New Integrations page in Wild Central UI for managing API tokens.
Provides token display, copy, and rotation so Wild Cloud and other
services can easily retrieve their authentication credentials.
- GET /api/v1/integrations returns current API token
- POST /api/v1/integrations/api-token/rotate generates a new token
- Frontend with show/hide toggle, copy button, and usage instructions
- Added to sidebar navigation under Central section
AuthGate component wraps the app layout:
- On load, checks if saved token is valid by calling a protected endpoint
- If auth not required (dev mode), passes through immediately
- If auth required and no valid token, shows a clean login screen
- Token input with password field, stored in localStorage on success
- Shows guidance: "Find your token in secrets.yaml under api.bearerToken"
- Handles connection errors gracefully (shows app anyway)
- Auto-generate random 32-char bearer token on first startup, stored in
secrets.yaml as api.bearerToken
- BearerAuthMiddleware checks Authorization: Bearer <token> on all /api/
endpoints except /health, /health/reconcile, /events (SSE), and non-API
paths (frontend static files)
- Development mode (WILD_CENTRAL_ENV=development) skips auth entirely
- Web app ApiClient: add setToken/clearToken/hasToken methods, persist
token in localStorage, automatically include Authorization header on
all API requests
- Token can be found in secrets.yaml for CLI/automation use
- Add certbot to getDaemonStatus: checks binary availability and version
- Dashboard: add Certificates card to services grid
- Sidebar: show green/red status dot for certbot on Certificates nav item
New page at /advanced/certificates showing:
- Overview card with central domain, cert count, Cloudflare token status
- Auto-provision readiness badge (requires CF token + operator email)
- Table of all domains needing TLS with: domain, source, expiry date,
issuer, and status badges (days left / covered by wildcard / missing)
- Per-domain "Provision" button for missing certs when auto-provision ready
- "Provision" and "Renew All" action buttons
- Guidance alert when prerequisites are missing
Also fixes pre-existing type errors:
- AppSidebar: guard daemon index access when undefined
- DomainsComponent: fix circular type reference in filter state
- DomainTopology: remove unused isWildcard variable
Adds Pi-hole-style DNS filtering using dnsmasq's native address=/ directives,
which block domains and all subdomains. Users subscribe to blocklists by URL
or upload files, with suggested lists from Hagezi, Steven Black, and OISD.
Background runner refreshes lists on a configurable interval (default 24h).
SMTP: Add host, port, username, sender, and password fields to the
Authelia configuration. Uses modern address format (submission:// for
STARTTLS on 587, smtps:// for implicit TLS on 465) with explicit TLS
server name. Falls back to filesystem notifier when SMTP is not
configured.
Fixes: Config changes now persist before attempting service restart,
so a restart failure (e.g. bad SMTP credentials) no longer prevents
saving. The specific Authelia error is extracted from the journal and
shown in the UI.
Frontend: SMTP fields added to the Authentication config card. Form
no longer continuously resets from server state while user is editing.
OIDC client edit UI added (pencil icon).
Authelia runs as a managed native service on Wild Central, providing
two integration patterns for network services:
- Forward-auth via HAProxy for apps without native SSO (Lua auth-request
script intercepts requests, redirects unauthenticated users to login portal)
- OIDC provider for apps with native support (Gitea, Grafana, etc.)
Backend: new internal/authelia/ package with service manager, config
generation, file-based user management (argon2id), and OIDC client
management. API endpoints for status, config, users CRUD, and OIDC
clients CRUD.
HAProxy: config generator extended with lua-load, auth-request
directives, and Authelia backend. Auth directives scoped to session
cookie domain — only subdomains of the auth portal's parent are
eligible for forward-auth.
Frontend: Authentication page with enable/disable, user management,
OIDC client management (add/edit/delete), and protected domains
toggles. Advanced subsystem page for raw config view. Dashboard
service card and sidebar entries.
The new icon represents Wild Central's role as a network hub —
a central node radiating connections to services. Updated favicon,
sidebar logo component, theme color, and PWA manifest name.
InstanceConfig was a ~50-field struct designed for Wild Cloud k8s instances,
but only 3 fields were ever read by dnsmasq (the sole consumer). The
reconciliation bridge constructed fake InstanceConfig objects from registered
domains just to satisfy this interface.
Replace with DNSEntry{Domain, IP} — a 2-field struct purpose-built for
dnsmasq. All domains get local=/ directives to prevent AAAA queries from
leaking to upstream DNS (Happy Eyeballs / RFC 8305 latency on LAN).
Removed dead code: InstanceConfig, NodeConfig, LoadCloudConfig,
SaveCloudConfig, DeepMerge, LoadMergedInstanceConfig, EnsureInstanceConfig,
instance path helpers, instanceLoadBalancerIP, GenerateInstanceConfig,
and all modular per-instance dnsmasq methods.
Split /api/v1/state into dedicated resource endpoints:
- /api/v1/operator, /api/v1/central-domain
- /api/v1/ddns/config, /api/v1/dns/settings
- /api/v1/dhcp/config (moved from /dnsmasq/dhcp/)
- /api/v1/nftables/config, /api/v1/haproxy/routes
Each page now talks to its own resource instead of deep-merging
a blob. Removes useConfig hook, CentralState type, and legacy
config methods.
- Add Routes model to services UI (paths, headers, IP whitelisting per route)
- Show TLS cert info per service with inline provision/renew actions
- Remove TLS Certificates section from dashboard (now on services page)
- Make gateway router port list dynamic from config + VPN state
- Add TODO for header validation in HAProxy config generation
The backend field + Public toggle already tell you where traffic
routes. Removed redundant "Routes to X on LAN, Y externally" line
and unused ddns/publicIp/backendHost vars.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The toggles (Public, Subdomains, Central TLS) already communicate
everything the table was restating. Replaced with a single routing
summary line: "Routes to X on LAN, Y externally."
Cleaner, no redundancy.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Service cards now have full inline editing:
- Backend address: editable input, updates on blur
- Public/Private: toggle switch, updates immediately
- Subdomains: toggle switch, updates immediately
- TLS (Central TLS / Passthrough): toggle switch, updates
both tls mode and backend type together
- Deregister button
Add form also uses toggle for TLS instead of dropdown.
Removed unused Badge and Select imports.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Service cards now have:
- Public/Private toggle (switches reach)
- Subdomains toggle (include *.domain)
- TLS badge (passthrough vs terminate, read-only for now)
- Inline status details (DNS, Proxy, TLS status)
- Deregister button
- Add Service form with toggles instead of dropdowns
The card speaks the user's language (public/private, subdomains on/off)
not implementation details (tcp-passthrough vs http, reach: internal).
Also updated docs/registrations.md:
- Added "User-facing concepts" section mapping API fields to toggles
- Added batch deregister endpoint
- Added backend.health field
- Cleaner examples
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Changed from single expandedDomain string to a Set<string> so
multiple cards can be open at once.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- na (passthrough, Central doesn't handle TLS): grey checkmark
- error (terminate but cert missing): red alert icon
- ok (terminate and cert exists): green checkmark
Previously passthrough showed green (wrong — Central isn't doing
anything) and missing certs showed amber (should be red — broken).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rewrote ServicesComponent:
- Each service is its own Card (not rows in a table)
- "Add Service" button with form (domain, backend, type, reach, subdomains)
- Deregister button per service
- Wildcard services show as *.domain
- Expandable detail view with DNS/Proxy/TLS status
- Removed separate "Custom TCP Routes" section — TCP routes are just
services with type tcp-passthrough
- Added register/deregister methods to servicesApi
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dashboard:
- Cloudflare token can be changed when already configured (was only
editable when missing/invalid)
- DDNS records can be added and removed inline (was read-only)
Services:
- Wildcard services display as *.domain instead of domain with a
separate subdomains badge — clearer at a glance
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- RegisteredService: removed name, added subdomains bool
- CertEntry: removed service field (domain is the key)
- Ingress page: domain as primary label, subdomains badge
- Certificates page: source shown under domain
- All type-check passes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove automatic wildcard cert assumption. Each service gets its own
cert by default. Wildcards are user-initiated via the Certificates page.
Backend:
- HAProxy L7 frontend uses cert directory (/etc/haproxy/certs/)
instead of single wildcard file — loads all PEMs, serves by SNI
- Cert status API shows every registered service individually with
coveredBy field when a wildcard cert covers the domain
- Reconciliation filters L7 routes to services that have a cert
- No auto-provisioning in reconciliation (just warnings)
Frontend:
- Certificates page shows per-service cert status
- "Provision" button for individual certs
- "Add Wildcard" form for opt-in wildcard provisioning
- Fixed CloudflareComponent type errors from cert API changes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New dedicated Certificates page in Wild Central UI showing:
- All tracked certs (central, wildcard, per-service)
- Status (valid with days remaining, or missing)
- Per-domain Provision button
- Renew All button
Cert provisioning is now user-initiated only — reconciliation logs
warnings about missing certs but does NOT auto-provision. This
prevents unexpected wildcard cert requests on startup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
API changes:
- /api/v1/cert/status now returns all relevant certs (central,
wildcard, per-service) with existence status and expiry
- /api/v1/cert/provision accepts ?domain= param for per-domain
provisioning
- Removed stale syncHAProxy references, uses reconcileNetworking
UI changes:
- Added TLS Certificates card to Cloudflare page showing cert status
for each domain with provision/renew actions
- Updated useCert hook and cert API types for new response format
Next: extract into dedicated Certificates page.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace "Instance Routes" with "Registered Services" on the Central
Ingress page. Services are fetched from /api/v1/services and display
name, domain, backend, source, reach level, and backend type.
Central no longer manages instances directly — it shows services
registered by Wild Cloud, Wild Works, and itself.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Extract Central pages from the wild-cloud web app into a standalone
React app for Wild Central. Includes:
- Central overview, DNS, DHCP, Firewall, VPN, Ingress, CrowdSec pages
- Simplified sidebar with Central-only navigation
- Branding updated to "Wild Central"
- All Cloud-specific pages, components, hooks, and API services removed
- TypeScript type-check and production build pass
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
