127 lines
5 KiB
Markdown
127 lines
5 KiB
Markdown
Great question — and you're absolutely right to ask.
|
||
|
||
You **don’t need** Innernet or Headscale+patch *if* you're comfortable building a small self-hosted portal that handles:
|
||
|
||
* ✅ OIDC login
|
||
* ✅ WireGuard peer key management
|
||
* ✅ Config generation and download
|
||
|
||
So let’s break it down:
|
||
|
||
---
|
||
|
||
## 🧩 Why *Innernet* and *Headscale+patch* Exist
|
||
|
||
Those tools solve **user/device coordination**, dynamic routing, and access control *automatically*, **with batteries included**. They're great if you want a more managed, “plug-and-play” experience. Specifically:
|
||
|
||
| Tool | Purpose |
|
||
| ------------------------ | ----------------------------------------------------------------- |
|
||
| **Innernet** | Full WireGuard-based mesh + OIDC login + per-device management |
|
||
| **Headscale** | Tailscale backend, enables user login + ACL + device coordination |
|
||
| **Headscale+OIDC patch** | Add OIDC login to Headscale (by default, only pre-shared keys) |
|
||
|
||
These tools do things like:
|
||
|
||
* Assign IPs/DNS names to users
|
||
* Regenerate keys
|
||
* Handle coordination between peers
|
||
* Gate access with identity
|
||
|
||
---
|
||
|
||
## 🛠️ Why You *Don’t* Need Them (Your Custom Portal Idea)
|
||
|
||
If you're fine with:
|
||
|
||
* Managing WireGuard server and IPs manually
|
||
* Writing a small web service to issue `.conf` files after login
|
||
* Using firewall rules for access control
|
||
|
||
Then you absolutely **can** build a custom system around **WireGuard + OIDC** like this:
|
||
|
||
---
|
||
|
||
### 🧱 Architecture: WireGuard + OIDC + Config Generator
|
||
|
||
```
|
||
┌──────────────┐
|
||
│ Your OIDC │
|
||
│ provider │◄────── Google, Authentik, Keycloak
|
||
└─────┬────────┘
|
||
│
|
||
(OIDC Login)
|
||
│
|
||
┌────────▼────────┐
|
||
│ Web Portal │◄────── nginx + Go, Node.js, Flask, etc.
|
||
│ (self-hosted) │
|
||
└──┬────────────┬─┘
|
||
Gen Keys │ │ Serve config
|
||
& register │ └─────> `client.conf` / QR code
|
||
▼
|
||
┌──────────────────────┐
|
||
│ WireGuard server │ (NixOS)
|
||
│ - Handles all peers │
|
||
└──────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
### 🔐 What Your Portal Needs to Do
|
||
|
||
* Authenticate via OIDC (OAuth2 flow)
|
||
* Store a list of "authorized users"
|
||
* When a user logs in:
|
||
|
||
* Check if they already have a WireGuard peer entry
|
||
* If not: generate a keypair, assign IP (e.g. `10.100.0.5`)
|
||
* Append to server config (`/etc/wireguard/wg0.conf`) or use `wg set`
|
||
* Return config file or QR code for the mobile client
|
||
|
||
---
|
||
|
||
## ✅ Benefits of This DIY Approach
|
||
|
||
* 💡 Full control: you own every step
|
||
* 🔐 OIDC is the gatekeeper (centrally managed access)
|
||
* ⚡ No extra daemon/software overhead (just WireGuard + your app)
|
||
* 🧩 Easily extensible (e.g., device limits, IP lease expiration)
|
||
|
||
---
|
||
|
||
## ⚙️ Tools You Can Use
|
||
|
||
| Purpose | Tools |
|
||
| ---------------------- | -------------------------------------------------------------------------- |
|
||
| OIDC Auth | [Dex](https://github.com/dexidp/dex), Keycloak, Authentik, or Firebase |
|
||
| Web Portal Backend | Node.js (Express), Go, Flask, FastAPI |
|
||
| Config Template Engine | Go templates, EJS, Jinja2 |
|
||
| WireGuard Integration | `wg`, `wg-quick`, or directly edit `wg0.conf` |
|
||
| NixOS Support | Use `networking.wireguard.interfaces.wg0.peers` to declaratively add peers |
|
||
|
||
---
|
||
|
||
## 🧪 Bonus Features You Could Build
|
||
|
||
* 🔐 Per-user firewall rules
|
||
* 🔁 One-time config URLs (`vpn.mydomain.com/invite/xyz`)
|
||
* 🔐 Optional Authelia/Keycloak MFA
|
||
* 📉 Dashboard with currently active peers (use `wg show`)
|
||
|
||
---
|
||
|
||
## ✨ Summary
|
||
|
||
| Option | You Need Innernet / Headscale? | Login via OIDC? | DNS Routing? | Complexity |
|
||
| ----------------- | ------------------------------ | --------------- | ------------ | ---------- |
|
||
| Your own portal | ❌ No | ✅ Yes | ❌ Manual | 🟡 Medium |
|
||
| Innernet | ✅ Yes | ✅ Yes | ✅ Built-in | 🟠 Medium |
|
||
| Headscale + patch | ✅ Yes | ✅ Yes | ✅ Built-in | 🔴 High |
|
||
|
||
You’re on a great path by choosing the custom VPN portal idea.
|
||
Let me know if you'd like:
|
||
|
||
* A **sample architecture repo**
|
||
* A **NixOS module to support peer configs**
|
||
* Help building the **login + config generator backend**
|
||
|
||
I can generate a Nix flake and a working OIDC portal template to kickstart the project.
|