Initial WireGuard admin panel: FastAPI UI, peer key management, live monitoring, Docker deploy

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

app/auth.py

@@ -0,0 +1,40 @@
+import bcrypt
+from fastapi import Depends, HTTPException, Request, status
+from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
+
+from .config import settings
+
+SESSION_COOKIE = "wg_admin_session"
+
+_serializer = URLSafeTimedSerializer(settings.secret_key, salt="wg-admin-session")
+_password_hash = bcrypt.hashpw(settings.admin_password.encode(), bcrypt.gensalt())
+
+
+def verify_credentials(username: str, password: str) -> bool:
+    if username != settings.admin_username:
+        return False
+    return bcrypt.checkpw(password.encode(), _password_hash)
+
+
+def create_session_token() -> str:
+    return _serializer.dumps({"user": settings.admin_username})
+
+
+def validate_session_token(token: str) -> bool:
+    try:
+        _serializer.loads(token, max_age=settings.session_max_age)
+        return True
+    except (BadSignature, SignatureExpired):
+        return False
+
+
+def require_login(request: Request) -> None:
+    token = request.cookies.get(SESSION_COOKIE)
+    if not token or not validate_session_token(token):
+        raise HTTPException(
+            status_code=status.HTTP_303_SEE_OTHER,
+            headers={"Location": "/login"},
+        )
+
+
+logged_in = Depends(require_login)