API now returns:
{
"logs": [...], // ConnectionLog array (same fields as before)
"_diag": [...] // status.log paths/existence/parse status per instance
}
Frontend updated to handle both array (legacy) and object format.
This makes it easy to diagnose:
- Which status.log paths the backend looked at
- Whether files exist and their sizes
- How many entries were parsed
- Any parse errors
User just needs to: git pull && rebuild && restart on production.
Root cause: listConnLogs only read from db.json which was never
populated (background sync silently failed due to Status check and
broken regex).
Fix approach: read status.log directly in API handlers — no DB
dependency, works immediately when OpenVPN is running.
Changes:
api/router.go:
- listConnLogs: parse status.log from all instances in real-time,
merge with historical DB entries for disconnected sessions
- dashboard: same real-time approach for recent_conn_logs
pkg/openvpn/manager.go:
- Fix regex for status-version 3 format (11 fields):
CLIENT_LIST,CN,RealAddr,VPNAddr,IPv6,BytesRecv,BytesSent,ConnectedSince,...
Old regex assumed wrong field order (CN,ConnectedSince,RealAddr)
- Add parseConnTime() helper supporting multiple time formats
internal/service/service.go:
- Remove Status=='running' check (was blocking sync for all instances)
- Add log.Printf debug output for sync operations
- Add 'log' import
internal/store/store.go:
- Add ListActiveConns(instanceID) for background sync
- Add UpdateActiveConnStats() for traffic updates without flush
OpenVPN now requires BOTH a valid client certificate AND a
username/password to establish a VPN connection.
Architecture:
Client .ovpn has 'auth-user-pass' → prompts for credentials
Server.conf has 'auth-user-pass-verify verify.sh via-env'
verify.sh (bash+curl) calls POST /api/vpn/verify on the manager
Manager verifies bcrypt hash via Go's golang.org/x/crypto/bcrypt
Endpoint is localhost-only (127.0.0.1) for security
Model changes:
Instance: new AuthMode field ('cert' | 'cert+password', default cert+password)
VPNUser: new PasswordHash (bcrypt) + Password (plaintext, transient)
Backend:
model: AuthMode type, VPNUser.PasswordHash, VPNUser.Password (transient)
store: ListUsers clears PasswordHash before returning
service: CreateUser hashes password with bcrypt, enforces min 4 chars
service: ResetVPNPassword for admin password reset
service: UpdateUser preserves PasswordHash from old record
service: CreateInstance defaults AuthMode=cert+password
api: POST /api/vpn/verify (no JWT, localhost-only, bcrypt verify)
api: POST /instances/:id/users/:uid/password (admin reset VPN pwd)
openvpn: WriteVerifyScript generates bash+curl verify script
openvpn: WriteServerConf adds script-security/auth-user-pass-verify
openvpn: GenerateClientOVPN adds auth-user-pass directive
Frontend:
Users.vue: password field on create form
Users.vue: '重置密码' button in table + dialog
Users.vue: '证书+密码' tag in auth column
api: Inst.resetVPNPassword() method
Security:
/api/vpn/verify rejects non-127.0.0.1 clients (403)
PasswordHash never exposed via any API response
verify.sh uses localhost curl (no external dependencies)
bcrypt cost=10 (same as admin passwords)
Verified: correct pwd → 200, wrong pwd → 401, missing user → 401,
non-localhost → 403, .ovpn has auth-user-pass, server.conf has
script-security 2 + auth-user-pass-verify + verify-client-cert require.
cnbugs