mirror of
https://github.com/h44z/wg-portal.git
synced 2025-12-14 02:26:19 +00:00
54ca1d8aed
* Add pfSense backend domain types and configuration This adds the necessary domain types and configuration structures for the pfSense backend support. Includes PfsenseInterfaceExtras and PfsensePeerExtras structs, and the BackendPfsense configuration with API URL, key, and timeout settings. * Add low-level pfSense REST API client Implements the HTTP client for interacting with the pfSense REST API. Handles authentication via X-API-Key header, request/response parsing, and error handling. Uses the pfSense REST API v2 endpoints as documented at https://pfrest.org/. * Implement pfSense WireGuard controller This implements the InterfaceController interface for pfSense firewalls. Handles WireGuard tunnel and peer management through the pfSense REST API. Includes proper filtering of peers by interface (since API filtering doesn't work) and parsing of the allowedips array structure with address/mask fields. * Register pfSense controllers and update configuration Registers the pfSense backend controllers in the controller manager and adds example configuration to config.yml.sample. Also updates README to mention pfSense backend support. * Fix peer filtering and allowedips parsing for pfSense backend The pfSense REST API doesn't support filtering peers by interface via query parameters, so all peers are returned regardless of the filter. This caused peers from all interfaces to be randomly assigned to a single interface in wg-portal. Additionally, the API returns allowedips as an array of objects with "address" and "mask" fields instead of a comma-separated string, which caused parsing failures. Changes: - Remove API filter from GetPeers() since it doesn't work - Add client-side filtering by checking the "tun" field in peer responses - Update convertWireGuardPeer() to parse allowedips array structure - Add parseAddressArray() helper for parsing address objects - Attempt to fetch interface addresses from /tunnel/{id}/address endpoint (endpoint may not be available in all pfSense versions) - Add debug logging for peer filtering and address loading operations Note: Interface addresses may still be empty if the address endpoint is not available. Public Endpoint and Default DNS Servers are typically configured manually in wg-portal as the pfSense API doesn't provide this information. * Extract endpoint, DNS, and peer names from pfSense peer data The pfSense API provides endpoint, port, and description (descr) fields in peer responses that can be used to populate interface defaults and peer display names. Changes: - Extract endpoint and port from peers and combine them properly - Fix peer name/description extraction to check "descr" field first (pfSense API uses "descr" instead of "description" or "comment") - Add extractPfsenseDefaultsFromPeers() helper to extract common endpoint and DNS from peers during interface import - Set PeerDefEndpoint and PeerDefDnsStr from peer data for pfSense backends during interface import - Use most common endpoint/DNS values when multiple peers are present * Fix interface display name to use descr field from pfSense API The pfSense API uses "descr" field for tunnel descriptions, not "description" or "comment". Updated convertWireGuardInterface() to check "descr" first so that tunnel descriptions (e.g., "HQ VPN") are displayed in the UI instead of just the tunnel name (e.g., "tun_wg0"). * Remove calls to non-working tunnel and peer detail endpoints The pfSense REST API endpoints /api/v2/vpn/wireguard/tunnel/{id} and /api/v2/vpn/wireguard/tunnel/{id}/address don't work and were causing log spam. Removed these calls and use only the data from the tunnel/peer list responses. Also removed the peer detail endpoint call that was added for statistics collection, as it likely doesn't work either. * Fix unused variable compilation error Removed unused deviceId variable that was causing build failure. * Optimize tunnel address fetching to use /tunnel?id endpoint Instead of using the separate /tunnel/address endpoint, now query the specific tunnel endpoint /tunnel?id={id} which includes the addresses array in the response. This avoids unnecessary API calls and simplifies the code. - GetInterface() now queries /tunnel?id={id} after getting tunnel ID - loadInterfaceData() queries /tunnel?id={id} as fallback if addresses missing - extractAddresses() properly parses addresses array from tunnel response - Removed /tunnel/address endpoint calls Signed-off-by: rwjack <jack@foss.family> * Fix URL encoding issue in tunnel endpoint queries Use Filters in PfsenseRequestOptions instead of passing query strings directly in the path. This prevents the ? character from being encoded as %3F, which was causing 404 errors. - GetInterface() now uses Filters map for id parameter - loadInterfaceData() now uses Filters map for id parameter Signed-off-by: rwjack <jack@foss.family> * update backend docs for pfsense --------- Signed-off-by: rwjack <jack@foss.family>
108 lines
3.6 KiB
Plaintext
108 lines
3.6 KiB
Plaintext
# More information about the configuration can be found in the documentation: https://wgportal.org/master/documentation/overview/
|
|
|
|
advanced:
|
|
log_level: trace
|
|
|
|
core:
|
|
admin_user: test@test.de
|
|
admin_password: secret
|
|
create_default_peer: true
|
|
create_default_peer_on_creation: false
|
|
|
|
web:
|
|
external_url: http://localhost:8888
|
|
request_logging: true
|
|
|
|
webhook:
|
|
url: ""
|
|
authentication: ""
|
|
timeout: 10s
|
|
|
|
auth:
|
|
ldap:
|
|
- id: ldap1
|
|
provider_name: company ldap
|
|
url: ldap://ldap.yourcompany.local:389
|
|
bind_user: ldap_wireguard@yourcompany.local
|
|
bind_pass: super_Secret_PASSWORD
|
|
base_dn: DC=YOURCOMPANY,DC=LOCAL
|
|
login_filter: (&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2))
|
|
admin_group: CN=WireGuardAdmins,OU=it,DC=YOURCOMPANY,DC=LOCAL
|
|
sync_interval: 0 # sync disabled
|
|
sync_filter: (&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))
|
|
registration_enabled: true
|
|
oidc:
|
|
- id: oidc1
|
|
provider_name: google
|
|
display_name: Login with</br>Google
|
|
base_url: https://accounts.google.com
|
|
client_id: the-client-id-1234.apps.googleusercontent.com
|
|
client_secret: A_CLIENT_SECRET
|
|
extra_scopes:
|
|
- https://www.googleapis.com/auth/userinfo.email
|
|
- https://www.googleapis.com/auth/userinfo.profile
|
|
registration_enabled: true
|
|
- id: oidc2
|
|
provider_name: google2
|
|
display_name: Login with</br>Google2
|
|
base_url: https://accounts.google.com
|
|
client_id: another-client-id-1234.apps.googleusercontent.com
|
|
client_secret: A_CLIENT_SECRET
|
|
extra_scopes:
|
|
- https://www.googleapis.com/auth/userinfo.email
|
|
- https://www.googleapis.com/auth/userinfo.profile
|
|
registration_enabled: true
|
|
oauth:
|
|
- id: google_plain_oauth
|
|
provider_name: google3
|
|
display_name: Login with</br>Google3
|
|
client_id: another-client-id-1234.apps.googleusercontent.com
|
|
client_secret: A_CLIENT_SECRET
|
|
auth_url: https://accounts.google.com/o/oauth2/v2/auth
|
|
token_url: https://oauth2.googleapis.com/token
|
|
user_info_url: https://openidconnect.googleapis.com/v1/userinfo
|
|
scopes:
|
|
- openid
|
|
- email
|
|
- profile
|
|
field_map:
|
|
email: email
|
|
firstname: name
|
|
user_identifier: sub
|
|
is_admin: this-attribute-must-be-true
|
|
registration_enabled: true
|
|
- id: google_plain_oauth_with_groups
|
|
provider_name: google4
|
|
display_name: Login with</br>Google4
|
|
client_id: another-client-id-1234.apps.googleusercontent.com
|
|
client_secret: A_CLIENT_SECRET
|
|
auth_url: https://accounts.google.com/o/oauth2/v2/auth
|
|
token_url: https://oauth2.googleapis.com/token
|
|
user_info_url: https://openidconnect.googleapis.com/v1/userinfo
|
|
scopes:
|
|
- openid
|
|
- email
|
|
- profile
|
|
- i-want-some-groups
|
|
field_map:
|
|
email: email
|
|
firstname: name
|
|
user_identifier: sub
|
|
user_groups: groups
|
|
admin_mapping:
|
|
admin_value_regex: ^true$
|
|
admin_group_regex: ^admin-group-name$
|
|
registration_enabled: true
|
|
log_user_info: true
|
|
|
|
backend:
|
|
default: local
|
|
pfsense:
|
|
- id: pfsense1
|
|
display_name: "Main pfSense Firewall"
|
|
api_url: "https://pfsense.example.com" # Base URL without /api/v2 (endpoints already include it)
|
|
api_key: "your-api-key" # Generate in pfSense under 'System' -> 'REST API' -> 'Keys'
|
|
api_verify_tls: true
|
|
api_timeout: 30s
|
|
concurrency: 5
|
|
debug: false |