mirror of
https://github.com/h44z/wg-portal.git
synced 2026-08-13 11:16:19 +00:00
62e7f9d8b9
* fix: build OAuth return URL from the live location, not the Vite base On base_path deployments, OAuth/OIDC login failed with a 400 "invalid return URL" before the user ever reached the IdP. LoginView and the router derived the app's runtime URL mount from import.meta.env.BASE_URL, which is Vite's build-time *asset* base. Since #711 set `base: './'` to fix relative asset loading (#710), BASE_URL is "./", so `base_path: /wg` produced the return URL https://host/wg./#/login. isValidReturnUrl() requires <base_path>/app, so every external-auth user on a base_path deployment was locked out. Derive the return URL from window.location instead: the app is mounted at {base_path}/app/ in production and at / under `npm run dev`, so the live document location is the only reliable source. Likewise drop the explicit base from createWebHashHistory(), which then defaults to `location.pathname + location.search` -- correct in every deployment. This leaves the relative asset base from #711 untouched, so #710 stays fixed, and it removes the last two readers of import.meta.env.BASE_URL under frontend/src so the asset base can no longer affect routing. Fixes #719 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Dan Berg <dan@webinargeek.com> * fix: log rejected OAuth return URLs The isValidReturnUrl() rejection was the only failure branch in handleOauthInitiateGet without a slog call, and the 400 response body reveals neither what was received nor what was expected. That is what made #719 hard to diagnose. Log both at Debug level, matching the neighbouring branches. The response body is unchanged -- the URL is not echoed to the client. Also note on the base-path test that the URL shape it pins is produced by externalLogin() in frontend/src/views/LoginView.vue, so a future frontend change has a breadcrumb back to the contract. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Dan Berg <dan@webinargeek.com> --------- Signed-off-by: Dan Berg <dan@webinargeek.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
WireGuard Portal v2
Introduction
WireGuard Portal is a simple, web-based configuration portal for WireGuard server management. The portal uses the WireGuard wgctrl library to manage existing VPN interfaces. This allows for the seamless activation or deactivation of new users without disturbing existing VPN connections.
The configuration portal supports using a database (SQLite, MySQL, MsSQL, or Postgres), OAuth or LDAP (Active Directory or OpenLDAP) as a user source for authentication and profile data.
Features
- Self-hosted - the whole application is a single binary
- Responsive multi-language web UI with dark-mode written in Vue.js
- Automatically selects IP from the network pool assigned to the client
- QR-Code for convenient mobile client configuration
- Sends email to the client with QR-code and client config
- Enable / Disable clients seamlessly
- Generation of wg-quick configuration file (
wgX.conf) if required - User authentication (database, OAuth, or LDAP), Passkey support
- IPv6 ready
- Docker ready
- Can be used with existing WireGuard setups
- Support for multiple WireGuard interfaces
- Supports multiple WireGuard backends (wgctrl, MikroTik, or pfSense)
- Peer Expiry Feature
- Handles route and DNS settings like wg-quick does
- Exposes Prometheus metrics for monitoring and alerting
- REST API for management and client deployment
- Webhook for custom actions on peer, interface, or user updates
Documentation
For the complete documentation visit wgportal.org.
What is out of scope
- Automatic generation or application of any
iptablesornftablesrules. - Support for operating systems other than linux.
- Automatic import of private keys of an existing WireGuard setup.
Application stack
- wgctrl-go and netlink for interface handling
- Bootstrap, for the HTML templates
- Vue.js, for the frontend
License
- MIT License. MIT or https://opensource.org/licenses/MIT
Contributors and Sponsors
Thanks so much for all your contributions! They’re truly appreciated and help keep WireGuard Portal moving ahead.
Want to support the project? You can buy me a coffee or join as a contributor - every bit of support helps! Become a sponsor!
Important
Since the project was accepted by the Docker-Sponsored Open Source Program, the Docker image location has moved to wgportal/wg-portal. Please update the Docker image from h44z/wg-portal to wgportal/wg-portal.