mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-31 04:53:01 +02:00
Joachim Wiberg
56ea7faa7c
Add firewall address-sets: named sets of IP addresses and networks, usable as zone sources for per-IP access control, issue #1189. Static entries are part of the configuration; dynamic entries are managed at runtime with new add/remove/flush actions, from the CLI or over NETCONF/RESTCONF. Dynamic entries survive firewall configuration changes but are not saved to the configuration. Sets with a timeout expire their entries automatically. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix WebUI
A lightweight web management interface for Infix network devices, built with Go and htmx.
The WebUI communicates with the device over RESTCONF (RFC 8040), presenting the same operational data available through the Infix CLI in a browser-friendly format.
Features
- Dashboard -- system info, hardware, sensors, and interface summary with bridge member grouping
- Interfaces -- list with status, addresses, and per-type detail; click through to a detail page with live-updating counters, WiFi station table, scan results, WireGuard peers, and ethernet frame statistics
- Firewall -- zone-to-zone policy matrix
- Keystore -- symmetric and asymmetric key display
- Firmware -- slot overview, install from URL with live progress
- Reboot -- two-phase status polling (wait down, wait up)
- Config download -- startup datastore as JSON
Building
Requires Go 1.22 or later.
make build
Produces a statically linked webui binary with all templates,
CSS, and JS embedded.
Cross-compile for the target:
GOOS=linux GOARCH=arm64 make build
Running
./webui --restconf https://192.168.0.1/restconf --listen :10000
| Flag | Default | Description |
|---|---|---|
--listen |
:10000 |
Address to listen on |
--restconf |
http://localhost:8080/restconf |
RESTCONF base URL of the device |
--insecure-tls |
false |
Disable TLS certificate verification |
The RESTCONF URL can also be set via the RESTCONF_URL environment
variable.
Development
Point RESTCONF_URL at a running Infix device and start the dev
server:
make dev ARGS="--restconf https://192.168.0.1/restconf"
This runs go run . on port 10000 with --insecure-tls already set.
Architecture
Browser ──htmx──▶ Go server ──RESTCONF──▶ Infix device (rousette/sysrepo)
- Single binary -- templates, CSS, JS, and images are embedded via
go:embed - Server-side rendering -- Go
html/templatewith per-page parsing to avoid{{define "content"}}collisions - htmx SPA navigation -- sidebar links use
hx-get/hx-targetfor partial page updates withhx-push-urlfor browser history - Stateless sessions -- AES-256-GCM encrypted cookies carry credentials (needed for every RESTCONF call); no server-side session store
- Live polling -- counters update every 5s, firmware progress every 3s, all via htmx triggers
main.go Entry point, flags, embedded FS
internal/
auth/ Login, logout, session (AES-GCM cookies)
restconf/ HTTP client (Get, GetRaw, Post, PostJSON)
handlers/ Page handlers
dashboard.go Dashboard, hardware, sensors
interfaces.go Interface list, detail, counters
firewall.go Zone matrix
keystore.go Key display
system.go Firmware, reboot, config download
server/
server.go Route registration, template wiring, middleware
templates/
layouts/ base.html (shell), sidebar.html
pages/ Per-page templates (one per route)
fragments/ htmx partial fragments
static/
css/style.css All styles
js/htmx.min.js htmx library
img/ Logo, favicon
License
See LICENSE.