From c9556bffbf98861a5d16dc3f120c15a583ecc437 Mon Sep 17 00:00:00 2001 From: boban Date: Sat, 20 Jun 2026 22:46:04 +0200 Subject: [PATCH] feat(wg): WireGuard help topic (registration + DE/EN content + test) --- app/Livewire/Help/Index.php | 3 +- lang/de/help.php | 1 + lang/en/help.php | 1 + .../help/content/de/wireguard.blade.php | 36 +++++++++++++++++++ .../help/content/en/wireguard.blade.php | 36 +++++++++++++++++++ tests/Feature/HelpWireguardTopicTest.php | 33 +++++++++++++++++ 6 files changed, 109 insertions(+), 1 deletion(-) create mode 100644 resources/views/livewire/help/content/de/wireguard.blade.php create mode 100644 resources/views/livewire/help/content/en/wireguard.blade.php create mode 100644 tests/Feature/HelpWireguardTopicTest.php diff --git a/app/Livewire/Help/Index.php b/app/Livewire/Help/Index.php index ef6cad0..0eb8a70 100644 --- a/app/Livewire/Help/Index.php +++ b/app/Livewire/Help/Index.php @@ -17,7 +17,7 @@ class Index extends Component /** Help topics in display order. */ private const TOPICS = [ 'overview', 'domain-tls', 'security', 'updates', 'commands', - 'servers', 'sessions', 'email', 'audit', 'recovery', + 'servers', 'sessions', 'email', 'audit', 'wireguard', 'recovery', ]; #[Url] @@ -51,6 +51,7 @@ class Index extends Component 'sessions' => __('help.topic_sessions'), 'email' => __('help.topic_email'), 'audit' => __('help.topic_audit'), + 'wireguard' => __('help.topic_wireguard'), 'recovery' => __('help.topic_recovery'), ]; diff --git a/lang/de/help.php b/lang/de/help.php index e4656a6..e8e22cd 100644 --- a/lang/de/help.php +++ b/lang/de/help.php @@ -15,5 +15,6 @@ return [ 'topic_sessions' => 'Sitzungen & Benutzer', 'topic_email' => 'E-Mail (SMTP)', 'topic_audit' => 'Audit-Log', + 'topic_wireguard' => 'WireGuard-Zugang', 'topic_recovery' => 'Konto-Wiederherstellung', ]; diff --git a/lang/en/help.php b/lang/en/help.php index 78cd4a2..6c53bcb 100644 --- a/lang/en/help.php +++ b/lang/en/help.php @@ -15,5 +15,6 @@ return [ 'topic_sessions' => 'Sessions & users', 'topic_email' => 'Email (SMTP)', 'topic_audit' => 'Audit log', + 'topic_wireguard' => 'WireGuard access', 'topic_recovery' => 'Account recovery', ]; diff --git a/resources/views/livewire/help/content/de/wireguard.blade.php b/resources/views/livewire/help/content/de/wireguard.blade.php new file mode 100644 index 0000000..2af8036 --- /dev/null +++ b/resources/views/livewire/help/content/de/wireguard.blade.php @@ -0,0 +1,36 @@ +@php + $h = 'font-display text-base font-semibold text-ink'; + $p = 'text-sm leading-relaxed text-ink-2'; + $li = 'text-sm leading-relaxed text-ink-2'; + $code = 'rounded bg-inset px-1.5 py-0.5 font-mono text-[12px] text-accent-text'; +@endphp + +
+

Was der WireGuard-Zugang macht

+

Stellt das gesamte Panel hinter einen WireGuard-Tunnel: Der Server wird zum WG-Server, deine Geräte verbinden sich als Peers, und das Panel (HTTP/HTTPS, Ports 80/443) ist nur noch über den Tunnel erreichbar. Eine Netzwerk-Sperre zusätzlich zu 2FA und Anmeldeschutz: Die schützen das Login, dies verbirgt das ganze Panel vor dem öffentlichen Internet.

+

Alles läuft über die Host-CLI clusev wg … (per SSH auf dem Server). Standardmäßig ist nichts aktiv — du entscheidest, wann der Tunnel und die Sperre eingeschaltet werden.

+
+ +
+

Einrichten — clusev wg setup

+

Interaktiv, jeder Wert mit sinnvoller Vorgabe und Erklärung:

+ +

Setup startet den Tunnel (übersteht Neustarts), aktiviert aber nicht die Sperre — das Panel bleibt zunächst öffentlich.

+
+ +
+

Client verbinden & testen

+

Den QR-Code aus setup (oder clusev wg add-peer <name>) in der WireGuard-App scannen. Standard ist Split-Tunnel: nur Panel-Verkehr läuft über WG, dein normales Internet nicht. Voll-Tunnel (0.0.0.0/0) ist möglich, aber nicht empfohlen.

+

Verbinden, dann http://<Server-Tunnel-IP> öffnen — erreicht das Panel? Erst wenn der Tunnel sicher funktioniert, die Sperre aktivieren.

+
+ +
+

Sperre ein/aus — clusev wg up / down

+

clusev wg up sperrt 80/443 auf das WG-Subnetz — von außen ist das Panel danach nicht mehr erreichbar. clusev wg status zeigt Peers, Handshakes und den Sperr-Status.

+

Notausgang: clusev wg down (per SSH) entfernt die Sperre sofort — das Panel ist wieder öffentlich. SSH (Port 22) und der WireGuard-Port sind von der Sperre nie betroffen, du kommst also immer per SSH auf den Server.

+

Schlägt wg0 nach einem Neustart fehl, wird die Sperre nicht angewendet — das Panel bleibt öffentlich erreichbar statt dich auszusperren.

+
diff --git a/resources/views/livewire/help/content/en/wireguard.blade.php b/resources/views/livewire/help/content/en/wireguard.blade.php new file mode 100644 index 0000000..de9089e --- /dev/null +++ b/resources/views/livewire/help/content/en/wireguard.blade.php @@ -0,0 +1,36 @@ +@php + $h = 'font-display text-base font-semibold text-ink'; + $p = 'text-sm leading-relaxed text-ink-2'; + $li = 'text-sm leading-relaxed text-ink-2'; + $code = 'rounded bg-inset px-1.5 py-0.5 font-mono text-[12px] text-accent-text'; +@endphp + +
+

What the WireGuard access does

+

Puts the whole panel behind a WireGuard tunnel: the server becomes a WG server, your devices peer in, and the panel (HTTP/HTTPS, ports 80/443) is reachable only through the tunnel. A network-layer gate on top of 2FA and the login protection: those guard the login; this hides the whole panel from the public internet.

+

Everything runs through the host CLI clusev wg … (over SSH on the server). Nothing is active by default — you decide when the tunnel and the gate go on.

+
+ +
+

Set up — clusev wg setup

+

Interactive, every value pre-filled with a sensible default and a hint:

+ +

Setup starts the tunnel (survives reboots) but does not enable the gate — the panel stays public for now.

+
+ +
+

Connect a client & test

+

Scan the QR code from setup (or clusev wg add-peer <name>) in the WireGuard app. The default is split tunnel: only panel traffic goes through WG, your normal internet does not. Full tunnel (0.0.0.0/0) is possible but not recommended.

+

Connect, then open http://<server-tunnel-ip> — does it reach the panel? Only once the tunnel reliably works, enable the gate.

+
+ +
+

Gate on/off — clusev wg up / down

+

clusev wg up restricts 80/443 to the WG subnet — from outside the panel is then unreachable. clusev wg status shows peers, handshakes and the gate state.

+

Escape hatch: clusev wg down (over SSH) removes the gate immediately — the panel is public again. SSH (port 22) and the WireGuard port are never affected by the gate, so you can always reach the server over SSH.

+

If wg0 fails to come up after a reboot, the gate is not applied — the panel stays publicly reachable rather than locking you out.

+
diff --git a/tests/Feature/HelpWireguardTopicTest.php b/tests/Feature/HelpWireguardTopicTest.php new file mode 100644 index 0000000..34408fd --- /dev/null +++ b/tests/Feature/HelpWireguardTopicTest.php @@ -0,0 +1,33 @@ +actingAs(User::factory()->create(['must_change_password' => false])); + } + + public function test_wireguard_is_a_known_topic_and_renders(): void + { + Livewire::test(Index::class, ['topic' => 'wireguard']) + ->assertSet('topic', 'wireguard') + ->assertSee('WireGuard'); + } + + public function test_wireguard_label_exists_in_both_locales(): void + { + $this->assertSame('WireGuard-Zugang', __('help.topic_wireguard', [], 'de')); + $this->assertSame('WireGuard access', __('help.topic_wireguard', [], 'en')); + } +}