Umbra
Panel web untuk WireGuard dan AdGuard Home di satu VPS Linux. Satu binary Go dengan frontend tertanam: server tidak butuh Go, Node, atau source code, cukup satu perintah untuk pasang dan update.A web panel for WireGuard and AdGuard Home on a single Linux VPS. One Go binary with the frontend embedded: the server needs no Go, Node, or source code, and one command installs or updates it.
ArsitekturArchitecture
- Satu binary Go dengan frontend SvelteKit di-embed lewat go:embed; GitHub Actions menerbitkan build amd64 dan arm64 dengan checksum sha256.One Go binary with the SvelteKit frontend embedded through go:embed; GitHub Actions publishes amd64 and arm64 builds with sha256 checksums.
- Backend WireGuard dipilih otomatis: modul kernel lewat wgctrl bila ada, selain itu wireguard-go userspace yang tertanam di binary.The WireGuard backend is picked automatically: the kernel module through wgctrl when available, otherwise userspace wireguard-go built into the binary.
- Panel berjalan sebagai user biasa; hanya helper root kecil lewat systemd path unit yang memasang dan mencopot AdGuard Home.The panel runs as an unprivileged user; only a small root helper, triggered by a systemd path unit, installs and removes AdGuard Home.
- Aman secara bawaan: hanya mendengar di 127.0.0.1, password argon2id, sesi + CSRF, CSP ketat, TOTP dengan kode pemulihan, dan aset di-host sendiri.Safe by default: listens on 127.0.0.1 only, argon2id passwords, sessions + CSRF, a strict CSP, TOTP with recovery codes, and self-hosted assets.
- SQLite murni Go (modernc, tanpa CGO), dan WireGuard serta firewall bisa diganti tiruan sehingga bisa dikembangkan di Windows dan macOS.Pure-Go SQLite (modernc, no CGO), and fake WireGuard and firewall backends so it can be developed on Windows and macOS.
Yang bisa dilakukanWhat it does
Wizard setupSetup wizard
Token setup sekali pakai, akun admin, lalu endpoint, interface, subnet, dan DNS, dengan cek sistem sebelum WireGuard dinyalakan.A one-time setup token, an admin account, then endpoint, interface, subnet, and DNS, with system checks before WireGuard comes up.
Perangkat & QRDevices & QR codes
Tambah, nonaktifkan, buat ulang kunci, unduh profil, atau pindai QR langsung dari HP.Add, disable, or rekey devices, download profiles, or scan a QR code straight from a phone.
Ringkasan langsungLive overview
Perangkat yang online, kecepatan 60 detik terakhir, dan total data di-stream lewat SSE.Who is online, the last 60 seconds of throughput, and total data, streamed over SSE.
Firewall dengan uji 60 detikFirewall with a 60-second trial
Aturan nftables baru otomatis dibatalkan kalau tidak dikonfirmasi, jadi salah aturan tidak mengunci akses ke server.New nftables rules roll back unless confirmed, so a bad rule never locks you out of the server.
Log sesi VPNVPN session log
Kapan perangkat terhubung, terputus, dan berganti IP publik, dibaca dari handshake WireGuard dan disimpan 90 hari.When devices connect, disconnect, and change public IP, derived from WireGuard handshakes and kept for 90 days.
Aktivitas jaringanNetwork activity
Koneksi aktif per perangkat dari conntrack dan situs yang dibuka dari riwayat DNS AdGuard, hanya metadata.Live connections per device from conntrack and visited sites from AdGuard DNS history, metadata only.
AdGuard Home dari panelAdGuard Home from the panel
Pasang, atur filter, DNS, layanan, klien, dan query log; DNS hanya mendengar di IP VPN agar tidak jadi open resolver.Install it, then manage filters, DNS, services, clients, and the query log; DNS listens only on the VPN IP so it never becomes an open resolver.
Impor dari WireGuard lamaImport from an existing WireGuard
Pindahkan perangkat dari wg0.conf atau database wireguard-ui, dengan pratinjau sebelum disimpan.Move devices over from wg0.conf or a wireguard-ui database, with a preview before saving.
Stack
- Backend
- Go · SQLite (modernc) · wgctrl · wireguard-go · nftables · conntrack
- Panel
- SvelteKit · Svelte 5 · TypeScript · Tailwind CSS 4
- Deploy
- systemd · GitHub Actions · Nginx · AdGuard Home