VPN Manager¶

Overview¶

The VPN Manager plugin (plugin ID: wireguard-vpn) provides:

WireGuard VPN managed via Headscale (self-hosted Tailscale-compatible coordinator)
IPSec site-to-site tunnels
Pre-auth keys for device onboarding

Requires the wireguard-vpn plugin to be enabled. All endpoints require superuser.

Headscale (WireGuard VPN)¶

Status & Install¶

GET /api/wireguard-vpn/status
POST /api/wireguard-vpn/install

Users¶

GET /api/wireguard-vpn/users
POST /api/wireguard-vpn/users
{ "name": "alice" }

DELETE /api/wireguard-vpn/users/:name

Nodes (Connected Devices)¶

GET /api/wireguard-vpn/nodes

DELETE /api/wireguard-vpn/nodes/:id

PUT /api/wireguard-vpn/nodes/:id/ip
{ "ip": "100.64.0.5" }

POST /api/wireguard-vpn/nodes/:id/expire

Pre-Auth Keys¶

GET /api/wireguard-vpn/preauthkeys

POST /api/wireguard-vpn/preauthkeys
{
  "user": "alice",
  "reusable": false,
  "expiry": "2024-12-31T23:59:59Z"
}

POST /api/wireguard-vpn/preauthkeys/expire
{ "key": "..." }

Settings¶

GET /api/wireguard-vpn/settings
POST /api/wireguard-vpn/settings
{
  "server_url": "https://headscale.example.com",
  "dns_nameservers": ["1.1.1.1"]
}

POST /api/wireguard-vpn/settings/subnet
{ "subnet": "100.64.0.0/10" }

Advertise Routes¶

POST /api/wireguard-vpn/advertise-routes
{
  "node_id": 1,
  "routes": ["10.0.0.0/24"]
}

Routes¶

GET /api/wireguard-vpn/routes

POST /api/wireguard-vpn/routes/:id/enable
POST /api/wireguard-vpn/routes/:id/disable

ACL¶

Headscale ACL policy:

GET /api/wireguard-vpn/acl
POST /api/wireguard-vpn/acl
{
  "acls": [
    { "action": "accept", "src": ["*"], "dst": ["*:*"] }
  ]
}

API Keys¶

GET /api/wireguard-vpn/apikeys
POST /api/wireguard-vpn/apikeys
{ "expiry": "2025-01-01T00:00:00Z" }

Service Control¶

POST /api/wireguard-vpn/service/start
POST /api/wireguard-vpn/service/stop
POST /api/wireguard-vpn/service/restart

IPSec Site-to-Site¶

IPSec tunnels are managed under the WireGuard VPN plugin.

Status & Install¶

GET /api/wireguard-vpn/ipsec/status
POST /api/wireguard-vpn/ipsec/install

Tunnel Management¶

# List tunnels
GET /api/wireguard-vpn/ipsec/

# Create tunnel
POST /api/wireguard-vpn/ipsec/
{
  "name": "DC-to-Cloud",
  "local_ip": "1.2.3.4",
  "remote_ip": "5.6.7.8",
  "local_subnet": "10.0.0.0/24",
  "remote_subnet": "10.1.0.0/24",
  "psk": "shared-secret",
  "ike_version": 2
}

# Update tunnel
PUT /api/wireguard-vpn/ipsec/:id

# Delete tunnel
DELETE /api/wireguard-vpn/ipsec/:id

# Toggle enabled/disabled
POST /api/wireguard-vpn/ipsec/:id/toggle

# Restart tunnel
POST /api/wireguard-vpn/ipsec/:id/restart

Utilities¶

# Generate a random PSK
GET /api/wireguard-vpn/ipsec/generate-secret

# Get local public IP
GET /api/wireguard-vpn/ipsec/local-ip