Jacopo ClarkandGitHub
64195a25c1
disable_missing tested absence against the raw sync result without checking that the search returned anything usable, so a search that succeeds and yields nothing looked like "every user has been removed". Connection and search errors were already safe, since synchronizeLdapUsers returns before the disable phase. The gap is the successful-but-empty case: a base_dn or sync_filter that stops matching, an unpopulated replica, a field_map user_identifier naming an attribute the server does not return, or a bind account that lost read access to the user subtree. LDAP gives nothing to tell those apart from a directory that is genuinely empty; they all answer success with zero entries. Acting on it is not a database flag. TopicUserDisabled removes each user's peers from the WireGuard device, the successful search means no error is logged, and every message on the path was Debug while log_level defaults to info, so the whole event was silent. It also repeats every sync interval. Refuse to disable anyone when no usable identifier came back, logging the provider, entry count and identifier field. The guard counts identifiers, not entries, so it covers the field_map case too. The per-user disable line moves from Debug to Warn so a mass disable is audible even where the guard does not fire. The cost is that a directory intentionally emptied of users now disables nobody. That is documented, along with the workaround: leave one account matching sync_filter and everyone else is disabled as before. Signed-off-by: clark-ja <37738506+clark-ja@users.noreply.github.com>
WireGuard Portal v2
Introduction
WireGuard Portal is a simple, web-based configuration portal for WireGuard server management. The portal uses the WireGuard wgctrl library to manage existing VPN interfaces. This allows for the seamless activation or deactivation of new users without disturbing existing VPN connections.
The configuration portal supports using a database (SQLite, MySQL, MsSQL, or Postgres), OAuth or LDAP (Active Directory or OpenLDAP) as a user source for authentication and profile data.
Features
- Self-hosted - the whole application is a single binary
- Responsive multi-language web UI with dark-mode written in Vue.js
- Automatically selects IP from the network pool assigned to the client
- QR-Code for convenient mobile client configuration
- Sends email to the client with QR-code and client config
- Enable / Disable clients seamlessly
- Generation of wg-quick configuration file (
wgX.conf) if required - User authentication (database, OAuth, or LDAP), Passkey support
- IPv6 ready
- Docker ready
- Can be used with existing WireGuard setups
- Support for multiple WireGuard interfaces
- Supports multiple WireGuard backends (wgctrl, MikroTik, or pfSense)
- Peer Expiry Feature
- Handles route and DNS settings like wg-quick does
- Exposes Prometheus metrics for monitoring and alerting
- REST API for management and client deployment
- Webhook for custom actions on peer, interface, or user updates
Documentation
For the complete documentation visit wgportal.org.
What is out of scope
- Automatic generation or application of any
iptablesornftablesrules. - Support for operating systems other than linux.
- Automatic import of private keys of an existing WireGuard setup.
Application stack
- wgctrl-go and netlink for interface handling
- Bootstrap, for the HTML templates
- Vue.js, for the frontend
License
- MIT License. MIT or https://opensource.org/licenses/MIT
Contributors and Sponsors
Thanks so much for all your contributions! They’re truly appreciated and help keep WireGuard Portal moving ahead.
Want to support the project? You can buy me a coffee or join as a contributor - every bit of support helps! Become a sponsor!
Important
Since the project was accepted by the Docker-Sponsored Open Source Program, the Docker image location has moved to wgportal/wg-portal. Please update the Docker image from h44z/wg-portal to wgportal/wg-portal.