
-	}
-
-	shouldHaveMainRule := false
-	for _, rule := range rules {
-		if rule.HasDefault == true {
-			shouldHaveMainRule = true
-			break
-		}
-	}
-
-	mainRules := 0
-	for _, existingRule := range existingRules {
-		if existingRule.Table == unix.RT_TABLE_MAIN && existingRule.SuppressPrefixlen == 0 {
-			mainRules++
-		}
-	}
-
-	removalCount := 0
-	if mainRules > 1 {
-		removalCount = mainRules - 1 // we only want one single rule
-	}
-	if !shouldHaveMainRule {
-		removalCount = mainRules
-	}
-
-	for _, existingRule := range existingRules {
-		if existingRule.Table == unix.RT_TABLE_MAIN && existingRule.SuppressPrefixlen == 0 {
-			if removalCount > 0 {
-				existingRule.Family = int(family) // set family, somehow the RuleList method does not populate the family field
-				if err := c.nl.RuleDel(&existingRule); err != nil {
-					return fmt.Errorf("failed to delete main rule: %w", err)
-				}
-				removalCount--
-			}
-		}
-	}
-
-	return nil
-}
-
-func (c LocalController) DeleteRouteRules(_ context.Context, rules []domain.RouteRule) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-// endregion routing-related
-
-// region statistics-related
-
-func (c LocalController) PingAddresses(
-	ctx context.Context,
-	addr string,
-) (*domain.PingerResult, error) {
-	pinger, err := probing.NewPinger(addr)
-	if err != nil {
-		return nil, fmt.Errorf("failed to instantiate pinger for %s: %w", addr, err)
-	}
-
-	checkCount := 1
-	pinger.SetPrivileged(!c.cfg.Statistics.PingUnprivileged)
-	pinger.Count = checkCount
-	pinger.Timeout = 2 * time.Second
-	err = pinger.RunWithContext(ctx) // Blocks until finished.
-	if err != nil {
-		return nil, fmt.Errorf("failed to ping %s: %w", addr, err)
-	}
-
-	stats := pinger.Statistics()
-
-	return &domain.PingerResult{
-		PacketsRecv: stats.PacketsRecv,
-		PacketsSent: stats.PacketsSent,
-		Rtts:        stats.Rtts,
-	}, nil
-}
-
-// endregion statistics-related

internal/adapters/wgcontroller/mikrotik.go

@@ -1,829 +0,0 @@
-package wgcontroller
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"log/slog"
-
-	"github.com/h44z/wg-portal/internal/config"
-	"github.com/h44z/wg-portal/internal/domain"
-	"github.com/h44z/wg-portal/internal/lowlevel"
-)
-
-type MikrotikController struct {
-	coreCfg *config.Config
-	cfg     *config.BackendMikrotik
-
-	client *lowlevel.MikrotikApiClient
-
-	// Add mutexes to prevent race conditions
-	interfaceMutexes sync.Map // map[domain.InterfaceIdentifier]*sync.Mutex
-	peerMutexes      sync.Map // map[domain.PeerIdentifier]*sync.Mutex
-}
-
-func NewMikrotikController(coreCfg *config.Config, cfg *config.BackendMikrotik) (*MikrotikController, error) {
-	client, err := lowlevel.NewMikrotikApiClient(coreCfg, cfg)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create Mikrotik API client: %w", err)
-	}
-
-	return &MikrotikController{
-		coreCfg: coreCfg,
-		cfg:     cfg,
-
-		client: client,
-
-		interfaceMutexes: sync.Map{},
-		peerMutexes:      sync.Map{},
-	}, nil
-}
-
-func (c *MikrotikController) GetId() domain.InterfaceBackend {
-	return domain.InterfaceBackend(c.cfg.Id)
-}
-
-// getInterfaceMutex returns a mutex for the given interface to prevent concurrent modifications
-func (c *MikrotikController) getInterfaceMutex(id domain.InterfaceIdentifier) *sync.Mutex {
-	mutex, _ := c.interfaceMutexes.LoadOrStore(id, &sync.Mutex{})
-	return mutex.(*sync.Mutex)
-}
-
-// getPeerMutex returns a mutex for the given peer to prevent concurrent modifications
-func (c *MikrotikController) getPeerMutex(id domain.PeerIdentifier) *sync.Mutex {
-	mutex, _ := c.peerMutexes.LoadOrStore(id, &sync.Mutex{})
-	return mutex.(*sync.Mutex)
-}
-
-// region wireguard-related
-
-func (c *MikrotikController) GetInterfaces(ctx context.Context) ([]domain.PhysicalInterface, error) {
-	wgReply := c.client.Query(ctx, "/interface/wireguard", &lowlevel.MikrotikRequestOptions{
-		PropList: []string{
-			".id", "name", "public-key", "private-key", "listen-port", "mtu", "disabled", "running", "comment",
-		},
-	})
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return nil, fmt.Errorf("failed to query interfaces: %v", wgReply.Error)
-	}
-
-	// Parallelize loading of interface details to speed up overall latency.
-	// Use a bounded semaphore to avoid overloading the MikroTik device.
-	maxConcurrent := c.cfg.GetConcurrency()
-	sem := make(chan struct{}, maxConcurrent)
-
-	interfaces := make([]domain.PhysicalInterface, 0, len(wgReply.Data))
-	var mu sync.Mutex
-	var wgWait sync.WaitGroup
-	var firstErr error
-	ctx2, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	for _, wgObj := range wgReply.Data {
-		wgWait.Add(1)
-		sem <- struct{}{} // block if more than maxConcurrent requests are processing
-		go func(wg lowlevel.GenericJsonObject) {
-			defer wgWait.Done()
-			defer func() { <-sem }() // read from the semaphore and make space for the next entry
-			if firstErr != nil {
-				return
-			}
-			pi, err := c.loadInterfaceData(ctx2, wg)
-			if err != nil {
-				mu.Lock()
-				if firstErr == nil {
-					firstErr = err
-					cancel()
-				}
-				mu.Unlock()
-				return
-			}
-			mu.Lock()
-			interfaces = append(interfaces, *pi)
-			mu.Unlock()
-		}(wgObj)
-	}
-
-	wgWait.Wait()
-	if firstErr != nil {
-		return nil, firstErr
-	}
-
-	return interfaces, nil
-}
-
-func (c *MikrotikController) GetInterface(ctx context.Context, id domain.InterfaceIdentifier) (
-	*domain.PhysicalInterface,
-	error,
-) {
-	wgReply := c.client.Query(ctx, "/interface/wireguard", &lowlevel.MikrotikRequestOptions{
-		PropList: []string{
-			".id", "name", "public-key", "private-key", "listen-port", "mtu", "disabled", "running",
-		},
-		Filters: map[string]string{
-			"name": string(id),
-		},
-	})
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return nil, fmt.Errorf("failed to query interface %s: %v", id, wgReply.Error)
-	}
-
-	if len(wgReply.Data) == 0 {
-		return nil, fmt.Errorf("interface %s not found", id)
-	}
-
-	return c.loadInterfaceData(ctx, wgReply.Data[0])
-}
-
-func (c *MikrotikController) loadInterfaceData(
-	ctx context.Context,
-	wireGuardObj lowlevel.GenericJsonObject,
-) (*domain.PhysicalInterface, error) {
-	deviceId := wireGuardObj.GetString(".id")
-	deviceName := wireGuardObj.GetString("name")
-	ifaceReply := c.client.Get(ctx, "/interface/"+deviceId, &lowlevel.MikrotikRequestOptions{
-		PropList: []string{
-			"name", "rx-byte", "tx-byte",
-		},
-	})
-	if ifaceReply.Status != lowlevel.MikrotikApiStatusOk {
-		return nil, fmt.Errorf("failed to query interface %s: %v", deviceId, ifaceReply.Error)
-	}
-
-	ipv4, ipv6, err := c.loadIpAddresses(ctx, deviceName)
-	if err != nil {
-		return nil, fmt.Errorf("failed to query IP addresses for interface %s: %v", deviceId, err)
-	}
-	addresses := c.convertIpAddresses(ipv4, ipv6)
-
-	interfaceModel, err := c.convertWireGuardInterface(wireGuardObj, ifaceReply.Data, addresses)
-	if err != nil {
-		return nil, fmt.Errorf("interface convert failed for %s: %w", deviceName, err)
-	}
-	return &interfaceModel, nil
-}
-
-func (c *MikrotikController) loadIpAddresses(
-	ctx context.Context,
-	deviceName string,
-) (ipv4 []lowlevel.GenericJsonObject, ipv6 []lowlevel.GenericJsonObject, err error) {
-	// Query IPv4 and IPv6 addresses in parallel to reduce latency.
-	var (
-		v4    []lowlevel.GenericJsonObject
-		v6    []lowlevel.GenericJsonObject
-		v4Err error
-		v6Err error
-		wg    sync.WaitGroup
-	)
-	wg.Add(2)
-
-	go func() {
-		defer wg.Done()
-		addrV4Reply := c.client.Query(ctx, "/ip/address", &lowlevel.MikrotikRequestOptions{
-			PropList: []string{
-				".id", "address", "network",
-			},
-			Filters: map[string]string{
-				"interface": deviceName,
-				"dynamic":   "false", // we only want static addresses
-				"disabled":  "false", // we only want addresses that are not disabled
-			},
-		})
-		if addrV4Reply.Status != lowlevel.MikrotikApiStatusOk {
-			v4Err = fmt.Errorf("failed to query IPv4 addresses for interface %s: %v", deviceName, addrV4Reply.Error)
-			return
-		}
-		v4 = addrV4Reply.Data
-	}()
-
-	go func() {
-		defer wg.Done()
-		addrV6Reply := c.client.Query(ctx, "/ipv6/address", &lowlevel.MikrotikRequestOptions{
-			PropList: []string{
-				".id", "address", "network",
-			},
-			Filters: map[string]string{
-				"interface": deviceName,
-				"dynamic":   "false", // we only want static addresses
-				"disabled":  "false", // we only want addresses that are not disabled
-			},
-		})
-		if addrV6Reply.Status != lowlevel.MikrotikApiStatusOk {
-			v6Err = fmt.Errorf("failed to query IPv6 addresses for interface %s: %v", deviceName, addrV6Reply.Error)
-			return
-		}
-		v6 = addrV6Reply.Data
-	}()
-
-	wg.Wait()
-	if v4Err != nil {
-		return nil, nil, v4Err
-	}
-	if v6Err != nil {
-		return nil, nil, v6Err
-	}
-
-	return v4, v6, nil
-}
-
-func (c *MikrotikController) convertIpAddresses(
-	ipv4, ipv6 []lowlevel.GenericJsonObject,
-) []domain.Cidr {
-	addresses := make([]domain.Cidr, 0, len(ipv4)+len(ipv6))
-	for _, addr := range append(ipv4, ipv6...) {
-		addrStr := addr.GetString("address")
-		if addrStr == "" {
-			continue
-		}
-		cidr, err := domain.CidrFromString(addrStr)
-		if err != nil {
-			continue
-		}
-
-		addresses = append(addresses, cidr)
-	}
-
-	return addresses
-}
-
-func (c *MikrotikController) convertWireGuardInterface(
-	wg, iface lowlevel.GenericJsonObject,
-	addresses []domain.Cidr,
-) (
-	domain.PhysicalInterface,
-	error,
-) {
-	pi := domain.PhysicalInterface{
-		Identifier: domain.InterfaceIdentifier(wg.GetString("name")),
-		KeyPair: domain.KeyPair{
-			PrivateKey: wg.GetString("private-key"),
-			PublicKey:  wg.GetString("public-key"),
-		},
-		ListenPort:    wg.GetInt("listen-port"),
-		Addresses:     addresses,
-		Mtu:           wg.GetInt("mtu"),
-		FirewallMark:  0,
-		DeviceUp:      wg.GetBool("running"),
-		ImportSource:  domain.ControllerTypeMikrotik,
-		DeviceType:    domain.ControllerTypeMikrotik,
-		BytesUpload:   uint64(iface.GetInt("tx-byte")),
-		BytesDownload: uint64(iface.GetInt("rx-byte")),
-	}
-
-	pi.SetExtras(domain.MikrotikInterfaceExtras{
-		Id:       wg.GetString(".id"),
-		Comment:  wg.GetString("comment"),
-		Disabled: wg.GetBool("disabled"),
-	})
-
-	return pi, nil
-}
-
-func (c *MikrotikController) GetPeers(ctx context.Context, deviceId domain.InterfaceIdentifier) (
-	[]domain.PhysicalPeer,
-	error,
-) {
-	wgReply := c.client.Query(ctx, "/interface/wireguard/peers", &lowlevel.MikrotikRequestOptions{
-		PropList: []string{
-			".id", "name", "allowed-address", "client-address", "client-endpoint", "client-keepalive", "comment",
-			"current-endpoint-address", "current-endpoint-port", "last-handshake", "persistent-keepalive",
-			"public-key", "private-key", "preshared-key", "mtu", "disabled", "rx", "tx", "responder", "client-dns",
-		},
-		Filters: map[string]string{
-			"interface": string(deviceId),
-		},
-	})
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return nil, fmt.Errorf("failed to query peers for %s: %v", deviceId, wgReply.Error)
-	}
-
-	if len(wgReply.Data) == 0 {
-		return nil, nil
-	}
-
-	peers := make([]domain.PhysicalPeer, 0, len(wgReply.Data))
-	for _, peer := range wgReply.Data {
-		peerModel, err := c.convertWireGuardPeer(peer)
-		if err != nil {
-			return nil, fmt.Errorf("peer convert failed for %v: %w", peer.GetString("name"), err)
-		}
-		peers = append(peers, peerModel)
-	}
-
-	return peers, nil
-}
-
-func (c *MikrotikController) convertWireGuardPeer(peer lowlevel.GenericJsonObject) (
-	domain.PhysicalPeer,
-	error,
-) {
-	keepAliveSeconds := 0
-	duration, err := time.ParseDuration(peer.GetString("persistent-keepalive"))
-	if err == nil {
-		keepAliveSeconds = int(duration.Seconds())
-	}
-
-	currentEndpoint := ""
-	if peer.GetString("current-endpoint-address") != "" && peer.GetString("current-endpoint-port") != "" {
-		currentEndpoint = peer.GetString("current-endpoint-address") + ":" + peer.GetString("current-endpoint-port")
-	}
-
-	lastHandshakeTime := time.Time{}
-	if peer.GetString("last-handshake") != "" {
-		relDuration, err := time.ParseDuration(peer.GetString("last-handshake"))
-		if err == nil {
-			lastHandshakeTime = time.Now().Add(-relDuration)
-		}
-	}
-
-	allowedAddresses, _ := domain.CidrsFromString(peer.GetString("allowed-address"))
-
-	clientKeepAliveSeconds := 0
-	duration, err = time.ParseDuration(peer.GetString("client-keepalive"))
-	if err == nil {
-		clientKeepAliveSeconds = int(duration.Seconds())
-	}
-
-	peerModel := domain.PhysicalPeer{
-		Identifier: domain.PeerIdentifier(peer.GetString("public-key")),
-		Endpoint:   currentEndpoint,
-		AllowedIPs: allowedAddresses,
-		KeyPair: domain.KeyPair{
-			PublicKey:  peer.GetString("public-key"),
-			PrivateKey: peer.GetString("private-key"),
-		},
-		PresharedKey:        domain.PreSharedKey(peer.GetString("preshared-key")),
-		PersistentKeepalive: keepAliveSeconds,
-		LastHandshake:       lastHandshakeTime,
-		ProtocolVersion:     0, // Mikrotik does not support protocol versioning, so we set it to 0
-		BytesUpload:         uint64(peer.GetInt("rx")),
-		BytesDownload:       uint64(peer.GetInt("tx")),
-		ImportSource:        domain.ControllerTypeMikrotik,
-	}
-
-	peerModel.SetExtras(domain.MikrotikPeerExtras{
-		Id:              peer.GetString(".id"),
-		Name:            peer.GetString("name"),
-		Comment:         peer.GetString("comment"),
-		IsResponder:     peer.GetBool("responder"),
-		Disabled:        peer.GetBool("disabled"),
-		ClientEndpoint:  peer.GetString("client-endpoint"),
-		ClientAddress:   peer.GetString("client-address"),
-		ClientDns:       peer.GetString("client-dns"),
-		ClientKeepalive: clientKeepAliveSeconds,
-	})
-
-	return peerModel, nil
-}
-
-func (c *MikrotikController) SaveInterface(
-	ctx context.Context,
-	id domain.InterfaceIdentifier,
-	updateFunc func(pi *domain.PhysicalInterface) (*domain.PhysicalInterface, error),
-) error {
-	// Lock the interface to prevent concurrent modifications
-	mutex := c.getInterfaceMutex(id)
-	mutex.Lock()
-	defer mutex.Unlock()
-
-	physicalInterface, err := c.getOrCreateInterface(ctx, id)
-	if err != nil {
-		return err
-	}
-
-	deviceId := physicalInterface.GetExtras().(domain.MikrotikInterfaceExtras).Id
-	if updateFunc != nil {
-		physicalInterface, err = updateFunc(physicalInterface)
-		if err != nil {
-			return err
-		}
-		newExtras := physicalInterface.GetExtras().(domain.MikrotikInterfaceExtras)
-		newExtras.Id = deviceId // ensure the ID is not changed
-		physicalInterface.SetExtras(newExtras)
-	}
-
-	if err := c.updateInterface(ctx, physicalInterface); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c *MikrotikController) getOrCreateInterface(
-	ctx context.Context,
-	id domain.InterfaceIdentifier,
-) (*domain.PhysicalInterface, error) {
-	wgReply := c.client.Query(ctx, "/interface/wireguard", &lowlevel.MikrotikRequestOptions{
-		PropList: []string{
-			".id", "name", "public-key", "private-key", "listen-port", "mtu", "disabled", "running",
-		},
-		Filters: map[string]string{
-			"name": string(id),
-		},
-	})
-	if wgReply.Status == lowlevel.MikrotikApiStatusOk && len(wgReply.Data) > 0 {
-		return c.loadInterfaceData(ctx, wgReply.Data[0])
-	}
-
-	// create a new interface if it does not exist
-	createReply := c.client.Create(ctx, "/interface/wireguard", lowlevel.GenericJsonObject{
-		"name": string(id),
-	})
-	if wgReply.Status == lowlevel.MikrotikApiStatusOk {
-		return c.loadInterfaceData(ctx, createReply.Data)
-	}
-
-	return nil, fmt.Errorf("failed to create interface %s: %v", id, createReply.Error)
-}
-
-func (c *MikrotikController) updateInterface(ctx context.Context, pi *domain.PhysicalInterface) error {
-	extras := pi.GetExtras().(domain.MikrotikInterfaceExtras)
-	interfaceId := extras.Id
-	wgReply := c.client.Update(ctx, "/interface/wireguard/"+interfaceId, lowlevel.GenericJsonObject{
-		"name":        pi.Identifier,
-		"comment":     extras.Comment,
-		"mtu":         strconv.Itoa(pi.Mtu),
-		"listen-port": strconv.Itoa(pi.ListenPort),
-		"private-key": pi.KeyPair.PrivateKey,
-		"disabled":    strconv.FormatBool(!pi.DeviceUp),
-	})
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return fmt.Errorf("failed to update interface %s: %v", pi.Identifier, wgReply.Error)
-	}
-
-	// update the interface's addresses
-	currentV4, currentV6, err := c.loadIpAddresses(ctx, string(pi.Identifier))
-	if err != nil {
-		return fmt.Errorf("failed to load current addresses for interface %s: %v", pi.Identifier, err)
-	}
-	currentAddresses := c.convertIpAddresses(currentV4, currentV6)
-
-	// get all addresses that are currently not in the interface, only in pi
-	newAddresses := make([]domain.Cidr, 0, len(pi.Addresses))
-	for _, addr := range pi.Addresses {
-		if slices.Contains(currentAddresses, addr) {
-			continue
-		}
-		newAddresses = append(newAddresses, addr)
-	}
-	// get obsolete addresses that are in the interface, but not in pi
-	obsoleteAddresses := make([]domain.Cidr, 0, len(currentAddresses))
-	for _, addr := range currentAddresses {
-		if slices.Contains(pi.Addresses, addr) {
-			continue
-		}
-		obsoleteAddresses = append(obsoleteAddresses, addr)
-	}
-
-	// update the IP addresses for the interface
-	if err := c.updateIpAddresses(ctx, string(pi.Identifier), currentV4, currentV6,
-		newAddresses, obsoleteAddresses); err != nil {
-		return fmt.Errorf("failed to update IP addresses for interface %s: %v", pi.Identifier, err)
-	}
-
-	return nil
-}
-
-func (c *MikrotikController) updateIpAddresses(
-	ctx context.Context,
-	deviceName string,
-	currentV4, currentV6 []lowlevel.GenericJsonObject,
-	new, obsolete []domain.Cidr,
-) error {
-	// first, delete all obsolete addresses
-	for _, addr := range obsolete {
-		// find ID of the address to delete
-		if addr.IsV4() {
-			for _, a := range currentV4 {
-				if a.GetString("address") == addr.String() {
-					// delete the address
-					reply := c.client.Delete(ctx, "/ip/address/"+a.GetString(".id"))
-					if reply.Status != lowlevel.MikrotikApiStatusOk {
-						return fmt.Errorf("failed to delete obsolete IPv4 address %s: %v", addr, reply.Error)
-					}
-					break
-				}
-			}
-		} else {
-			for _, a := range currentV6 {
-				if a.GetString("address") == addr.String() {
-					// delete the address
-					reply := c.client.Delete(ctx, "/ipv6/address/"+a.GetString(".id"))
-					if reply.Status != lowlevel.MikrotikApiStatusOk {
-						return fmt.Errorf("failed to delete obsolete IPv6 address %s: %v", addr, reply.Error)
-					}
-					break
-				}
-			}
-		}
-	}
-
-	// then, add all new addresses
-	for _, addr := range new {
-		var createPath string
-		if addr.IsV4() {
-			createPath = "/ip/address"
-		} else {
-			createPath = "/ipv6/address"
-		}
-
-		// create the address
-		reply := c.client.Create(ctx, createPath, lowlevel.GenericJsonObject{
-			"address":   addr.String(),
-			"interface": deviceName,
-		})
-		if reply.Status != lowlevel.MikrotikApiStatusOk {
-			return fmt.Errorf("failed to create new address %s: %v", addr, reply.Error)
-		}
-	}
-
-	return nil
-}
-
-func (c *MikrotikController) DeleteInterface(ctx context.Context, id domain.InterfaceIdentifier) error {
-	// Lock the interface to prevent concurrent modifications
-	mutex := c.getInterfaceMutex(id)
-	mutex.Lock()
-	defer mutex.Unlock()
-
-	// delete the interface's addresses
-	currentV4, currentV6, err := c.loadIpAddresses(ctx, string(id))
-	if err != nil {
-		return fmt.Errorf("failed to load current addresses for interface %s: %v", id, err)
-	}
-	for _, a := range currentV4 {
-		// delete the address
-		reply := c.client.Delete(ctx, "/ip/address/"+a.GetString(".id"))
-		if reply.Status != lowlevel.MikrotikApiStatusOk {
-			return fmt.Errorf("failed to delete IPv4 address %s: %v", a.GetString("address"), reply.Error)
-		}
-	}
-	for _, a := range currentV6 {
-		// delete the address
-		reply := c.client.Delete(ctx, "/ipv6/address/"+a.GetString(".id"))
-		if reply.Status != lowlevel.MikrotikApiStatusOk {
-			return fmt.Errorf("failed to delete IPv6 address %s: %v", a.GetString("address"), reply.Error)
-		}
-	}
-
-	// delete the WireGuard interface
-	wgReply := c.client.Query(ctx, "/interface/wireguard", &lowlevel.MikrotikRequestOptions{
-		PropList: []string{".id"},
-		Filters: map[string]string{
-			"name": string(id),
-		},
-	})
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return fmt.Errorf("unable to find WireGuard interface %s: %v", id, wgReply.Error)
-	}
-	if len(wgReply.Data) == 0 {
-		return nil // interface does not exist, nothing to delete
-	}
-
-	interfaceId := wgReply.Data[0].GetString(".id")
-	deleteReply := c.client.Delete(ctx, "/interface/wireguard/"+interfaceId)
-	if deleteReply.Status != lowlevel.MikrotikApiStatusOk {
-		return fmt.Errorf("failed to delete WireGuard interface %s: %v", id, deleteReply.Error)
-	}
-
-	return nil
-}
-
-func (c *MikrotikController) SavePeer(
-	ctx context.Context,
-	deviceId domain.InterfaceIdentifier,
-	id domain.PeerIdentifier,
-	updateFunc func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error),
-) error {
-	// Lock the peer to prevent concurrent modifications
-	mutex := c.getPeerMutex(id)
-	mutex.Lock()
-	defer mutex.Unlock()
-
-	physicalPeer, err := c.getOrCreatePeer(ctx, deviceId, id)
-	if err != nil {
-		return err
-	}
-
-	peerId := physicalPeer.GetExtras().(domain.MikrotikPeerExtras).Id
-	physicalPeer, err = updateFunc(physicalPeer)
-	if err != nil {
-		return err
-	}
-	newExtras := physicalPeer.GetExtras().(domain.MikrotikPeerExtras)
-	newExtras.Id = peerId // ensure the ID is not changed
-	physicalPeer.SetExtras(newExtras)
-
-	if err := c.updatePeer(ctx, deviceId, physicalPeer); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (c *MikrotikController) getOrCreatePeer(
-	ctx context.Context,
-	deviceId domain.InterfaceIdentifier,
-	id domain.PeerIdentifier,
-) (*domain.PhysicalPeer, error) {
-	wgReply := c.client.Query(ctx, "/interface/wireguard/peers", &lowlevel.MikrotikRequestOptions{
-		PropList: []string{
-			".id", "name", "public-key", "private-key", "preshared-key", "persistent-keepalive", "client-address",
-			"client-endpoint", "client-keepalive", "allowed-address", "client-dns", "comment", "disabled", "responder",
-		},
-		Filters: map[string]string{
-			"public-key": string(id),
-			"interface":  string(deviceId),
-		},
-	})
-	if wgReply.Status == lowlevel.MikrotikApiStatusOk && len(wgReply.Data) > 0 {
-		slog.Debug("found existing Mikrotik peer", "peer", id, "interface", deviceId)
-		existingPeer, err := c.convertWireGuardPeer(wgReply.Data[0])
-		if err != nil {
-			return nil, err
-		}
-		return &existingPeer, nil
-	}
-
-	// create a new peer if it does not exist
-	slog.Debug("creating new Mikrotik peer", "peer", id, "interface", deviceId)
-	createReply := c.client.Create(ctx, "/interface/wireguard/peers", lowlevel.GenericJsonObject{
-		"name":            fmt.Sprintf("tmp-wg-%s", id[0:8]),
-		"interface":       string(deviceId),
-		"public-key":      string(id),
-		"allowed-address": "0.0.0.0/0", // Use 0.0.0.0/0 as default, will be updated by updatePeer
-	})
-	if createReply.Status == lowlevel.MikrotikApiStatusOk {
-		newPeer, err := c.convertWireGuardPeer(createReply.Data)
-		if err != nil {
-			return nil, err
-		}
-		slog.Debug("successfully created Mikrotik peer", "peer", id, "interface", deviceId)
-		return &newPeer, nil
-	}
-
-	return nil, fmt.Errorf("failed to create peer %s for interface %s: %v", id, deviceId, createReply.Error)
-}
-
-func (c *MikrotikController) updatePeer(
-	ctx context.Context,
-	deviceId domain.InterfaceIdentifier,
-	pp *domain.PhysicalPeer,
-) error {
-	extras := pp.GetExtras().(domain.MikrotikPeerExtras)
-	peerId := extras.Id
-
-	endpoint := pp.Endpoint
-	endpointPort := "51820" // default port if not set
-	if s := strings.Split(endpoint, ":"); len(s) == 2 {
-		endpoint = s[0]
-		endpointPort = s[1]
-	}
-
-	allowedAddressStr := domain.CidrsToString(pp.AllowedIPs)
-	slog.Debug("updating Mikrotik peer",
-		"peer", pp.Identifier,
-		"interface", deviceId,
-		"allowed-address", allowedAddressStr,
-		"allowed-ips-count", len(pp.AllowedIPs),
-		"disabled", extras.Disabled)
-
-	wgReply := c.client.Update(ctx, "/interface/wireguard/peers/"+peerId, lowlevel.GenericJsonObject{
-		"name":                 extras.Name,
-		"comment":              extras.Comment,
-		"preshared-key":        pp.PresharedKey,
-		"public-key":           pp.KeyPair.PublicKey,
-		"private-key":          pp.KeyPair.PrivateKey,
-		"persistent-keepalive": (time.Duration(pp.PersistentKeepalive) * time.Second).String(),
-		"disabled":             strconv.FormatBool(extras.Disabled),
-		"responder":            strconv.FormatBool(extras.IsResponder),
-		"client-endpoint":      extras.ClientEndpoint,
-		"client-address":       extras.ClientAddress,
-		"client-keepalive":     (time.Duration(extras.ClientKeepalive) * time.Second).String(),
-		"client-dns":           extras.ClientDns,
-		"endpoint-address":     endpoint,
-		"endpoint-port":        endpointPort,
-		"allowed-address":      allowedAddressStr, // Add the missing allowed-address field
-	})
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return fmt.Errorf("failed to update peer %s on interface %s: %v", pp.Identifier, deviceId, wgReply.Error)
-	}
-
-	if extras.Disabled {
-		slog.Debug("successfully disabled Mikrotik peer", "peer", pp.Identifier, "interface", deviceId)
-	} else {
-		slog.Debug("successfully updated Mikrotik peer", "peer", pp.Identifier, "interface", deviceId)
-	}
-
-	return nil
-}
-
-func (c *MikrotikController) DeletePeer(
-	ctx context.Context,
-	deviceId domain.InterfaceIdentifier,
-	id domain.PeerIdentifier,
-) error {
-	// Lock the peer to prevent concurrent modifications
-	mutex := c.getPeerMutex(id)
-	mutex.Lock()
-	defer mutex.Unlock()
-
-	wgReply := c.client.Query(ctx, "/interface/wireguard/peers", &lowlevel.MikrotikRequestOptions{
-		PropList: []string{".id"},
-		Filters: map[string]string{
-			"public-key": string(id),
-			"interface":  string(deviceId),
-		},
-	})
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return fmt.Errorf("unable to find WireGuard peer %s for interface %s: %v", id, deviceId, wgReply.Error)
-	}
-	if len(wgReply.Data) == 0 {
-		return nil // peer does not exist, nothing to delete
-	}
-
-	peerId := wgReply.Data[0].GetString(".id")
-	deleteReply := c.client.Delete(ctx, "/interface/wireguard/peers/"+peerId)
-	if deleteReply.Status != lowlevel.MikrotikApiStatusOk {
-		return fmt.Errorf("failed to delete WireGuard peer %s for interface %s: %v", id, deviceId, deleteReply.Error)
-	}
-
-	return nil
-}
-
-// endregion wireguard-related
-
-// region wg-quick-related
-
-func (c *MikrotikController) ExecuteInterfaceHook(id domain.InterfaceIdentifier, hookCmd string) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (c *MikrotikController) SetDNS(id domain.InterfaceIdentifier, dnsStr, dnsSearchStr string) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (c *MikrotikController) UnsetDNS(id domain.InterfaceIdentifier) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-// endregion wg-quick-related
-
-// region routing-related
-
-func (c *MikrotikController) SyncRouteRules(_ context.Context, rules []domain.RouteRule) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (c *MikrotikController) DeleteRouteRules(_ context.Context, rules []domain.RouteRule) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-// endregion routing-related
-
-// region statistics-related
-
-func (c *MikrotikController) PingAddresses(
-	ctx context.Context,
-	addr string,
-) (*domain.PingerResult, error) {
-	wgReply := c.client.ExecList(ctx, "/tool/ping",
-		// limit to 1 packet with a max running time of 2 seconds
-		lowlevel.GenericJsonObject{"address": addr, "count": 1, "interval": "00:00:02"},
-	)
-
-	if wgReply.Status != lowlevel.MikrotikApiStatusOk {
-		return nil, fmt.Errorf("failed to ping %s: %v", addr, wgReply.Error)
-	}
-
-	var result domain.PingerResult
-	for _, item := range wgReply.Data {
-		result.PacketsRecv += item.GetInt("received")
-		result.PacketsSent += item.GetInt("sent")
-
-		rttStr := item.GetString("avg-rtt")
-		if rttStr != "" {
-			rtt, err := time.ParseDuration(rttStr)
-			if err == nil {
-				result.Rtts = append(result.Rtts, rtt)
-			} else {
-				// use a high value to indicate failure or timeout
-				result.Rtts = append(result.Rtts, 999999*time.Millisecond)
-			}
-		}
-	}
-
-	return &result, nil
-}
-
-// endregion statistics-related

internal/adapters/wireguard.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
 	"os"
 
 	"github.com/vishvananda/netlink"
@@ -17,9 +16,8 @@ import (
 
 // WgRepo implements all low-level WireGuard interactions.
 type WgRepo struct {
-	wg  lowlevel.WireGuardClient
+	wg lowlevel.WireGuardClient
-	nl  lowlevel.NetlinkClient
+	nl lowlevel.NetlinkClient
-	log *slog.Logger
 }
 
 // NewWireGuardRepository creates a new WgRepo instance.
@@ -33,9 +31,8 @@ func NewWireGuardRepository() *WgRepo {
 	nl := &lowlevel.NetlinkManager{}
 
 	repo := &WgRepo{
-		wg:  wg,
+		wg: wg,
-		nl:  nl,
+		nl: nl,
-		log: slog.Default().With(slog.String("adapter", "wireguard")),
 	}
 
 	return repo
@@ -43,10 +40,8 @@ func NewWireGuardRepository() *WgRepo {
 
 // GetInterfaces returns all existing WireGuard interfaces.
 func (r *WgRepo) GetInterfaces(_ context.Context) ([]domain.PhysicalInterface, error) {
-	r.log.Debug("getting all interfaces")
 	devices, err := r.wg.Devices()
 	if err != nil {
-		r.log.Error("failed to get devices", "error", err)
 		return nil, fmt.Errorf("device list error: %w", err)
 	}
 
@@ -65,17 +60,14 @@ func (r *WgRepo) GetInterfaces(_ context.Context) ([]domain.PhysicalInterface, e
 // GetInterface returns the interface with the given id.
 // If no interface is found, an error os.ErrNotExist is returned.
 func (r *WgRepo) GetInterface(_ context.Context, id domain.InterfaceIdentifier) (*domain.PhysicalInterface, error) {
-	r.log.Debug("getting interface", "id", id)
 	return r.getInterface(id)
 }
 
 // GetPeers returns all peers associated with the given interface id.
 // If the requested interface is found, an error os.ErrNotExist is returned.
 func (r *WgRepo) GetPeers(_ context.Context, deviceId domain.InterfaceIdentifier) ([]domain.PhysicalPeer, error) {
-	r.log.Debug("getting peers for interface", "deviceId", deviceId)
 	device, err := r.wg.Device(string(deviceId))
 	if err != nil {
-		r.log.Error("failed to get device", "deviceId", deviceId, "error", err)
 		return nil, fmt.Errorf("device error: %w", err)
 	}
 
@@ -98,7 +90,6 @@ func (r *WgRepo) GetPeer(
 	deviceId domain.InterfaceIdentifier,
 	id domain.PeerIdentifier,
 ) (*domain.PhysicalPeer, error) {
-	r.log.Debug("getting peer", "deviceId", deviceId, "peerId", id)
 	return r.getPeer(deviceId, id)
 }
 
@@ -183,31 +174,25 @@ func (r *WgRepo) SaveInterface(
 	id domain.InterfaceIdentifier,
 	updateFunc func(pi *domain.PhysicalInterface) (*domain.PhysicalInterface, error),
 ) error {
-	r.log.Debug("saving interface", "id", id)
 	physicalInterface, err := r.getOrCreateInterface(id)
 	if err != nil {
-		r.log.Error("failed to get or create interface", "id", id, "error", err)
 		return err
 	}
 
 	if updateFunc != nil {
 		physicalInterface, err = updateFunc(physicalInterface)
 		if err != nil {
-			r.log.Error("interface update function failed", "id", id, "error", err)
 			return err
 		}
 	}
 
 	if err := r.updateLowLevelInterface(physicalInterface); err != nil {
-		r.log.Error("failed to update low level interface", "id", id, "error", err)
 		return err
 	}
 	if err := r.updateWireGuardInterface(physicalInterface); err != nil {
-		r.log.Error("failed to update wireguard interface", "id", id, "error", err)
 		return err
 	}
 
-	r.log.Debug("successfully saved interface", "id", id)
 	return nil
 }
 
@@ -338,13 +323,10 @@ func (r *WgRepo) updateWireGuardInterface(pi *domain.PhysicalInterface) error {
 // DeleteInterface deletes the interface with the given id.
 // If the requested interface is found, no error is returned.
 func (r *WgRepo) DeleteInterface(_ context.Context, id domain.InterfaceIdentifier) error {
-	r.log.Debug("deleting interface", "id", id)
 	if err := r.deleteLowLevelInterface(id); err != nil {
-		r.log.Error("failed to delete low level interface", "id", id, "error", err)
 		return err
 	}
 
-	r.log.Debug("successfully deleted interface", "id", id)
 	return nil
 }
 
@@ -374,25 +356,20 @@ func (r *WgRepo) SavePeer(
 	id domain.PeerIdentifier,
 	updateFunc func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error),
 ) error {
-	r.log.Debug("saving peer", "deviceId", deviceId, "peerId", id)
 	physicalPeer, err := r.getOrCreatePeer(deviceId, id)
 	if err != nil {
-		r.log.Error("failed to get or create peer", "deviceId", deviceId, "peerId", id, "error", err)
 		return err
 	}
 
 	physicalPeer, err = updateFunc(physicalPeer)
 	if err != nil {
-		r.log.Error("peer update function failed", "deviceId", deviceId, "peerId", id, "error", err)
 		return err
 	}
 
 	if err := r.updatePeer(deviceId, physicalPeer); err != nil {
-		r.log.Error("failed to update peer", "deviceId", deviceId, "peerId", id, "error", err)
 		return err
 	}
 
-	r.log.Debug("successfully saved peer", "deviceId", deviceId, "peerId", id)
 	return nil
 }
 
@@ -464,7 +441,6 @@ func (r *WgRepo) updatePeer(deviceId domain.InterfaceIdentifier, pp *domain.Phys
 
 	err := r.wg.ConfigureDevice(string(deviceId), wgtypes.Config{ReplacePeers: false, Peers: []wgtypes.PeerConfig{cfg}})
 	if err != nil {
-		r.log.Error("failed to configure device for peer update", "deviceId", deviceId, "peerId", pp.Identifier, "error", err)
 		return err
 	}
 
@@ -474,20 +450,15 @@ func (r *WgRepo) updatePeer(deviceId domain.InterfaceIdentifier, pp *domain.Phys
 // DeletePeer deletes the peer with the given id.
 // If the requested interface or peer is found, no error is returned.
 func (r *WgRepo) DeletePeer(_ context.Context, deviceId domain.InterfaceIdentifier, id domain.PeerIdentifier) error {
-	r.log.Debug("deleting peer", "deviceId", deviceId, "peerId", id)
 	if !id.IsPublicKey() {
-		err := errors.New("invalid public key")
+		return errors.New("invalid public key")
-		r.log.Error("invalid peer id", "peerId", id, "error", err)
-		return err
 	}
 
 	err := r.deletePeer(deviceId, id)
 	if err != nil {
-		r.log.Error("failed to delete peer", "deviceId", deviceId, "peerId", id, "error", err)
 		return err
 	}
 
-	r.log.Debug("successfully deleted peer", "deviceId", deviceId, "peerId", id)
 	return nil
 }
 
@@ -499,7 +470,6 @@ func (r *WgRepo) deletePeer(deviceId domain.InterfaceIdentifier, id domain.PeerI
 
 	err := r.wg.ConfigureDevice(string(deviceId), wgtypes.Config{ReplacePeers: false, Peers: []wgtypes.PeerConfig{cfg}})
 	if err != nil {
-		r.log.Error("failed to configure device for peer deletion", "deviceId", deviceId, "peerId", id, "error", err)
 		return err
 	}
 

internal/app/api/core/assets/doc/v0_swagger.json

@@ -1781,11 +1781,6 @@
                         "type": "string"
                     }
                 },
-                "Backend": {
-                    "description": "the backend used for this interface e.g., local, mikrotik, ...",
-                    "type": "string",
-                    "example": "local"
-                },
                 "Disabled": {
                     "description": "flag that specifies if the interface is enabled (up) or not (down)",
                     "type": "boolean"
@@ -1974,7 +1969,7 @@
                         "type": "string"
                     }
                 },
-                "Prefix": {
+                "Suffix": {
                     "type": "string"
                 }
             }
@@ -2254,12 +2249,6 @@
                 "ApiAdminOnly": {
                     "type": "boolean"
                 },
-                "AvailableBackends": {
-                    "type": "array",
-                    "items": {
-                        "$ref": "#/definitions/model.SettingsBackendNames"
-                    }
-                },
                 "LoginFormVisible": {
                     "type": "boolean"
                 },
@@ -2280,17 +2269,6 @@
                 }
             }
         },
-        "model.SettingsBackendNames": {
-            "type": "object",
-            "properties": {
-                "Id": {
-                    "type": "string"
-                },
-                "Name": {
-                    "type": "string"
-                }
-            }
-        },
         "model.User": {
             "type": "object",
             "properties": {

internal/app/api/core/assets/doc/v0_swagger.yaml

@@ -65,10 +65,6 @@ definitions:
         items:
           type: string
         type: array
-      Backend:
-        description: the backend used for this interface e.g., local, mikrotik, ...
-        example: local
-        type: string
       Disabled:
         description: flag that specifies if the interface is enabled (up) or not (down)
         type: boolean
@@ -210,7 +206,7 @@ definitions:
         items:
           type: string
         type: array
-      Prefix:
+      Suffix:
         type: string
     type: object
   model.Peer:
@@ -385,10 +381,6 @@ definitions:
     properties:
       ApiAdminOnly:
         type: boolean
-      AvailableBackends:
-        items:
-          $ref: '#/definitions/model.SettingsBackendNames'
-        type: array
       LoginFormVisible:
         type: boolean
       MailLinkOnly:
@@ -402,13 +394,6 @@ definitions:
       WebAuthnEnabled:
         type: boolean
     type: object
-  model.SettingsBackendNames:
-    properties:
-      Id:
-        type: string
-      Name:
-        type: string
-    type: object
   model.User:
     properties:
       ApiEnabled:

internal/app/api/core/assets/doc/v1_swagger.json

@@ -2086,11 +2086,6 @@
                 "InterfaceIdentifier"
             ],
             "properties": {
-                "DisplayName": {
-                    "description": "DisplayName is an optional name for the new peer.\nIf unset, a default template value (e.g., \"API Peer ...\") will be assigned.",
-                    "type": "string",
-                    "example": "API Peer xyz"
-                },
                 "InterfaceIdentifier": {
                     "description": "InterfaceIdentifier is the identifier of the WireGuard interface the peer should be linked to.",
                     "type": "string",

internal/app/api/core/assets/doc/v1_swagger.yaml

@@ -445,12 +445,6 @@ definitions:
     type: object
   models.ProvisioningRequest:
     properties:
-      DisplayName:
-        description: |-
-          DisplayName is an optional name for the new peer.
-          If unset, a default template value (e.g., "API Peer ...") will be assigned.
-        example: API Peer xyz
-        type: string
       InterfaceIdentifier:
         description: InterfaceIdentifier is the identifier of the WireGuard interface
           the peer should be linked to.

internal/app/api/core/server.go

@@ -100,7 +100,6 @@ func (s *Server) Run(ctx context.Context, listenAddress string) {
 	srvContext, cancelFn := context.WithCancel(ctx)
 	go func() {
 		var err error
-		slog.Debug("starting server", "certFile", s.cfg.Web.CertFile, "keyFile", s.cfg.Web.KeyFile)
 		if s.cfg.Web.CertFile != "" && s.cfg.Web.KeyFile != "" {
 			err = srv.ListenAndServeTLS(s.cfg.Web.CertFile, s.cfg.Web.KeyFile)
 		} else {
@@ -139,8 +138,7 @@ func (s *Server) setupRoutes(endpoints ...ApiEndpointSetupFunc) {
 			s.versions[version].HandleFunc("GET /swagger/index.html", s.rapiDocHandler(version)) // Deprecated: old link
 			s.versions[version].HandleFunc("GET /doc.html", s.rapiDocHandler(version))
 
-			versionGroup := s.versions[version].Group()
+			groupSetupFn(s.versions[version])
-			groupSetupFn(versionGroup)
 		}
 	}
 }

internal/app/api/v0/handlers/endpoint_config.go

@@ -21,23 +21,17 @@ import (
 //go:embed frontend_config.js.gotpl
 var frontendJs embed.FS
 
-type ControllerManager interface {
-	GetControllerNames() []config.BackendBase
-}
-
 type ConfigEndpoint struct {
 	cfg           *config.Config
 	authenticator Authenticator
-	controllerMgr ControllerManager
 
 	tpl *respond.TemplateRenderer
 }
 
-func NewConfigEndpoint(cfg *config.Config, authenticator Authenticator, ctrlMgr ControllerManager) ConfigEndpoint {
+func NewConfigEndpoint(cfg *config.Config, authenticator Authenticator) ConfigEndpoint {
 	ep := ConfigEndpoint{
 		cfg:           cfg,
 		authenticator: authenticator,
-		controllerMgr: ctrlMgr,
 		tpl: respond.NewTemplateRenderer(template.Must(template.ParseFS(frontendJs,
 			"frontend_config.js.gotpl"))),
 	}
@@ -102,36 +96,13 @@ func (e ConfigEndpoint) handleSettingsGet() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		sessionUser := domain.GetUserInfo(r.Context())
 
-		controllerFn := func() []model.SettingsBackendNames {
-			controllers := e.controllerMgr.GetControllerNames()
-			names := make([]model.SettingsBackendNames, 0, len(controllers))
-
-			for _, controller := range controllers {
-				displayName := controller.GetDisplayName()
-				if displayName == "" {
-					displayName = controller.Id // fallback to ID if no display name is set
-				}
-				if controller.Id == config.LocalBackendName {
-					displayName = "modals.interface-edit.backend.local" // use a localized string for the local backend
-				}
-				names = append(names, model.SettingsBackendNames{
-					Id:   controller.Id,
-					Name: displayName,
-				})
-			}
-
-			return names
-
-		}
-
 		hasSocialLogin := len(e.cfg.Auth.OAuth) > 0 || len(e.cfg.Auth.OpenIDConnect) > 0 || e.cfg.Auth.WebAuthn.Enabled
 
 		// For anonymous users, we return the settings object with minimal information
 		if sessionUser.Id == domain.CtxUnknownUserId || sessionUser.Id == "" {
 			respond.JSON(w, http.StatusOK, model.Settings{
-				WebAuthnEnabled:   e.cfg.Auth.WebAuthn.Enabled,
+				WebAuthnEnabled:  e.cfg.Auth.WebAuthn.Enabled,
-				AvailableBackends: []model.SettingsBackendNames{}, // return an empty list instead of null
+				LoginFormVisible: !e.cfg.Auth.HideLoginForm || !hasSocialLogin,
-				LoginFormVisible:  !e.cfg.Auth.HideLoginForm || !hasSocialLogin,
 			})
 		} else {
 			respond.JSON(w, http.StatusOK, model.Settings{
@@ -141,7 +112,6 @@ func (e ConfigEndpoint) handleSettingsGet() http.HandlerFunc {
 				ApiAdminOnly:              e.cfg.Advanced.ApiAdminOnly,
 				WebAuthnEnabled:           e.cfg.Auth.WebAuthn.Enabled,
 				MinPasswordLength:         e.cfg.Auth.MinPasswordLength,
-				AvailableBackends:         controllerFn(),
 				LoginFormVisible:          !e.cfg.Auth.HideLoginForm || !hasSocialLogin,
 			})
 		}

internal/app/api/v0/model/models.go

@@ -6,17 +6,11 @@ type Error struct {
 }
 
 type Settings struct {
-	MailLinkOnly              bool                   `json:"MailLinkOnly"`
+	MailLinkOnly              bool `json:"MailLinkOnly"`
-	PersistentConfigSupported bool                   `json:"PersistentConfigSupported"`
+	PersistentConfigSupported bool `json:"PersistentConfigSupported"`
-	SelfProvisioning          bool                   `json:"SelfProvisioning"`
+	SelfProvisioning          bool `json:"SelfProvisioning"`
-	ApiAdminOnly              bool                   `json:"ApiAdminOnly"`
+	ApiAdminOnly              bool `json:"ApiAdminOnly"`
-	WebAuthnEnabled           bool                   `json:"WebAuthnEnabled"`
+	WebAuthnEnabled           bool `json:"WebAuthnEnabled"`
-	MinPasswordLength         int                    `json:"MinPasswordLength"`
+	MinPasswordLength         int  `json:"MinPasswordLength"`
-	AvailableBackends         []SettingsBackendNames `json:"AvailableBackends"`
+	LoginFormVisible          bool `json:"LoginFormVisible"`
-	LoginFormVisible          bool                   `json:"LoginFormVisible"`
-}
-
-type SettingsBackendNames struct {
-	Id   string `json:"Id"`
-	Name string `json:"Name"`
 }

internal/app/api/v0/model/models_interface.go

@@ -4,7 +4,6 @@ import (
 	"time"
 
 	"github.com/h44z/wg-portal/internal"
-	"github.com/h44z/wg-portal/internal/config"
 	"github.com/h44z/wg-portal/internal/domain"
 )
 
@@ -12,7 +11,6 @@ type Interface struct {
 	Identifier     string `json:"Identifier" example:"wg0"`      // device name, for example: wg0
 	DisplayName    string `json:"DisplayName"`                   // a nice display name/ description for the interface
 	Mode           string `json:"Mode" example:"server"`         // the interface type, either 'server', 'client' or 'any'
-	Backend        string `json:"Backend" example:"local"`       // the backend used for this interface e.g., local, mikrotik, ...
 	PrivateKey     string `json:"PrivateKey" example:"abcdef=="` // private Key of the server interface
 	PublicKey      string `json:"PublicKey" example:"abcdef=="`  // public Key of the server interface
 	Disabled       bool   `json:"Disabled"`                      // flag that specifies if the interface is enabled (up) or not (down)
@@ -59,7 +57,6 @@ func NewInterface(src *domain.Interface, peers []domain.Peer) *Interface {
 		Identifier:                 string(src.Identifier),
 		DisplayName:                src.DisplayName,
 		Mode:                       string(src.Type),
-		Backend:                    string(src.Backend),
 		PrivateKey:                 src.PrivateKey,
 		PublicKey:                  src.PublicKey,
 		Disabled:                   src.IsDisabled(),
@@ -95,10 +92,6 @@ func NewInterface(src *domain.Interface, peers []domain.Peer) *Interface {
 		Filename:     src.GetConfigFileName(),
 	}
 
-	if iface.Backend == "" {
-		iface.Backend = config.LocalBackendName // default to local backend
-	}
-
 	if len(peers) > 0 {
 		iface.TotalPeers = len(peers)
 
@@ -153,7 +146,6 @@ func NewDomainInterface(src *Interface) *domain.Interface {
 		SaveConfig:                 src.SaveConfig,
 		DisplayName:                src.DisplayName,
 		Type:                       domain.InterfaceType(src.Mode),
-		Backend:                    domain.InterfaceBackend(src.Backend),
 		DriverType:                 "",  // currently unused
 		Disabled:                   nil, // set below
 		DisabledReason:             src.DisabledReason,

internal/app/api/v0/model/models_peer.go

@@ -172,13 +172,13 @@ func NewDomainPeer(src *Peer) *domain.Peer {
 
 type MultiPeerRequest struct {
 	Identifiers []string `json:"Identifiers"`
-	Prefix      string   `json:"Prefix"`
+	Suffix      string   `json:"Suffix"`
 }
 
 func NewDomainPeerCreationRequest(src *MultiPeerRequest) *domain.PeerCreationRequest {
 	return &domain.PeerCreationRequest{
 		UserIdentifiers: src.Identifiers,
-		Prefix:          src.Prefix,
+		Suffix:          src.Suffix,
 	}
 }
 

internal/app/api/v1/backend/provisioning_service.go

@@ -162,11 +162,7 @@ func (p ProvisioningService) NewPeer(ctx context.Context, req models.Provisionin
 	if req.PresharedKey != "" {
 		peer.PresharedKey = domain.PreSharedKey(req.PresharedKey)
 	}
-	if req.DisplayName == "" {
+	peer.GenerateDisplayName("API")
-		peer.GenerateDisplayName("API")
-	} else {
-		peer.DisplayName = req.DisplayName
-	}
 
 	// save new peer
 	peer, err = p.peers.CreatePeer(ctx, peer)

internal/app/api/v1/models/models_provisioning.go

@@ -68,10 +68,6 @@ type ProvisioningRequest struct {
 	// If no user identifier is set, the authenticated user is used.
 	UserIdentifier string `json:"UserIdentifier" example:"uid-1234567"`
 
-	// DisplayName is an optional name for the new peer.
-	// If unset, a default template value (e.g., "API Peer ...") will be assigned.
-	DisplayName string `json:"DisplayName" example:"API Peer xyz" binding:"omitempty"`
-
 	// PublicKey is the optional public key of the peer. If no public key is set, a new key pair is generated.
 	PublicKey string `json:"PublicKey" example:"xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=" binding:"omitempty,len=44"`
 	// PresharedKey is the optional pre-shared key of the peer. If no pre-shared key is set, a new key is generated.

internal/app/app.go

@@ -46,7 +46,7 @@ func Initialize(
 		users: users,
 	}
 
-	startupContext, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	startupContext, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
 	// Switch to admin user context

internal/app/auth/auth_ldap.go

@@ -54,7 +54,7 @@ func (l LdapAuthenticator) PlaintextAuthentication(userId domain.UserIdentifier,
 
 	attrs := []string{"dn"}
 
-	loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", ldap.EscapeFilter(string(userId)), -1)
+	loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", string(userId), -1)
 	searchRequest := ldap.NewSearchRequest(
 		l.cfg.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 20, false, // 20 second time limit
@@ -100,7 +100,7 @@ func (l LdapAuthenticator) GetUserInfo(_ context.Context, userId domain.UserIden
 
 	attrs := internal.LdapSearchAttributes(&l.cfg.FieldMap)
 
-	loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", ldap.EscapeFilter(string(userId)), -1)
+	loginFilter := strings.Replace(l.cfg.LoginFilter, "{{login_identifier}}", string(userId), -1)
 	searchRequest := ldap.NewSearchRequest(
 		l.cfg.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 20, false, // 20 second time limit

internal/app/migrate_v1.go

@@ -47,18 +47,11 @@ func migrateFromV1(db *gorm.DB, source, typ string) error {
 	}
 	latestVersion := "1.0.9"
 	if lastVersion.Version != latestVersion {
-		return fmt.Errorf("unsupported old version, update to database version %s first", latestVersion)
+		return fmt.Errorf("unsupported old version, update to database version %s first: %w", latestVersion, err)
 	}
 
 	slog.Info("found valid V1 database", "version", lastVersion.Version)
 
-	// validate target database
-	if err := validateTargetDatabase(db); err != nil {
-		return fmt.Errorf("target database validation failed: %w", err)
-	}
-
-	slog.Info("found valid target database, starting migration...")
-
 	if err := migrateV1Users(oldDb, db); err != nil {
 		return fmt.Errorf("user migration failed: %w", err)
 	}
@@ -77,36 +70,6 @@ func migrateFromV1(db *gorm.DB, source, typ string) error {
 	return nil
 }
 
-// validateTargetDatabase checks if the target database is empty and ready for migration.
-func validateTargetDatabase(db *gorm.DB) error {
-	var count int64
-	err := db.Model(&domain.User{}).Count(&count).Error
-	if err != nil {
-		return fmt.Errorf("failed to check user table: %w", err)
-	}
-	if count > 0 {
-		return fmt.Errorf("target database contains %d users, please use an empty database for migration", count)
-	}
-
-	err = db.Model(&domain.Interface{}).Count(&count).Error
-	if err != nil {
-		return fmt.Errorf("failed to check interface table: %w", err)
-	}
-	if count > 0 {
-		return fmt.Errorf("target database contains %d interfaces, please use an empty database for migration", count)
-	}
-
-	err = db.Model(&domain.Peer{}).Count(&count).Error
-	if err != nil {
-		return fmt.Errorf("failed to check peer table: %w", err)
-	}
-	if count > 0 {
-		return fmt.Errorf("target database contains %d peers, please use an empty database for migration", count)
-	}
-
-	return nil
-}
-
 func migrateV1Users(oldDb, newDb *gorm.DB) error {
 	type User struct {
 		Email     string `gorm:"primaryKey"`
@@ -160,7 +123,7 @@ func migrateV1Users(oldDb, newDb *gorm.DB) error {
 			LinkedPeerCount: 0,
 		}
 
-		if err := newDb.Create(&newUser).Error; err != nil {
+		if err := newDb.Save(&newUser).Error; err != nil {
 			return fmt.Errorf("failed to migrate user %s: %w", oldUser.Email, err)
 		}
 
@@ -254,8 +217,7 @@ func migrateV1Interfaces(oldDb, newDb *gorm.DB) error {
 			PeerDefPostDown:            "",
 		}
 
-		// Create new interface with associations
+		if err := newDb.Save(&newInterface).Error; err != nil {
-		if err := newDb.Create(&newInterface).Error; err != nil {
 			return fmt.Errorf("failed to migrate device %s: %w", oldDevice.DeviceName, err)
 		}
 
@@ -400,7 +362,7 @@ func migrateV1Peers(oldDb, newDb *gorm.DB) error {
 			},
 		}
 
-		if err := newDb.Create(&newPeer).Error; err != nil {
+		if err := newDb.Save(&newPeer).Error; err != nil {
 			return fmt.Errorf("failed to migrate peer %s (%s): %w", oldPeer.Identifier, oldPeer.PublicKey, err)
 		}
 

internal/app/wireguard/controller_manager.go

@@ -1,166 +0,0 @@
-package wireguard
-
-import (
-	"context"
-	"fmt"
-	"log/slog"
-	"maps"
-	"slices"
-
-	"github.com/h44z/wg-portal/internal/adapters/wgcontroller"
-	"github.com/h44z/wg-portal/internal/config"
-	"github.com/h44z/wg-portal/internal/domain"
-)
-
-type InterfaceController interface {
-	GetId() domain.InterfaceBackend
-	GetInterfaces(_ context.Context) ([]domain.PhysicalInterface, error)
-	GetInterface(_ context.Context, id domain.InterfaceIdentifier) (*domain.PhysicalInterface, error)
-	GetPeers(_ context.Context, deviceId domain.InterfaceIdentifier) ([]domain.PhysicalPeer, error)
-	SaveInterface(
-		_ context.Context,
-		id domain.InterfaceIdentifier,
-		updateFunc func(pi *domain.PhysicalInterface) (*domain.PhysicalInterface, error),
-	) error
-	DeleteInterface(_ context.Context, id domain.InterfaceIdentifier) error
-	SavePeer(
-		_ context.Context,
-		deviceId domain.InterfaceIdentifier,
-		id domain.PeerIdentifier,
-		updateFunc func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error),
-	) error
-	DeletePeer(_ context.Context, deviceId domain.InterfaceIdentifier, id domain.PeerIdentifier) error
-	PingAddresses(
-		ctx context.Context,
-		addr string,
-	) (*domain.PingerResult, error)
-}
-
-type backendInstance struct {
-	Config         config.BackendBase // Config is the configuration for the backend instance.
-	Implementation InterfaceController
-}
-
-type ControllerManager struct {
-	cfg         *config.Config
-	controllers map[domain.InterfaceBackend]backendInstance
-}
-
-func NewControllerManager(cfg *config.Config) (*ControllerManager, error) {
-	c := &ControllerManager{
-		cfg:         cfg,
-		controllers: make(map[domain.InterfaceBackend]backendInstance),
-	}
-
-	err := c.init()
-	if err != nil {
-		return nil, err
-	}
-
-	return c, nil
-}
-
-func (c *ControllerManager) init() error {
-	if err := c.registerLocalController(); err != nil {
-		return err
-	}
-
-	if err := c.registerMikrotikControllers(); err != nil {
-		return err
-	}
-
-	c.logRegisteredControllers()
-
-	return nil
-}
-
-func (c *ControllerManager) registerLocalController() error {
-	localController, err := wgcontroller.NewLocalController(c.cfg)
-	if err != nil {
-		return fmt.Errorf("failed to create local WireGuard controller: %w", err)
-	}
-
-	c.controllers[config.LocalBackendName] = backendInstance{
-		Config: config.BackendBase{
-			Id:          config.LocalBackendName,
-			DisplayName: "Local WireGuard Controller",
-		},
-		Implementation: localController,
-	}
-	return nil
-}
-
-func (c *ControllerManager) registerMikrotikControllers() error {
-	for _, backendConfig := range c.cfg.Backend.Mikrotik {
-		if backendConfig.Id == config.LocalBackendName {
-			slog.Warn("skipping registration of Mikrotik controller with reserved ID", "id", config.LocalBackendName)
-			continue
-		}
-
-		controller, err := wgcontroller.NewMikrotikController(c.cfg, &backendConfig)
-		if err != nil {
-			return fmt.Errorf("failed to create Mikrotik controller for backend %s: %w", backendConfig.Id, err)
-		}
-
-		c.controllers[domain.InterfaceBackend(backendConfig.Id)] = backendInstance{
-			Config:         backendConfig.BackendBase,
-			Implementation: controller,
-		}
-	}
-	return nil
-}
-
-func (c *ControllerManager) logRegisteredControllers() {
-	for backend, controller := range c.controllers {
-		slog.Debug("backend controller registered",
-			"backend", backend, "type", fmt.Sprintf("%T", controller.Implementation))
-	}
-}
-
-func (c *ControllerManager) GetControllerByName(backend domain.InterfaceBackend) InterfaceController {
-	return c.getController(backend, "")
-}
-
-func (c *ControllerManager) GetController(iface domain.Interface) InterfaceController {
-	return c.getController(iface.Backend, iface.Identifier)
-}
-
-func (c *ControllerManager) getController(
-	backend domain.InterfaceBackend,
-	ifaceId domain.InterfaceIdentifier,
-) InterfaceController {
-	if backend == "" {
-		// If no backend is specified, use the local controller.
-		// This might be the case for interfaces created in previous WireGuard Portal versions.
-		backend = config.LocalBackendName
-	}
-
-	controller, exists := c.controllers[backend]
-	if !exists {
-		controller, exists = c.controllers[config.LocalBackendName] // Fallback to local controller
-		if !exists {
-			// If the local controller is also not found, panic
-			panic(fmt.Sprintf("%s interface controller for backend %s not found", ifaceId, backend))
-		}
-		slog.Warn("controller for backend not found, using local controller",
-			"backend", backend, "interface", ifaceId)
-	}
-	return controller.Implementation
-}
-
-func (c *ControllerManager) GetAllControllers() []InterfaceController {
-	var backendInstances = make([]InterfaceController, 0, len(c.controllers))
-	for instance := range maps.Values(c.controllers) {
-		backendInstances = append(backendInstances, instance.Implementation)
-	}
-	return backendInstances
-}
-
-func (c *ControllerManager) GetControllerNames() []config.BackendBase {
-	var names []config.BackendBase
-	for _, id := range slices.Sorted(maps.Keys(c.controllers)) {
-		names = append(names, c.controllers[id].Config)
-	}
-
-	return names
-}

internal/app/wireguard/statistics.go

@@ -6,6 +6,8 @@ import (
 	"sync"
 	"time"
 
+	probing "github.com/prometheus-community/pro-bing"
+
 	"github.com/h44z/wg-portal/internal/app"
 	"github.com/h44z/wg-portal/internal/config"
 	"github.com/h44z/wg-portal/internal/domain"
@@ -28,6 +30,11 @@ type StatisticsDatabaseRepo interface {
 	DeletePeerStatus(ctx context.Context, id domain.PeerIdentifier) error
 }
 
+type StatisticsInterfaceController interface {
+	GetInterface(_ context.Context, id domain.InterfaceIdentifier) (*domain.PhysicalInterface, error)
+	GetPeers(_ context.Context, deviceId domain.InterfaceIdentifier) ([]domain.PhysicalPeer, error)
+}
+
 type StatisticsMetricsServer interface {
 	UpdateInterfaceMetrics(status domain.InterfaceStatus)
 	UpdatePeerMetrics(peer *domain.Peer, status domain.PeerStatus)
@@ -40,20 +47,15 @@ type StatisticsEventBus interface {
 	Publish(topic string, args ...any)
 }
 
-type pingJob struct {
-	Peer    domain.Peer
-	Backend domain.InterfaceBackend
-}
-
 type StatisticsCollector struct {
 	cfg *config.Config
 	bus StatisticsEventBus
 
 	pingWaitGroup sync.WaitGroup
-	pingJobs      chan pingJob
+	pingJobs      chan domain.Peer
 
 	db StatisticsDatabaseRepo
-	wg *ControllerManager
+	wg StatisticsInterfaceController
 	ms StatisticsMetricsServer
 
 	peerChangeEvent chan domain.PeerIdentifier
@@ -64,7 +66,7 @@ func NewStatisticsCollector(
 	cfg *config.Config,
 	bus StatisticsEventBus,
 	db StatisticsDatabaseRepo,
-	wg *ControllerManager,
+	wg StatisticsInterfaceController,
 	ms StatisticsMetricsServer,
 ) (*StatisticsCollector, error) {
 	c := &StatisticsCollector{
@@ -115,7 +117,7 @@ func (c *StatisticsCollector) collectInterfaceData(ctx context.Context) {
 			}
 
 			for _, in := range interfaces {
-				physicalInterface, err := c.wg.GetController(in).GetInterface(ctx, in.Identifier)
+				physicalInterface, err := c.wg.GetInterface(ctx, in.Identifier)
 				if err != nil {
 					slog.Warn("failed to load physical interface for data collection", "interface", in.Identifier,
 						"error", err)
@@ -167,7 +169,7 @@ func (c *StatisticsCollector) collectPeerData(ctx context.Context) {
 			}
 
 			for _, in := range interfaces {
-				peers, err := c.wg.GetController(in).GetPeers(ctx, in.Identifier)
+				peers, err := c.wg.GetPeers(ctx, in.Identifier)
 				if err != nil {
 					slog.Warn("failed to fetch peers for data collection", "interface", in.Identifier, "error", err)
 					continue
@@ -195,7 +197,6 @@ func (c *StatisticsCollector) collectPeerData(ctx context.Context) {
 							p.CalcConnected()
 
 							if wasConnected != p.IsConnected {
-								slog.Debug("peer connection state changed", "peer", peer.Identifier, "connected", p.IsConnected)
 								connectionStateChanged = true
 								newPeerStatus = *p // store new status for event publishing
 							}
@@ -269,7 +270,7 @@ func (c *StatisticsCollector) startPingWorkers(ctx context.Context) {
 
 	c.pingWaitGroup = sync.WaitGroup{}
 	c.pingWaitGroup.Add(c.cfg.Statistics.PingCheckWorkers)
-	c.pingJobs = make(chan pingJob, c.cfg.Statistics.PingCheckWorkers)
+	c.pingJobs = make(chan domain.Peer, c.cfg.Statistics.PingCheckWorkers)
 
 	// start workers
 	for i := 0; i < c.cfg.Statistics.PingCheckWorkers; i++ {
@@ -312,10 +313,7 @@ func (c *StatisticsCollector) enqueuePingChecks(ctx context.Context) {
 					continue
 				}
 				for _, peer := range peers {
-					c.pingJobs <- pingJob{
+					c.pingJobs <- peer
-						Peer:    peer,
-						Backend: in.Backend,
-					}
 				}
 			}
 		}
@@ -324,14 +322,11 @@ func (c *StatisticsCollector) enqueuePingChecks(ctx context.Context) {
 
 func (c *StatisticsCollector) pingWorker(ctx context.Context) {
 	defer c.pingWaitGroup.Done()
-	for job := range c.pingJobs {
+	for peer := range c.pingJobs {
-		peer := job.Peer
-		backend := job.Backend
-
 		var connectionStateChanged bool
 		var newPeerStatus domain.PeerStatus
 
-		peerPingable := c.isPeerPingable(ctx, backend, peer)
+		peerPingable := c.isPeerPingable(ctx, peer)
 		slog.Debug("peer ping check completed", "peer", peer.Identifier, "pingable", peerPingable)
 
 		now := time.Now()
@@ -372,11 +367,7 @@ func (c *StatisticsCollector) pingWorker(ctx context.Context) {
 	}
 }
 
-func (c *StatisticsCollector) isPeerPingable(
+func (c *StatisticsCollector) isPeerPingable(ctx context.Context, peer domain.Peer) bool {
-	ctx context.Context,
-	backend domain.InterfaceBackend,
-	peer domain.Peer,
-) bool {
 	if !c.cfg.Statistics.UsePingChecks {
 		return false
 	}
@@ -386,13 +377,23 @@ func (c *StatisticsCollector) isPeerPingable(
 		return false
 	}
 
-	stats, err := c.wg.GetControllerByName(backend).PingAddresses(ctx, checkAddr)
+	pinger, err := probing.NewPinger(checkAddr)
 	if err != nil {
-		slog.Debug("failed to ping peer", "peer", peer.Identifier, "error", err)
+		slog.Debug("failed to instantiate pinger", "peer", peer.Identifier, "address", checkAddr, "error", err)
 		return false
 	}
 
-	return stats.IsPingable()
+	checkCount := 1
+	pinger.SetPrivileged(!c.cfg.Statistics.PingUnprivileged)
+	pinger.Count = checkCount
+	pinger.Timeout = 2 * time.Second
+	err = pinger.RunWithContext(ctx) // Blocks until finished.
+	if err != nil {
+		slog.Debug("pinger for peer exited unexpectedly", "peer", peer.Identifier, "address", checkAddr, "error", err)
+		return false
+	}
+	stats := pinger.Statistics()
+	return stats.PacketsRecv == checkCount
 }
 
 func (c *StatisticsCollector) updateInterfaceMetrics(status domain.InterfaceStatus) {

internal/app/wireguard/wireguard.go

@@ -37,6 +37,25 @@ type InterfaceAndPeerDatabaseRepo interface {
 	GetUsedIpsPerSubnet(ctx context.Context, subnets []domain.Cidr) (map[domain.Cidr][]domain.Cidr, error)
 }
 
+type InterfaceController interface {
+	GetInterfaces(_ context.Context) ([]domain.PhysicalInterface, error)
+	GetInterface(_ context.Context, id domain.InterfaceIdentifier) (*domain.PhysicalInterface, error)
+	GetPeers(_ context.Context, deviceId domain.InterfaceIdentifier) ([]domain.PhysicalPeer, error)
+	SaveInterface(
+		_ context.Context,
+		id domain.InterfaceIdentifier,
+		updateFunc func(pi *domain.PhysicalInterface) (*domain.PhysicalInterface, error),
+	) error
+	DeleteInterface(_ context.Context, id domain.InterfaceIdentifier) error
+	SavePeer(
+		_ context.Context,
+		deviceId domain.InterfaceIdentifier,
+		id domain.PeerIdentifier,
+		updateFunc func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error),
+	) error
+	DeletePeer(_ context.Context, deviceId domain.InterfaceIdentifier, id domain.PeerIdentifier) error
+}
+
 type WgQuickController interface {
 	ExecuteInterfaceHook(id domain.InterfaceIdentifier, hookCmd string) error
 	SetDNS(id domain.InterfaceIdentifier, dnsStr, dnsSearchStr string) error
@@ -56,7 +75,7 @@ type Manager struct {
 	cfg   *config.Config
 	bus   EventBus
 	db    InterfaceAndPeerDatabaseRepo
-	wg    *ControllerManager
+	wg    InterfaceController
 	quick WgQuickController
 
 	userLockMap *sync.Map
@@ -65,7 +84,7 @@ type Manager struct {
 func NewWireGuardManager(
 	cfg *config.Config,
 	bus EventBus,
-	wg *ControllerManager,
+	wg InterfaceController,
 	quick WgQuickController,
 	db InterfaceAndPeerDatabaseRepo,
 ) (*Manager, error) {

internal/app/wireguard/wireguard_interfaces.go

@@ -11,7 +11,6 @@ import (
 
 	"github.com/h44z/wg-portal/internal/app"
 	"github.com/h44z/wg-portal/internal/app/audit"
-	"github.com/h44z/wg-portal/internal/config"
 	"github.com/h44z/wg-portal/internal/domain"
 )
 
@@ -22,17 +21,12 @@ func (m Manager) GetImportableInterfaces(ctx context.Context) ([]domain.Physical
 		return nil, err
 	}
 
-	var allPhysicalInterfaces []domain.PhysicalInterface
+	physicalInterfaces, err := m.wg.GetInterfaces(ctx)
-	for _, wgBackend := range m.wg.GetAllControllers() {
+	if err != nil {
-		physicalInterfaces, err := wgBackend.GetInterfaces(ctx)
+		return nil, err
-		if err != nil {
-			return nil, err
-		}
-
-		allPhysicalInterfaces = append(allPhysicalInterfaces, physicalInterfaces...)
 	}
 
-	return allPhysicalInterfaces, nil
+	return physicalInterfaces, nil
 }
 
 // GetInterfaceAndPeers returns the interface and all peers for the given interface identifier.
@@ -115,49 +109,47 @@ func (m Manager) ImportNewInterfaces(ctx context.Context, filter ...domain.Inter
 		return 0, err
 	}
 
+	physicalInterfaces, err := m.wg.GetInterfaces(ctx)
+	if err != nil {
+		return 0, err
+	}
+
+	// if no filter is given, exclude already existing interfaces
+	var excludedInterfaces []domain.InterfaceIdentifier
+	if len(filter) == 0 {
+		existingInterfaces, err := m.db.GetAllInterfaces(ctx)
+		if err != nil {
+			return 0, err
+		}
+		for _, existingInterface := range existingInterfaces {
+			excludedInterfaces = append(excludedInterfaces, existingInterface.Identifier)
+		}
+	}
+
 	imported := 0
-	for _, wgBackend := range m.wg.GetAllControllers() {
+	for _, physicalInterface := range physicalInterfaces {
-		physicalInterfaces, err := wgBackend.GetInterfaces(ctx)
+		if slices.Contains(excludedInterfaces, physicalInterface.Identifier) {
+			continue
+		}
+
+		if len(filter) != 0 && !slices.Contains(filter, physicalInterface.Identifier) {
+			continue
+		}
+
+		slog.Info("importing new interface", "interface", physicalInterface.Identifier)
+
+		physicalPeers, err := m.wg.GetPeers(ctx, physicalInterface.Identifier)
 		if err != nil {
 			return 0, err
 		}
 
-		// if no filter is given, exclude already existing interfaces
+		err = m.importInterface(ctx, &physicalInterface, physicalPeers)
-		var excludedInterfaces []domain.InterfaceIdentifier
+		if err != nil {
-		if len(filter) == 0 {
+			return 0, fmt.Errorf("import of %s failed: %w", physicalInterface.Identifier, err)
-			existingInterfaces, err := m.db.GetAllInterfaces(ctx)
-			if err != nil {
-				return 0, err
-			}
-			for _, existingInterface := range existingInterfaces {
-				excludedInterfaces = append(excludedInterfaces, existingInterface.Identifier)
-			}
 		}
 
-		for _, physicalInterface := range physicalInterfaces {
+		slog.Info("imported new interface", "interface", physicalInterface.Identifier, "peers", len(physicalPeers))
-			if slices.Contains(excludedInterfaces, physicalInterface.Identifier) {
+		imported++
-				continue
-			}
-
-			if len(filter) != 0 && !slices.Contains(filter, physicalInterface.Identifier) {
-				continue
-			}
-
-			slog.Info("importing new interface", "interface", physicalInterface.Identifier)
-
-			physicalPeers, err := wgBackend.GetPeers(ctx, physicalInterface.Identifier)
-			if err != nil {
-				return 0, err
-			}
-
-			err = m.importInterface(ctx, wgBackend, &physicalInterface, physicalPeers)
-			if err != nil {
-				return 0, fmt.Errorf("import of %s failed: %w", physicalInterface.Identifier, err)
-			}
-
-			slog.Info("imported new interface", "interface", physicalInterface.Identifier, "peers", len(physicalPeers))
-			imported++
-		}
 	}
 
 	return imported, nil
@@ -221,19 +213,10 @@ func (m Manager) RestoreInterfaceState(
 			return fmt.Errorf("failed to load peers for %s: %w", iface.Identifier, err)
 		}
 
-		_, err = m.wg.GetController(iface).GetInterface(ctx, iface.Identifier)
+		_, err = m.wg.GetInterface(ctx, iface.Identifier)
 		if err != nil && !iface.IsDisabled() {
 			slog.Debug("creating missing interface", "interface", iface.Identifier)
 
-			// temporarily disable interface in database so that the current state is reflected correctly
-			_ = m.db.SaveInterface(ctx, iface.Identifier,
-				func(in *domain.Interface) (*domain.Interface, error) {
-					now := time.Now()
-					in.Disabled = &now // set
-					in.DisabledReason = domain.DisabledReasonInterfaceMissing
-					return in, nil
-				})
-
 			// try to create a new interface
 			_, err = m.saveInterface(ctx, &iface)
 			if err != nil {
@@ -277,14 +260,18 @@ func (m Manager) RestoreInterfaceState(
 		// restore peers
 		for _, peer := range peers {
 			switch {
-			case iface.IsDisabled() && iface.Backend == config.LocalBackendName: // if interface is disabled, delete all peers
+			case iface.IsDisabled(): // if interface is disabled, delete all peers
-				if err := m.wg.GetController(iface).DeletePeer(ctx, iface.Identifier,
+				if err := m.wg.DeletePeer(ctx, iface.Identifier, peer.Identifier); err != nil {
-					peer.Identifier); err != nil {
 					return fmt.Errorf("failed to remove peer %s for disabled interface %s: %w",
 						peer.Identifier, iface.Identifier, err)
 				}
+			case peer.IsDisabled(): // if peer is disabled, delete it
+				if err := m.wg.DeletePeer(ctx, iface.Identifier, peer.Identifier); err != nil {
+					return fmt.Errorf("failed to remove disbaled peer %s from interface %s: %w",
+						peer.Identifier, iface.Identifier, err)
+				}
 			default: // update peer
-				err := m.wg.GetController(iface).SavePeer(ctx, iface.Identifier, peer.Identifier,
+				err := m.wg.SavePeer(ctx, iface.Identifier, peer.Identifier,
 					func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error) {
 						domain.MergeToPhysicalPeer(pp, &peer)
 						return pp, nil
@@ -297,7 +284,7 @@ func (m Manager) RestoreInterfaceState(
 		}
 
 		// remove non-wgportal peers
-		physicalPeers, _ := m.wg.GetController(iface).GetPeers(ctx, iface.Identifier)
+		physicalPeers, _ := m.wg.GetPeers(ctx, iface.Identifier)
 		for _, physicalPeer := range physicalPeers {
 			isWgPortalPeer := false
 			for _, peer := range peers {
@@ -307,8 +294,7 @@ func (m Manager) RestoreInterfaceState(
 				}
 			}
 			if !isWgPortalPeer {
-				err := m.wg.GetController(iface).DeletePeer(ctx, iface.Identifier,
+				err := m.wg.DeletePeer(ctx, iface.Identifier, domain.PeerIdentifier(physicalPeer.PublicKey))
-					domain.PeerIdentifier(physicalPeer.PublicKey))
 				if err != nil {
 					return fmt.Errorf("failed to remove non-wgportal peer %s from interface %s: %w",
 						physicalPeer.PublicKey, iface.Identifier, err)
@@ -473,7 +459,7 @@ func (m Manager) DeleteInterface(ctx context.Context, id domain.InterfaceIdentif
 	existingInterface.Disabled = &now // simulate a disabled interface
 	existingInterface.DisabledReason = domain.DisabledReasonDeleted
 
-	physicalInterface, _ := m.wg.GetController(*existingInterface).GetInterface(ctx, id)
+	physicalInterface, _ := m.wg.GetInterface(ctx, id)
 
 	if err := m.handleInterfacePreSaveHooks(existingInterface, !existingInterface.IsDisabled(), false); err != nil {
 		return fmt.Errorf("pre-delete hooks failed: %w", err)
@@ -487,7 +473,7 @@ func (m Manager) DeleteInterface(ctx context.Context, id domain.InterfaceIdentif
 		return fmt.Errorf("peer deletion failure: %w", err)
 	}
 
-	if err := m.wg.GetController(*existingInterface).DeleteInterface(ctx, id); err != nil {
+	if err := m.wg.DeleteInterface(ctx, id); err != nil {
 		return fmt.Errorf("wireguard deletion failure: %w", err)
 	}
 
@@ -536,7 +522,7 @@ func (m Manager) saveInterface(ctx context.Context, iface *domain.Interface) (
 	err := m.db.SaveInterface(ctx, iface.Identifier, func(i *domain.Interface) (*domain.Interface, error) {
 		iface.CopyCalculatedAttributes(i)
 
-		err := m.wg.GetController(*iface).SaveInterface(ctx, iface.Identifier,
+		err := m.wg.SaveInterface(ctx, iface.Identifier,
 			func(pi *domain.PhysicalInterface) (*domain.PhysicalInterface, error) {
 				domain.MergeToPhysicalInterface(pi, iface)
 				return pi, nil
@@ -552,7 +538,7 @@ func (m Manager) saveInterface(ctx context.Context, iface *domain.Interface) (
 	}
 
 	if iface.IsDisabled() {
-		physicalInterface, _ := m.wg.GetController(*iface).GetInterface(ctx, iface.Identifier)
+		physicalInterface, _ := m.wg.GetInterface(ctx, iface.Identifier)
 		fwMark := iface.FirewallMark
 		if physicalInterface != nil && fwMark == 0 {
 			fwMark = physicalInterface.FirewallMark
@@ -569,27 +555,6 @@ func (m Manager) saveInterface(ctx context.Context, iface *domain.Interface) (
 		return nil, fmt.Errorf("post-save hooks failed: %w", err)
 	}
 
-	// If the interface has just been enabled, restore its peers on the physical controller
-	if !oldEnabled && newEnabled && iface.Backend == config.LocalBackendName {
-		peers, err := m.db.GetInterfacePeers(ctx, iface.Identifier)
-		if err != nil {
-			return nil, fmt.Errorf("failed to load peers for interface %s: %w", iface.Identifier, err)
-		}
-		for _, peer := range peers {
-			saveErr := m.wg.GetController(*iface).SavePeer(ctx, iface.Identifier, peer.Identifier,
-				func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error) {
-					domain.MergeToPhysicalPeer(pp, &peer)
-					return pp, nil
-				})
-			if saveErr != nil {
-				return nil, fmt.Errorf("failed to restore peer %s for interface %s: %w", peer.Identifier,
-					iface.Identifier, saveErr)
-			}
-		}
-		// notify that peers for this interface have changed so config/routes can be updated
-		m.bus.Publish(app.TopicPeerInterfaceUpdated, iface.Identifier)
-	}
-
 	m.bus.Publish(app.TopicAuditInterfaceChanged, domain.AuditEventWrapper[audit.InterfaceEvent]{
 		Ctx: ctx,
 		Event: audit.InterfaceEvent{
@@ -780,12 +745,7 @@ func (m Manager) getFreshListenPort(ctx context.Context) (port int, err error) {
 	return
 }
 
-func (m Manager) importInterface(
+func (m Manager) importInterface(ctx context.Context, in *domain.PhysicalInterface, peers []domain.PhysicalPeer) error {
-	ctx context.Context,
-	backend InterfaceController,
-	in *domain.PhysicalInterface,
-	peers []domain.PhysicalPeer,
-) error {
 	now := time.Now()
 	iface := domain.ConvertPhysicalInterface(in)
 	iface.BaseModel = domain.BaseModel{
@@ -794,20 +754,8 @@ func (m Manager) importInterface(
 		CreatedAt: now,
 		UpdatedAt: now,
 	}
-	iface.Backend = backend.GetId()
 	iface.PeerDefAllowedIPsStr = iface.AddressStr()
 
-	// try to predict the interface type based on the number of peers
-	switch len(peers) {
-	case 0:
-		iface.Type = domain.InterfaceTypeAny // no peers means this is an unknown interface
-	case 1:
-		iface.Type = domain.InterfaceTypeClient // one peer means this is a client interface
-	default: // multiple peers means this is a server interface
-
-		iface.Type = domain.InterfaceTypeServer
-	}
-
 	existingInterface, err := m.db.GetInterface(ctx, iface.Identifier)
 	if err != nil && !errors.Is(err, domain.ErrNotFound) {
 		return err
@@ -858,20 +806,16 @@ func (m Manager) importPeer(ctx context.Context, in *domain.Interface, p *domain
 	peer.Interface.PreDown = domain.NewConfigOption(in.PeerDefPreDown, true)
 	peer.Interface.PostDown = domain.NewConfigOption(in.PeerDefPostDown, true)
 
-	var displayName string
 	switch in.Type {
 	case domain.InterfaceTypeAny:
 		peer.Interface.Type = domain.InterfaceTypeAny
-		displayName = "Autodetected Peer (" + peer.Interface.PublicKey[0:8] + ")"
+		peer.DisplayName = "Autodetected Peer (" + peer.Interface.PublicKey[0:8] + ")"
 	case domain.InterfaceTypeClient:
 		peer.Interface.Type = domain.InterfaceTypeServer
-		displayName = "Autodetected Endpoint (" + peer.Interface.PublicKey[0:8] + ")"
+		peer.DisplayName = "Autodetected Endpoint (" + peer.Interface.PublicKey[0:8] + ")"
 	case domain.InterfaceTypeServer:
 		peer.Interface.Type = domain.InterfaceTypeClient
-		displayName = "Autodetected Client (" + peer.Interface.PublicKey[0:8] + ")"
+		peer.DisplayName = "Autodetected Client (" + peer.Interface.PublicKey[0:8] + ")"
-	}
-	if peer.DisplayName == "" {
-		peer.DisplayName = displayName // use auto-generated display name if not set
 	}
 
 	err := m.db.SavePeer(ctx, peer.Identifier, func(_ *domain.Peer) (*domain.Peer, error) {
@@ -885,12 +829,12 @@ func (m Manager) importPeer(ctx context.Context, in *domain.Interface, p *domain
 }
 
 func (m Manager) deleteInterfacePeers(ctx context.Context, id domain.InterfaceIdentifier) error {
-	iface, allPeers, err := m.db.GetInterfaceAndPeers(ctx, id)
+	allPeers, err := m.db.GetInterfacePeers(ctx, id)
 	if err != nil {
 		return err
 	}
 	for _, peer := range allPeers {
-		err = m.wg.GetController(*iface).DeletePeer(ctx, id, peer.Identifier)
+		err = m.wg.DeletePeer(ctx, id, peer.Identifier)
 		if err != nil && !errors.Is(err, os.ErrNotExist) {
 			return fmt.Errorf("wireguard peer deletion failure for %s: %w", peer.Identifier, err)
 		}

internal/app/wireguard/wireguard_peers.go

@@ -188,29 +188,29 @@ func (m Manager) CreatePeer(ctx context.Context, peer *domain.Peer) (*domain.Pee
 
 	sessionUser := domain.GetUserInfo(ctx)
 
-	// Enforce peer limit for non-admin users if LimitAdditionalUserPeers is set
+    // Enforce peer limit for non-admin users if LimitAdditionalUserPeers is set
-	if m.cfg.Core.SelfProvisioningAllowed && !sessionUser.IsAdmin && m.cfg.Advanced.LimitAdditionalUserPeers > 0 {
+    if m.cfg.Core.SelfProvisioningAllowed && !sessionUser.IsAdmin && m.cfg.Advanced.LimitAdditionalUserPeers > 0 {
-		peers, err := m.db.GetUserPeers(ctx, peer.UserIdentifier)
+        peers, err := m.db.GetUserPeers(ctx, peer.UserIdentifier)
-		if err != nil {
+        if err != nil {
-			return nil, fmt.Errorf("failed to fetch peers for user %s: %w", peer.UserIdentifier, err)
+            return nil, fmt.Errorf("failed to fetch peers for user %s: %w", peer.UserIdentifier, err)
-		}
+        }
-		// Count enabled peers (disabled IS NULL)
+        // Count enabled peers (disabled IS NULL)
-		peerCount := 0
+        peerCount := 0
-		for _, p := range peers {
+        for _, p := range peers {
-			if !p.IsDisabled() {
+            if !p.IsDisabled() {
-				peerCount++
+                peerCount++
-			}
+            }
-		}
+        }
-		totalAllowedPeers := 1 + m.cfg.Advanced.LimitAdditionalUserPeers // 1 default peer + x additional peers
+        totalAllowedPeers := 1 + m.cfg.Advanced.LimitAdditionalUserPeers // 1 default peer + x additional peers
-		if peerCount >= totalAllowedPeers {
+        if peerCount >= totalAllowedPeers {
-			slog.WarnContext(ctx, "peer creation blocked due to limit",
+            slog.WarnContext(ctx, "peer creation blocked due to limit",
-				"user", peer.UserIdentifier,
+                "user", peer.UserIdentifier,
-				"current_count", peerCount,
+                "current_count", peerCount,
-				"allowed_count", totalAllowedPeers)
+                "allowed_count", totalAllowedPeers)
-			return nil, fmt.Errorf("peer limit reached (%d peers allowed): %w", totalAllowedPeers,
+            return nil, fmt.Errorf("peer limit reached (%d peers allowed): %w", totalAllowedPeers, domain.ErrNoPermission)
-				domain.ErrNoPermission)
+        }
-		}
+    }
-	}
+
 
 	existingPeer, err := m.db.GetPeer(ctx, peer.Identifier)
 	if err != nil && !errors.Is(err, domain.ErrNotFound) {
@@ -257,7 +257,7 @@ func (m Manager) CreateMultiplePeers(
 		return nil, err
 	}
 
-	createdPeers := make([]domain.Peer, 0, len(r.UserIdentifiers))
+	var newPeers []*domain.Peer
 
 	for _, id := range r.UserIdentifiers {
 		freshPeer, err := m.PreparePeer(ctx, interfaceId)
@@ -266,22 +266,27 @@ func (m Manager) CreateMultiplePeers(
 		}
 
 		freshPeer.UserIdentifier = domain.UserIdentifier(id) // use id as user identifier. peers are allowed to have invalid user identifiers
-		if r.Prefix != "" {
+		if r.Suffix != "" {
-			freshPeer.DisplayName = r.Prefix + " " + freshPeer.DisplayName
+			freshPeer.DisplayName += " " + r.Suffix
 		}
 
 		if err := m.validatePeerCreation(ctx, nil, freshPeer); err != nil {
 			return nil, fmt.Errorf("creation not allowed: %w", err)
 		}
 
-		// Save immediately to reserve the assigned IPs so the next prepared peer gets the next free IPs
+		newPeers = append(newPeers, freshPeer)
-		if err := m.savePeers(ctx, freshPeer); err != nil {
+	}
-			return nil, fmt.Errorf("failed to create new peer %s: %w", freshPeer.Identifier, err)
-		}
 
-		createdPeers = append(createdPeers, *freshPeer)
+	err := m.savePeers(ctx, newPeers...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create new peers: %w", err)
+	}
 
-		m.bus.Publish(app.TopicPeerCreated, *freshPeer)
+	createdPeers := make([]domain.Peer, len(newPeers))
+	for i := range newPeers {
+		createdPeers[i] = *newPeers[i]
+
+		m.bus.Publish(app.TopicPeerCreated, *newPeers[i])
 	}
 
 	return createdPeers, nil
@@ -371,12 +376,7 @@ func (m Manager) DeletePeer(ctx context.Context, id domain.PeerIdentifier) error
 		return fmt.Errorf("delete not allowed: %w", err)
 	}
 
-	iface, err := m.db.GetInterface(ctx, peer.InterfaceIdentifier)
+	err = m.wg.DeletePeer(ctx, peer.InterfaceIdentifier, id)
-	if err != nil {
-		return fmt.Errorf("unable to find interface %s: %w", peer.InterfaceIdentifier, err)
-	}
-
-	err = m.wg.GetController(*iface).DeletePeer(ctx, peer.InterfaceIdentifier, id)
 	if err != nil {
 		return fmt.Errorf("wireguard failed to delete peer %s: %w", id, err)
 	}
@@ -438,28 +438,35 @@ func (m Manager) GetUserPeerStats(ctx context.Context, id domain.UserIdentifier)
 func (m Manager) savePeers(ctx context.Context, peers ...*domain.Peer) error {
 	interfaces := make(map[domain.InterfaceIdentifier]struct{})
 
-	for _, peer := range peers {
+	for i := range peers {
-		iface, err := m.db.GetInterface(ctx, peer.InterfaceIdentifier)
+		peer := peers[i]
-		if err != nil {
+		var err error
-			return fmt.Errorf("unable to find interface %s: %w", peer.InterfaceIdentifier, err)
+		if peer.IsDisabled() || peer.IsExpired() {
+			err = m.db.SavePeer(ctx, peer.Identifier, func(p *domain.Peer) (*domain.Peer, error) {
+				peer.CopyCalculatedAttributes(p)
+
+				if err := m.wg.DeletePeer(ctx, peer.InterfaceIdentifier, peer.Identifier); err != nil {
+					return nil, fmt.Errorf("failed to delete wireguard peer %s: %w", peer.Identifier, err)
+				}
+
+				return peer, nil
+			})
+		} else {
+			err = m.db.SavePeer(ctx, peer.Identifier, func(p *domain.Peer) (*domain.Peer, error) {
+				peer.CopyCalculatedAttributes(p)
+
+				err := m.wg.SavePeer(ctx, peer.InterfaceIdentifier, peer.Identifier,
+					func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error) {
+						domain.MergeToPhysicalPeer(pp, peer)
+						return pp, nil
+					})
+				if err != nil {
+					return nil, fmt.Errorf("failed to save wireguard peer %s: %w", peer.Identifier, err)
+				}
+
+				return peer, nil
+			})
 		}
-
-		// Always save the peer to the backend, regardless of disabled/expired state
-		// The backend will handle the disabled state appropriately
-		err = m.db.SavePeer(ctx, peer.Identifier, func(p *domain.Peer) (*domain.Peer, error) {
-			peer.CopyCalculatedAttributes(p)
-
-			err := m.wg.GetController(*iface).SavePeer(ctx, peer.InterfaceIdentifier, peer.Identifier,
-				func(pp *domain.PhysicalPeer) (*domain.PhysicalPeer, error) {
-					domain.MergeToPhysicalPeer(pp, peer)
-					return pp, nil
-				})
-			if err != nil {
-				return nil, fmt.Errorf("failed to save wireguard peer %s: %w", peer.Identifier, err)
-			}
-
-			return peer, nil
-		})
 		if err != nil {
 			return fmt.Errorf("save failure for peer %s: %w", peer.Identifier, err)
 		}

internal/config/backend.go

@@ -1,94 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"time"
-)
-
-const LocalBackendName = "local"
-
-type Backend struct {
-	Default string `yaml:"default"` // The default backend to use (defaults to the internal backend)
-
-	Mikrotik []BackendMikrotik `yaml:"mikrotik"`
-}
-
-// Validate checks the backend configuration for errors.
-func (b *Backend) Validate() error {
-	if b.Default == "" {
-		b.Default = LocalBackendName
-	}
-
-	uniqueMap := make(map[string]struct{})
-	for _, backend := range b.Mikrotik {
-		if backend.Id == LocalBackendName {
-			return fmt.Errorf("backend ID %q is a reserved keyword", LocalBackendName)
-		}
-		if _, exists := uniqueMap[backend.Id]; exists {
-			return fmt.Errorf("backend ID %q is not unique", backend.Id)
-		}
-		uniqueMap[backend.Id] = struct{}{}
-	}
-
-	if b.Default != LocalBackendName {
-		if _, ok := uniqueMap[b.Default]; !ok {
-			return fmt.Errorf("default backend %q is not defined in the configuration", b.Default)
-		}
-	}
-
-	return nil
-}
-
-type BackendBase struct {
-	Id          string `yaml:"id"`           // A unique id for the backend
-	DisplayName string `yaml:"display_name"` // A display name for the backend
-}
-
-// GetDisplayName returns the display name of the backend.
-// If no display name is set, it falls back to the ID.
-func (b BackendBase) GetDisplayName() string {
-	if b.DisplayName == "" {
-		return b.Id // Fallback to ID if no display name is set
-	}
-	return b.DisplayName
-}
-
-type BackendMikrotik struct {
-	BackendBase `yaml:",inline"` // Embed the base fields
-
-	ApiUrl       string        `yaml:"api_url"` // The base URL of the Mikrotik API (e.g., "https://10.10.10.10:8729/rest")
-	ApiUser      string        `yaml:"api_user"`
-	ApiPassword  string        `yaml:"api_password"`
-	ApiVerifyTls bool          `yaml:"api_verify_tls"` // Whether to verify the TLS certificate of the Mikrotik API
-	ApiTimeout   time.Duration `yaml:"api_timeout"`    // Timeout for API requests (default: 30 seconds)
-
-	// Concurrency controls the maximum number of concurrent API requests that this backend will issue
-	// when enumerating interfaces and their details. If 0 or negative, a default of 5 is used.
-	Concurrency int `yaml:"concurrency"`
-
-	Debug bool `yaml:"debug"` // Enable debug logging for the Mikrotik backend
-}
-
-// GetConcurrency returns the configured concurrency for this backend or a sane default (5)
-// when the configured value is zero or negative.
-func (b *BackendMikrotik) GetConcurrency() int {
-	if b == nil {
-		return 5
-	}
-	if b.Concurrency <= 0 {
-		return 5
-	}
-	return b.Concurrency
-}
-
-// GetApiTimeout returns the configured API timeout or a sane default (30 seconds)
-// when the configured value is zero or negative.
-func (b *BackendMikrotik) GetApiTimeout() time.Duration {
-	if b == nil {
-		return 30 * time.Second
-	}
-	if b.ApiTimeout <= 0 {
-		return 30 * time.Second
-	}
-	return b.ApiTimeout
-}

internal/config/config.go

@@ -44,8 +44,6 @@ type Config struct {
 		LimitAdditionalUserPeers int           `yaml:"limit_additional_user_peers"`
 	} `yaml:"advanced"`
 
-	Backend Backend `yaml:"backend"`
-
 	Statistics struct {
 		UsePingChecks          bool          `yaml:"use_ping_checks"`
 		PingCheckWorkers       int           `yaml:"ping_check_workers"`
@@ -101,12 +99,6 @@ func (c *Config) LogStartupValues() {
 		"minPasswordLength", c.Auth.MinPasswordLength,
 		"hideLoginForm", c.Auth.HideLoginForm,
 	)
-
-	slog.Debug("Config Backend",
-		"defaultBackend", c.Backend.Default,
-		"extraBackends", len(c.Backend.Mikrotik),
-	)
-
 }
 
 // defaultConfig returns the default configuration
@@ -130,10 +122,6 @@ func defaultConfig() *Config {
 		DSN:  "data/sqlite.db",
 	}
 
-	cfg.Backend = Backend{
-		Default: LocalBackendName, // local backend is the default (using wgcrtl)
-	}
-
 	cfg.Web = WebConfig{
 		RequestLogging:    false,
 		ExternalUrl:       "http://localhost:8888",
@@ -213,10 +201,6 @@ func GetConfig() (*Config, error) {
 	}
 
 	cfg.Web.Sanitize()
-	err := cfg.Backend.Validate()
-	if err != nil {
-		return nil, err
-	}
 
 	return cfg, nil
 }

internal/domain/controller.go

@@ -1,32 +0,0 @@
-package domain
-
-// ControllerType defines the type of controller used to manage interfaces.
-
-const (
-	ControllerTypeMikrotik = "mikrotik"
-	ControllerTypeLocal    = "wgctrl"
-)
-
-// Controller extras can be used to store additional information available for specific controllers only.
-
-type MikrotikInterfaceExtras struct {
-	Id       string // internal mikrotik ID
-	Comment  string
-	Disabled bool
-}
-
-type MikrotikPeerExtras struct {
-	Id              string // internal mikrotik ID
-	Name            string
-	Comment         string
-	IsResponder     bool
-	Disabled        bool
-	ClientEndpoint  string
-	ClientAddress   string
-	ClientDns       string
-	ClientKeepalive int
-}
-
-type LocalPeerExtras struct {
-	Disabled bool
-}

internal/domain/interface.go

@@ -10,8 +10,6 @@ import (
 	"strings"
 	"time"
 
-	"golang.org/x/sys/unix"
-
 	"github.com/h44z/wg-portal/internal"
 )
 
@@ -25,7 +23,6 @@ var allowedFileNameRegex = regexp.MustCompile("[^a-zA-Z0-9-_]+")
 
 type InterfaceIdentifier string
 type InterfaceType string
-type InterfaceBackend string
 
 type Interface struct {
 	BaseModel
@@ -52,12 +49,11 @@ type Interface struct {
 	SaveConfig bool // automatically persist config changes to the wgX.conf file
 
 	// WG Portal specific
-	DisplayName    string           // a nice display name/ description for the interface
+	DisplayName    string        // a nice display name/ description for the interface
-	Type           InterfaceType    // the interface type, either InterfaceTypeServer or InterfaceTypeClient
+	Type           InterfaceType // the interface type, either InterfaceTypeServer or InterfaceTypeClient
-	Backend        InterfaceBackend // the backend that is used to manage the interface (wgctrl, mikrotik, ...)
+	DriverType     string        // the interface driver type (linux, software, ...)
-	DriverType     string           // the interface driver type (linux, software, ...)
+	Disabled       *time.Time    `gorm:"index"` // flag that specifies if the interface is enabled (up) or not (down)
-	Disabled       *time.Time       `gorm:"index"` // flag that specifies if the interface is enabled (up) or not (down)
+	DisabledReason string        // the reason why the interface has been disabled
-	DisabledReason string           // the reason why the interface has been disabled
 
 	// Default settings for the peer, used for new peers, those settings will be published to ConfigOption options of
 	// the peer config
@@ -208,31 +204,9 @@ type PhysicalInterface struct {
 
 	BytesUpload   uint64
 	BytesDownload uint64
-
-	backendExtras any // additional backend-specific extras, e.g., domain.MikrotikInterfaceExtras
-}
-
-func (p *PhysicalInterface) GetExtras() any {
-	return p.backendExtras
-}
-
-func (p *PhysicalInterface) SetExtras(extras any) {
-	switch extras.(type) {
-	case MikrotikInterfaceExtras: // OK
-	default: // we only support MikrotikInterfaceExtras for now
-		panic(fmt.Sprintf("unsupported interface backend extras type %T", extras))
-	}
-
-	p.backendExtras = extras
 }
 
 func ConvertPhysicalInterface(pi *PhysicalInterface) *Interface {
-	networks := make([]Cidr, 0, len(pi.Addresses))
-	for _, addr := range pi.Addresses {
-		networks = append(networks, addr.NetworkAddr())
-	}
-
-	// create a new basic interface with the data from the physical interface
 	iface := &Interface{
 		Identifier:                 pi.Identifier,
 		KeyPair:                    pi.KeyPair,
@@ -252,11 +226,11 @@ func ConvertPhysicalInterface(pi *PhysicalInterface) *Interface {
 		Type:                       InterfaceTypeAny,
 		DriverType:                 pi.DeviceType,
 		Disabled:                   nil,
-		PeerDefNetworkStr:          CidrsToString(networks),
+		PeerDefNetworkStr:          "",
 		PeerDefDnsStr:              "",
 		PeerDefDnsSearchStr:        "",
 		PeerDefEndpoint:            "",
-		PeerDefAllowedIPsStr:       CidrsToString(networks),
+		PeerDefAllowedIPsStr:       "",
 		PeerDefMtu:                 pi.Mtu,
 		PeerDefPersistentKeepalive: 0,
 		PeerDefFirewallMark:        0,
@@ -267,23 +241,6 @@ func ConvertPhysicalInterface(pi *PhysicalInterface) *Interface {
 		PeerDefPostDown:            "",
 	}
 
-	if pi.GetExtras() == nil {
-		return iface
-	}
-
-	// enrich the data with controller-specific extras
-	now := time.Now()
-	switch pi.ImportSource {
-	case ControllerTypeMikrotik:
-		extras := pi.GetExtras().(MikrotikInterfaceExtras)
-		iface.DisplayName = extras.Comment
-		if extras.Disabled {
-			iface.Disabled = &now
-		} else {
-			iface.Disabled = nil
-		}
-	}
-
 	return iface
 }
 
@@ -296,15 +253,6 @@ func MergeToPhysicalInterface(pi *PhysicalInterface, i *Interface) {
 	pi.FirewallMark = i.FirewallMark
 	pi.DeviceUp = !i.IsDisabled()
 	pi.Addresses = i.Addresses
-
-	switch pi.ImportSource {
-	case ControllerTypeMikrotik:
-		extras := MikrotikInterfaceExtras{
-			Comment:  i.DisplayName,
-			Disabled: i.IsDisabled(),
-		}
-		pi.SetExtras(extras)
-	}
 }
 
 type RoutingTableInfo struct {
@@ -331,30 +279,3 @@ func (r RoutingTableInfo) GetRoutingTable() int {
 
 	return r.Table
 }
-
-type IpFamily int
-
-const (
-	IpFamilyIPv4 IpFamily = unix.AF_INET
-	IpFamilyIPv6 IpFamily = unix.AF_INET6
-)
-
-func (f IpFamily) String() string {
-	switch f {
-	case IpFamilyIPv4:
-		return "IPv4"
-	case IpFamilyIPv6:
-		return "IPv6"
-	default:
-		return "unknown"
-	}
-}
-
-// RouteRule represents a routing table rule.
-type RouteRule struct {
-	InterfaceId InterfaceIdentifier
-	IpFamily    IpFamily
-	FwMark      uint32
-	Table       int
-	HasDefault  bool
-}

internal/domain/peer.go

@@ -129,7 +129,7 @@ func (p *Peer) GenerateDisplayName(prefix string) {
 	p.DisplayName = fmt.Sprintf("%sPeer %s", prefix, internal.TruncateString(string(p.Identifier), 8))
 }
 
-// OverwriteUserEditableFields overwrites the user-editable fields of the peer with the values from the userPeer
+// OverwriteUserEditableFields overwrites the user editable fields of the peer with the values from the userPeer
 func (p *Peer) OverwriteUserEditableFields(userPeer *Peer, cfg *config.Config) {
 	p.DisplayName = userPeer.DisplayName
 	if cfg.Core.EditableKeys {
@@ -182,12 +182,9 @@ type PhysicalPeer struct {
 
 	BytesUpload   uint64 // upload bytes are the number of bytes that the remote peer has sent to the server
 	BytesDownload uint64 // upload bytes are the number of bytes that the remote peer has received from the server
-
-	ImportSource  string // import source (wgctrl, file, ...)
-	backendExtras any    // additional backend-specific extras, e.g., domain.MikrotikPeerExtras
 }
 
-func (p *PhysicalPeer) GetPresharedKey() *wgtypes.Key {
+func (p PhysicalPeer) GetPresharedKey() *wgtypes.Key {
 	if p.PresharedKey == "" {
 		return nil
 	}
@@ -199,7 +196,7 @@ func (p *PhysicalPeer) GetPresharedKey() *wgtypes.Key {
 	return &key
 }
 
-func (p *PhysicalPeer) GetEndpointAddress() *net.UDPAddr {
+func (p PhysicalPeer) GetEndpointAddress() *net.UDPAddr {
 	if p.Endpoint == "" {
 		return nil
 	}
@@ -211,7 +208,7 @@ func (p *PhysicalPeer) GetEndpointAddress() *net.UDPAddr {
 	return addr
 }
 
-func (p *PhysicalPeer) GetPersistentKeepaliveTime() *time.Duration {
+func (p PhysicalPeer) GetPersistentKeepaliveTime() *time.Duration {
 	if p.PersistentKeepalive == 0 {
 		return nil
 	}
@@ -220,7 +217,7 @@ func (p *PhysicalPeer) GetPersistentKeepaliveTime() *time.Duration {
 	return &keepAliveDuration
 }
 
-func (p *PhysicalPeer) GetAllowedIPs() []net.IPNet {
+func (p PhysicalPeer) GetAllowedIPs() []net.IPNet {
 	allowedIPs := make([]net.IPNet, len(p.AllowedIPs))
 	for i, ip := range p.AllowedIPs {
 		allowedIPs[i] = *ip.IpNet()
@@ -229,21 +226,6 @@ func (p *PhysicalPeer) GetAllowedIPs() []net.IPNet {
 	return allowedIPs
 }
 
-func (p *PhysicalPeer) GetExtras() any {
-	return p.backendExtras
-}
-
-func (p *PhysicalPeer) SetExtras(extras any) {
-	switch extras.(type) {
-	case MikrotikPeerExtras: // OK
-	case LocalPeerExtras: // OK
-	default: // we only support MikrotikPeerExtras and LocalPeerExtras for now
-		panic(fmt.Sprintf("unsupported peer backend extras type %T", extras))
-	}
-
-	p.backendExtras = extras
-}
-
 func ConvertPhysicalPeer(pp *PhysicalPeer) *Peer {
 	peer := &Peer{
 		Endpoint:            NewConfigOption(pp.Endpoint, true),
@@ -262,44 +244,6 @@ func ConvertPhysicalPeer(pp *PhysicalPeer) *Peer {
 		},
 	}
 
-	if pp.GetExtras() == nil {
-		return peer
-	}
-
-	// enrich the data with controller-specific extras
-	now := time.Now()
-	switch pp.ImportSource {
-	case ControllerTypeMikrotik:
-		extras := pp.GetExtras().(MikrotikPeerExtras)
-		peer.Notes = extras.Comment
-		peer.DisplayName = extras.Name
-		if extras.ClientEndpoint != "" { // if the client endpoint is set, we assume that this is a client peer
-			peer.Endpoint = NewConfigOption(extras.ClientEndpoint, true)
-			peer.Interface.Type = InterfaceTypeClient
-			peer.Interface.Addresses, _ = CidrsFromString(extras.ClientAddress)
-			peer.Interface.DnsStr = NewConfigOption(extras.ClientDns, true)
-			peer.PersistentKeepalive = NewConfigOption(extras.ClientKeepalive, true)
-		} else {
-			peer.Interface.Type = InterfaceTypeServer
-		}
-		if extras.Disabled {
-			peer.Disabled = &now
-			peer.DisabledReason = "Disabled by Mikrotik controller"
-		} else {
-			peer.Disabled = nil
-			peer.DisabledReason = ""
-		}
-	case ControllerTypeLocal:
-		extras := pp.GetExtras().(LocalPeerExtras)
-		if extras.Disabled {
-			peer.Disabled = &now
-			peer.DisabledReason = "Disabled by Local controller"
-		} else {
-			peer.Disabled = nil
-			peer.DisabledReason = ""
-		}
-	}
-
 	return peer
 }
 
@@ -321,30 +265,9 @@ func MergeToPhysicalPeer(pp *PhysicalPeer, p *Peer) {
 	pp.PresharedKey = p.PresharedKey
 	pp.PublicKey = p.Interface.PublicKey
 	pp.PersistentKeepalive = p.PersistentKeepalive.GetValue()
-
-	switch pp.ImportSource {
-	case ControllerTypeMikrotik:
-		extras := MikrotikPeerExtras{
-			Id:              "",
-			Name:            p.DisplayName,
-			Comment:         p.Notes,
-			IsResponder:     false,
-			Disabled:        p.IsDisabled(),
-			ClientEndpoint:  p.Endpoint.GetValue(),
-			ClientAddress:   CidrsToString(p.Interface.Addresses),
-			ClientDns:       p.Interface.DnsStr.GetValue(),
-			ClientKeepalive: p.PersistentKeepalive.GetValue(),
-		}
-		pp.SetExtras(extras)
-	case ControllerTypeLocal:
-		extras := LocalPeerExtras{
-			Disabled: p.IsDisabled(),
-		}
-		pp.SetExtras(extras)
-	}
 }
 
 type PeerCreationRequest struct {
 	UserIdentifiers []string
-	Prefix          string
+	Suffix          string
 }

internal/domain/statistics.go

@@ -1,8 +1,6 @@
 package domain
 
-import (
+import "time"
-	"time"
-)
 
 type PeerStatus struct {
 	PeerId    PeerIdentifier `gorm:"primaryKey;column:identifier" json:"PeerId"`
@@ -39,25 +37,3 @@ type InterfaceStatus struct {
 	BytesReceived    uint64 `gorm:"column:received"`
 	BytesTransmitted uint64 `gorm:"column:transmitted"`
 }
-
-type PingerResult struct {
-	PacketsRecv int
-	PacketsSent int
-	Rtts        []time.Duration
-}
-
-func (r PingerResult) IsPingable() bool {
-	return r.PacketsRecv > 0 && r.PacketsSent > 0 && len(r.Rtts) > 0
-}
-
-func (r PingerResult) AverageRtt() time.Duration {
-	if len(r.Rtts) == 0 {
-		return 0
-	}
-
-	var total time.Duration
-	for _, rtt := range r.Rtts {
-		total += rtt
-	}
-	return total / time.Duration(len(r.Rtts))
-}

internal/logger.go

@@ -12,8 +12,8 @@ import (
 	"sync"
 )
 
-// GetLoggingHandler initializes a slog.Handler based on the provided logging level and format options.
+// SetupLogging initializes the global logger with the given level and format
-func GetLoggingHandler(level string, pretty, json bool) slog.Handler {
+func SetupLogging(level string, pretty, json bool) {
 	var logLevel = new(slog.LevelVar)
 
 	switch strings.ToLower(level) {
@@ -46,13 +46,6 @@ func GetLoggingHandler(level string, pretty, json bool) slog.Handler {
 		handler = slog.NewTextHandler(output, opts)
 	}
 
-	return handler
-}
-
-// SetupLogging initializes the global logger with the given level and format
-func SetupLogging(level string, pretty, json bool) {
-	handler := GetLoggingHandler(level, pretty, json)
-
 	logger := slog.New(handler)
 
 	slog.SetDefault(logger)

internal/lowlevel/mikrotik.go

@@ -1,435 +0,0 @@
-package lowlevel
-
-import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"encoding/json"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/h44z/wg-portal/internal"
-	"github.com/h44z/wg-portal/internal/config"
-)
-
-// region models
-
-const (
-	MikrotikApiStatusOk    = "success"
-	MikrotikApiStatusError = "error"
-)
-
-const (
-	MikrotikApiErrorCodeUnknown = iota + 600
-	MikrotikApiErrorCodeRequestPreparationFailed
-	MikrotikApiErrorCodeRequestFailed
-	MikrotikApiErrorCodeResponseDecodeFailed
-)
-
-type MikrotikApiResponse[T any] struct {
-	Status string
-	Code   int
-	Data   T                 `json:"data,omitempty"`
-	Error  *MikrotikApiError `json:"error,omitempty"`
-}
-
-type MikrotikApiError struct {
-	Code    int    `json:"error,omitempty"`
-	Message string `json:"message,omitempty"`
-	Details string `json:"detail,omitempty"`
-}
-
-func (e *MikrotikApiError) String() string {
-	if e == nil {
-		return "no error"
-	}
-	return fmt.Sprintf("API error %d: %s - %s", e.Code, e.Message, e.Details)
-}
-
-type GenericJsonObject map[string]any
-type EmptyResponse struct{}
-
-func (JsonObject GenericJsonObject) GetString(key string) string {
-	if value, ok := JsonObject[key]; ok {
-		if strValue, ok := value.(string); ok {
-			return strValue
-		} else {
-			return fmt.Sprintf("%v", value) // Convert to string if not already
-		}
-	}
-	return ""
-}
-
-func (JsonObject GenericJsonObject) GetInt(key string) int {
-	if value, ok := JsonObject[key]; ok {
-		if intValue, ok := value.(int); ok {
-			return intValue
-		} else {
-			if floatValue, ok := value.(float64); ok {
-				return int(floatValue) // Convert float64 to int
-			}
-			if strValue, ok := value.(string); ok {
-				if intValue, err := strconv.Atoi(strValue); err == nil {
-					return intValue // Convert string to int if possible
-				}
-			}
-		}
-	}
-	return 0
-}
-
-func (JsonObject GenericJsonObject) GetBool(key string) bool {
-	if value, ok := JsonObject[key]; ok {
-		if boolValue, ok := value.(bool); ok {
-			return boolValue
-		} else {
-			if intValue, ok := value.(int); ok {
-				return intValue == 1 // Convert int to bool (1 is true, 0 is false)
-			}
-			if floatValue, ok := value.(float64); ok {
-				return int(floatValue) == 1 // Convert float64 to bool (1.0 is true, 0.0 is false)
-			}
-			if strValue, ok := value.(string); ok {
-				boolValue, err := strconv.ParseBool(strValue)
-				if err == nil {
-					return boolValue
-				}
-			}
-		}
-	}
-	return false
-}
-
-type MikrotikRequestOptions struct {
-	Filters  map[string]string `json:"filters,omitempty"`
-	PropList []string          `json:"proplist,omitempty"`
-}
-
-func (o *MikrotikRequestOptions) GetPath(base string) string {
-	if o == nil {
-		return base
-	}
-
-	path, err := url.Parse(base)
-	if err != nil {
-		return base
-	}
-
-	query := path.Query()
-	for k, v := range o.Filters {
-		query.Set(k, v)
-	}
-	if len(o.PropList) > 0 {
-		query.Set(".proplist", strings.Join(o.PropList, ","))
-	}
-	path.RawQuery = query.Encode()
-	return path.String()
-}
-
-// region models
-
-// region API-client
-
-type MikrotikApiClient struct {
-	coreCfg *config.Config
-	cfg     *config.BackendMikrotik
-
-	client *http.Client
-	log    *slog.Logger
-}
-
-func NewMikrotikApiClient(coreCfg *config.Config, cfg *config.BackendMikrotik) (*MikrotikApiClient, error) {
-	c := &MikrotikApiClient{
-		coreCfg: coreCfg,
-		cfg:     cfg,
-	}
-
-	err := c.setup()
-	if err != nil {
-		return nil, err
-	}
-
-	c.debugLog("Mikrotik api client created", "api_url", cfg.ApiUrl)
-
-	return c, nil
-}
-
-func (m *MikrotikApiClient) setup() error {
-	m.client = &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				InsecureSkipVerify: !m.cfg.ApiVerifyTls,
-			},
-		},
-		Timeout: m.cfg.GetApiTimeout(),
-	}
-
-	if m.cfg.Debug {
-		m.log = slog.New(internal.GetLoggingHandler("debug",
-			m.coreCfg.Advanced.LogPretty,
-			m.coreCfg.Advanced.LogJson).
-			WithAttrs([]slog.Attr{
-				{
-					Key: "mikrotik-bid", Value: slog.StringValue(m.cfg.Id),
-				},
-			}))
-	}
-
-	return nil
-}
-
-func (m *MikrotikApiClient) debugLog(msg string, args ...any) {
-	if m.log != nil {
-		m.log.Debug("[MT-API] "+msg, args...)
-	}
-}
-
-func (m *MikrotikApiClient) getFullPath(command string) string {
-	path, err := url.JoinPath(m.cfg.ApiUrl, command)
-	if err != nil {
-		return ""
-	}
-	return path
-}
-
-func (m *MikrotikApiClient) prepareGetRequest(ctx context.Context, fullUrl string) (*http.Request, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullUrl, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-	req.Header.Set("Accept", "application/json")
-	if m.cfg.ApiUser != "" && m.cfg.ApiPassword != "" {
-		req.SetBasicAuth(m.cfg.ApiUser, m.cfg.ApiPassword)
-	}
-
-	return req, nil
-}
-
-func (m *MikrotikApiClient) prepareDeleteRequest(ctx context.Context, fullUrl string) (*http.Request, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, fullUrl, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-	req.Header.Set("Accept", "application/json")
-	if m.cfg.ApiUser != "" && m.cfg.ApiPassword != "" {
-		req.SetBasicAuth(m.cfg.ApiUser, m.cfg.ApiPassword)
-	}
-
-	return req, nil
-}
-
-func (m *MikrotikApiClient) preparePayloadRequest(
-	ctx context.Context,
-	method string,
-	fullUrl string,
-	payload GenericJsonObject,
-) (*http.Request, error) {
-	// marshal the payload to JSON
-	payloadBytes, err := json.Marshal(payload)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal payload: %w", err)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, method, fullUrl, bytes.NewReader(payloadBytes))
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-	req.Header.Set("Accept", "application/json")
-	req.Header.Set("Content-Type", "application/json")
-	if m.cfg.ApiUser != "" && m.cfg.ApiPassword != "" {
-		req.SetBasicAuth(m.cfg.ApiUser, m.cfg.ApiPassword)
-	}
-
-	return req, nil
-}
-
-func errToApiResponse[T any](code int, message string, err error) MikrotikApiResponse[T] {
-	return MikrotikApiResponse[T]{
-		Status: MikrotikApiStatusError,
-		Code:   code,
-		Error: &MikrotikApiError{
-			Code:    code,
-			Message: message,
-			Details: err.Error(),
-		},
-	}
-}
-
-func parseHttpResponse[T any](resp *http.Response, err error) MikrotikApiResponse[T] {
-	if err != nil {
-		return errToApiResponse[T](MikrotikApiErrorCodeRequestFailed, "failed to execute request", err)
-	}
-
-	defer func(Body io.ReadCloser) {
-		err := Body.Close()
-		if err != nil {
-			slog.Error("failed to close response body", "error", err)
-		}
-	}(resp.Body)
-
-	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-		var data T
-
-		// if the type of T is EmptyResponse, we can return an empty response with just the status
-		if _, ok := any(data).(EmptyResponse); ok {
-			return MikrotikApiResponse[T]{Status: MikrotikApiStatusOk, Code: resp.StatusCode}
-		}
-
-		if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
-			return errToApiResponse[T](MikrotikApiErrorCodeResponseDecodeFailed, "failed to decode response", err)
-		}
-		return MikrotikApiResponse[T]{Status: MikrotikApiStatusOk, Code: resp.StatusCode, Data: data}
-	}
-
-	var apiErr MikrotikApiError
-	if err := json.NewDecoder(resp.Body).Decode(&apiErr); err != nil {
-		return errToApiResponse[T](resp.StatusCode, "unknown error, unparsable response", err)
-	} else {
-		return MikrotikApiResponse[T]{Status: MikrotikApiStatusError, Code: resp.StatusCode, Error: &apiErr}
-	}
-}
-
-func (m *MikrotikApiClient) Query(
-	ctx context.Context,
-	command string,
-	opts *MikrotikRequestOptions,
-) MikrotikApiResponse[[]GenericJsonObject] {
-	apiCtx, cancel := context.WithTimeout(ctx, m.cfg.GetApiTimeout())
-	defer cancel()
-
-	fullUrl := opts.GetPath(m.getFullPath(command))
-
-	req, err := m.prepareGetRequest(apiCtx, fullUrl)
-	if err != nil {
-		return errToApiResponse[[]GenericJsonObject](MikrotikApiErrorCodeRequestPreparationFailed,
-			"failed to create request", err)
-	}
-
-	start := time.Now()
-	m.debugLog("executing API query", "url", fullUrl)
-	response := parseHttpResponse[[]GenericJsonObject](m.client.Do(req))
-	m.debugLog("retrieved API query result", "url", fullUrl, "duration", time.Since(start).String())
-	return response
-}
-
-func (m *MikrotikApiClient) Get(
-	ctx context.Context,
-	command string,
-	opts *MikrotikRequestOptions,
-) MikrotikApiResponse[GenericJsonObject] {
-	apiCtx, cancel := context.WithTimeout(ctx, m.cfg.GetApiTimeout())
-	defer cancel()
-
-	fullUrl := opts.GetPath(m.getFullPath(command))
-
-	req, err := m.prepareGetRequest(apiCtx, fullUrl)
-	if err != nil {
-		return errToApiResponse[GenericJsonObject](MikrotikApiErrorCodeRequestPreparationFailed,
-			"failed to create request", err)
-	}
-
-	start := time.Now()
-	m.debugLog("executing API get", "url", fullUrl)
-	response := parseHttpResponse[GenericJsonObject](m.client.Do(req))
-	m.debugLog("retrieved API get result", "url", fullUrl, "duration", time.Since(start).String())
-	return response
-}
-
-func (m *MikrotikApiClient) Create(
-	ctx context.Context,
-	command string,
-	payload GenericJsonObject,
-) MikrotikApiResponse[GenericJsonObject] {
-	apiCtx, cancel := context.WithTimeout(ctx, m.cfg.GetApiTimeout())
-	defer cancel()
-
-	fullUrl := m.getFullPath(command)
-
-	req, err := m.preparePayloadRequest(apiCtx, http.MethodPut, fullUrl, payload)
-	if err != nil {
-		return errToApiResponse[GenericJsonObject](MikrotikApiErrorCodeRequestPreparationFailed,
-			"failed to create request", err)
-	}
-
-	start := time.Now()
-	m.debugLog("executing API put", "url", fullUrl)
-	response := parseHttpResponse[GenericJsonObject](m.client.Do(req))
-	m.debugLog("retrieved API put result", "url", fullUrl, "duration", time.Since(start).String())
-	return response
-}
-
-func (m *MikrotikApiClient) Update(
-	ctx context.Context,
-	command string,
-	payload GenericJsonObject,
-) MikrotikApiResponse[GenericJsonObject] {
-	apiCtx, cancel := context.WithTimeout(ctx, m.cfg.GetApiTimeout())
-	defer cancel()
-
-	fullUrl := m.getFullPath(command)
-
-	req, err := m.preparePayloadRequest(apiCtx, http.MethodPatch, fullUrl, payload)
-	if err != nil {
-		return errToApiResponse[GenericJsonObject](MikrotikApiErrorCodeRequestPreparationFailed,
-			"failed to create request", err)
-	}
-
-	start := time.Now()
-	m.debugLog("executing API patch", "url", fullUrl)
-	response := parseHttpResponse[GenericJsonObject](m.client.Do(req))
-	m.debugLog("retrieved API patch result", "url", fullUrl, "duration", time.Since(start).String())
-	return response
-}
-
-func (m *MikrotikApiClient) Delete(
-	ctx context.Context,
-	command string,
-) MikrotikApiResponse[EmptyResponse] {
-	apiCtx, cancel := context.WithTimeout(ctx, m.cfg.GetApiTimeout())
-	defer cancel()
-
-	fullUrl := m.getFullPath(command)
-
-	req, err := m.prepareDeleteRequest(apiCtx, fullUrl)
-	if err != nil {
-		return errToApiResponse[EmptyResponse](MikrotikApiErrorCodeRequestPreparationFailed,
-			"failed to create request", err)
-	}
-
-	start := time.Now()
-	m.debugLog("executing API delete", "url", fullUrl)
-	response := parseHttpResponse[EmptyResponse](m.client.Do(req))
-	m.debugLog("retrieved API delete result", "url", fullUrl, "duration", time.Since(start).String())
-	return response
-}
-
-func (m *MikrotikApiClient) ExecList(
-	ctx context.Context,
-	command string,
-	payload GenericJsonObject,
-) MikrotikApiResponse[[]GenericJsonObject] {
-	apiCtx, cancel := context.WithTimeout(ctx, m.cfg.GetApiTimeout())
-	defer cancel()
-
-	fullUrl := m.getFullPath(command)
-
-	req, err := m.preparePayloadRequest(apiCtx, http.MethodPost, fullUrl, payload)
-	if err != nil {
-		return errToApiResponse[[]GenericJsonObject](MikrotikApiErrorCodeRequestPreparationFailed,
-			"failed to create request", err)
-	}
-
-	start := time.Now()
-	m.debugLog("executing API post", "url", fullUrl)
-	response := parseHttpResponse[[]GenericJsonObject](m.client.Do(req))
-	m.debugLog("retrieved API post result", "url", fullUrl, "duration", time.Since(start).String())
-	return response
-}
-
-// endregion API-client

mkdocs.yml

@@ -80,7 +80,6 @@ nav:
           - Examples: documentation/configuration/examples.md
       - Usage:
           - General: documentation/usage/general.md
-          - Backends: documentation/usage/backends.md
           - LDAP: documentation/usage/ldap.md
           - Security: documentation/usage/security.md
           - Webhooks: documentation/usage/webhooks.md