Islandr

Self-hosted WireGuard management platform. Peer lifecycle, RBAC access control, nftables enforcement.

Islandr[Software System]Islandr Backend[Container: Quarkus 3 / Java 21 (native binary)]auth[Component: JAX-RS + CDI] Session management, local login(per-user PBKDF2 password or ENVadmin), OIDC callback, adminbootstrap (seeds admin@local),session filter.identity[Component: CDI] OIDC provider registry, JWKS cache,ID token verification.peer[Component: JAX-RS + CDI + @Scheduled] Peer lifecycle (create, enable,disable, delete), QR code generation,activity poller.acl[Component: JAX-RS + CDI] Sites, Resources, ResourcePorts,Roles, RoleResourceGrants, ACLmatrix API. Browser-RDP WebSocketproxy (IronRDP RDCleanPath) with aper-port zero-trust grant check.firewall[Component: CDI] Full ruleset computation from ACLmodel, nft -c -f validation, atomic nft-f reload. Real/Mock/DryRunadapters.wg[Component: CDI] WireGuard CLI adapter.Real/Mock/DryRun implementationsselected via islandr.wg.mode config.user[Component: JAX-RS + CDI] User management, avatar resolution(Gravatar → MS365 photo →deterministic initials).audit[Component: CDI] Immutable append-only audit log.Written on every mutating actionacross all packages.settings[Component: JAX-RS + CDI] Runtime instance settings (WGconfig, private key retention, OIDCproviders). Stored in DB, audited.dashboard[Component: JAX-RS + CDI] Dashboard aggregation: online peercount, audit summary, firewallstatus.dns[Component: CDI] Minimal DNS resolver(UDP/best-effort TCP :53), opt-in inSettings. Authoritative for themanaged resource zone(Resource.dnsName), ACL-filteredanswers (NXDOMAIN for resourcesthe querying peer has no grant on);everything else forwarded upstreambyte-for-byte, unparsed. Hand-rolledRFC 1035 wire format, no library(ADR-0023).tls[Component: CDI] TLS keystore management.Hot-swaps between dummyself-signed cert and anadmin-uploaded or ACME-issued certat runtime, no restart (ADR-0015).acme[Component: JAX-RS + CDI + @Scheduled] Hand-rolled RFC 8555 ACME client.Requests, validates (HTTP-01 orDNS-01 manual mode), and renewsa certificate when ACME is enabledin Settings; no certificate library(ADR-0019, ADR-0020).proxy[Component: CDI] Host-side Unix-socket-proxy channelfor wg/nft when the backend runsunprivileged in a container.Adapter-mode resolution (explicit >container-detected > mock),degraded 'enforcement unavailable'status (ADR-0012).discovery[Component: JAX-RS + CDI] Admin-triggered device discovery:enumerates a site's CIDR, probeshost liveness with unprivilegedsockets, fingerprints a resource typefrom open ports, bulk-imports thereviewed selection as Resource rows(ADR-0014).admin[Component: JAX-RS + CDI] Instance config export/import,seeded-data timestamp repair onimport, version/update-checkendpoint.OIDC Provider[Software System] Authenticates users. Microsoft 365or Google Workspace.WireGuard[Software System] Linux kernel VPN module. Managedvia wg CLI.nftables[Software System] Linux kernel packet filter. EnforcesACL rules generated by Islandr.Let's Encrypt (ACME CA)[Software System] Fully optional — only contactedwhen an admin sets a domain andenables ACME in Settings. Islandr'sown hand-rolled RFC 8555 clientrequests, validates (HTTP-01), andrenews a certificate directly; nocertificate library, no external ACMEclient (ADR-0019).Resource Host[Software System] A machine behind the VPN inside asite (e.g. an RDP server). Forbrowser-based RDP the hubconnects to it directly over TLS andrelays to the browser.DNS Upstream[Software System] Fully optional — only reached whenthe resource DNS resolver is enabledin Settings. Public oradmin-configured recursiveresolver(s) (default 1.1.1.1 / 8.8.8.8,Settings.dnsResolverUpstream) thehub forwards any query outside itsown managed resource zone to,verbatim and unparsed (ADR-0023).Delegates OIDC token verificationLooks up or creates user on OIDC loginLogs login eventsAdds / removes peers from WireGuard interfaceTriggers full ruleset recompute on peer state changeLogs all peer mutationsTriggers full ruleset recompute on grant changeLogs ACL mutationsBrowser-RDP RDCleanPath proxy over TLS[TCP/TLS]Logs user mutationsLogs settings changesTriggers recompute on site-CIDR or resource changeUploads/replaces certificate PEM, reads certificate infonft CLI calls[ProcessBuilder]Delegates nft calls when containerized (socket mode)[islandr.nft.mode=socket]wg CLI calls[ProcessBuilder]Delegates wg calls when containerized (socket mode)[islandr.wg.mode=socket]Logs enforcement mode changesJWKS fetch[HTTPS]ACL-scoped grant check for filtered zone answers[AclService.hasAnyGrant]Forwards non-zone queries verbatim[UDP/TCP 53]ACME directory, order, and HTTP-01/DNS-01 challenge requests[HTTPS]HTTP-01 challenge callback[HTTP]Installs renewed certificate into the keystoreLogs renewal attempts and outcomesUnprivileged liveness/port probes over the existing WireGuard route[TCP/UDP]Bulk-imports reviewed hosts as Resource rowsLogs config import/export
Component View: Islandr - Islandr Backend
C4 Level 3 — Backend Components
Show legend
ComponentSoftwareSystem,ExternalRelationship