Skip to content

Modernize and secure the VPN gateway with WAN-aware control, containers, and docs#1

Open
ApiCentraal wants to merge 38 commits into
Bram-diederik:mainfrom
ApiCentraal:main
Open

Modernize and secure the VPN gateway with WAN-aware control, containers, and docs#1
ApiCentraal wants to merge 38 commits into
Bram-diederik:mainfrom
ApiCentraal:main

Conversation

@ApiCentraal

Copy link
Copy Markdown

This change set modernizes the project while keeping the original two-machine VPN design intact.

  • Harden authentication and sessions with a shared auth layer, CSRF protection, and safer login/logout handling.
  • Centralize VPN shell execution in VpnService and expose JSON endpoints for action, status, logs, and health.
  • Rebuild the dashboard into reusable components with WAN awareness, LAN-only fallback, live polling, and clearer status warnings.
  • Add Dockerfiles, entrypoints, and a containerization plan for the VPN gateway and inbound OpenVPN server.
  • Expand documentation with security guidance, changelog details, screenshots, and smoke testing notes.

Eddy-ApiCentraal added 30 commits April 24, 2026 16:44
Create and validate per-session CSRF tokens for all state-changing requests.
Centralize login checks, lockout handling, and session lifecycle helpers.
Wrap every VPN command behind one service with argument validation and exit-code enforcement.
Configure the hardened session cookie and load the shared service classes once per request.
Replace the old hardcoded login flow with the new Auth layer and current username lookup.
Use the shared bootstrap and Auth::isLoggedIn to choose between dashboard and login views.
Add POST-only access, CSRF validation, and lockout-aware login responses.
Require a valid token before clearing the session and redirecting to the login page.
Swap direct shell execution for VpnService status reads and graceful error handling.
Return dashboard data through VpnService and keep failures isolated from the UI.
Replace raw tail shell calls with Auth protection and the shared log tail helper.
Expose a CSRF-protected POST endpoint for applying the selected VPN profile.
Return the current VPN service snapshot as JSON for polling clients.
Expose the log tail as JSON with a configurable line limit.
Provide a monitoring check for the VPN binary, logs, and PHP runtime.
Render the branded header, signed-in identity chip, and CSRF-protected logout form.
Show the service state, routing mode, current profile, and IP forwarding state.
Render the selectable VPN profiles and the apply, stop, and route-local actions.
Provide the live log viewer and refresh controls used by the dashboard.
Drive status polling, log polling, and AJAX form submission from the browser.
Apply the new dark visual system and component styling for the full interface.
Compose the component-based dashboard and inject the initial API state for the client script.
Add the new login presentation and wire in the CSRF-aware form flow.
Document credential handling, sudoers requirements, TLS expectations, and hardening defaults.
Provide a repeatable end-to-end shell test for login, health, status, and logs.
Signed-off-by: Eddy-ApiCentraal <help@apicentraal.nl>
Surface WAN uplink state, public IP visibility, and LAN-only fallback behavior in the dashboard.

Also update the VPN service parsing and command helper so the status view can distinguish VPN, WAN-down, and LAN-only situations cleanly.
Add the latest login and dashboard screenshots to the README so the current design is visible directly in the repository.

Keep the documentation focused on the current interface while leaving the implementation changes in the previous technical commit.
Add containerization assets for the PHP VPN gateway and the inbound OpenVPN server.

Include the containerization plan, Docker ignore rules, and lightweight entrypoints so the services can be built and deployed independently.
Signed-off-by: Eddy-ApiCentraal <help@apicentraal.nl>
Copilot AI review requested due to automatic review settings April 24, 2026 16:55

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@Bram-diederik

Copy link
Copy Markdown
Owner

Oh my this is fantastic.
I need to test it out.

and you prolly know that will take some time. while keeping my original system in tact.

But thanks for committing. Only we make opensource software great.

@ApiCentraal

Copy link
Copy Markdown
Author

Hey Bram,

Thanks. And absolutety. Take your time and please keep me updated when you find any issues.

Have a nice one!

@Bram-diederik

Bram-diederik commented Apr 25, 2026 via email

Copy link
Copy Markdown
Owner

Eddy-ApiCentraal added 4 commits April 26, 2026 02:01
Add a local Docker Compose stack, setup and verification scripts, and secret-safe ignore rules.\n\nUpdate README with developer/operator instructions and sanitize credential guidance.
…urity improvements

Signed-off-by: Eddy-ApiCentraal <help@apicentraal.nl>
@ApiCentraal

Copy link
Copy Markdown
Author

Yes, I got it working on one system with Docker containers.

I added a local single-host setup where both roles run as containers on the same machine:

OpenVPN server container:
VPN gateway + web UI container

What is included:

  • docker-compose.local.yml
  • setup-local-vpn.sh
  • verify-local-vpn.sh

How it works:

  • Both containers run on one Docker network.
  • Both get NET_ADMIN and /dev/net/tun.
  • Local runtime config and keys are generated under .runtime.
  • The gateway starts profile localtest.
  • Verification confirms ActiveState=active and tun0 presence.

Security/runtime notes:

Local secrets/runtime files are ignored from git via .gitignore and .dockerignore.
This one-host Docker mode is meant for reproducible local/dev validation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants