U
    sig(                     @   s   d dl mZmZmZmZmZmZmZmZ d dl	Z	d dl
Z
d dlZd dlmZ d dlZd dlZd dlZd dlmZ eeZdZdZdZdZd	Zd
ZdZdZdZdZdd Zdd Zdd Z dZ!dZ"dZ#e$ddd Z%e$de dd Z&e$de dd  Z'ej$d!d"gd#e d$d% Z(e$d&e d'd( Z)ej$d)d*d"gd#e d+d, Z*e$d-e d.d/ Z+e$d0d1d2 Z,e$d3d4d5 Z-e$d6e d7d8 Z.ej$d9d*d"gd#d:d; Z/d<d= Z0d>d? Z1d@dA Z2dBdC Z3dDdE Z4edFkrej5dGdHdI dS )J    )Flaskrequestrender_template_string	send_fileabortredirecturl_forResponseN)datetimewrapsz/opt/wgconfig/tokens.jsonz/opt/wgconfig/subnets.jsonz/opt/wgconfig/used_tokens.logz/opt/wgconfig/wg0-peers.confz/var/log/wg_keys_issued.logz/opt/wgconfig/backupsz,bsped9nemtP9fRfcVLoLL3JWTj7zHFYWJebAhgH7RFw=z24.249.187.133:51820ZadminZchangemec                 C   s   | t ko|tkS N)ADMIN_USERNAMEADMIN_PASSWORD)usernamepassword r   &/var/www/wgsetup/wg_flask_token_app.py
check_auth   s    r   c                   C   s   t ddddiS )NzLogin Requiredi  zWWW-AuthenticatezBasic realm="Login Required")r	   r   r   r   r   authenticate   s    r   c                    s   t   fdd}|S )Nc                     s(   t j}|rt|j|jst S  | |S r   )r   Zauthorizationr   r   r   r   )argskwargsZauthfr   r   	decorated!   s    z requires_auth.<locals>.decoratedr   )r   r   r   r   r   requires_auth    s    r   aU  
<!doctype html>
<title>WireGuard Config Generator</title>
<h2>WireGuard Config Generator</h2>
<p>Welcome, your token is valid. Click below to generate your secure config.</p>
<form method="post">
    <button type="submit">Generate My WireGuard Config</button>
</form>
<p><a href="/instructions" target="_blank">How to use this page</a></p>
un  
<!doctype html>
<title>WireGuard Setup Portal</title>
<h2>📜 Welcome to the WireGuard Setup Portal</h2>
<ol>
<li>Copy "<code>https://wgsetup.glorytoyah.org/setup?token=YourToken</code>" into the browser window.  Replace "YourToken" with your one-time token.  Ensure your one-time token is included on the line before going to step 2.</li>
<li>Click "Generate Config" to download your WireGuard config.  *Note where you are saving your config file.</li>
<li>Import it into the WireGuard app (mobile or desktop)</li>
<li>DO NOT LOAD THE SAME CONFIGURATION FILE ON MORE THAN ONE DEVICE.  For multiple devices ... Repeat steps 1 -3 for each device.</li>
</ol>
<p>
<a href="/setup?token=example-token"><button>🔐 Generate Config</button></a>
<a href="/admin/guide"><button>📘 Admin Guide</button></a>
<a href="/admin/tokens"><button>🎛️ Token Dashboard</button></a>
</p>

u  
<!doctype html>
<title>Admin Guide</title>
<h2>Admin Guide</h2>
<ul>
  <li>📦 <strong>Token Creation</strong>: Use /generate-and-redirect/&lt;GroupName&gt; to generate a token.</li>
  <li>🔐 <strong>Access Token Panel</strong>: Visit /admin/tokens to manage tokens.</li>
  <li>🗃 <strong>Used Tokens</strong>: View /admin/used for audit logs of used/revoked tokens.</li>
  <li>🧰 <strong>Subnet Setup</strong>: Add or modify group subnets via /admin/subnets.</li>
  <li>💾 <strong>Backup</strong>: Download backups from /admin/backup.</li>
  <li>♻️ <strong>Restore</strong>: Unzip a backup and move files into /opt/wgconfig.</li>
</ul>
<h3>Common Issues:</h3>
<ul>
  <li>🚫 <strong>Permission denied?</strong> Ensure correct file permissions (e.g., chown www-data).</li>
  <li>❌ <strong>WireGuard fails to reload?</strong> Check for duplicate IPs or malformed entries.</li>
</ul>
<h3>FAQs:</h3>
<ul>
  <li><strong>Can a token be reused?</strong> No. Tokens are removed after use.</li>
  <li><strong>Can I edit peer configs manually?</strong> Yes, but ensure unique IPs and public keys.</li>
</ul>
<p><a href="/"><button>🏠 Back to Home</button></a></p>
z/generate-and-redirect/<group>c                    s   t  }t }|krdS |   fdd| D }dt| }  d| d}t|rv|d7 }  d| d}qTtt }|d||< t| t	t
d	|d
S )N)zInvalid group namei  c                    s4   g | ],}| d kr| dd r|d qS )groupip )get
startswith).0databaser   r   r   
<listcomp>f   s       z)generate_and_redirect.<locals>.<listcomp>   .z/24   )r   r   setup)token)load_tokensload_subnetsvalueslen	ip_in_usestruuidZuuid4save_tokensr   r   )r   tokenssubnetsusedZ	next_hostZnew_ipr*   r   r#   r   generate_and_redirect_   s    r6   z/admin/tokensc                  C   sZ   t  } d}|  D ]2\}}|d| d|d  d|d  d| d	7 }q|d7 }|d	7 }|S )
Nzg<h2>Active Tokens</h2><table border='1'><tr><th>Token</th><th>IP</th><th>Group</th><th>Revoke</th></tr><tr><td>	</td><td>r   r   z </td><td><a href='/admin/revoke/z'>Revoke</a></td></tr>zh</table><form method='post' action='/admin/tokens/purge'><button type='submit'>Purge All</button></form>z<p><a href='/admin/used'>View Used</a> | <a href='/admin/subnets'>Subnets</a> | <a href='/admin/backup'>Backup</a> | <a href='/admin/guide'>Admin Guide</a></p><a href='/'><button> Back to Home</button></a></p>)r+   items)r3   htmltvr   r   r   admin_tokensq   s    ,r=   z/admin/revoke/<token>c              	   C   s^   t  }| |krRttd"}|d|  d||   d W 5 Q R X ||  t| ttdS )Naz
[REVOKED]  - 
r=   )r+   openUSED_LOG_PATHwritepopr2   r   r   )r*   r3   logr   r   r   revoke_token|   s    &
rF   z/admin/tokens/purgePOST)methodsc                   C   s   t tdd ttdS )Nwz{}r=   )rA   TOKEN_DB_PATHrC   r   r   r   r   r   r   purge_tokens   s    rK   z/admin/usedc               
   C   s@   t jtsdS tt} d|   dW  5 Q R  S Q R X d S )Nu}   <p>No used tokens logged.</p><p><a href='/admin/tokens'>Back</a></p><p><a href='/'><button>🏠 Back to Home</button></a></p>z!<h2>Used/Revoked Tokens</h2><pre>uf   </pre><p><a href='/admin/tokens'>Back</a></p><p><a href='/'><button>🏠 Back to Home</button></a></p>)ospathexistsrB   rA   readr   r   r   r   	view_used   s    
rP   z/admin/subnetsZGETc                  C   s   t  } tjdkr@tjd}tjd}|r@|r@|| |< t|  d}|  D ]\}}|d| d| d7 }qL|d7 }|d	7 }|S )
NrG   namer$   zH<h2>Subnets</h2><table border='1'><tr><th>Group</th><th>Subnet</th></tr>r7   r8   z
</td></tr>zl</table><form method='post'>Group: <input name='name'> Base: <input name='base'> <button>Add</button></form>uj   <p><a href='/admin/tokens'>Back to Tokens</a></p><p><a href='/'><button>🏠 Back to Home</button></a></p>)r,   r   methodZformr   save_subnetsr9   )r4   rQ   r$   r:   kr<   r   r   r   manage_subnets   s    
rU   z/admin/backupc                  C   sT   t jtdd t d} t jtd|  d}t	|
dddd t|dd	S )
NT)exist_okz%Y%m%d_%H%M%SZbackup_z.zipr   zipz/opt/wgconfigZas_attachment)rL   makedirs
BACKUP_DIRr
   nowstrftimerM   joinshutilZmake_archivereplacer   )Z	timestampZzip_pathr   r   r   
backup_all   s
    r`   /c                   C   s   t tS r   r   HTML_INSTRUCTIONSr   r   r   r   homepage   s    rd   z/instructionsc                   C   s   t tS r   rb   r   r   r   r   instructions   s    re   z/admin/guidec                   C   s   t tS r   )r   HTML_ADMIN_GUIDEr   r   r   r   admin_guide   s    rg   z/setupc                  C   s:  t jd} t }| |kr&tdddS ||  d }t jdkr2z8tddg 	 }tjdd	g|
 d
 	 }W n4 tk
r } zd| df W Y S d }~X Y nX d| d| dt dt d	}t }tj|d|  d}t|d}	|	| W 5 Q R X ttd.}
|
dt  d|  d| d| d	 W 5 Q R X d| d|dd  d}ttd}|| W 5 Q R X z tjd dd!d"tgd#tjd$ W n> tjk
r } ztjd%|j    W 5 d }~X Y nX tt!d"}|d&|  d'||   d( W 5 Q R X |"|  t#| t$|d#d)S t%t&S )*Nr*   i  zInvalid or missing token.)descriptionr   rG   ZwgZgenkeyZpubkey)inputzKey generation failed: i  z
[Interface]
PrivateKey = z
Address = z

[Peer]
PublicKey = z
Endpoint = z1
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
Zclient_z.confrI   r>   [z] z -> z (z)
z
[Peer]
PublicKey = z
AllowedIPs = ra   r   z/32
ZsudoZaddconfZwg0T)Zcheckstderrz(Failed to update live WireGuard config: z[USED] r?   r@   rX   )'r   r   r   r+   r   rR   
subprocessZcheck_outputdecodestripencode	ExceptionSERVER_PUBLIC_KEYSERVER_ENDPOINTtempfileZmkdtemprL   rM   r]   rA   rC   KEY_LOG_PATHr
   r[   splitPEERS_CONF_PATHrunPIPEZCalledProcessErrorappZloggererrorrk   rB   rD   r2   r   r   	HTML_FORM)r*   r3   Zassigned_ipZprivate_keyZ
public_keyeZconfigZtemp_dirZconfig_pathr   rE   Z
peer_entryZpeerconfr5   r   r   r   r)      sN    "$2 *&
r)   c               
   C   s6   t jtr2tt} t| W  5 Q R  S Q R X i S r   )rL   rM   rN   rJ   rA   jsonloadr   r   r   r   r+      s    
r+   c              	   C   s*   t td}tj| |dd W 5 Q R X d S NrI   r&   )Zindent)rA   rJ   r}   dump)r3   r   r   r   r   r2      s    r2   c               
   C   s6   t jtr2tt} t| W  5 Q R  S Q R X i S r   )rL   rM   rN   SUBNET_DB_PATHrA   r}   r~   r   r   r   r   r,      s    
r,   c              	   C   s*   t td}tj| |dd W 5 Q R X d S r   )rA   r   r}   r   )r4   r   r   r   r   rS      s    rS   c              
   C   sF   t jtsdS tt$}| dd | kW  5 Q R  S Q R X d S )NFra   r   )rL   rM   rN   rv   rA   ru   rO   )r   r   r   r   r   r/      s    
r/   __main__z0.0.0.0i  )ZhostZport)6Zflaskr   r   r   r   r   r   r   r	   rL   rl   rs   r
   r^   r}   r1   	functoolsr   __name__ry   rJ   r   rB   rv   rt   rZ   rq   rr   r   r   r   r   r   r{   rc   rf   Zrouter6   r=   rF   rK   rP   rU   r`   rd   re   rg   r)   r+   r2   r,   rS   r/   rw   r   r   r   r   <module>   sz   (	
		


+
