Initial commit: OpenVPN Manager v1.0

OpenVPN Web management console with multi-instance support, client cert issuance, traffic/connection auditing, certificate expiry reminders, auto backup/restore. Stack: - Backend: Go 1.21+ (Gin + JWT) - Frontend: Vue 3 + Element Plus + ECharts + Vite - Storage: JSON file (db.json) + filesystem (pki/, instances/, clients/, backups/) Features: - Multi-instance OpenVPN management (independent port/proto/subnet/PKI) - One-click client certificate issuance with .ovpn (embedded certs) - Certificate expiry reminders (30-day threshold) - Connection log parsing (status-version 3) - Auto backup/restore (tar.gz) - Audit log for all write operations - JWT auth (12h TTL) - One-line install.sh for Ubuntu/Debian/RHEL/Fedora
2026-08-09 20:32:37 +08:00
commit 77f8b59290
34 changed files with 6063 additions and 0 deletions
@@ -0,0 +1,402 @@
+package api
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/gin-contrib/cors"
+	"github.com/gin-gonic/gin"
+
+	"openvpn-manager/internal/config"
+	"openvpn-manager/internal/middleware"
+	"openvpn-manager/internal/model"
+	"openvpn-manager/internal/service"
+)
+
+type Server struct {
+	Cfg *config.Config
+	Svc *service.Service
+}
+
+func NewServer(cfg *config.Config, svc *service.Service) *Server {
+	return &Server{Cfg: cfg, Svc: svc}
+}
+
+func (s *Server) Router(distDir string) *gin.Engine {
+	gin.SetMode(gin.ReleaseMode)
+	r := gin.New()
+	r.Use(gin.Recovery())
+	r.Use(cors.New(cors.Config{
+		AllowAllOrigins: true,
+		AllowMethods:    []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+		AllowHeaders:    []string{"Authorization", "Content-Type"},
+		MaxAge:          12 * time.Hour,
+	}))
+
+	// 公共
+	r.POST("/api/login", s.login)
+	r.GET("/api/health", func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) })
+
+	auth := r.Group("/api", middleware.JWTAuth(s.Cfg.JWTSecret))
+	{
+		auth.GET("/me", s.me)
+		auth.POST("/logout", s.logout)
+		auth.GET("/dashboard", s.dashboard)
+
+		auth.GET("/instances", s.listInstances)
+		auth.POST("/instances", s.createInstance)
+		auth.GET("/instances/:id", s.getInstance)
+		auth.PUT("/instances/:id", s.updateInstance)
+		auth.DELETE("/instances/:id", s.deleteInstance)
+		auth.POST("/instances/:id/start", s.startInstance)
+		auth.POST("/instances/:id/stop", s.stopInstance)
+		auth.GET("/instances/:id/online", s.onlineClients)
+
+		auth.GET("/instances/:id/users", s.listUsers)
+		auth.POST("/instances/:id/users", s.createUser)
+		auth.POST("/instances/:id/users/:uid/revoke", s.revokeUser)
+		auth.DELETE("/instances/:id/users/:uid", s.deleteUser)
+		auth.GET("/instances/:id/users/:uid/ovpn", s.downloadOVPN)
+
+		auth.GET("/certs", s.listCerts)
+
+		auth.GET("/connlogs", s.listConnLogs)
+
+		auth.GET("/backups", s.listBackups)
+		auth.POST("/backups", s.createBackup)
+		auth.POST("/backups/:id/restore", s.restoreBackup)
+		auth.DELETE("/backups/:id", s.deleteBackup)
+
+		auth.GET("/audits", s.listAudits)
+	}
+
+	// 静态前端
+	if distDir != "" {
+		if _, err := os.Stat(distDir); err == nil {
+			r.NoRoute(func(c *gin.Context) {
+				path := filepath.Join(distDir, c.Request.URL.Path)
+				if !fileExists(path) || strings.HasSuffix(c.Request.URL.Path, "/") {
+					c.File(filepath.Join(distDir, "index.html"))
+					return
+				}
+				c.File(path)
+			})
+		}
+	}
+	return r
+}
+
+func fileExists(p string) bool {
+	fi, err := os.Stat(p)
+	return err == nil && !fi.IsDir()
+}
+
+// ---------- handlers ----------
+
+func (s *Server) login(c *gin.Context) {
+	var req struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"})
+		return
+	}
+	if req.Username != s.Cfg.AdminUser || req.Password != s.Cfg.AdminPass {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "用户名或密码错误"})
+		return
+	}
+	tok, err := middleware.IssueToken(s.Cfg.JWTSecret, req.Username, "admin", 12*time.Hour)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "issue token failed"})
+		return
+	}
+	c.JSON(200, gin.H{"token": tok, "username": req.Username})
+}
+
+func (s *Server) logout(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) }
+
+func (s *Server) me(c *gin.Context) {
+	u, _ := c.Get("user")
+	c.JSON(200, gin.H{"username": u})
+}
+
+// dashboard 汇总统计
+func (s *Server) dashboard(c *gin.Context) {
+	instances := s.Svc.Store.ListInstances()
+	users := s.Svc.Store.ListUsers("")
+	certs, _ := s.Svc.CertInfos()
+	expiring := 0
+	for _, ct := range certs {
+		if ct.DaysLeft <= 30 {
+			expiring++
+		}
+	}
+	online := 0
+	for _, in := range instances {
+		cl, _ := s.Svc.ListOnline(in.ID)
+		online += len(cl)
+	}
+	c.JSON(200, gin.H{
+		"instances":        len(instances),
+		"running":          countByStatus(instances, "running"),
+		"users":            len(users),
+		"active_users":     countEnabled(users),
+		"online":           online,
+		"expiring_certs":   expiring,
+		"recent_audits":    s.Svc.Store.ListAudits(20),
+		"recent_conn_logs": s.Svc.Store.ListConnLogs("", 20),
+	})
+}
+
+// ---- instances ----
+
+func (s *Server) listInstances(c *gin.Context) {
+	c.JSON(200, s.Svc.Store.ListInstances())
+}
+
+func (s *Server) getInstance(c *gin.Context) {
+	in, err := s.Svc.Store.GetInstance(c.Param("id"))
+	if err != nil {
+		c.JSON(404, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(200, in)
+}
+
+func (s *Server) createInstance(c *gin.Context) {
+	var in model.Instance
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.JSON(400, gin.H{"error": "bad request"})
+		return
+	}
+	out, err := s.Svc.CreateInstance(in)
+	if err != nil {
+		s.Svc.AuditForAPI(c, "create_instance", in.Name, err.Error(), "failed")
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "create_instance", in.Name, "port="+itoa(out.Port), "ok")
+	c.JSON(200, out)
+}
+
+func (s *Server) updateInstance(c *gin.Context) {
+	var in model.Instance
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.JSON(400, gin.H{"error": "bad request"})
+		return
+	}
+	in.ID = c.Param("id")
+	if err := s.Svc.UpdateInstance(in); err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "update_instance", in.Name, "", "ok")
+	c.JSON(200, in)
+}
+
+func (s *Server) deleteInstance(c *gin.Context) {
+	id := c.Param("id")
+	if err := s.Svc.DeleteInstance(id); err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "delete_instance", id, "", "ok")
+	c.JSON(200, gin.H{"ok": true})
+}
+
+func (s *Server) startInstance(c *gin.Context) {
+	id := c.Param("id")
+	if err := s.Svc.StartInstance(id); err != nil {
+		s.Svc.AuditForAPI(c, "start_instance", id, err.Error(), "failed")
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "start_instance", id, "", "ok")
+	c.JSON(200, gin.H{"ok": true})
+}
+
+func (s *Server) stopInstance(c *gin.Context) {
+	id := c.Param("id")
+	if err := s.Svc.StopInstance(id); err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "stop_instance", id, "", "ok")
+	c.JSON(200, gin.H{"ok": true})
+}
+
+func (s *Server) onlineClients(c *gin.Context) {
+	cl, err := s.Svc.ListOnline(c.Param("id"))
+	if err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(200, cl)
+}
+
+// ---- users ----
+
+func (s *Server) listUsers(c *gin.Context) {
+	c.JSON(200, s.Svc.Store.ListUsers(c.Param("id")))
+}
+
+func (s *Server) createUser(c *gin.Context) {
+	var u model.VPNUser
+	if err := c.ShouldBindJSON(&u); err != nil {
+		c.JSON(400, gin.H{"error": "bad request"})
+		return
+	}
+	u.InstanceID = c.Param("id")
+	out, err := s.Svc.CreateUser(u)
+	if err != nil {
+		s.Svc.AuditForAPI(c, "create_user", u.Username, err.Error(), "failed")
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "create_user", u.Username, "instance="+u.InstanceID, "ok")
+	c.JSON(200, out)
+}
+
+func (s *Server) revokeUser(c *gin.Context) {
+	uid := c.Param("uid")
+	if err := s.Svc.RevokeUser(uid); err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "revoke_user", uid, "", "ok")
+	c.JSON(200, gin.H{"ok": true})
+}
+
+func (s *Server) deleteUser(c *gin.Context) {
+	uid := c.Param("uid")
+	if err := s.Svc.DeleteUser(uid); err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "delete_user", uid, "", "ok")
+	c.JSON(200, gin.H{"ok": true})
+}
+
+func (s *Server) downloadOVPN(c *gin.Context) {
+	host := c.Query("host")
+	if host == "" {
+		host = c.Request.Host
+	}
+	p, err := s.Svc.GenerateOVPN(c.Param("uid"), host)
+	if err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	c.Header("Content-Disposition", "attachment; filename="+filepath.Base(p))
+	c.File(p)
+}
+
+// ---- certs ----
+
+func (s *Server) listCerts(c *gin.Context) {
+	certs, err := s.Svc.CertInfos()
+	if err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(200, certs)
+}
+
+// ---- conn logs ----
+
+func (s *Server) listConnLogs(c *gin.Context) {
+	c.JSON(200, s.Svc.Store.ListConnLogs(c.Query("instance"), 200))
+}
+
+// ---- backups ----
+
+func (s *Server) listBackups(c *gin.Context) {
+	c.JSON(200, s.Svc.Store.ListBackups())
+}
+
+func (s *Server) createBackup(c *gin.Context) {
+	var req struct{ Note string `json:"note"` }
+	_ = c.ShouldBindJSON(&req)
+	b, err := s.Svc.Backup(req.Note)
+	if err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "create_backup", b.ID, "", "ok")
+	c.JSON(200, b)
+}
+
+func (s *Server) restoreBackup(c *gin.Context) {
+	id := c.Param("id")
+	if err := s.Svc.Restore(id); err != nil {
+		s.Svc.AuditForAPI(c, "restore_backup", id, err.Error(), "failed")
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	s.Svc.AuditForAPI(c, "restore_backup", id, "", "ok")
+	c.JSON(200, gin.H{"ok": true})
+}
+
+func (s *Server) deleteBackup(c *gin.Context) {
+	id := c.Param("id")
+	if err := s.Svc.DeleteBackup(id); err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(200, gin.H{"ok": true})
+}
+
+// ---- audits ----
+
+func (s *Server) listAudits(c *gin.Context) {
+	c.JSON(200, s.Svc.Store.ListAudits(500))
+}
+
+// ---- helpers ----
+
+func countByStatus(in []model.Instance, status string) int {
+	n := 0
+	for _, x := range in {
+		if x.Status == status {
+			n++
+		}
+	}
+	return n
+}
+
+func countEnabled(u []model.VPNUser) int {
+	n := 0
+	for _, x := range u {
+		if x.Enabled {
+			n++
+		}
+	}
+	return n
+}
+
+func itoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	neg := false
+	if n < 0 {
+		neg = true
+		n = -n
+	}
+	var buf [20]byte
+	i := len(buf)
+	for n > 0 {
+		i--
+		buf[i] = byte('0' + n%10)
+		n /= 10
+	}
+	if neg {
+		i--
+		buf[i] = '-'
+	}
+	return string(buf[i:])
+}