12 | {this.props.children}
13 |
14 | );
15 | }
16 | }
17 |
--------------------------------------------------------------------------------
/pkg/authnz/authutil/random.go:
--------------------------------------------------------------------------------
1 | package authutil
2 |
3 | import (
4 | "crypto/rand"
5 | "encoding/base64"
6 |
7 | "github.com/pkg/errors"
8 | "github.com/sirupsen/logrus"
9 | )
10 |
11 | func RandomString(size int) string {
12 | blk := make([]byte, size)
13 | _, err := rand.Read(blk)
14 | if err != nil {
15 | logrus.Fatal(errors.Wrap(err, "failed to make a random string"))
16 | }
17 | return base64.StdEncoding.EncodeToString(blk)
18 | }
19 |
--------------------------------------------------------------------------------
/scripts/run-postgres.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | set -eou pipefail
3 |
4 | NAME="wg-access-server"
5 |
6 | if [[ ! "$(docker ps -aqf name=$NAME)" ]]; then
7 | docker run \
8 | -e 'POSTGRES_USER=postgres' \
9 | -e 'POSTGRES_PASSWORD=example' \
10 | -e 'POSTGRES_DB=postgres' \
11 | -p 5432:5432 \
12 | -d \
13 | --name "$NAME" \
14 | postgres:11-alpine
15 | else
16 | docker start "$NAME"
17 | fi
18 |
19 | echo "started postgres: $NAME"
20 |
--------------------------------------------------------------------------------
/website/src/AppState.ts:
--------------------------------------------------------------------------------
1 | import { observable } from 'mobx';
2 | import { InfoRes } from './sdk/server_pb';
3 |
4 | class GlobalAppState {
5 | @observable
6 | info?: InfoRes.AsObject;
7 | }
8 |
9 | export const AppState = new GlobalAppState();
10 |
11 | console.info('see global app state by typing "window.AppState"');
12 |
13 | Object.assign(window as any, {
14 | get AppState() {
15 | return JSON.parse(JSON.stringify(AppState));
16 | },
17 | });
18 |
--------------------------------------------------------------------------------
/deploy/helm/wg-access-server/.helmignore:
--------------------------------------------------------------------------------
1 | # Patterns to ignore when building packages.
2 | # This supports shell glob matching, relative path matching, and
3 | # negation (prefixed with !). Only one pattern per line.
4 | .DS_Store
5 | # Common VCS dirs
6 | .git/
7 | .gitignore
8 | .bzr/
9 | .bzrignore
10 | .hg/
11 | .hgignore
12 | .svn/
13 | # Common backup files
14 | *.swp
15 | *.bak
16 | *.tmp
17 | *.orig
18 | *~
19 | # Various IDEs
20 | .project
21 | .idea/
22 | *.tmproj
23 | .vscode/
24 |
--------------------------------------------------------------------------------
/proto/server.proto:
--------------------------------------------------------------------------------
1 | syntax = "proto3";
2 |
3 | package proto;
4 |
5 | import "google/protobuf/wrappers.proto";
6 |
7 | service Server {
8 | rpc Info(InfoReq) returns (InfoRes) {}
9 | }
10 |
11 | message InfoReq {
12 |
13 | }
14 |
15 | message InfoRes {
16 | string public_key = 1;
17 | google.protobuf.StringValue host = 2;
18 | int32 port = 3;
19 | string host_vpn_ip = 4;
20 | bool metadata_enabled = 5;
21 | bool is_admin = 6;
22 | string allowed_ips = 7;
23 | bool dns_enabled = 8;
24 | string dns_address = 9;
25 | }
26 |
--------------------------------------------------------------------------------
/website/src/components/QRCode.tsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import qrcode from 'qrcode';
3 | import { lazy } from '../Util';
4 | import { CircularProgress } from '@material-ui/core';
5 |
6 | interface Props {
7 | content: string;
8 | }
9 |
10 | export class QRCode extends React.Component
23 |
24 |
26 |
29 |
30 | );
31 | }
32 |
--------------------------------------------------------------------------------
/docker-compose.yml:
--------------------------------------------------------------------------------
1 | version: "3.0"
2 | services:
3 | wg-access-server:
4 | # to build the docker image from the source
5 | # build:
6 | # dockerfile: Dockerfile
7 | # context: .
8 | image: place1/wg-access-server
9 | container_name: wg-access-server
10 | cap_add:
11 | - NET_ADMIN
12 | volumes:
13 | - "wg-access-server-data:/data"
14 | # - "./config.yaml:/config.yaml" # if you have a custom config file
15 | environment:
16 | - "WG_ADMIN_USERNAME=admin"
17 | - "WG_ADMIN_PASSWORD=${WG_ADMIN_PASSWORD:?\n\nplease set the WG_ADMIN_PASSWORD environment variable:\n export WG_ADMIN_PASSWORD=example\n}"
18 | - "WG_WIREGUARD_PRIVATE_KEY=${WG_WIREGUARD_PRIVATE_KEY:?\n\nplease set the WG_WIREGUARD_PRIVATE_KEY environment variable:\n export WG_WIREGUARD_PRIVATE_KEY=$(wg genkey)\n}"
19 | ports:
20 | - "8000:8000/tcp"
21 | - "51820:51820/udp"
22 | devices:
23 | - "/dev/net/tun:/dev/net/tun"
24 |
25 | # shared volumes with the host
26 | volumes:
27 | wg-access-server-data:
28 | driver: local
29 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2019 James Batt
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/website/src/Platform.ts:
--------------------------------------------------------------------------------
1 | export enum Platform {
2 | Unknown,
3 | Mac,
4 | Ios,
5 | Windows,
6 | Android,
7 | Linux,
8 | }
9 |
10 | // adapted from
11 | // https://stackoverflow.com/questions/38241480/detect-macos-ios-windows-android-and-linux-os-with-js
12 | export function getPlatform() {
13 | const userAgent = window.navigator.userAgent;
14 | const platform = window.navigator.platform;
15 | const macosPlatforms = ['Macintosh', 'MacIntel', 'MacPPC', 'Mac68K'];
16 | const windowsPlatforms = ['Win32', 'Win64', 'Windows', 'WinCE'];
17 | const iosPlatforms = ['iPhone', 'iPad', 'iPod'];
18 | if (macosPlatforms.indexOf(platform) !== -1) {
19 | return Platform.Mac;
20 | } else if (iosPlatforms.indexOf(platform) !== -1) {
21 | return Platform.Ios;
22 | } else if (windowsPlatforms.indexOf(platform) !== -1) {
23 | return Platform.Windows;
24 | } else if (/Android/.test(userAgent)) {
25 | return Platform.Android;
26 | } else if (/Linux/.test(platform)) {
27 | return Platform.Linux;
28 | }
29 | return Platform.Unknown;
30 | }
31 |
32 | export function isMobile() {
33 | return [Platform.Ios, Platform.Android].includes(getPlatform());
34 | }
35 |
--------------------------------------------------------------------------------
/website/src/components/Info.tsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import { observable } from 'mobx';
3 | import { observer } from 'mobx-react';
4 | import Popover from '@material-ui/core/Popover';
5 | import IconButton from '@material-ui/core/IconButton';
6 | import InfoIcon from '@material-ui/icons/Info';
7 |
8 | interface Props {
9 | children: React.ReactNode;
10 | }
11 |
12 | @observer
13 | export class Info extends React.Component{this.props.children}
37 | {this.props.children}
35 | loading...
; 21 | } 22 | return ( 23 |loading...
; 24 | } 25 | return ( 26 |Sign In
120 | 121 | {{range $i, $p := .Providers}} 122 | 123 | 124 | 125 | {{end}} 126 | 127 | 135 | 136 || Endpoint | 63 |{device.endpoint} | 64 |
| Download | 67 |{numeral(device.transmitBytes).format('0b')} | 68 |
| Upload | 71 |{numeral(device.receiveBytes).format('0b')} | 72 |
| Disconnected | 78 ||
| Last Seen | 82 |{lastSeen(device.lastHandshakeTime)} | 83 |
| Public key | 86 |
87 | |
89 |
loading...
; 37 | } 38 | 39 | const rows = this.devices.current; 40 | 41 | // show the provider column 42 | // when there is more than 1 provider in use 43 | // i.e. not all devices are from the same auth provider. 44 | const showProviderCol = rows.length >= 2 && rows.some((r) => r.ownerProvider !== rows[0].ownerProvider); 45 | 46 | return ( 47 |
48 |
49 | Devices
50 |
51 |
52 |
53 |
82 |
83 |
84 | Server Info
85 |
86 |
93 | );
94 | }
95 | }
96 |
--------------------------------------------------------------------------------
/pkg/authnz/router.go:
--------------------------------------------------------------------------------
1 | package authnz
2 |
3 | import (
4 | "fmt"
5 | "net/http"
6 | "strconv"
7 |
8 | "github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
9 | "github.com/pkg/errors"
10 |
11 | "github.com/place1/wg-access-server/pkg/authnz/authconfig"
12 | "github.com/place1/wg-access-server/pkg/authnz/authruntime"
13 | "github.com/place1/wg-access-server/pkg/authnz/authsession"
14 | "github.com/place1/wg-access-server/pkg/authnz/authtemplates"
15 | "github.com/place1/wg-access-server/pkg/authnz/authutil"
16 |
17 | "github.com/gorilla/mux"
18 | "github.com/gorilla/sessions"
19 | )
20 |
21 | type AuthMiddleware struct {
22 | config authconfig.AuthConfig
23 | claimsMiddleware authsession.ClaimsMiddleware
24 | router *mux.Router
25 | runtime *authruntime.ProviderRuntime
26 | }
27 |
28 | func New(config authconfig.AuthConfig, claimsMiddleware authsession.ClaimsMiddleware) *AuthMiddleware {
29 | router := mux.NewRouter()
30 | store := sessions.NewCookieStore([]byte(authutil.RandomString(32)))
31 | runtime := authruntime.NewProviderRuntime(store)
32 | providers := config.Providers()
33 |
34 | for _, p := range providers {
35 | if p.RegisterRoutes != nil {
36 | p.RegisterRoutes(router, runtime)
37 | }
38 | }
39 |
40 | router.HandleFunc("/signin", func(w http.ResponseWriter, r *http.Request) {
41 | w.WriteHeader(http.StatusOK)
42 | fmt.Fprint(w, authtemplates.RenderLoginPage(w, authtemplates.LoginPage{
43 | Providers: providers,
44 | }))
45 | })
46 |
47 | router.HandleFunc("/signin/{index}", func(w http.ResponseWriter, r *http.Request) {
48 | index, err := strconv.Atoi(mux.Vars(r)["index"])
49 | if err != nil || index < 0 || len(providers) <= index {
50 | w.WriteHeader(http.StatusBadRequest)
51 | fmt.Fprintf(w, "unknown provider")
52 | return
53 | }
54 | provider := providers[index]
55 | provider.Invoke(w, r, runtime)
56 | })
57 |
58 | router.HandleFunc("/signout", func(w http.ResponseWriter, r *http.Request) {
59 | runtime.ClearSession(w, r)
60 | runtime.Restart(w, r)
61 | })
62 |
63 | return &AuthMiddleware{
64 | config,
65 | claimsMiddleware,
66 | router,
67 | runtime,
68 | }
69 | }
70 |
71 | func NewMiddleware(config authconfig.AuthConfig, claimsMiddleware authsession.ClaimsMiddleware) mux.MiddlewareFunc {
72 | return New(config, claimsMiddleware).Middleware
73 | }
74 |
75 | func (m *AuthMiddleware) Middleware(next http.Handler) http.Handler {
76 | return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
77 | // check if the request is for an auth
78 | // related page i.e. /signin
79 | // to be handled by our own router
80 | if ok := m.router.Match(r, &mux.RouteMatch{}); ok {
81 | m.router.ServeHTTP(w, r)
82 | return
83 | }
84 |
85 | // otherwise we apply the standard middleware
86 | // functionality i.e. annotate the request context
87 | // with the request user (identity)
88 | if s, err := m.runtime.GetSession(r); err == nil {
89 | if m.claimsMiddleware != nil {
90 | if err := m.claimsMiddleware(s.Identity); err != nil {
91 | ctxlogrus.Extract(r.Context()).Error(errors.Wrap(err, "authz middleware failure"))
92 | http.Error(w, "internal server error", http.StatusInternalServerError)
93 | return
94 | }
95 | }
96 | next.ServeHTTP(w, r.WithContext(authsession.SetIdentityCtx(r.Context(), s)))
97 | } else {
98 | next.ServeHTTP(w, r)
99 | }
100 | })
101 | }
102 |
103 | func RequireAuthentication(next http.Handler) http.Handler {
104 | return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
105 | if authsession.Authenticated(r.Context()) {
106 | next.ServeHTTP(w, r)
107 | } else {
108 | http.Redirect(w, r, "/signin", http.StatusTemporaryRedirect)
109 | }
110 | })
111 | }
112 |
--------------------------------------------------------------------------------
/docs/4-auth.md:
--------------------------------------------------------------------------------
1 | # Authentication
2 |
3 | Authentication is pluggable in wg-access-server. Community contributions are welcome
4 | for supporting new authentication backends.
5 |
6 | If you're just getting started you can skip over this section and rely on the default
7 | admin account instead.
8 |
9 | If your authentication system is not yet supported and you aren't quite ready to
10 | contribute you could try using a project like [dex](https://github.com/dexidp/dex)
11 | or SaaS provider like [Auth0](https://auth0.com/) which supports a wider variety of
12 | authentication protocols. wg-access-server can happily be an OpenID Connect client
13 | to a larger solution like this.
14 |
15 | The following authentication backends are currently supported:
16 |
17 | | Backend | Use Case | Notes |
18 | | -------------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
19 | | Basic Auth | Deployments with a static list of users. Simple and great for self-hosters and home use-cases | The wg-access-server admin account is powered by this backend |
20 | | OpenID Connect | For delegating authentication to an existing identity solution | |
21 | | Gitlab | For delegating authentication to gitlab. Supports self-hosted Gitlab. | |
22 |
23 | ## Configuration
24 |
25 | Currently authentication providers are only configurable via the wg-access-server
26 | config file (config.yaml).
27 |
28 | Below is an annotated example config section that can be used as a starting point.
29 |
30 | ```yaml
31 | # Configure zero or more authentication backends
32 | auth:
33 | # HTTP Basic Authentication
34 | basic:
35 | # Users is a list of htpasswd encoded username:password pairs
36 | # supports BCrypt, Sha, Ssha, Md5
37 | # You can create a user using "htpasswd -nB
87 |
88 | {JSON.stringify(AppState.info, null, 2)}
89 |
90 |
91 |
92 | -
63 |
-
96 |