Islandr

Self-hosted WireGuard management platform. Peer lifecycle, RBAC access control, nftables enforcement.

Islandr[Software System]Islandr Backend[Container: Quarkus 3 / Java 21 (native binary)]auth[Component: JAX-RS + CDI] Session management, local login(per-user PBKDF2 password or ENVadmin), OIDC callback, adminbootstrap (seeds admin@local),session filter.identity[Component: CDI] OIDC provider registry, JWKS cache,ID token verification.peer[Component: JAX-RS + CDI + @Scheduled] Peer lifecycle (create, enable,disable, delete), QR code generation,activity poller.acl[Component: JAX-RS + CDI] Sites, Resources, ResourcePorts,Roles, RoleResourceGrants, ACLmatrix API. Browser-RDP WebSocketproxy (IronRDP RDCleanPath) with aper-port zero-trust grant check.firewall[Component: CDI] Full ruleset computation from ACLmodel, nft -c -f validation, atomic nft-f reload. Real/Mock/DryRunadapters.wg[Component: CDI] WireGuard CLI adapter.Real/Mock/DryRun implementationsselected via islandr.wg.mode config.user[Component: JAX-RS + CDI] User management, avatar resolution(Gravatar → MS365 photo →deterministic initials).audit[Component: CDI] Immutable append-only audit log.Written on every mutating actionacross all packages.settings[Component: JAX-RS + CDI] Runtime instance settings (WGconfig, private key retention, OIDCproviders). Stored in DB, audited.dashboard[Component: JAX-RS + CDI] Dashboard aggregation: online peercount, audit summary, firewallstatus.OIDC Provider[Software System] Authenticates users. Microsoft 365or Google Workspace.WireGuard[Software System] Linux kernel VPN module. Managedvia wg CLI.nftables[Software System] Linux kernel packet filter. EnforcesACL rules generated by Islandr.Resource Host[Software System] A machine behind the VPN inside asite (e.g. an RDP server). Forbrowser-based RDP the hubconnects to it directly over TLS andrelays to the browser.Delegates OIDC token verificationLooks up or creates user on OIDC loginLogs login eventsAdds / removes peers from WireGuard interfaceTriggers full ruleset recompute on peer state changeLogs all peer mutationsTriggers full ruleset recompute on grant changeLogs ACL mutationsBrowser-RDP RDCleanPath proxy over TLS[TCP/TLS]Logs user mutationsLogs settings changesTriggers recompute on site-CIDR or resource changenft CLI calls[ProcessBuilder]wg CLI calls[ProcessBuilder]JWKS fetch[HTTPS]
Component View: Islandr - Islandr Backend
C4 Level 3 — Backend Components
Show legend
ComponentSoftwareSystem,ExternalRelationship