Islandr

Self-hosted WireGuard management platform. Peer lifecycle, RBAC access control, nftables enforcement.

Index:

Internet[Deployment Node: Public network]Hub VM[Deployment Node: Linux]systemd service[Deployment Node]Linux Kernel[Deployment Node]Reverse Proxy Process[Deployment Node]Admin Browser[Infrastructure Node: Chrome / Firefox]End User Browser[Infrastructure Node: Chrome / Firefox]WireGuard Client[Infrastructure Node: WireGuard App(iOS/Android/macOS/Windows/Linux)]Islandr Backend[Container: Quarkus 3 / Java 21 (native binary)] REST API, domain logic, WireGuardand nftables adapters, OIDC tokenverification, activity polling, auditlogging.Built-in TLS[Infrastructure Node: Quarkus TLS registry] HTTPS :8443 — dummy cert until anadmin uploads one, hot-swapped atruntime, no proxy required(ADR-0015)DNS Resolver[Infrastructure Node] UDP/TCP :53, opt-in in Settings —needs CAP_NET_BIND_SERVICE(outside ADR-0011's sudoers scope);bind failure is caught and logged,resolver stays off rather thancrashing (ADR-0023)SQLite File[Infrastructure Node: Durable file] /var/lib/islandr/islandr.dbwg0[Infrastructure Node: UDP 51820] WireGuard interfacenftables[Infrastructure Node: Packet filter] inet islandr tableTLS Termination[Infrastructure Node] TCP 443 → 8080/8443
Deployment View: Islandr - Native (systemd)
Deployment View — native binary on the Hub VM (systemd)
Show legend
ElementContainer,Backend
Internet[Deployment Node: Public network]Docker Host[Deployment Node: Docker]Linux Kernel[Deployment Node]Reverse Proxy (fully optional)[Deployment Node]islandr container[Deployment Node: Docker container]Admin Browser[Infrastructure Node: Chrome / Firefox]End User Browser[Infrastructure Node: Chrome / Firefox]islandr-proxy.service[Infrastructure Node] systemd service, unprivileged user,socket-activated on/run/islandr/proxy.sock, scopedsudoers for wg/nft — allowlistedJSON protocol (ADR-0012)Data volume[Infrastructure Node: Docker volume] islandr-data → /var/lib/islandr(SQLite)wg0[Infrastructure Node: UDP 51820] WireGuard interfacenftables[Infrastructure Node: Packet filter] inet islandr tableTLS Termination[Infrastructure Node] TCP 443 → 8080/8443Islandr Backend[Container: Quarkus 3 / Java 21 (native binary)] REST API, domain logic, WireGuardand nftables adapters, OIDC tokenverification, activity polling, auditlogging.Built-in TLS[Infrastructure Node: Quarkus TLS registry] HTTPS :8443 — dummy cert until anadmin uploads one, no proxyrequired (ADR-0015)
Deployment View: Islandr - Docker (host socket proxy)
Deployment View — Docker container (evaluation, mock adapters)
Show legend
ElementContainer,Backend