wireguard-admin/docs/FEATURES.md

WireGuard Admin Panel - Feature Specification

Stack: FastAPI + Jinja2 (server-rendered) + SQLite + minimal JS, deployed in Docker with NET_ADMIN.

1. Auto Configuration

• On first start, auto-generate the server keypair if none exists.
• Auto-create and bring up the WireGuard interface (wg0) from settings (subnet, port, DNS).
• Auto-assign the next free IP from the subnet when a peer is created.
• Apply peer changes live with wg syncconf (no tunnel drops).
• NAT/forwarding rules (iptables) set up automatically inside the container.
• All settings configurable via environment variables / .env.

2. Client Key Management

• Generate keypair (private/public) and preshared key per peer on creation.
• Regenerate (rotate) a peer's keys on demand; old key is revoked immediately.
• Peer private keys stored encrypted at rest in SQLite.
• Export client config as downloadable .conf file.
• Export client config as QR code (for mobile apps), rendered inline.
• Enable / disable a peer without deleting it.
• Delete (revoke) a peer, removed from the live interface immediately.
• Optional peer expiry date, expired peers are auto-disabled.

3. Monitoring

• Dashboard: interface state, listen port, public key, peer count, total RX/TX.
• Per-peer live status: last handshake, online/offline (handshake < 3 min), endpoint, RX/TX bytes.
• Auto-refreshing status via a JSON endpoint polled by the page (no full reload).
• Traffic history sampled periodically and stored, shown as simple usage charts.

4. Authentication

• Single admin account (username/password from env, bcrypt hashed).
• Session cookie login (signed, HTTP-only), logout, session expiry.
• All pages and API endpoints require login.

5. Web UI Pages

Page	Purpose
/login	Admin login
/	Dashboard (interface status, totals, recent peers)
/peers	Peer list with online status, add/enable/disable/delete
/peers/{id}	Peer detail: config download, QR code, key rotation, stats
/settings	Server settings view (interface, port, subnet, DNS)

6. JSON API (used by UI, reusable for automation)

Method	Path	Purpose
GET	/api/status	Interface + all peers live stats
POST	/api/peers	Create peer
POST	/api/peers/{id}/toggle	Enable/disable peer
POST	/api/peers/{id}/rotate	Rotate peer keys
DELETE	/api/peers/{id}	Delete peer
GET	/api/peers/{id}/config	Download .conf
GET	/api/peers/{id}/qr	QR code PNG

7. Deployment

• Dockerfile (python slim + wireguard-tools + iptables).
• docker-compose.yml with cap_add: NET_ADMIN, sysctl ip_forward, UDP 51820, panel on 8000.
• Persistent volume for SQLite DB and generated configs.