Merge remote-tracking branch 'upstream/master'

perf: avoid repeated client scans during CIDR changes (#2707 )
* perf: avoid repeated client scans during CIDR changes (#2706) * refactor: retain CIDR change guards * perf: avoid repeated client reads during migration --------- Co-authored-by: potatosips <potatosips@users.noreply.github.com>
2026-07-24 12:00:29 +02:00 · 2026-07-23 07:55:04 +02:00 · 2026-07-21 11:00:26 +02:00 · 2026-07-21 10:52:32 +02:00 · 2026-07-21 10:51:31 +02:00 · 2026-07-21 10:37:40 +02:00
241 changed files with 16481 additions and 5923 deletions
@@ -1,28 +1,51 @@
-<!--- Provide a general summary of your changes in the Title above -->
+<!-- Provide a general summary of your changes in the Title above -->

 ## Description
-<!--- Describe your changes in detail -->
+
+<!-- Describe your changes in detail -->
+<!-- Focus on the implementation and any important technical decisions. -->

 ## Motivation and Context
-<!--- Why is this change required? What problem does it solve? -->
-<!--- If it fixes an open issue, please link to the issue here. -->
+
+<!-- Why is this change needed? What problem does it solve? -->
+<!-- Use "Fixes #123" or "Closes #123" when this pull request resolves an issue. -->

 ## How has this been tested?
-<!--- Please describe in detail how you tested your changes. -->
-<!--- Include details of your testing environment, tests ran to see how -->
-<!--- your change affects other areas of the code, etc. -->

-## Screenshots (if appropriate):
+<!-- Please describe in detail how you tested your changes. -->
+<!-- Include details of your testing environment, tests ran to see how -->
+<!-- your change affects other areas of the code, etc. -->
+
+## Screenshots:
+
+<!-- Add screenshots or recordings for visual changes. -->
+<!-- Remove this section if it is not applicable. -->

 ## Types of changes
-<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
+
+<!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
+
 - [ ] Bug fix (non-breaking change which fixes an issue)
 - [ ] New feature (non-breaking change which adds functionality)
 - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Refactoring (change which does not alter existing functionality)
+- [ ] Documentation (changes to documentation only)

 ## Checklist:
-<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
-<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+
+<!-- Go over all the following points, and put an `x` in all the boxes that apply. -->
+<!-- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+
+- [ ] I have reviewed my own changes.
 - [ ] My code follows the code style of this project.
+- [ ] I have added or updated tests where appropriate.
+- [ ] My changes do not include unrelated modifications.
 - [ ] My change requires a change to the documentation.
 - [ ] I have updated the documentation accordingly.
+
+## AI Disclosure:
+
+<!-- See the AI contribution policy: https://github.com/wg-easy/wg-easy/blob/master/contributing.md#ai-contribution-policy -->
+<!-- Disclose whether AI tools were used -->
+<!-- Which tools were used -->
+<!-- The extent to which they were used -->
@@ -5,13 +5,3 @@ updates:
    schedule:
      interval: "weekly"
    rebase-strategy: "auto"
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-  - package-ecosystem: "npm"
-    directory: "/src/"
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
@@ -27,7 +27,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
@@ -21,7 +21,7 @@ jobs:
          # - platform: linux/arm/v7
          #   os: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Prepare
        run: |
@@ -30,7 +30,7 @@ jobs:

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/wg-easy/wg-easy
@@ -38,21 +38,21 @@ jobs:
            latest=false

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.arch.platform }}
@@ -69,7 +69,7 @@ jobs:
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
@@ -85,32 +85,32 @@ jobs:
    needs: docker-build
    steps:
      - name: Download digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Codeberg
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: codeberg.org
          username: ${{ secrets.CODEBERG_USER }}
          password: ${{ secrets.CODEBERG_PASS }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/wg-easy/wg-easy
@@ -123,8 +123,14 @@ jobs:
      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf 'ghcr.io/wg-easy/wg-easy@sha256:%s ' *)
+          n=3
+          for i in $(seq 1 $n); do
+            docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+              $(printf 'ghcr.io/wg-easy/wg-easy@sha256:%s ' *) && break
+
+            [ "$i" = "$n" ] && exit 1
+            sleep 10
+          done

      - name: Inspect image
        run: |
@@ -138,7 +144,7 @@ jobs:
      contents: write
    needs: docker-merge
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -28,7 +28,7 @@ jobs:
          # - platform: linux/arm/v7
          #   os: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          ref: master

@@ -39,7 +39,7 @@ jobs:

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/wg-easy/wg-easy
@@ -47,21 +47,21 @@ jobs:
            latest=false

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.arch.platform }}
@@ -78,7 +78,7 @@ jobs:
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
@@ -94,32 +94,32 @@ jobs:
    needs: docker-build
    steps:
      - name: Download digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Codeberg
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: codeberg.org
          username: ${{ secrets.CODEBERG_USER }}
          password: ${{ secrets.CODEBERG_PASS }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/wg-easy/wg-easy
@@ -132,8 +132,14 @@ jobs:
      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf 'ghcr.io/wg-easy/wg-easy@sha256:%s ' *)
+          n=3
+          for i in $(seq 1 $n); do
+            docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+              $(printf 'ghcr.io/wg-easy/wg-easy@sha256:%s ' *) && break
+
+            [ "$i" = "$n" ] && exit 1
+            sleep 10
+          done

      - name: Inspect image
        run: |
@@ -147,7 +153,7 @@ jobs:
      contents: write
    needs: docker-merge
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          ref: master

@@ -24,7 +24,7 @@ jobs:
          # - platform: linux/arm/v7
          #   os: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Prepare
        run: |
@@ -32,20 +32,20 @@ jobs:
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Docker Image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
@@ -29,7 +29,7 @@ jobs:
          # - platform: linux/arm/v7
          #   os: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Prepare
        run: |
@@ -38,7 +38,7 @@ jobs:

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/wg-easy/wg-easy
@@ -46,21 +46,21 @@ jobs:
            latest=false

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.arch.platform }}
@@ -77,7 +77,7 @@ jobs:
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
@@ -95,32 +95,32 @@ jobs:
    needs: docker-build
    steps:
      - name: Download digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Codeberg
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: codeberg.org
          username: ${{ secrets.CODEBERG_USER }}
          password: ${{ secrets.CODEBERG_PASS }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/wg-easy/wg-easy
@@ -135,8 +135,14 @@ jobs:
      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf 'ghcr.io/wg-easy/wg-easy@sha256:%s ' *)
+          n=3
+          for i in $(seq 1 $n); do
+            docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+              $(printf 'ghcr.io/wg-easy/wg-easy@sha256:%s ' *) && break
+
+            [ "$i" = "$n" ] && exit 1
+            sleep 10
+          done

      - name: Inspect image
        run: |
@@ -152,7 +158,7 @@ jobs:
      contents: write
    needs: docker-merge
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -14,17 +14,17 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false

      - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
-          node-version: "lts/jod"
+          node-version: "lts/krypton"
          check-latest: true
          cache: "pnpm"

@@ -47,17 +47,17 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false

      - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
-          node-version: "lts/jod"
+          node-version: "lts/krypton"
          check-latest: true
          cache: "pnpm"

@@ -1,3 +1,6 @@
 .DS_Store
 *.swp
-node_modules
+node_modules
+
+docs/site
+docs/.cache
@@ -26,5 +26,8 @@
  "i18n-ally.sortKeys": false,
  "i18n-ally.keepFulfilled": false,
  "i18n-ally.keystyle": "nested",
-  "editor.gotoLocation.multipleDefinitions": "goto"
+  "editor.gotoLocation.multipleDefinitions": "goto",
+  "[toml]": {
+    "editor.defaultFormatter": "tamasfe.even-better-toml"
+  }
 }
@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+### Added
+
+- Support disabling version check (https://github.com/wg-easy/wg-easy/pull/2648)
+- OAuth integration (https://github.com/wg-easy/wg-easy/pull/2659)
+
+### Fixed
+
+- Button styling (https://github.com/wg-easy/wg-easy/pull/2666)
+- Escape Prometheus label values (https://github.com/wg-easy/wg-easy/pull/2702)
+- Skip ip6tables for firewall when IPv6 is disabled (https://github.com/wg-easy/wg-easy/pull/2701)
+
+### Changed
+
+- Only set sysctl if needed (https://github.com/wg-easy/wg-easy/pull/2630)
+- Improve security (https://github.com/wg-easy/wg-easy/pull/2661, https://github.com/wg-easy/wg-easy/pull/2668, https://github.com/wg-easy/wg-easy/pull/2669)
+- Replace mkdocs with zensical (https://github.com/wg-easy/wg-easy/pull/2667)
+- Migrate to Nuxt 4 (https://github.com/wg-easy/wg-easy/pull/2660)
+
+## [15.3.0] - 2026-05-18
+
+### Added
+
+- AWG: support for H1-H4 ranges (https://github.com/wg-easy/wg-easy/pull/2480)
+- Client Firewall (https://github.com/wg-easy/wg-easy/pull/2418)
+- CLI: Show QR code (https://github.com/wg-easy/wg-easy/pull/2518)
+- Copy QR code to clipboard / save as png (https://github.com/wg-easy/wg-easy/pull/2521)
+
+### Fixed
+
+- Add trailing newline to Prometheus metrics output (https://github.com/wg-easy/wg-easy/pull/2573)
+- Correctly use DEBUG env var (https://github.com/wg-easy/wg-easy/pull/2619)
+
+### Changed
+
+- Hooks are now Textareas (https://github.com/wg-easy/wg-easy/pull/2522)
+- Update to Node Krypton (24) (https://github.com/wg-easy/wg-easy/pull/2536)
+- Mobile UI (https://github.com/wg-easy/wg-easy/pull/2569)
+- Prevent enabling client when expired (https://github.com/wg-easy/wg-easy/pull/2594)
+
 ## [15.2.2] - 2026-02-06

 ### Added
@@ -1,4 +1,4 @@
-FROM docker.io/library/node:jod-alpine AS build
+FROM docker.io/library/node:krypton-alpine AS build
 WORKDIR /app

 # update corepack
@@ -7,7 +7,7 @@ RUN npm install --global corepack@latest
 RUN corepack enable pnpm

 # Copy Web UI
-COPY src/package.json src/pnpm-lock.yaml ./
+COPY src/package.json src/pnpm-lock.yaml src/pnpm-workspace.yaml ./
 RUN pnpm install

 # Build UI
@@ -21,11 +21,16 @@ RUN apk add linux-headers build-base go git && \
    cd amneziawg-go && \
    make && \
    cd ../amneziawg-tools/src && \
-    make
+    make && \
+    sed -i 's|\[\[ $proto == -4 \]\] && cmd sysctl -q net\.ipv4\.conf\.all\.src_valid_mark=1|[[ $proto == -4 ]] \&\& [[ $(sysctl -n net.ipv4.conf.all.src_valid_mark) != 1 ]] \&\& cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1|' ./wg-quick/linux.bash
+
+FROM docker.io/library/node:krypton-alpine AS build-libsql
+WORKDIR /app
+RUN npm install --no-save --omit=dev libsql

 # Copy build result to a new image.
 # This saves a lot of disk space.
-FROM docker.io/library/node:jod-alpine
+FROM docker.io/library/node:krypton-alpine
 WORKDIR /app

 HEALTHCHECK --interval=1m --timeout=5s --retries=3 CMD /usr/bin/timeout 5s /bin/sh -c "/usr/bin/wg show | /bin/grep -q interface || exit 1"
@@ -35,9 +40,8 @@ COPY --from=build /app/.output /app
 # Copy migrations
 COPY --from=build /app/server/database/migrations /app/server/database/migrations
 # libsql (https://github.com/nitrojs/nitro/issues/3328)
-RUN cd /app/server && \
-    npm install --no-save --omit=dev libsql && \
-    npm cache clean --force
+COPY --from=build-libsql /app/node_modules /app/server/node_modules
+
 # cli
 COPY --from=build /app/cli/cli.sh /usr/local/bin/cli
 RUN chmod +x /usr/local/bin/cli
@@ -59,7 +63,8 @@ RUN apk add --no-cache \
    kmod \
    iptables-legacy \
    wireguard-go \
-    wireguard-tools
+    wireguard-tools && \
+    sed -i 's|\[\[ $proto == -4 \]\] && cmd sysctl -q net\.ipv4\.conf\.all\.src_valid_mark=1|[[ $proto == -4 ]] \&\& [[ $(sysctl -n net.ipv4.conf.all.src_valid_mark) != 1 ]] \&\& cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1|' /usr/bin/wg-quick

 RUN mkdir -p /etc/amnezia
 RUN ln -s /etc/wireguard /etc/amnezia/amneziawg
@@ -69,7 +74,7 @@ RUN update-alternatives --install /usr/sbin/iptables iptables /usr/sbin/iptables
 RUN update-alternatives --install /usr/sbin/ip6tables ip6tables /usr/sbin/ip6tables-legacy 10 --slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/ip6tables-legacy-restore --slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/ip6tables-legacy-save

 # Set Environment
-ENV DEBUG=Server,WireGuard,Database,CMD
+ENV DEBUG=Server,WireGuard,Database,CMD,Firewall
 ENV PORT=51821
 ENV HOST=0.0.0.0
 ENV INSECURE=false
@@ -1,4 +1,4 @@
-FROM docker.io/library/node:jod-alpine
+FROM docker.io/library/node:krypton-alpine
 WORKDIR /app

 # update corepack
@@ -24,7 +24,7 @@ RUN update-alternatives --install /usr/sbin/iptables iptables /usr/sbin/iptables
 RUN update-alternatives --install /usr/sbin/ip6tables ip6tables /usr/sbin/ip6tables-legacy 10 --slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/ip6tables-legacy-restore --slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/ip6tables-legacy-save

 # Set Environment
-ENV DEBUG=Server,WireGuard,Database,CMD
+ENV DEBUG=Server,WireGuard,Database,CMD,Firewall
 ENV PORT=51821
 ENV HOST=0.0.0.0
 ENV INSECURE=true
@@ -32,7 +32,7 @@ ENV INIT_ENABLED=false
 ENV DISABLE_IPV6=false

 # Install Dependencies
-COPY src/package.json src/pnpm-lock.yaml ./
+COPY src/package.json src/pnpm-lock.yaml src/pnpm-workspace.yaml ./
 RUN pnpm install

 # Copy Project
@@ -1,16 +1,14 @@
 # WireGuard Easy

-[![Build & Publish latest Image](https://github.com/wg-easy/wg-easy/actions/workflows/deploy.yml/badge.svg?branch=production)](https://github.com/wg-easy/wg-easy/actions/workflows/deploy.yml)
+[![Build & Publish latest Image](https://github.com/wg-easy/wg-easy/actions/workflows/deploy.yml/badge.svg)](https://github.com/wg-easy/wg-easy/actions/workflows/deploy.yml)
 [![Lint](https://github.com/wg-easy/wg-easy/actions/workflows/lint.yml/badge.svg?branch=master)](https://github.com/wg-easy/wg-easy/actions/workflows/lint.yml)
 [![GitHub Stars](https://img.shields.io/github/stars/wg-easy/wg-easy)](https://github.com/wg-easy/wg-easy/stargazers)
 [![License](https://img.shields.io/github/license/wg-easy/wg-easy)](LICENSE)
 [![GitHub Release](https://img.shields.io/github/v/release/wg-easy/wg-easy)](https://github.com/wg-easy/wg-easy/releases/latest)
-[![Image Pulls](https://img.shields.io/badge/image_pulls-12M+-blue)](https://github.com/wg-easy/wg-easy/pkgs/container/wg-easy)
+[![Image Pulls](https://img.shields.io/badge/image_pulls-28M+-blue)](https://github.com/wg-easy/wg-easy/pkgs/container/wg-easy)

 You have found the easiest way to install & manage WireGuard on any Linux host!

-<!-- TOOD: update screenshot -->
-
 <p align="center">
  <img src="./assets/screenshot.png" width="802" alt="wg-easy Screenshot" />
 </p>
@@ -33,6 +31,7 @@ You have found the easiest way to install & manage WireGuard on any Linux host!
 - IPv6 support
 - CIDR support
 - 2FA support
+- Per-client firewall filtering (requires iptables)

 > [!NOTE]
 > To better manage documentation for this project, it has its own site here: [https://wg-easy.github.io/wg-easy/latest](https://wg-easy.github.io/wg-easy/latest)
@@ -0,0 +1,63 @@
+{
+  "fill" : {
+    "automatic-gradient" : "display-p3:0.48853,0.13220,0.12335,1.00000"
+  },
+  "groups" : [
+    {
+      "layers" : [
+        {
+          "fill" : {
+            "automatic-gradient" : "srgb:1.00000,1.00000,1.00000,1.00000"
+          },
+          "image-name" : "wireguard-logo.png",
+          "name" : "wireguard-logo",
+          "position" : {
+            "scale" : 0.5,
+            "translation-in-points" : [
+              255.828125,
+              -225.5
+            ]
+          }
+        },
+        {
+          "fill-specializations" : [
+            {
+              "value" : {
+                "automatic-gradient" : "srgb:1.00000,1.00000,1.00000,1.00000"
+              }
+            },
+            {
+              "appearance" : "dark",
+              "value" : {
+                "automatic-gradient" : "display-p3:0.48853,0.13220,0.12335,1.00000"
+              }
+            }
+          ],
+          "image-name" : "ticket.png",
+          "name" : "ticket",
+          "position" : {
+            "scale" : 1.2,
+            "translation-in-points" : [
+              -119.91562499999998,
+              165.65625
+            ]
+          }
+        }
+      ],
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.5
+      }
+    }
+  ],
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
+  }
+}
@@ -2,17 +2,15 @@

 First and foremost, thank you! We appreciate that you want to contribute to wg-easy, your time is valuable, and your contributions mean a lot to us.

-
 ## Important!

 By contributing to this project, you:

-* Agree that you have authored 100% of the content
-* Agree that you have the necessary rights to the content
-* Agree that you have received the necessary permissions from your employer to make the contributions (if applicable)
-* Agree that the content you contribute may be provided under the Project license(s)
-* Agree that, if you did not author 100% of the content, the appropriate licenses and copyrights have been added along with any other necessary attribution.
-
+- Agree that you have authored 100% of the content
+- Agree that you have the necessary rights to the content
+- Agree that you have received the necessary permissions from your employer to make the contributions (if applicable)
+- Agree that the content you contribute may be provided under the Project license(s)
+- Agree that, if you did not author 100% of the content, the appropriate licenses and copyrights have been added along with any other necessary attribution.

 ## Getting started

@@ -24,7 +22,6 @@ Creating an issue is the simplest form of contributing to a project. But there a
 - Feature requests
 - Bug reports

-
 ## Showing support for wg-easy

 Please keep in mind that open source software is built by people like you, who spend their free time creating things the rest the community can use.
@@ -34,6 +31,20 @@ Don't have time to contribute? No worries, here are some other ways to show your
 - star the [project](https://github.com/wg-easy/wg-easy)
 - tweet your support for wg-easy

+## AI Contribution Policy
+
+Contributions made with the assistance of AI tools are welcome, but contributors must use them responsibly and disclose that use clearly.
+
+1. Review AI-generated code closely before marking a pull request ready for review.
+2. Manually test the changes and add appropriate automated tests where feasible.
+3. Only use AI to assist in contributions that you understand well enough to explain, defend, and revise yourself during review.
+4. Disclose AI-assisted content clearly.
+5. Do not use AI to reply to questions about your issue or pull request. The questions are for you, not an AI model.
+6. AI may be used to help draft issues and pull requests, but contributors remain responsible for the accuracy, completeness, and intent of what they submit.
+
+Maintainers reserve the right to close pull requests and issues that do not disclose AI assistance, that appear to be low-quality AI-generated content, or where the contributor cannot explain or defend the proposed changes themselves.
+
+We welcome new contributors, but cannot sustain the effort of supporting contributors who primarily defer to AI rather than engaging substantively with the review process.

 ## Issues

@@ -71,7 +82,6 @@ Please be as descriptive as possible when creating an issue. Give us the informa
 - **error messages**: (required) please paste any error messages into the issue, or a [gist](https://gist.github.com/)
 - **extensions, plugins, helpers, etc** (if applicable): please list any extensions you're using

-
 ### Closing issues

 The original poster or the maintainers of wg-easy may close an issue at any time. Typically, but not exclusively, issues are closed when:
@@ -81,7 +91,6 @@ The original poster or the maintainers of wg-easy may close an issue at any time
 - An issue is clearly a duplicate of another issue, in which case the duplicate issue will be linked.
 - A discussion has clearly run its course

-
 ## Next steps

 **Tips for creating idiomatic issues**
@@ -5,6 +5,7 @@ title: API
 /// warning | Breaking Changes

 This API is not yet stable and may change in the future. The API is currently in development and is subject to change without notice. The API is not yet documented, but we will add documentation as the API stabilizes.
+
 ///

 You can use the API to interact with the application programmatically. The API is available at `/api` and supports both GET and POST requests. The API is designed to be simple and easy to use, with a focus on providing a consistent interface for all endpoints.
@@ -39,14 +39,14 @@ If a parameter is not set, it will not be added to the configuration. If all Amn

 ### Parameter Compatibility Table

-| Parameter | Can differ between server and client | Configurable on server | Configurable on client  |
-| --------- | ------------------------------------ | ---------------------- | ----------------------- |
-| Jc        | ✅ Yes                               | ✅                     | ✅                      |
-| Jmin      | ✅ Yes                               | ✅                     | ✅                      |
-| Jmax      | ✅ Yes                               | ✅                     | ✅                      |
-| S1-S4     | ❌ No, must match                    | ✅                     | ❌ (copied from server) |
-| H1-H4     | ❌ No, must match                    | ✅                     | ❌ (copied from server) |
-| I1-I5     | ✅ Yes                               | ✅                     | ✅                      |
+| Parameter | Can differ between server and client | Configurable on server | Configurable on client   |
+| --------- | ------------------------------------ | ---------------------- | ------------------------ |
+| Jc        | :white_check_mark: Yes               | :white_check_mark:     | :white_check_mark:       |
+| Jmin      | :white_check_mark: Yes               | :white_check_mark:     | :white_check_mark:       |
+| Jmax      | :white_check_mark: Yes               | :white_check_mark:     | :white_check_mark:       |
+| S1-S4     | :x: No, must match                   | :white_check_mark:     | :x: (copied from server) |
+| H1-H4     | :x: No, must match                   | :white_check_mark:     | :x: (copied from server) |
+| I1-I5     | :white_check_mark: Yes               | :white_check_mark:     | :white_check_mark:       |

 ## Client Applications

@@ -0,0 +1,182 @@
+---
+title: External Authentication
+---
+
+## OAuth
+
+### Setup
+
+To enable OAuth set the env var `OAUTH_PROVIDERS` to any of the following providers:
+
+| Provider                      | Value    |
+| ----------------------------- | -------- |
+| [Google](#google)             | `google` |
+| [GitHub](#github)             | `github` |
+| [Generic OIDC](#generic-oidc) | `oidc`   |
+
+You can enable multiple providers by separating them with a comma:
+
+e.g. `google,github`
+
+### Auto Register
+
+To automatically register users that log in with an OAuth provider, set the following environment variable to `true`:
+
+| Env                   | Required | Default | Description              |
+| --------------------- | -------- | ------- | ------------------------ |
+| `OAUTH_AUTO_REGISTER` | :x:      | `false` | Enable auto-registration |
+
+When enabled:
+
+- If a user logs in with an email address that is not yet registered, a new account will be created for them.
+
+- If a user logs in with an email address that is already registered, their account will be linked to the OAuth provider (if not already linked), regardless of the value of `OAUTH_AUTO_REGISTER`.
+
+/// warning | Security
+
+Users will be created with Admin Permissions, as the permissions system is not yet implemented. Only enable this if you trust all users that can log in with the OAuth provider.
+
+Use [Allowed Domains](#allowed-domains) to restrict which users can log in.
+
+///
+
+### Allowed Domains
+
+To only allow users with an email address from a specific domain to log in, set the following environment variable to the allowed domain.
+
+| Env                     | Required | Default | Description           |
+| ----------------------- | -------- | ------- | --------------------- |
+| `OAUTH_ALLOWED_DOMAINS` | :x:      | -       | Allowed email domains |
+
+You can allow multiple domains by separating them with a comma:
+
+e.g. `example.com,example.org`
+
+### Auto Launch
+
+To automatically launch the OAuth login flow when visiting the login page, set the following environment variable to the provider you want to launch:
+
+| Env                 | Required | Default | Description                   |
+| ------------------- | -------- | ------- | ----------------------------- |
+| `OAUTH_AUTO_LAUNCH` | :x:      | -       | Auto launch an OAuth provider |
+
+When enabled:
+
+- Visiting the login page will automatically redirect to the selected provider's login page
+- The user can still access the normal login page by visiting `/login?auto_launch=false`
+- You can auto launch any provider by visiting `/login?auto_launch=<provider>`
+
+### Redirect URIs
+
+You have to configure the following redirect URIs in your OAuth provider:
+
+- `https://<your-domain>/api/auth/<provider>/callback`
+  Used to log in to with the provider
+- `https://<your-domain>/api/auth/<provider>/link`
+  Used to link an existing account to the provider
+
+If your provider does not support multiple redirect URIs (e.g. GitHub) but allows multiple URIs under the same base, then configure:
+
+- `https://<your-domain>/api/auth/<provider>/`
+
+### Provider Configuration
+
+#### Google
+
+| Env                          | Required           | Description          |
+| ---------------------------- | ------------------ | -------------------- |
+| `OAUTH_GOOGLE_CLIENT_ID`     | :white_check_mark: | Google Client ID     |
+| `OAUTH_GOOGLE_CLIENT_SECRET` | :white_check_mark: | Google Client Secret |
+
+<h5>Setup</h5>
+
+1. Go to [Google Cloud Console](https://console.cloud.google.com/apis/credentials)
+2. Create an OAuth 2.0 Client ID (Web application)
+3. Add Authorized redirect URI: See [Redirect URIs](#redirect-uris)
+4. Copy the Client ID and Client Secret to the environment variables
+
+#### GitHub
+
+| Env                          | Required           | Description          |
+| ---------------------------- | ------------------ | -------------------- |
+| `OAUTH_GITHUB_CLIENT_ID`     | :white_check_mark: | GitHub Client ID     |
+| `OAUTH_GITHUB_CLIENT_SECRET` | :white_check_mark: | GitHub Client Secret |
+
+<h5>Setup</h5>
+
+1. Go to [GitHub Developer Settings](https://github.com/settings/developers)
+2. Create a new OAuth App
+3. Add Authorization callback URL: See [Redirect URIs](#redirect-uris)
+4. Create a new client secret
+5. Copy the Client ID and Client Secret to the environment variables
+
+#### Generic OIDC
+
+This supports generic OIDC providers like Authelia, Authentik, etc.
+
+The provider needs to support:
+
+- PKCE
+- default scopes: `openid email profile`
+- Client Secret Authentication `client_secret_post`
+
+The provider needs to be available with HTTPS and have a valid certificate.
+
+| Env                        | Required           | Default | Example                    | Description        |
+| -------------------------- | ------------------ | ------- | -------------------------- | ------------------ |
+| `OAUTH_OIDC_SERVER`        | :white_check_mark: | -       | `https://auth.example.com` | OIDC Server        |
+| `OAUTH_OIDC_CLIENT_ID`     | :white_check_mark: | -       | -                          | OIDC Client ID     |
+| `OAUTH_OIDC_CLIENT_SECRET` | :white_check_mark: | -       | -                          | OIDC Client Secret |
+| `OAUTH_OIDC_NAME`          | :x:                | OIDC    | `Authelia`                 | Provider Name      |
+
+##### Authelia Setup
+
+Generate Client ID and Secret:
+
+```shell
+# Client ID
+docker run --rm authelia/authelia:latest authelia crypto rand --length 72 --charset rfc3986
+# Client Secret
+docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
+```
+
+```yaml
+- client_id: '...'
+  client_name: wg-easy
+  client_secret: '$pbkdf2-...'
+  redirect_uris:
+      - https://<your-domain>/api/auth/oidc/callback
+      - https://<your-domain>/api/auth/oidc/link
+  scopes:
+      - openid
+      - profile
+      - email
+  authorization_policy: one_factor
+  pre_configured_consent_duration: 1 week
+  require_pkce: true
+  token_endpoint_auth_method: client_secret_post
+```
+
+#### Generic OAuth
+
+Not currently supported
+
+### Disable Password Authentication
+
+To disable password-based authentication and only allow login via OAuth providers, set the following environment variable to `true`:
+
+| Env                     | Required | Default | Description                     |
+| ----------------------- | -------- | ------- | ------------------------------- |
+| `DISABLE_PASSWORD_AUTH` | :x:      | `false` | Disable password authentication |
+
+When enabled:
+
+- Users will not be able to log in with a password
+
+/// warning | Access Recovery
+
+Before disabling password authentication, ensure that at least one OAuth provider is configured and that you have successfully linked an administrator account.
+
+If no login method is available, you will not be able to log in to the application and will need to reset the configuration to regain access.
+
+///
@@ -4,12 +4,13 @@ title: Optional Configuration

 You can set these environment variables to configure the container. They are not required, but can be useful in some cases.

-| Env            | Default   | Example     | Description                        |
-| -------------- | --------- | ----------- | ---------------------------------- |
-| `PORT`         | `51821`   | `6789`      | TCP port for Web UI.               |
-| `HOST`         | `0.0.0.0` | `localhost` | IP address web UI binds to.        |
-| `INSECURE`     | `false`   | `true`      | If access over http is allowed     |
-| `DISABLE_IPV6` | `false`   | `true`      | If IPv6 support should be disabled |
+| Env                     | Default   | Example     | Description                             |
+| ----------------------- | --------- | ----------- | --------------------------------------- |
+| `PORT`                  | `51821`   | `6789`      | TCP port for Web UI.                    |
+| `HOST`                  | `0.0.0.0` | `localhost` | IP address web UI binds to.             |
+| `INSECURE`              | `false`   | `true`      | If access over http is allowed          |
+| `DISABLE_IPV6`          | `false`   | `true`      | If IPv6 support should be disabled      |
+| `DISABLE_VERSION_CHECK` | `false`   | `true`      | If wg-easy should check for new updates |

 /// note | IPv6 Caveats

@@ -23,6 +23,7 @@ These will only be used during the first start of the container. After that, the
 If variables are in the same group, you have to set all of them. For example, if you set `INIT_IPV4_CIDR`, you also have to set `INIT_IPV6_CIDR`.

 If you want to skip the setup process, you have to configure group `1`
+
 ///

 /// note | Security
@@ -30,4 +31,5 @@ If you want to skip the setup process, you have to configure group `1`
 The initial username and password is not checked for complexity. Make sure to set a long enough username and password. Otherwise, the user won't be able to log in.

 It's recommended to remove the variables after the setup is done to prevent the password from being exposed.
+
 ///
@@ -39,4 +39,5 @@ You can use the following Grafana dashboard to visualize the metrics:

 The Grafana dashboard is not official and is not maintained by the `wg-easy` team. If you have any issues with the dashboard, please contact the author of the dashboard.
 See [#1299](https://github.com/wg-easy/wg-easy/pull/1299) for more information.
+
 ///
@@ -9,6 +9,7 @@ This project is Open Source. That means that you can contribute on enhancements,
 /// note | Attention

 **Before opening an issue**, read the [`README`][github-file-readme] carefully, study the docs for your version (maybe [latest][docs-latest]) and your search engine you trust. The issue tracker is not meant to be used for unrelated questions!
+
 ///

 When opening an issue, please provide details use case to let the community reproduce your problem.
@@ -16,6 +17,7 @@ When opening an issue, please provide details use case to let the community repr
 /// note | Attention

 **Use the issue templates** to provide the necessary information. Issues which do not use these templates are not worked on and closed.
+
 ///

 By raising issues, I agree to these terms and I understand, that the rules set for the issue tracker will help both maintainers as well as everyone to find a solution.
@@ -39,6 +41,7 @@ When an option is marked with "not officially supported" / "unsupported", then s
 /// question | Motivation

 You want to add a feature? Feel free to start creating an issue explaining what you want to do and how you're thinking doing it. Other users may have the same need and collaboration may lead to better results.
+
 ///

 ### Submit a Pull-Request
@@ -9,9 +9,11 @@ This tutorial is a follow-up to the official [Traefik tutorial](./traefik.md). I
 - A working [wg-easy](./basic-installation.md) and [Traefik](./traefik.md) setup from the previous guides.

 /// warning | Important: Following this guide will reset your WireGuard configuration.
+
 The process involves re-creating the `wg-easy` container and its data, which means **all existing WireGuard clients and settings will be deleted.**

 You will need to create your clients again after completing this guide.
+
 ///

 ## Add `adguard` configuration
@@ -152,13 +154,15 @@ networks:
 2. Navigate to `https://adguard.$example.com$` to begin the AdGuard Home setup.

 /// warning | Important: Configure AdGuard Home Admin Web Interface Port
+
 During the initial AdGuard Home setup on the `Step 2/5` page, you **must** set the **Admin Web Interface Port** to **3000**. Do not use the default port 80, as it will not work with the Traefik configuration.

 After completing the setup, the AdGuard UI might appear unresponsive. This is expected. **Simply reload the page**, and the panel will display correctly.
-///

 > If you accidentally left it default (80), you will need to manually edit the `docker-compose.yml` file for AdGuard Home (`/etc/docker/containers/adguard/docker-compose.yml`) and change the line `traefik.http.services.adguard.loadbalancer.server.port=3000` to `traefik.http.services.adguard.loadbalancer.server.port=80`. After making this change, restart AdGuard Home by navigating to `/etc/docker/containers/adguard` and running `sudo docker compose up -d`.

+///
+
 ## Final System Checks

 ### Firewall
@@ -2,7 +2,7 @@
 title: Basic Installation
 ---

-<!-- TOOD: add docs for pihole, nginx, caddy, traefik -->
+<!-- TODO: add docs for pihole, nginx, caddy, traefik -->

 ## Requirements

@@ -5,6 +5,7 @@ title: Caddy
 /// note | Opinionated

 This guide is opinionated. If you use other conventions or folder layouts, feel free to change the commands and paths.
+
 ///

 We're using [Caddy](https://caddyserver.com/) here as reverse proxy to serve `wg-easy` on [https://wg-easy.example.com](https://wg-easy.example.com) via TLS.
@@ -7,6 +7,7 @@ title: No Reverse Proxy
 This is insecure. You should use a reverse proxy to secure the connection.

 Only use this method if you know what you are doing.
+
 ///

 If you only allow access to the web UI from your local network, you can skip the reverse proxy setup. This is not recommended, but it is possible.
@@ -61,6 +61,7 @@ Pick an IPv4 and IPv6 subnet for your clients and add static routes on your rout
 /// note | 2001:db8::/32

 The _documentation prefix_ `2001:db8::/32` (RFC 3849) used in this example is not meant for production use, replace it with your own ISP-assigned IPv6 prefix (GUA) or local prefix (ULA)
+
 ///

 I want my WireGuard clients in `192.168.0.0/24` and `2001:db8:abc:0::/64`.
@@ -5,6 +5,7 @@ title: Traefik
 /// note | Opinionated

 This guide is opinionated. If you use other conventions or folder layouts, feel free to change the commands and paths.
+
 ///

 ## Create docker compose project
@@ -6,6 +6,20 @@ hide:

 Here are some frequently asked questions or errors about `wg-easy`. If you have a question that is not answered here, please feel free to open a discussion on GitHub.

+## How do I restrict client access to specific networks or servers?
+
+Use the **Per-Client Firewall** feature to enforce server-side restrictions on what each client can access.
+
+**Requirements:** This feature requires `iptables` (and `ip6tables` for IPv6) to be installed on the host system.
+
+1. Enable "Per-Client Firewall" in **Admin Panel → Interface**
+2. Edit a client and configure "Firewall Allowed IPs"
+3. Specify which destinations the client should be allowed to access
+
+Unlike "Allowed IPs" which only controls client-side routing, firewall rules are enforced by the server and cannot be bypassed.
+
+See the [Admin Panel Guide](./guides/admin.md#per-client-firewall) and [Client Guide](./guides/clients.md#firewall-allowed-ips) for detailed configuration.
+
 ## Error: WireGuard exited with the error: Cannot find device "wg0"

 This error indicates that the WireGuard interface `wg0` does not exist. This can happen if the WireGuard kernel module is not loaded or if the interface was not created properly.
@@ -95,3 +109,31 @@ To resolve this issue, you can try the following steps:
    ```shell
     echo "ip6table_filter" | sudo tee -a /etc/modules
    ```
+
+## Clients lose connectivity after restarting the container when using multiple networks?
+
+When you attach multiple Docker networks (e.g., `wg` and a reverse proxy network like `traefik` or `nginx`) to the `wg-easy` container, Docker might assign the network interfaces randomly (e.g., swapping `eth0` and `eth1`). Since `wg-easy` expects the wireguard interface to act as `eth0` and configures `POSTROUTING` rules for it, connectivity will break if the interfaces are swapped upon container restart.
+
+To solve this, specify the `interface_name` and `gw_priority` explicitly in your `docker-compose.yml` file to guarantee that the `wg` network always binds to `eth0` and acts as the default gateway.
+
+**Example `docker-compose.yml`:**
+
+```yaml
+services:
+    wg-easy:
+        # ... other configuration ...
+        networks:
+            wg:
+                interface_name: eth0
+                gw_priority: 1
+                ipv4_address: 10.42.42.42
+            nginx:
+                interface_name: eth1
+                gw_priority: 0
+
+networks:
+    wg:
+        # ... wg network config ...
+    nginx:
+        external: true
+```
@@ -24,6 +24,7 @@ There are a few requirements for a suitable host system:

 On the host, you need to have a suitable container runtime (like _Docker_ or _Podman_) installed. We assume [_Docker Compose_][docker-compose] is [installed][docker-compose-installation]. We have aligned file names and configuration conventions with the latest [Docker Compose specification][docker-compose-specification].
 If you're using podman, make sure to read the related [documentation][docs-podman].
+
 ///

 [docker-compose]: https://docs.docker.com/compose/
@@ -69,6 +70,7 @@ When publishing a tag we follow the [Semantic Versioning][semver] specification.
 /// danger | Use the Correct Commands For Stopping and Starting `wg-easy`

 **Use `sudo docker compose up / down`, not `sudo docker compose start / stop`**. Otherwise, the container is not properly destroyed and you may experience problems during startup because of inconsistent state.
+
 ///

 **That's it! It really is that easy**.
@@ -2,4 +2,44 @@
 title: Admin Panel
 ---

-TODO
+## Interface Settings
+
+### Per-Client Firewall
+
+Enable server-side firewall filtering to enforce network access restrictions per client.
+
+When enabled, each client can have custom "Firewall Allowed IPs" configured that restrict which destinations they can access through the VPN. These restrictions are enforced by the server using iptables/ip6tables and cannot be bypassed by the client.
+
+/// warning | Experimental Feature
+
+This feature is currently experimental. While functional, it should be thoroughly tested in your environment before relying on it for production security requirements. Always verify that firewall rules are working as expected using test traffic or by manually inspecting the rules.
+
+///
+
+**Requirements:**
+
+- `iptables` must be installed on the host system
+- `ip6tables` must be installed if IPv6 is enabled (default)
+- The feature cannot be enabled if these tools are not available
+
+/// note
+
+Most Linux distributions include iptables by default. If you're running in a minimal container environment, you may need to install the `iptables` package on the host system.
+
+///
+
+**Enable this feature if you want to:**
+
+- Restrict certain clients to only access specific servers or networks
+- Prevent clients from accessing the internet while allowing LAN access
+- Enforce port-based restrictions (e.g., only allow HTTP/HTTPS)
+- Separate routing configuration from security enforcement
+
+**How it works:**
+
+1. Enable "Per-Client Firewall" in Admin Panel → Interface
+2. Edit any client to see the new "Firewall Allowed IPs" field
+3. Specify allowed destinations (IPs, subnets, ports) for that client
+4. Server enforces these rules automatically
+
+See [Edit Client → Firewall Allowed IPs](./clients.md#firewall-allowed-ips) for detailed configuration syntax and examples.
@@ -41,3 +41,31 @@ docker compose exec -it wg-easy cli db:admin:reset --password <new_password>
 ```

 This will reset the password for the admin user to the new password you provided. If you include special characters in the password, make sure to escape them properly.
+
+### Show Clients
+
+List all clients that are currently configured with details such as client ID, Name, Public Key, and enabled status.
+
+```shell
+cli clients:list
+```
+
+### Show Client QR Code
+
+Display the QR code for a specific client, which can be scanned by a compatible app to import the client's configuration.
+
+```shell
+cli clients:qr <client_id>
+```
+
+Replace `<client_id>` with the actual client ID you want to show the QR code for.
+
+/// warning | IPv6 Support
+
+IPv6 support is enabled by default, even if you disabled it using environment variables. To disable it pass the `--no-ipv6` flag when running the CLI.
+
+```shell
+cli clients:qr <client_id> --no-ipv6
+```
+
+///
@@ -19,7 +19,60 @@ Which IPs will be routed through the VPN.

 This will not prevent the user from modifying it locally and accessing IP ranges that they should not be able to access.

-Use firewall rules to prevent access to IP ranges that the user should not be able to access.
+Use the Firewall Allowed IPs feature to prevent access to IP ranges that the user should not be able to access.
+
+## Firewall Allowed IPs
+
+/// note | Attention
+
+This field only appears when **Per-Client Firewall** is enabled in the Admin Panel → Interface settings.
+
+///
+
+Server-side firewall rules that restrict which destinations the client can access, regardless of their local configuration.
+
+Unlike "Allowed IPs" which only controls routing on the client side, these rules are enforced by the server using iptables/ip6tables and cannot be bypassed by the client.
+
+**Supported Formats:**
+
+- `10.10.0.3`, `2001:db8::1` - Allow access to a single IP address
+- `10.10.0.0/24`, `2001:db8::/32` - Allow access to an entire subnet
+- `192.168.1.5:443` - Allow access to specific port (TCP+UDP)
+- `192.168.1.5:443/tcp` - Allow access to specific port (TCP only)
+- `192.168.1.5:443/udp` - Allow access to specific port (UDP only)
+- `10.10.0.0/24:443` - Allow access to an entire subnet on a specific port (TCP+UDP)
+- `10.10.0.0/24:443/tcp` - Allow access to an entire subnet on a specific port (TCP only)
+- `10.10.0.0/24:443/udp` - Allow access to an entire subnet on a specific port (UDP only)
+- `[2001:db8::1]:443` - IPv6 address with port (brackets required)
+- `[2001:db8::/32]:443/tcp` - IPv6 CIDR with port and protocol
+
+/// warning | Invalid Formats
+
+Protocol specifiers (`/tcp` or `/udp`) require a port number. The following formats are **not supported** and will result in an error:
+
+- `10.10.0.3/tcp` (use `10.10.0.3:443/tcp` instead)
+- `10.10.0.0/24/udp` (use `10.10.0.0/24:53/udp` instead)
+
+///
+
+**Behavior:**
+
+- **Empty**: Falls back to the client's "Allowed IPs" setting
+- **Specified**: Only listed destinations are accessible (allow-only, everything else is blocked)
+- **Disable for specific client**: To disable firewall filtering for a single client while keeping it enabled for others, add `0.0.0.0/0, ::/0` to allow all traffic
+
+/// note
+
+To allow clients to reach the VPN server itself (e.g. for DNS), include the server's VPN address in the firewall allowed IPs.
+
+///
+
+**Use Case Examples**:
+
+- Allow only specific servers: `10.10.0.5`
+- Allow only internal network: `10.10.0.0/24, 192.168.1.0/24`
+- Allow only web browsing: `0.0.0.0/0:80, 0.0.0.0/0:443, [::/0]:80, [::/0]:443`
+- Block internet, allow LAN: Leave "Allowed IPs" as `0.0.0.0/0, ::/0` but set Firewall IPs to `10.0.0.0/8, 192.168.0.0/16`

 ## Server Allowed IPs

@@ -9,6 +9,7 @@ hide:
 /// info | This Documentation is Versioned

 **Make sure** to select the correct version of this documentation! It should match the version of the image you are using. The default version corresponds to [the most recent stable release][docs-tagging].
+
 ///

 This documentation provides you not only with the basic setup and configuration of `wg-easy` but also with advanced configuration, elaborate usage scenarios, detailed examples, hints and more.
@@ -1,87 +0,0 @@
-site_name: 'wg-easy'
-site_description: 'The easiest way to run WireGuard VPN + Web-based Admin UI.'
-site_author: 'WireGuard Easy'
-copyright: >
-    <p>
-    &copy <a href="https://github.com/wg-easy"><em>Wireguard Easy</em></a><br/>
-    <span>This project is licensed under AGPL-3.0-only.</span><br/>
-    <span>This project is not affiliated, associated, authorized, endorsed by, or in any way officially connected with Jason A. Donenfeld, ZX2C4 or Edge Security</span><br/>
-    <span>"WireGuard" and the "WireGuard" logo are registered trademarks of Jason A. Donenfeld</span>
-    </p>
-
-repo_url: https://github.com/wg-easy/wg-easy
-repo_name: wg-easy
-
-edit_uri: 'edit/master/docs/content'
-
-docs_dir: 'content/'
-
-site_url: https://wg-easy.github.io/wg-easy
-
-theme:
-    name: material
-    favicon: assets/logo/favicon.png
-    logo: assets/logo/logo.png
-    icon:
-        repo: fontawesome/brands/github
-    features:
-        - navigation.tabs
-        - navigation.top
-        - navigation.expand
-        - navigation.instant
-        - content.action.edit
-        - content.action.view
-        - content.code.annotate
-    palette:
-        # Light mode
-        - media: '(prefers-color-scheme: light)'
-          scheme: default
-          primary: grey
-          accent: red
-          toggle:
-              icon: material/weather-night
-              name: Switch to dark mode
-        # Dark mode
-        - media: '(prefers-color-scheme: dark)'
-          scheme: slate
-          primary: grey
-          accent: red
-          toggle:
-              icon: material/weather-sunny
-              name: Switch to light mode
-
-extra:
-    version:
-        provider: mike
-
-markdown_extensions:
-    - toc:
-          anchorlink: true
-    - abbr
-    - attr_list
-    - pymdownx.blocks.admonition:
-          types:
-              - danger
-              - note
-              - info
-              - question
-              - warning
-    - pymdownx.details
-    - pymdownx.superfences:
-          custom_fences:
-              - name: mermaid
-                class: mermaid
-                format: !!python/name:pymdownx.superfences.fence_code_format
-    - pymdownx.tabbed:
-          alternate_style: true
-          slugify: !!python/object/apply:pymdownx.slugs.slugify
-              kwds:
-                  case: lower
-    - pymdownx.tasklist:
-          custom_checkbox: true
-    - pymdownx.magiclink
-    - pymdownx.inlinehilite
-    - pymdownx.tilde
-    - pymdownx.emoji:
-          emoji_index: !!python/name:material.extensions.emoji.twemoji
-          emoji_generator: !!python/name:material.extensions.emoji.to_svg
@@ -1,4 +1,2 @@
-mkdocs-material
-pillow
-cairosvg
-mike
+zensical==0.0.45
+git+https://github.com/squidfunk/mike.git
@@ -0,0 +1,97 @@
+[project]
+site_name = "wg-easy"
+site_description = "The easiest way to run WireGuard VPN + Web-based Admin UI."
+site_author = "WireGuard Easy"
+copyright = """
+<p>
+&copy <a href="https://github.com/wg-easy"><em>Wireguard Easy</em></a><br/>
+<span>This project is licensed under AGPL-3.0-only.</span><br/>
+<span>This project is not affiliated, associated, authorized, endorsed by, or in any way officially connected with Jason A. Donenfeld, ZX2C4 or Edge Security</span><br/>
+<span>"WireGuard" and the "WireGuard" logo are registered trademarks of Jason A. Donenfeld</span>
+</p>
+"""
+
+repo_url = "https://github.com/wg-easy/wg-easy"
+repo_name = "wg-easy"
+
+edit_uri = "edit/master/docs/content"
+
+docs_dir = "content/"
+
+site_url = "https://wg-easy.github.io/wg-easy"
+
+[project.theme]
+variant = "modern"
+favicon = "assets/logo/favicon.png"
+logo = "assets/logo/logo.png"
+features = [
+  "navigation.instant",
+  "navigation.tabs",
+  "navigation.expand",
+  "navigation.path",
+  "navigation.top",
+  "content.action.edit",
+  "content.action.view",
+  "content.code.copy",
+  "content.code.annotate",
+]
+
+[project.theme.icon]
+repo = "fontawesome/brands/github"
+
+# Palette toggle for automatic mode
+[[project.theme.palette]]
+media = "(prefers-color-scheme)"
+toggle.icon = "lucide/sun-moon"
+toggle.name = "Switch to light mode"
+
+# Palette toggle for light mode
+[[project.theme.palette]]
+media = "(prefers-color-scheme: light)"
+scheme = "default"
+primary = "grey"
+accent = "red"
+toggle.icon = "lucide/sun"
+toggle.name = "Switch to dark mode"
+
+# Palette toggle for dark mode
+[[project.theme.palette]]
+media = "(prefers-color-scheme: dark)"
+scheme = "slate"
+primary = "grey"
+accent = "red"
+toggle.icon = "lucide/moon"
+toggle.name = "Switch to system preference"
+
+# [project.plugins.privacy]
+
+[project.extra.version]
+provider = "mike"
+
+[project.markdown_extensions.pymdownx.blocks.admonition]
+types = ["danger", "note", "info", "question", "warning"]
+
+[project.markdown_extensions.md_in_html]
+
+[project.markdown_extensions.toc]
+permalink = true
+
+[project.markdown_extensions.pymdownx.details]
+
+[project.markdown_extensions.pymdownx.emoji]
+emoji_generator = "zensical.extensions.emoji.to_svg"
+emoji_index = "zensical.extensions.emoji.twemoji"
+
+[project.markdown_extensions.pymdownx.highlight]
+anchor_linenums = true
+line_spans = "__span"
+pygments_lang_class = true
+
+[project.markdown_extensions.pymdownx.inlinehilite]
+
+[project.markdown_extensions.pymdownx.smartsymbols]
+
+[project.markdown_extensions.pymdownx.superfences]
+custom_fences = [
+  { name = "mermaid", class = "mermaid", format = "pymdownx.superfences.fence_code_format" },
+]
@@ -5,13 +5,13 @@
    "dev": "docker compose -f docker-compose.dev.yml up wg-easy --build",
    "cli:dev": "docker compose -f docker-compose.dev.yml run --build --rm -it wg-easy cli:dev",
    "build": "docker build -t wg-easy .",
-    "docs:preview": "docker run --rm -it -p 8080:8080 -v ./docs:/docs squidfunk/mkdocs-material serve -a 0.0.0.0:8080",
+    "docs:preview": "docker run --rm -it -p 8080:8080 -v ./docs:/docs zensical/zensical serve -a 0.0.0.0:8080",
    "scripts:version": "bash scripts/version.sh",
    "scripts:i18n": "bash scripts/i18n.sh",
    "format:check:docs": "prettier --check docs"
  },
  "devDependencies": {
-    "prettier": "^3.8.1"
+    "prettier": "^3.9.5"
  },
-  "packageManager": "pnpm@10.29.2"
+  "packageManager": "pnpm@11.15.1"
 }
@@ -9,16 +9,16 @@ importers:
  .:
    devDependencies:
      prettier:
-        specifier: ^3.8.1
-        version: 3.8.1
+        specifier: ^3.9.5
+        version: 3.9.5

 packages:

-  prettier@3.8.1:
-    resolution: {integrity: sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==}
+  prettier@3.9.5:
+    resolution: {integrity: sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==}
    engines: {node: '>=14'}
    hasBin: true

 snapshots:

-  prettier@3.8.1: {}
+  prettier@3.9.5: {}
@@ -1 +1 @@
-setups.@nuxt/test-utils="3.23.0"
+setups.@nuxt/test-utils="4.0.3"
@@ -0,0 +1,7 @@
+:root {
+  color-scheme: light;
+}
+
+.dark {
+  color-scheme: dark;
+}
@@ -18,7 +18,7 @@
        >
          <slot name="description" />
        </DialogDescription>
-        <div class="mt-6 flex justify-end gap-2">
+        <div class="mt-6 flex flex-wrap justify-end gap-2">
          <slot name="actions" />
        </div>
      </DialogContent>
@@ -0,0 +1,26 @@
+<template>
+  <component
+    :is="elementType"
+    role="button"
+    class="rounded-lg border-2 border-gray-100 text-gray-500 hover:border-red-800 hover:bg-red-800 hover:text-white focus:border-red-800 focus:outline-0 focus:ring-0 disabled:cursor-not-allowed disabled:border-gray-200 disabled:bg-gray-100 disabled:text-gray-400 dark:border-neutral-800 dark:bg-neutral-700 dark:text-neutral-200 dark:placeholder:text-neutral-400 dark:disabled:border-neutral-800 dark:disabled:bg-neutral-700 dark:disabled:text-neutral-400"
+    v-bind="attrs"
+  >
+    <slot />
+  </component>
+</template>
+
+<script setup lang="ts">
+const props = defineProps({
+  as: {
+    type: String,
+    default: 'button',
+  },
+});
+
+const elementType = computed(() => props.as);
+
+const attrs = computed(() => {
+  const { as, ...rest } = props;
+  return rest;
+});
+</script>
@@ -0,0 +1,10 @@
+<template>
+  <textarea
+    v-model="data"
+    class="rounded-lg border-2 border-gray-100 text-gray-500 focus:border-red-800 focus:outline-0 focus:ring-0 dark:border-neutral-800 dark:bg-neutral-700 dark:text-neutral-200 dark:placeholder:text-neutral-400"
+  />
+</template>
+
+<script lang="ts" setup>
+const data = defineModel<string>();
+</script>
@@ -16,7 +16,7 @@
 </template>

 <script setup lang="ts">
-import type { ApexOptions } from 'apexcharts';
+import type { ApexChart, ApexOptions } from 'apexcharts';

 defineProps<{
  client: LocalClient;
@@ -9,7 +9,7 @@
        <div class="flex flex-grow flex-col gap-1">
          <ClientCardName :client="client" />
          <div
-            class="flex flex-col pb-1 text-xs text-gray-500 md:inline-block md:pb-0 dark:text-neutral-400"
+            class="flex flex-col text-xs text-gray-500 dark:text-neutral-400"
          >
            <div>
              <ClientCardAddress :client="client" />
@@ -1,7 +1,5 @@
 <template>
-  <div
-    class="block pb-1 text-xs text-gray-500 md:inline-block md:pb-0 dark:text-neutral-400"
-  >
+  <div class="block text-xs text-gray-500 dark:text-neutral-400">
    <span class="inline-block">{{ expiredDateFormat(client.expiresAt) }}</span>
  </div>
 </template>
@@ -1,11 +1,9 @@
 <template>
  <div
-    class="text-sm text-gray-700 md:text-base dark:text-neutral-200"
+    class="break-all text-sm text-gray-700 md:text-base dark:text-neutral-200"
    :title="$t('client.createdOn') + $d(new Date(client.createdAt))"
  >
-    <span class="border-b-2 border-t-2 border-transparent">
-      {{ client.name }}
-    </span>
+    {{ client.name }}
  </div>
 </template>

@@ -14,10 +14,11 @@ const props = defineProps<{ client: LocalClient }>();
 const clientsStore = useClientsStore();

 const _showOneTimeLink = useSubmit(
-  `/api/client/${props.client.id}/generateOneTimeLink`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/client/${props.client.id}/generateOneTimeLink`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async () => {
      await clientsStore.refresh();
@@ -18,10 +18,11 @@ const enabled = ref(props.client.enabled);
 const clientsStore = useClientsStore();

 const _disableClient = useSubmit(
-  `/api/client/${props.client.id}/disable`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/client/${props.client.id}/disable`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async () => {
      await clientsStore.refresh();
@@ -31,10 +32,11 @@ const _disableClient = useSubmit(
 );

 const _enableClient = useSubmit(
-  `/api/client/${props.client.id}/enable`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/client/${props.client.id}/enable`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async () => {
      await clientsStore.refresh();
@@ -43,10 +43,11 @@ function createClient() {
 }

 const _createClient = useSubmit(
-  '/api/client',
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch('/api/client', {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: () => clientsStore.refresh(),
    successMsg: t('client.created'),
@@ -3,7 +3,7 @@
    {{ $t('client.empty') }}<br /><br />
    <ClientsCreateDialog>
      <BaseSecondaryButton as="span">
-        <IconsPlus class="w-4 md:mr-2" />
+        <IconsPlus class="mr-2 w-4" />
        <span class="text-sm">{{ $t('client.new') }}</span>
      </BaseSecondaryButton>
    </ClientsCreateDialog>
@@ -1,8 +1,8 @@
 <template>
  <ClientsCreateDialog>
    <BaseSecondaryButton as="span">
-      <IconsPlus class="w-4 md:mr-2" />
-      <span class="text-sm max-md:hidden">{{ $t('client.newShort') }}</span>
+      <IconsPlus class="mr-2 w-4" />
+      <span class="text-sm">{{ $t('client.newShort') }}</span>
    </BaseSecondaryButton>
  </ClientsCreateDialog>
 </template>
@@ -5,10 +5,24 @@
    </template>
    <template #description>
      <div class="bg-white">
-        <img :src="qrCode" />
+        <img ref="img" :src="qrCode" />
      </div>
    </template>
    <template #actions>
+      <BaseSecondaryButton
+        class="flex items-center gap-2"
+        :title="$t('client.copyPng')"
+        @click="copyPng"
+      >
+        <IconsCopy class="size-5" /> PNG
+      </BaseSecondaryButton>
+      <BaseSecondaryButton
+        class="flex items-center gap-2"
+        :title="$t('client.downloadPng')"
+        @click="downloadPng"
+      >
+        <IconsDownload class="size-5" /> PNG
+      </BaseSecondaryButton>
      <DialogClose as-child>
        <BaseSecondaryButton>{{ $t('dialog.cancel') }}</BaseSecondaryButton>
      </DialogClose>
@@ -18,4 +32,87 @@

 <script setup lang="ts">
 defineProps<{ qrCode: string }>();
+
+const toast = useToast();
+const img = useTemplateRef('img');
+
+async function svgToPng() {
+  if (!img.value || !img.value.complete || img.value.naturalWidth === 0) {
+    throw new Error('image is not loaded');
+  }
+
+  const width = 1000;
+  const height = 1000;
+
+  const canvas = document.createElement('canvas');
+  canvas.width = width;
+  canvas.height = height;
+  const ctx = canvas.getContext('2d');
+  if (!ctx) {
+    throw new Error('was not able to create 2d context');
+  }
+  ctx.drawImage(img.value!, 0, 0, width, height);
+
+  return new Promise<Blob>((res, rej) => {
+    canvas.toBlob((blob) => {
+      if (!blob) {
+        return rej(new Error('was not able to create blob'));
+      }
+      return res(blob);
+    }, 'image/png');
+  });
+}
+
+async function downloadPng() {
+  try {
+    const blob = await svgToPng();
+
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = 'client-config.png';
+    document.body.appendChild(a);
+    a.click();
+    document.body.removeChild(a);
+    URL.revokeObjectURL(url);
+  } catch (e) {
+    console.error('failed to download png', e);
+    toast.showToast({
+      type: 'error',
+      message: $t('toast.unknown'),
+    });
+  }
+}
+
+async function copyPng() {
+  const blob = await svgToPng().catch((e) => {
+    console.error('failed to convert svg to png', e);
+    toast.showToast({
+      type: 'error',
+      message: $t('toast.unknown'),
+    });
+  });
+  if (!blob) {
+    return;
+  }
+
+  try {
+    await navigator.clipboard.write([
+      new ClipboardItem({
+        [blob.type]: blob,
+      }),
+    ]);
+
+    toast.showToast({
+      type: 'success',
+      message: $t('copy.copied'),
+    });
+  } catch (e) {
+    console.error('failed to copy png', e);
+    toast.showToast({
+      type: 'error',
+      message: $t('copy.failed'),
+    });
+  }
+}
 </script>
@@ -1,5 +1,5 @@
 <template>
-  <div class="relative w-60 md:mr-2">
+  <div class="relative">
    <div class="relative flex h-full items-center">
      <IconsMagnifyingGlass
        class="absolute left-2.5 h-4 w-4 text-gray-400 dark:text-neutral-500"
@@ -1,11 +1,8 @@
 <template>
  <BasePrimaryButton @click="toggleSort">
-    <IconsArrowDown
-      v-if="globalStore.sortClient === true"
-      class="w-4 md:mr-2"
-    />
-    <IconsArrowUp v-else class="w-4 md:mr-2" />
-    <span class="text-sm max-md:hidden"> {{ $t('client.sort') }}</span>
+    <IconsArrowDown v-if="globalStore.sortClient === 'asc'" class="mr-2 w-4" />
+    <IconsArrowUp v-else class="mr-2 w-4" />
+    <span class="text-sm">{{ $t('client.sort') }}</span>
  </BasePrimaryButton>
 </template>

@@ -14,7 +11,7 @@ const globalStore = useGlobalStore();
 const clientsStore = useClientsStore();

 function toggleSort() {
-  globalStore.sortClient = !globalStore.sortClient;
+  globalStore.sortClient = globalStore.sortClient === 'asc' ? 'desc' : 'asc';
  clientsStore.refresh().catch(console.error);
 }
 </script>
@@ -12,23 +12,15 @@
          class="rounded-lg border-2 border-gray-100 text-gray-500 focus:border-red-800 focus:outline-0 focus:ring-0 dark:border-neutral-800 dark:bg-neutral-700 dark:text-neutral-200 dark:placeholder:text-neutral-400"
          @input="update($event, i)"
        />
-        <BaseSecondaryButton
-          as="input"
-          type="button"
-          class="rounded-lg"
-          value="-"
-          @click="del(i)"
-        />
+        <BaseSecondaryButton type="button" class="rounded-lg" @click="del(i)">
+          {{ '-' }}
+        </BaseSecondaryButton>
      </div>
    </div>
    <div class="mt-2">
-      <BasePrimaryButton
-        as="input"
-        type="button"
-        class="rounded-lg"
-        :value="$t('form.add')"
-        @click="add"
-      />
+      <BasePrimaryButton type="button" class="rounded-lg" @click="add">
+        {{ $t('form.add') }}
+      </BasePrimaryButton>
    </div>
  </div>
 </template>
@@ -1,10 +1,10 @@
 <template>
-  <h4 class="col-span-full flex items-center py-6 text-2xl">
+  <h3 class="col-span-full flex items-center py-6 text-2xl">
    <slot />
    <BaseTooltip v-if="description" :text="description">
      <IconsInfo class="size-4" />
    </BaseTooltip>
-  </h4>
+  </h3>
 </template>

 <script lang="ts" setup>
@@ -1,7 +1,7 @@
 <template>
-  <RLabel :for="props.for" class="md:align-middle md:leading-10"
-    ><slot
-  /></RLabel>
+  <RLabel :for="props.for" class="md:leading-[2.75rem]">
+    <slot />
+  </RLabel>
 </template>

 <script lang="ts" setup>
@@ -12,23 +12,15 @@
          class="rounded-lg border-2 border-gray-100 text-gray-500 focus:border-red-800 focus:outline-0 focus:ring-0 dark:border-neutral-800 dark:bg-neutral-700 dark:text-neutral-200 dark:placeholder:text-neutral-400"
          @input="update($event, i)"
        />
-        <BaseSecondaryButton
-          as="input"
-          type="button"
-          class="rounded-lg"
-          value="-"
-          @click="del(i)"
-        />
+        <BaseSecondaryButton type="button" class="rounded-lg" @click="del(i)">
+          {{ '-' }}
+        </BaseSecondaryButton>
      </div>
    </div>
    <div class="mt-2">
-      <BasePrimaryButton
-        as="input"
-        type="button"
-        class="rounded-lg"
-        :value="$t('form.add')"
-        @click="add"
-      />
+      <BasePrimaryButton type="button" class="rounded-lg" @click="add">
+        {{ $t('form.add') }}
+      </BasePrimaryButton>
    </div>
  </div>
 </template>
@@ -2,7 +2,7 @@
  <input
    :value="label"
    :type="type ?? 'button'"
-    class="col-span-2 rounded-lg border-2 border-red-800 bg-red-800 py-2 text-white hover:border-red-600 hover:bg-red-600 focus:border-red-800 focus:outline-0 focus:ring-0"
+    class="col-span-2 rounded-lg border-2 border-red-800 bg-red-800 px-4 py-2 text-white hover:border-red-600 hover:bg-red-600 focus:border-red-800 focus:outline-0 focus:ring-0"
  />
 </template>

@@ -1,16 +1,32 @@
 <template>
-  <input
-    :value="label"
-    :type="type ?? 'button'"
-    class="col-span-2 rounded-lg border-2 border-gray-100 py-2 text-gray-500 hover:border-red-800 hover:bg-red-800 hover:text-white focus:border-red-800 focus:outline-0 focus:ring-0 dark:border-neutral-800 dark:bg-neutral-700 dark:text-neutral-200 dark:placeholder:text-neutral-400"
-  />
+  <BaseFormSecondaryButton
+    :as="as"
+    :value="isInput ? label : undefined"
+    :type="isInput ? type : undefined"
+    class="col-span-2 px-4 py-2"
+  >
+    <template v-if="!isInput">
+      {{ label }}
+    </template>
+  </BaseFormSecondaryButton>
 </template>

 <script lang="ts" setup>
 import type { InputTypeHTMLAttribute } from 'vue';

-defineProps<{
-  label: string;
-  type?: InputTypeHTMLAttribute;
-}>();
+const props = withDefaults(
+  defineProps<{
+    label: string;
+    type?: InputTypeHTMLAttribute;
+    as?: string;
+  }>(),
+  {
+    type: 'button',
+    as: 'input',
+  }
+);
+
+const isInput = computed(() => {
+  return props.as === 'input';
+});
 </script>
@@ -7,7 +7,9 @@
      <IconsInfo class="size-4" />
    </BaseTooltip>
  </div>
-  <BaseSwitch :id="id" v-model="data" />
+  <div class="my-auto">
+    <BaseSwitch :id="id" v-model="data" />
+  </div>
 </template>

 <script lang="ts" setup>
@@ -0,0 +1,29 @@
+<template>
+  <div class="flex items-center">
+    <FormLabel :for="id">
+      {{ label }}
+    </FormLabel>
+    <BaseTooltip v-if="description" :text="description">
+      <IconsInfo class="size-4" />
+    </BaseTooltip>
+  </div>
+  <BaseTextArea
+    :id="id"
+    v-model.trim="data"
+    :name="id"
+    :autocomplete="autocomplete"
+    :disabled="disabled"
+  />
+</template>
+
+<script lang="ts" setup>
+defineProps<{
+  id: string;
+  label: string;
+  description?: string;
+  autocomplete?: string;
+  disabled?: boolean;
+}>();
+
+const data = defineModel<string>();
+</script>
@@ -1,12 +1,12 @@
 <template>
  <Toggle
    :pressed="globalStore.uiShowCharts"
-    class="group inline-flex h-8 w-8 cursor-pointer items-center justify-center whitespace-nowrap rounded-full bg-gray-200 transition hover:bg-gray-300 dark:bg-neutral-700 dark:hover:bg-neutral-600"
+    class="group flex h-8 w-8 items-center justify-center rounded-full bg-gray-200 transition hover:bg-gray-300 dark:bg-neutral-700 dark:hover:bg-neutral-600"
    :title="$t('layout.toggleCharts')"
    @update:pressed="globalStore.toggleCharts"
  >
    <IconsChart
-      class="h-5 w-5 fill-gray-400 transition group-data-[state=on]:fill-gray-600 dark:fill-neutral-600 dark:group-data-[state=on]:fill-neutral-400"
+      class="h-5 w-5 transition group-data-[state=on]:fill-gray-600 dark:text-neutral-400 dark:group-data-[state=on]:fill-gray-300"
    />
  </Toggle>
 </template>
@@ -1,12 +1,14 @@
 <template>
  <SelectRoot v-model="langProxy" :default-value="locale">
    <SelectTrigger
-      class="inline-flex h-8 items-center justify-around gap-2 rounded bg-gray-200 px-3 text-sm leading-none dark:bg-neutral-700 dark:text-neutral-400"
+      class="group inline-flex h-8 items-center justify-around gap-2 rounded bg-gray-200 px-3 text-sm leading-none dark:bg-neutral-700 dark:text-neutral-400"
      aria-label="Select language"
    >
      <IconsLanguage class="size-3" />
      <SelectValue />
-      <IconsArrowDown class="size-3" />
+      <IconsArrowDown
+        class="size-3 transition-transform group-data-[state=open]:rotate-180"
+      />
    </SelectTrigger>

    <SelectPortal>
@@ -1,5 +1,5 @@
 <template>
-  <NuxtLink to="/" class="mb-4">
+  <NuxtLink to="/" class="max-sm:mb-4">
    <h1 class="text-4xl font-medium dark:text-neutral-200">
      <img
        src="/logo.png"
@@ -5,7 +5,7 @@
      authStore.userData &&
      hasPermissions(authStore.userData, 'admin', 'any')
    "
-    class="font-small mb-10 rounded-md bg-red-800 p-4 text-sm text-white shadow-lg dark:bg-red-100 dark:text-red-600"
+    class="font-small rounded-md bg-red-800 p-4 text-sm text-white shadow-lg dark:bg-red-100 dark:text-red-600"
    :title="`v${globalStore.information.currentRelease} → v${globalStore.information.latestRelease.version}`"
  >
    <div class="container mx-auto flex flex-auto flex-row items-center">
@@ -0,0 +1,23 @@
+<template>
+  <!-- https://brand.github.com/foundations/logo -->
+  <svg
+    width="98"
+    height="96"
+    viewBox="0 0 98 96"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <g clip-path="url(#clip0_730_27136)">
+      <path
+        d="M41.4395 69.3848C28.8066 67.8535 19.9062 58.7617 19.9062 46.9902C19.9062 42.2051 21.6289 37.0371 24.5 33.5918C23.2559 30.4336 23.4473 23.7344 24.8828 20.959C28.7109 20.4805 33.8789 22.4902 36.9414 25.2656C40.5781 24.1172 44.4062 23.543 49.0957 23.543C53.7852 23.543 57.6133 24.1172 61.0586 25.1699C64.0254 22.4902 69.2891 20.4805 73.1172 20.959C74.457 23.543 74.6484 30.2422 73.4043 33.4961C76.4668 37.1328 78.0937 42.0137 78.0937 46.9902C78.0937 58.7617 69.1934 67.6621 56.3691 69.2891C59.623 71.3945 61.8242 75.9883 61.8242 81.252L61.8242 91.2051C61.8242 94.0762 64.2168 95.7031 67.0879 94.5547C84.4102 87.9512 98 70.6289 98 49.1914C98 22.1074 75.9883 6.69539e-07 48.9043 4.309e-07C21.8203 1.92261e-07 -1.9479e-07 22.1074 -4.3343e-07 49.1914C-6.20631e-07 70.4375 13.4941 88.0469 31.6777 94.6504C34.2617 95.6074 36.75 93.8848 36.75 91.3008L36.75 83.6445C35.4102 84.2188 33.6875 84.6016 32.1562 84.6016C25.8398 84.6016 22.1074 81.1563 19.4277 74.7441C18.375 72.1602 17.2266 70.6289 15.0254 70.3418C13.877 70.2461 13.4941 69.7676 13.4941 69.1934C13.4941 68.0449 15.4082 67.1836 17.3223 67.1836C20.0977 67.1836 22.4902 68.9063 24.9785 72.4473C26.8926 75.2227 28.9023 76.4668 31.2949 76.4668C33.6875 76.4668 35.2187 75.6055 37.4199 73.4043C39.0469 71.7773 40.291 70.3418 41.4395 69.3848Z"
+        fill="white"
+        class="fill-black dark:fill-white"
+      />
+    </g>
+    <defs>
+      <clipPath id="clip0_730_27136">
+        <rect width="98" height="96" fill="white" />
+      </clipPath>
+    </defs>
+  </svg>
+</template>
@@ -0,0 +1,247 @@
+<template>
+  <!-- By Original: Google Vector: Designism, Liquinoid, and YeBoy371 - Own work based on: Google updating its ‘G’ icon for the first time in 10 years, Public Domain, https://commons.wikimedia.org/w/index.php?curid=165142698 -->
+  <svg
+    version="1.1"
+    viewBox="0 0 268.1522 273.8827"
+    overflow="hidden"
+    xml:space="preserve"
+    xmlns:xlink="http://www.w3.org/1999/xlink"
+    xmlns="http://www.w3.org/2000/svg"
+    xmlns:svg="http://www.w3.org/2000/svg"
+  >
+    <defs>
+      <linearGradient id="a">
+        <stop offset="0" stop-color="#0fbc5c" />
+        <stop offset="1" stop-color="#0cba65" />
+      </linearGradient>
+      <linearGradient id="g">
+        <stop offset=".2312727" stop-color="#0fbc5f" />
+        <stop offset=".3115468" stop-color="#0fbc5f" />
+        <stop offset=".3660131" stop-color="#0fbc5e" />
+        <stop offset=".4575163" stop-color="#0fbc5d" />
+        <stop offset=".540305" stop-color="#12bc58" />
+        <stop offset=".6993464" stop-color="#28bf3c" />
+        <stop offset=".7712418" stop-color="#38c02b" />
+        <stop offset=".8605665" stop-color="#52c218" />
+        <stop offset=".9150327" stop-color="#67c30f" />
+        <stop offset="1" stop-color="#86c504" />
+      </linearGradient>
+      <linearGradient id="h">
+        <stop offset=".1416122" stop-color="#1abd4d" />
+        <stop offset=".2475151" stop-color="#6ec30d" />
+        <stop offset=".3115468" stop-color="#8ac502" />
+        <stop offset=".3660131" stop-color="#a2c600" />
+        <stop offset=".4456735" stop-color="#c8c903" />
+        <stop offset=".540305" stop-color="#ebcb03" />
+        <stop offset=".6156363" stop-color="#f7cd07" />
+        <stop offset=".6993454" stop-color="#fdcd04" />
+        <stop offset=".7712418" stop-color="#fdce05" />
+        <stop offset=".8605661" stop-color="#ffce0a" />
+      </linearGradient>
+      <linearGradient id="f">
+        <stop offset=".3159041" stop-color="#ff4c3c" />
+        <stop offset=".6038179" stop-color="#ff692c" />
+        <stop offset=".7268366" stop-color="#ff7825" />
+        <stop offset=".884534" stop-color="#ff8d1b" />
+        <stop offset="1" stop-color="#ff9f13" />
+      </linearGradient>
+      <linearGradient id="b">
+        <stop offset=".2312727" stop-color="#ff4541" />
+        <stop offset=".3115468" stop-color="#ff4540" />
+        <stop offset=".4575163" stop-color="#ff4640" />
+        <stop offset=".540305" stop-color="#ff473f" />
+        <stop offset=".6993464" stop-color="#ff5138" />
+        <stop offset=".7712418" stop-color="#ff5b33" />
+        <stop offset=".8605665" stop-color="#ff6c29" />
+        <stop offset="1" stop-color="#ff8c18" />
+      </linearGradient>
+      <linearGradient id="d">
+        <stop offset=".4084578" stop-color="#fb4e5a" />
+        <stop offset="1" stop-color="#ff4540" />
+      </linearGradient>
+      <linearGradient id="c">
+        <stop offset=".1315461" stop-color="#0cba65" />
+        <stop offset=".2097843" stop-color="#0bb86d" />
+        <stop offset=".2972969" stop-color="#09b479" />
+        <stop offset=".3962575" stop-color="#08ad93" />
+        <stop offset=".4771242" stop-color="#0aa6a9" />
+        <stop offset=".5684245" stop-color="#0d9cc6" />
+        <stop offset=".667385" stop-color="#1893dd" />
+        <stop offset=".7687273" stop-color="#258bf1" />
+        <stop offset=".8585063" stop-color="#3086ff" />
+      </linearGradient>
+      <linearGradient id="e">
+        <stop offset=".3660131" stop-color="#ff4e3a" />
+        <stop offset=".4575163" stop-color="#ff8a1b" />
+        <stop offset=".540305" stop-color="#ffa312" />
+        <stop offset=".6156363" stop-color="#ffb60c" />
+        <stop offset=".7712418" stop-color="#ffcd0a" />
+        <stop offset=".8605665" stop-color="#fecf0a" />
+        <stop offset=".9150327" stop-color="#fecf08" />
+        <stop offset="1" stop-color="#fdcd01" />
+      </linearGradient>
+      <linearGradient
+        id="s"
+        xlink:href="#a"
+        x1="219.6997"
+        y1="329.5351"
+        x2="254.4673"
+        y2="329.5351"
+        gradientUnits="userSpaceOnUse"
+      />
+      <radialGradient
+        id="m"
+        xlink:href="#b"
+        gradientUnits="userSpaceOnUse"
+        gradientTransform="matrix(-1.936885,1.043001,1.455731,2.555422,290.5254,-400.6338)"
+        cx="109.6267"
+        cy="135.8619"
+        fx="109.6267"
+        fy="135.8619"
+        r="71.46001"
+      />
+      <radialGradient
+        id="n"
+        xlink:href="#c"
+        gradientUnits="userSpaceOnUse"
+        gradientTransform="matrix(-3.512595,-4.45809,-1.692547,1.260616,870.8006,191.554)"
+        cx="45.25866"
+        cy="279.2738"
+        fx="45.25866"
+        fy="279.2738"
+        r="71.46001"
+      />
+      <radialGradient
+        id="l"
+        xlink:href="#d"
+        cx="304.0166"
+        cy="118.0089"
+        fx="304.0166"
+        fy="118.0089"
+        r="47.85445"
+        gradientTransform="matrix(2.064353,-4.926832e-6,-2.901531e-6,2.592041,-297.6788,-151.7469)"
+        gradientUnits="userSpaceOnUse"
+      />
+      <radialGradient
+        id="o"
+        xlink:href="#e"
+        gradientUnits="userSpaceOnUse"
+        gradientTransform="matrix(-0.2485783,2.083138,2.962486,0.3341668,-255.1463,-331.1636)"
+        cx="181.001"
+        cy="177.2013"
+        fx="181.001"
+        fy="177.2013"
+        r="71.46001"
+      />
+      <radialGradient
+        id="p"
+        xlink:href="#f"
+        cx="207.6733"
+        cy="108.0972"
+        fx="207.6733"
+        fy="108.0972"
+        r="41.1025"
+        gradientTransform="matrix(-1.249206,1.343263,-3.896837,-3.425693,880.5011,194.9051)"
+        gradientUnits="userSpaceOnUse"
+      />
+      <radialGradient
+        id="r"
+        xlink:href="#g"
+        gradientUnits="userSpaceOnUse"
+        gradientTransform="matrix(-1.936885,-1.043001,1.455731,-2.555422,290.5254,838.6834)"
+        cx="109.6267"
+        cy="135.8619"
+        fx="109.6267"
+        fy="135.8619"
+        r="71.46001"
+      />
+      <radialGradient
+        id="j"
+        xlink:href="#h"
+        gradientUnits="userSpaceOnUse"
+        gradientTransform="matrix(-0.081402,-1.93722,2.926737,-0.1162508,-215.1345,632.8606)"
+        cx="154.8697"
+        cy="145.9691"
+        fx="154.8697"
+        fy="145.9691"
+        r="71.46001"
+      />
+      <filter
+        id="q"
+        x="-.04842873"
+        y="-.0582241"
+        width="1.096857"
+        height="1.116448"
+        color-interpolation-filters="sRGB"
+      >
+        <feGaussianBlur stdDeviation="1.700914" />
+      </filter>
+      <filter
+        id="k"
+        x="-.01670084"
+        y="-.01009856"
+        width="1.033402"
+        height="1.020197"
+        color-interpolation-filters="sRGB"
+      >
+        <feGaussianBlur stdDeviation=".2419367" />
+      </filter>
+      <clipPath id="i" clipPathUnits="userSpaceOnUse">
+        <path
+          d="M371.3784 193.2406H237.0825v53.4375h77.167c-1.2405 7.5627-4.0259 15.0024-8.1049 21.7862-4.6734 7.7723-10.4511 13.6895-16.373 18.1957-17.7389 13.4983-38.42 16.2584-52.7828 16.2584-36.2824 0-67.2833-23.2865-79.2844-54.9287-.4843-1.1482-.8059-2.3344-1.1975-3.5068-2.652-8.0533-4.101-16.5825-4.101-25.4474 0-9.226 1.5691-18.0575 4.4301-26.3985 11.2851-32.8967 42.9849-57.4674 80.1789-57.4674 7.4811 0 14.6854.8843 21.5173 2.6481 15.6135 4.0309 26.6578 11.9698 33.4252 18.2494l40.834-39.7111c-24.839-22.616-57.2194-36.3201-95.8444-36.3201-30.8782-.00066-59.3863 9.55308-82.7477 25.6992-18.9454 13.0941-34.4833 30.6254-44.9695 50.9861-9.75366 18.8785-15.09441 39.7994-15.09441 62.2934 0 22.495 5.34891 43.6334 15.10261 62.3374v.126c10.3023 19.8567 25.3678 36.9537 43.6783 49.9878 15.9962 11.3866 44.6789 26.5516 84.0307 26.5516 22.6301 0 42.6867-4.0517 60.3748-11.6447 12.76-5.4775 24.0655-12.6217 34.3012-21.8036 13.5247-12.1323 24.1168-27.1388 31.3465-44.4041 7.2297-17.2654 11.097-36.7895 11.097-57.957 0-9.858-.9971-19.8694-2.6881-28.9684Z"
+          fill="#000"
+        />
+      </clipPath>
+    </defs>
+    <g transform="matrix(0.957922,0,0,0.985255,-90.17436,-78.85577)">
+      <g clip-path="url(#i)">
+        <path
+          d="M92.07563 219.9585c.14844 22.14 6.5014 44.983 16.11767 63.4234v.1269c6.9482 13.3919 16.4444 23.9704 27.2604 34.4518l65.326-23.67c-12.3593-6.2344-14.2452-10.0546-23.1048-17.0253-9.0537-9.0658-15.8015-19.4735-20.0038-31.677h-.1693l.1693-.1269c-2.7646-8.0587-3.0373-16.6129-3.1393-25.5029Z"
+          fill="url(#j)"
+          filter="url(#k)"
+        />
+        <path
+          d="M237.0835 79.02491c-6.4568 22.52569-3.988 44.42139 0 57.16129 7.4561.0055 14.6388.8881 21.4494 2.6464 15.6135 4.0309 26.6566 11.97 33.424 18.2496l41.8794-40.7256c-24.8094-22.58904-54.6663-37.2961-96.7528-37.33169Z"
+          fill="url(#l)"
+          filter="url(#k)"
+        />
+        <path
+          d="M236.9434 78.84678c-31.6709-.00068-60.9107 9.79833-84.8718 26.35902-8.8968 6.149-17.0612 13.2521-24.3311 21.1509-1.9045 17.7429 14.2569 39.5507 46.2615 39.3702 15.5284-17.9373 38.4946-29.5427 64.0561-29.5427.0233 0 .046.0019.0693.002l-1.0439-57.33536c-.0472-.00003-.0929-.00406-.1401-.00406Z"
+          fill="url(#m)"
+          filter="url(#k)"
+        />
+        <path
+          d="m341.4751 226.3788-28.2685 19.2848c-1.2405 7.5627-4.0278 15.0023-8.1068 21.7861-4.6734 7.7723-10.4506 13.6898-16.3725 18.196-17.7022 13.4704-38.3286 16.2439-52.6877 16.2553-14.8415 25.1018-17.4435 37.6749 1.0439 57.9342 22.8762-.0167 43.157-4.1174 61.0458-11.7965 12.9312-5.551 24.3879-12.7913 34.7609-22.0964 13.7061-12.295 24.4421-27.5034 31.7688-45.0003 7.3267-17.497 11.2446-37.2822 11.2446-58.7336Z"
+          fill="url(#n)"
+          filter="url(#k)"
+        />
+        <path
+          d="M234.9956 191.2104v57.4981h136.0062c1.1962-7.8745 5.1523-18.0644 5.1523-26.5001 0-9.858-.9963-21.899-2.6873-30.998Z"
+          fill="#3086ff"
+          filter="url(#k)"
+        />
+        <path
+          d="M128.3894 124.3268c-8.393 9.1191-15.5632 19.326-21.2483 30.3646-9.75351 18.8785-15.09402 41.8295-15.09402 64.3235 0 .317.02642.6271.02855.9436 4.31953 8.2244 59.66647 6.6495 62.45617 0-.0035-.3103-.0387-.6128-.0387-.9238 0-9.226 1.5696-16.0262 4.4306-24.3672 3.5294-10.2885 9.0557-19.7628 16.1223-27.9257 1.6019-2.0309 5.8748-6.3969 7.1214-9.0157.4749-.9975-.8621-1.5574-.9369-1.9085-.0836-.3927-1.8762-.0769-2.2778-.3694-1.2751-.9288-3.8001-1.4138-5.3334-1.8449-3.2772-.9215-8.7085-2.9536-11.7252-5.0601-9.5357-6.6586-24.417-14.6122-33.5047-24.2164Z"
+          fill="url(#o)"
+          filter="url(#k)"
+        />
+        <path
+          d="M162.0989 155.8569c22.1123 13.3013 28.4714-6.7139 43.173-12.9771L179.698 90.21568c-9.4075 3.92642-18.2957 8.80465-26.5426 14.50442-12.316 8.5122-23.192 18.8995-32.1763 30.7204Z"
+          fill="url(#p)"
+          filter="url(#q)"
+        />
+        <path
+          d="M171.0987 290.222c-29.6829 10.6413-34.3299 11.023-37.0622 29.2903 5.2213 5.0597 10.8312 9.74 16.7926 13.9835 15.9962 11.3867 46.766 26.5517 86.1178 26.5517.0462 0 .0904-.004.1366-.004v-59.1574c-.0298.0001-.064.002-.0938.002-14.7359 0-26.5113-3.8435-38.5848-10.5273-2.9768-1.6479-8.3775 2.7772-11.1229.799-3.7865-2.7284-12.8991 2.3508-16.1833-.9378Z"
+          fill="url(#r)"
+          filter="url(#k)"
+        />
+        <path
+          d="M219.6997 299.0227v59.9959c5.506.6402 11.2361 1.0289 17.2472 1.0289 6.0259 0 11.8556-.3073 17.5204-.8723v-59.7481c-6.3482 1.0777-12.3272 1.461-17.4776 1.461-5.9318 0-11.7005-.6858-17.29-1.8654Z"
+          opacity=".5"
+          fill="url(#s)"
+          filter="url(#k)"
+        />
+      </g>
+    </g>
+  </svg>
+</template>
@@ -0,0 +1,10 @@
+<template>
+  <IconsBrandsGitHub v-if="provider === 'github'" />
+  <IconsBrandsGoogle v-else-if="provider === 'google'" />
+</template>
+
+<script setup lang="ts">
+defineProps<{
+  provider: OAUTH_PROVIDER;
+}>();
+</script>
@@ -0,0 +1,7 @@
+<template>
+  <ClipboardDocumentIcon />
+</template>
+
+<script lang="ts" setup>
+import ClipboardDocumentIcon from '@heroicons/vue/24/outline/esm/ClipboardDocumentIcon';
+</script>
@@ -1,7 +1,9 @@
 <template>
-  <div
-    class="container mx-auto max-w-3xl overflow-hidden rounded-lg bg-white px-3 text-gray-700 shadow-md md:px-0 dark:bg-neutral-700 dark:text-neutral-200"
-  >
-    <slot />
+  <div class="container mx-auto max-w-3xl">
+    <div
+      class="mx-3 overflow-hidden rounded-lg bg-white text-gray-700 shadow-md dark:bg-neutral-700 dark:text-neutral-200"
+    >
+      <slot />
+    </div>
  </div>
 </template>
@@ -1,5 +1,5 @@
 <template>
-  <div class="flex flex-shrink-0 items-center space-x-2">
+  <div class="flex flex-shrink-0 flex-col items-center gap-2 sm:flex-row">
    <slot />
  </div>
 </template>
@@ -1,6 +1,6 @@
 <template>
  <div
-    class="flex flex-auto flex-grow flex-row items-center border-b-2 border-gray-100 p-3 px-5 dark:border-neutral-600"
+    class="flex flex-col items-center gap-2 border-b-2 border-gray-100 p-3 px-5 sm:flex-row dark:border-neutral-600"
  >
    <slot />
  </div>
@@ -1,11 +1,5 @@
 <template>
-  <h2 class="flex-1 text-2xl font-medium">
-    {{ text }}
+  <h2 class="flex-1 break-all text-2xl font-medium">
+    <slot />
  </h2>
 </template>
-
-<script setup lang="ts">
-const { text } = defineProps<{
-  text: string;
-}>();
-</script>
@@ -0,0 +1,21 @@
+<template>
+  <a
+    :href="`/api/auth/${provider}`"
+    class="flex items-center justify-center gap-2 rounded border border-gray-300 bg-white py-2 text-sm text-gray-700 shadow-sm transition hover:bg-gray-50 dark:border-neutral-600 dark:bg-neutral-800 dark:text-neutral-200 dark:hover:bg-neutral-700"
+  >
+    <IconsBrandsProvider :provider="provider" class="h-4 w-4" />
+    <span>
+      {{ $t('login.signInWith', [info.friendlyName]) }}
+    </span>
+  </a>
+</template>
+
+<script setup lang="ts">
+defineProps<{
+  info: {
+    enabled: boolean;
+    friendlyName: string;
+  };
+  provider: OAUTH_PROVIDER;
+}>();
+</script>
@@ -70,10 +70,11 @@ const authStore = useAuthStore();
 const toggleState = ref(false);

 const _submit = useSubmit(
-  '/api/session',
-  {
-    method: 'delete',
-  },
+  (data) =>
+    $fetch('/api/session', {
+      method: 'delete',
+      body: data,
+    }),
  {
    revert: async () => {
      await navigateTo('/login');
@@ -1,49 +1,24 @@
-import type {
-  NitroFetchRequest,
-  NitroFetchOptions,
-  TypedInternalResponse,
-  ExtractedRouteMethod,
-} from 'nitropack/types';
 import { FetchError } from 'ofetch';

-type RevertFn<
-  R extends NitroFetchRequest,
-  T = unknown,
-  O extends NitroFetchOptions<R> = NitroFetchOptions<R>,
-> = (
-  success: boolean,
-  data:
-    | TypedInternalResponse<
-        R,
-        T,
-        NitroFetchOptions<R> extends O ? 'get' : ExtractedRouteMethod<R, O>
-      >
-    | undefined
-) => Promise<void>;
+type RevertFn<T> = (success: boolean, data: T | undefined) => Promise<void>;

-type SubmitOpts<
-  R extends NitroFetchRequest,
-  T = unknown,
-  O extends NitroFetchOptions<R> = NitroFetchOptions<R>,
-> = {
-  revert: RevertFn<R, T, O>;
+type SubmitOpts<T> = {
+  revert: RevertFn<T>;
  successMsg?: string;
  noSuccessToast?: boolean;
 };

-export function useSubmit<
-  R extends NitroFetchRequest,
-  O extends NitroFetchOptions<R> & { body?: never },
-  T = unknown,
->(url: R, options: O, opts: SubmitOpts<R, T, O>) {
+type Body = Record<string, unknown> | null | undefined;
+
+export function useSubmit<T>(
+  fetcher: (data: Body) => Promise<T>,
+  opts: SubmitOpts<T>
+) {
  const toast = useToast();

-  return async (data: unknown) => {
+  return async (data: Body) => {
    try {
-      const res = await $fetch(url, {
-        ...options,
-        body: data,
-      });
+      const res = await fetcher(data);

      if (!opts.noSuccessToast) {
        toast.showToast({
@@ -1,6 +1,8 @@
 <template>
  <div>
-    <header class="mx-auto mt-4 flex max-w-3xl flex-col justify-center">
+    <header
+      class="mx-auto my-4 flex max-w-3xl flex-col justify-center max-md:px-3"
+    >
      <div
        class="mb-5 w-full"
        :class="
@@ -17,7 +19,7 @@
          <UiUserMenu v-if="loggedIn" />
        </div>
      </div>
-      <HeaderUpdate class="mt-4" />
+      <HeaderUpdate class="my-4" />
    </header>
    <slot />
    <UiFooter />
@@ -27,5 +29,7 @@
 <script setup lang="ts">
 const route = useRoute();

-const loggedIn = computed(() => route.path !== '/login');
+const loggedIn = computed(
+  () => route.path !== '/login' && route.path !== '/login/2fa'
+);
 </script>
@@ -9,8 +9,10 @@ export default defineNuxtRouteMiddleware(async (to) => {
  const authStore = useAuthStore();
  authStore.userData = await authStore.getSession(event);

-  // skip login if already logged in
-  if (to.path === '/login') {
+  const isLoginRoute = to.path === '/login' || to.path === '/login/2fa';
+
+  // skip login pages if already logged in
+  if (isLoginRoute) {
    if (authStore.userData?.username) {
      return navigateTo('/', { redirectCode: 302 });
    }
@@ -2,35 +2,47 @@
  <div>
    <div class="container mx-auto p-4">
      <div class="flex flex-col gap-4 lg:flex-row">
-        <div class="rounded-lg bg-white p-4 lg:w-64 dark:bg-neutral-700">
-          <NuxtLink to="/admin">
-            <h2 class="mb-4 text-xl font-bold dark:text-neutral-200">
-              {{ t('pages.admin.panel') }}
-            </h2>
-          </NuxtLink>
-          <div class="flex flex-col space-y-2">
-            <NuxtLink
-              v-for="(item, index) in menuItems"
-              :key="index"
-              :to="`/admin/${item.id}`"
-              class="group rounded"
-              active-class="bg-red-800 active"
-            >
-              <BaseSecondaryButton
-                as="span"
-                class="w-full font-medium group-[.active]:text-white"
+        <div
+          class="overflow-hidden rounded-lg bg-white text-gray-700 shadow-md lg:w-64 dark:bg-neutral-700 dark:text-neutral-200"
+        >
+          <PanelHead>
+            <PanelHeadTitle>
+              <NuxtLink to="/admin">
+                {{ t('pages.admin.panel') }}
+              </NuxtLink>
+            </PanelHeadTitle>
+          </PanelHead>
+          <PanelBody>
+            <nav class="flex flex-col gap-2">
+              <NuxtLink
+                v-for="(item, index) in menuItems"
+                :key="index"
+                :to="`/admin/${item.id}`"
+                class="group rounded"
+                active-class="bg-red-800 active"
              >
-                {{ item.name }}
-              </BaseSecondaryButton>
-            </NuxtLink>
-          </div>
+                <BaseSecondaryButton
+                  as="span"
+                  class="w-full font-medium group-[.active]:text-white"
+                >
+                  {{ item.name }}
+                </BaseSecondaryButton>
+              </NuxtLink>
+            </nav>
+          </PanelBody>
        </div>

        <div
-          class="flex-1 rounded-lg bg-white p-6 dark:bg-neutral-700 dark:text-neutral-200"
+          class="flex-1 overflow-hidden rounded-lg bg-white text-gray-700 shadow-md dark:bg-neutral-700 dark:text-neutral-200"
        >
-          <h1 class="mb-6 text-3xl font-bold">{{ activeMenuItem.name }}</h1>
-          <NuxtPage />
+          <PanelHead>
+            <PanelHeadTitle>
+              {{ activeMenuItem.name }}
+            </PanelHeadTitle>
+          </PanelHead>
+          <PanelBody>
+            <NuxtPage />
+          </PanelBody>
        </div>
      </div>
    </div>
@@ -121,10 +121,11 @@ const { data: _data, refresh } = await useFetch(`/api/admin/userconfig`, {
 const data = toRef(_data.value);

 const _submit = useSubmit(
-  `/api/admin/userconfig`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/admin/userconfig`, {
+      method: 'post',
+      body: data,
+    }),
  { revert }
 );

@@ -46,10 +46,11 @@ const { data: _data, refresh } = await useFetch(`/api/admin/general`, {
 const data = toRef(_data.value);

 const _submit = useSubmit(
-  `/api/admin/general`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/admin/general`, {
+      method: 'post',
+      body: data,
+    }),
  { revert }
 );

@@ -2,22 +2,22 @@
  <main v-if="data">
    <FormElement @submit.prevent="submit">
      <FormGroup>
-        <FormTextField
+        <FormTextArea
          id="PreUp"
          v-model="data.preUp"
          :label="$t('hooks.preUp')"
        />
-        <FormTextField
+        <FormTextArea
          id="PostUp"
          v-model="data.postUp"
          :label="$t('hooks.postUp')"
        />
-        <FormTextField
+        <FormTextArea
          id="PreDown"
          v-model="data.preDown"
          :label="$t('hooks.preDown')"
        />
-        <FormTextField
+        <FormTextArea
          id="PostDown"
          v-model="data.postDown"
          :label="$t('hooks.postDown')"
@@ -40,10 +40,11 @@ const { data: _data, refresh } = await useFetch(`/api/admin/hooks`, {
 const data = toRef(_data.value);

 const _submit = useSubmit(
-  `/api/admin/hooks`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/admin/hooks`, {
+      method: 'post',
+      body: data,
+    }),
  { revert }
 );

@@ -69,6 +69,30 @@
          :label="$t('awg.s4Label')"
          :description="$t('awg.s4Description')"
        />
+        <FormNullTextField
+          id="h1"
+          v-model="data.h1"
+          :label="$t('awg.h1Label')"
+          :description="$t('awg.h1Description')"
+        />
+        <FormNullTextField
+          id="h2"
+          v-model="data.h2"
+          :label="$t('awg.h2Label')"
+          :description="$t('awg.h2Description')"
+        />
+        <FormNullTextField
+          id="h3"
+          v-model="data.h3"
+          :label="$t('awg.h3Label')"
+          :description="$t('awg.h3Description')"
+        />
+        <FormNullTextField
+          id="h4"
+          v-model="data.h4"
+          :label="$t('awg.h4Label')"
+          :description="$t('awg.h4Description')"
+        />
        <FormNullTextField
          id="i1"
          v-model="data.i1"
@@ -99,29 +123,14 @@
          :label="$t('awg.i5Label')"
          :description="$t('awg.i5Description')"
        />
-        <FormNullNumberField
-          id="h1"
-          v-model="data.h1"
-          :label="$t('awg.h1Label')"
-          :description="$t('awg.h1Description')"
-        />
-        <FormNullNumberField
-          id="h2"
-          v-model="data.h2"
-          :label="$t('awg.h2Label')"
-          :description="$t('awg.h2Description')"
-        />
-        <FormNullNumberField
-          id="h3"
-          v-model="data.h3"
-          :label="$t('awg.h3Label')"
-          :description="$t('awg.h3Description')"
-        />
-        <FormNullNumberField
-          id="h4"
-          v-model="data.h4"
-          :label="$t('awg.h4Label')"
-          :description="$t('awg.h4Description')"
+      </FormGroup>
+      <FormGroup>
+        <FormHeading>{{ $t('admin.interface.firewall') }}</FormHeading>
+        <FormSwitchField
+          id="firewallEnabled"
+          v-model="data.firewallEnabled"
+          :label="$t('admin.interface.firewallEnabled')"
+          :description="$t('admin.interface.firewallEnabledDesc')"
        />
      </FormGroup>
      <FormGroup>
@@ -136,8 +145,8 @@
        >
          <FormSecondaryActionField
            :label="$t('admin.interface.changeCidr')"
-            class="w-full"
-            tabindex="-1"
+            class="inline-block w-full"
+            as="span"
          />
        </AdminCidrDialog>
        <AdminRestartInterfaceDialog
@@ -146,8 +155,8 @@
        >
          <FormSecondaryActionField
            :label="$t('admin.interface.restart')"
-            class="w-full"
-            tabindex="-1"
+            class="inline-block w-full"
+            as="span"
          />
        </AdminRestartInterfaceDialog>
      </FormGroup>
@@ -167,11 +176,20 @@ const { data: _data, refresh } = await useFetch(`/api/admin/interface`, {
 const data = toRef(_data.value);

 const _submit = useSubmit(
-  `/api/admin/interface`,
+  (data) =>
+    $fetch(`/api/admin/interface`, {
+      method: 'post',
+      body: data,
+    }),
  {
-    method: 'post',
-  },
-  { revert }
+    revert: async (success) => {
+      await revert();
+      if (success) {
+        // Refresh global store information after successful save
+        await globalStore.refreshInformation();
+      }
+    },
+  }
 );

 function submit() {
@@ -184,10 +202,11 @@ async function revert() {
 }

 const _changeCidr = useSubmit(
-  `/api/admin/interface/cidr`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/admin/interface/cidr`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert,
    successMsg: t('admin.interface.cidrSuccess'),
@@ -199,10 +218,11 @@ async function changeCidr(ipv4Cidr: string, ipv6Cidr: string) {
 }

 const _restartInterface = useSubmit(
-  `/api/admin/interface/restart`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/admin/interface/restart`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert,
    successMsg: t('admin.interface.restartSuccess'),
@@ -2,7 +2,9 @@
  <main v-if="data">
    <Panel>
      <PanelHead>
-        <PanelHeadTitle :text="data.name" />
+        <PanelHeadTitle>
+          {{ data.name }}
+        </PanelHeadTitle>
      </PanelHead>
      <PanelBody>
        <FormElement @submit.prevent="submit">
@@ -61,6 +63,12 @@
              name="serverAllowedIps"
            />
          </FormGroup>
+          <FormGroup v-if="globalStore.information?.firewallEnabled">
+            <FormHeading :description="$t('client.firewallIpsDesc')">
+              {{ $t('client.firewallIps') }}
+            </FormHeading>
+            <FormNullArrayField v-model="data.firewallIps" name="firewallIps" />
+          </FormGroup>
          <FormGroup>
            <FormHeading :description="$t('client.dnsDesc')">
              {{ $t('general.dns') }}
@@ -141,25 +149,25 @@
            <FormHeading :description="$t('client.hooksDescription')">
              {{ $t('client.hooks') }}
            </FormHeading>
-            <FormTextField
+            <FormTextArea
              id="PreUp"
              v-model="data.preUp"
              :description="$t('client.hooksLeaveEmpty')"
              :label="$t('hooks.preUp')"
            />
-            <FormTextField
+            <FormTextArea
              id="PostUp"
              v-model="data.postUp"
              :description="$t('client.hooksLeaveEmpty')"
              :label="$t('hooks.postUp')"
            />
-            <FormTextField
+            <FormTextArea
              id="PreDown"
              v-model="data.preDown"
              :description="$t('client.hooksLeaveEmpty')"
              :label="$t('hooks.preDown')"
            />
-            <FormTextField
+            <FormTextArea
              id="PostDown"
              v-model="data.postDown"
              :description="$t('client.hooksLeaveEmpty')"
@@ -180,9 +188,7 @@
            >
              <FormSecondaryActionField
                :label="$t('client.delete')"
-                class="w-full"
-                type="button"
-                tabindex="-1"
+                class="inline-block w-full"
                as="span"
              />
            </ClientsDeleteDialog>
@@ -192,9 +198,7 @@
            >
              <FormSecondaryActionField
                :label="$t('client.viewConfig')"
-                class="w-full"
-                type="button"
-                tabindex="-1"
+                class="inline-block w-full"
                as="span"
              />
            </ClientsConfigDialog>
@@ -217,10 +221,11 @@ const { data: _data, refresh } = await useFetch(`/api/client/${id}`, {
 const data = toRef(_data.value);

 const _submit = useSubmit(
-  `/api/client/${id}`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/client/${id}`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async (success) => {
      if (success) {
@@ -242,10 +247,11 @@ async function revert() {
 }

 const _deleteClient = useSubmit(
-  `/api/client/${id}`,
-  {
-    method: 'delete',
-  },
+  (data) =>
+    $fetch(`/api/client/${id}`, {
+      method: 'delete',
+      body: data,
+    }),
  {
    revert: async () => {
      await navigateTo('/');
@@ -2,11 +2,15 @@
  <main>
    <Panel>
      <PanelHead>
-        <PanelHeadTitle :text="$t('pages.clients')" />
+        <PanelHeadTitle>
+          {{ $t('pages.clients') }}
+        </PanelHeadTitle>
        <PanelHeadBoat>
          <ClientsSearch />
-          <ClientsSort />
-          <ClientsNew />
+          <div class="flex gap-2">
+            <ClientsSort />
+            <ClientsNew />
+          </div>
        </PanelHeadBoat>
      </PanelHead>

@@ -2,9 +2,8 @@
  <main>
    <UiBanner />
    <HeaderInsecure />
-    <form
+    <div
      class="mx-auto mt-10 flex w-64 flex-col gap-5 overflow-hidden rounded-md bg-white p-5 text-gray-700 shadow dark:bg-neutral-700 dark:text-neutral-200"
-      @submit.prevent="submit"
    >
      <!-- Avatar -->
      <div
@@ -13,117 +12,7 @@
        <IconsAvatar class="m-5 h-10 w-10 text-white dark:text-white" />
      </div>

-      <BaseInput
-        v-model="username"
-        type="text"
-        :placeholder="$t('general.username')"
-        autocomplete="username"
-        autofocus
-        name="username"
-      />
-
-      <BaseInput
-        v-model="password"
-        type="password"
-        name="password"
-        :placeholder="$t('general.password')"
-        autocomplete="current-password"
-      />
-
-      <BaseInput
-        v-if="totpRequired"
-        v-model="totp"
-        type="text"
-        name="totp"
-        :placeholder="$t('general.2faCode')"
-        autocomplete="one-time-code"
-        inputmode="numeric"
-        maxlength="6"
-        pattern="\d{6}"
-      />
-
-      <label
-        class="flex gap-2 whitespace-nowrap"
-        :title="$t('login.rememberMeDesc')"
-      >
-        <BaseSwitch v-model="remember" />
-        <span class="text-sm">{{ $t('login.rememberMe') }}</span>
-      </label>
-
-      <button
-        class="rounded py-2 text-sm text-white shadow transition dark:text-white"
-        :class="{
-          'cursor-pointer bg-red-800 hover:bg-red-700 dark:bg-red-800 dark:hover:bg-red-700':
-            password && username,
-          'cursor-not-allowed bg-gray-200 dark:bg-neutral-800':
-            !password || !username,
-        }"
-      >
-        <IconsLoading v-if="authenticating" class="mx-auto w-5 animate-spin" />
-        <span v-else>{{ $t('login.signIn') }}</span>
-      </button>
-    </form>
+      <NuxtPage />
+    </div>
  </main>
 </template>
-
-<script setup lang="ts">
-const toast = useToast();
-const { t } = useI18n();
-
-const authenticating = ref(false);
-const remember = ref(false);
-const username = ref<string>('');
-const password = ref<string>('');
-const totpRequired = ref(false);
-const totp = ref<string>('');
-
-const _submit = useSubmit(
-  '/api/session',
-  {
-    method: 'post',
-  },
-  {
-    revert: async (success, data) => {
-      if (success) {
-        if (data?.status === 'success') {
-          await navigateTo('/');
-        } else if (data?.status === 'TOTP_REQUIRED') {
-          authenticating.value = false;
-          totpRequired.value = true;
-          toast.showToast({
-            title: t('general.2fa'),
-            message: t('login.2faRequired'),
-            type: 'error',
-          });
-          return;
-        } else if (data?.status === 'INVALID_TOTP_CODE') {
-          authenticating.value = false;
-          totp.value = '';
-          toast.showToast({
-            title: t('general.2fa'),
-            message: t('login.2faWrong'),
-            type: 'error',
-          });
-          return;
-        }
-      }
-      authenticating.value = false;
-      password.value = '';
-    },
-    noSuccessToast: true,
-  }
-);
-
-async function submit() {
-  if (!username.value || !password.value || authenticating.value) return;
-
-  authenticating.value = true;
-
-  return _submit({
-    username: username.value,
-    password: password.value,
-    remember: remember.value,
-    totpCode: totpRequired.value ? totp.value : undefined,
-  });
-}
-</script>
@@ -0,0 +1,108 @@
+<template>
+  <div>
+    <form class="flex flex-col gap-5" @submit.prevent="submit">
+      <BaseInput
+        v-model="totp"
+        type="text"
+        name="totp"
+        :placeholder="$t('general.2faCode')"
+        autocomplete="one-time-code"
+        inputmode="numeric"
+        maxlength="6"
+        pattern="\d{6}"
+        autofocus
+      />
+
+      <button
+        class="rounded bg-red-800 py-2 text-sm text-white shadow transition hover:bg-red-700 disabled:cursor-not-allowed disabled:bg-gray-200 dark:bg-red-800 dark:text-white dark:hover:bg-red-700 disabled:dark:bg-neutral-800"
+        :disabled="!totp || authenticating"
+      >
+        <IconsLoading v-if="authenticating" class="mx-auto w-5 animate-spin" />
+        <span v-else>{{ $t('general.continue') }}</span>
+      </button>
+
+      <button
+        type="button"
+        class="rounded border-2 border-gray-100 py-2 text-sm text-gray-700 transition hover:border-red-800 hover:bg-red-800 hover:text-white dark:border-neutral-600 dark:text-neutral-200"
+        @click="cancel"
+      >
+        {{ $t('dialog.cancel') }}
+      </button>
+    </form>
+  </div>
+</template>
+
+<script setup lang="ts">
+const toast = useToast();
+const { t } = useI18n();
+
+const authenticating = ref(false);
+const totp = ref<string>('');
+
+const { error } = await useFetch('/api/auth/pending');
+if (error.value) {
+  await navigateTo('/login');
+}
+
+const _submit = useSubmit(
+  (data) =>
+    $fetch('/api/auth/verify-2fa', {
+      method: 'post',
+      body: data,
+    }),
+  {
+    revert: async (success, data) => {
+      if (success) {
+        if (data?.status === 'success') {
+          await navigateTo('/');
+          return;
+        } else if (data?.status === 'INVALID_TOTP_CODE') {
+          authenticating.value = false;
+          totp.value = '';
+          toast.showToast({
+            title: t('general.2fa'),
+            message: t('login.2faWrong'),
+            type: 'error',
+          });
+          return;
+        } else if (data?.status === 'PENDING_LOGIN_EXPIRED') {
+          toast.showToast({
+            title: t('general.2fa'),
+            message: t('login.loginExpired'),
+            type: 'error',
+          });
+          await navigateTo('/login');
+          return;
+        }
+      }
+      authenticating.value = false;
+    },
+    noSuccessToast: true,
+  }
+);
+
+async function submit() {
+  if (!totp.value || authenticating.value) return;
+
+  authenticating.value = true;
+  return _submit({ totpCode: totp.value });
+}
+
+const _cancel = useSubmit(
+  (data) =>
+    $fetch('/api/auth/cancel', {
+      method: 'post',
+      body: data,
+    }),
+  {
+    revert: async () => {
+      await navigateTo('/login');
+    },
+    noSuccessToast: true,
+  }
+);
+
+async function cancel() {
+  return _cancel({});
+}
+</script>
@@ -0,0 +1,147 @@
+<template>
+  <div class="flex flex-col gap-5">
+    <div
+      v-if="authMethods && authMethods.oauthEnabled"
+      class="flex flex-col gap-5"
+    >
+      <UiLoginOauthButton
+        v-for="(info, provider) in authMethods.providers"
+        :key="provider"
+        :provider="provider"
+        :info="info"
+      />
+
+      <!-- Divider -->
+      <div
+        v-if="authMethods.oauthEnabled && !authMethods.passwordDisabled"
+        class="flex items-center gap-2"
+      >
+        <div class="h-px flex-1 bg-gray-300 dark:bg-neutral-600"></div>
+        <span class="text-xs text-gray-500 dark:text-neutral-400">
+          {{ $t('login.or') }}
+        </span>
+        <div class="h-px flex-1 bg-gray-300 dark:bg-neutral-600"></div>
+      </div>
+    </div>
+
+    <!-- Classic Login Form -->
+    <form
+      v-if="!authMethods?.passwordDisabled"
+      class="flex flex-col gap-5"
+      @submit.prevent="submit"
+    >
+      <BaseInput
+        v-model="username"
+        type="text"
+        :placeholder="$t('general.username')"
+        autocomplete="username"
+        autofocus
+        name="username"
+      />
+
+      <BaseInput
+        v-model="password"
+        type="password"
+        name="password"
+        :placeholder="$t('general.password')"
+        autocomplete="current-password"
+      />
+
+      <label
+        class="flex gap-2 whitespace-nowrap"
+        :title="$t('login.rememberMeDesc')"
+      >
+        <BaseSwitch v-model="remember" />
+        <span class="text-sm">{{ $t('login.rememberMe') }}</span>
+      </label>
+
+      <button
+        class="rounded bg-red-800 py-2 text-sm text-white shadow transition hover:bg-red-700 disabled:cursor-not-allowed disabled:bg-gray-200 dark:bg-red-800 dark:text-white dark:hover:bg-red-700 disabled:dark:bg-neutral-800"
+        :disabled="!password || !username"
+      >
+        <IconsLoading v-if="authenticating" class="mx-auto w-5 animate-spin" />
+        <span v-else>{{ $t('login.signIn') }}</span>
+      </button>
+    </form>
+  </div>
+</template>
+
+<script setup lang="ts">
+const toast = useToast();
+const { t } = useI18n();
+const route = useRoute();
+
+const authenticating = ref(false);
+const remember = ref(false);
+const username = ref<string>('');
+const password = ref<string>('');
+
+const { data: authMethods } = await useFetch('/api/auth/methods');
+
+watchEffect(() => {
+  const autoLauchQuery =
+    typeof route.query.auto_launch === 'string' && !!route.query.auto_launch
+      ? route.query.auto_launch
+      : undefined;
+
+  if (authMethods.value?.autoLaunchProvider && !autoLauchQuery) {
+    navigateTo(`/api/auth/${authMethods.value.autoLaunchProvider}`, {
+      external: true,
+    });
+  }
+
+  if (
+    autoLauchQuery &&
+    autoLauchQuery !== 'false' &&
+    authMethods.value?.providers?.[autoLauchQuery as OAUTH_PROVIDER]
+  ) {
+    navigateTo(`/api/auth/${autoLauchQuery}`, {
+      external: true,
+    });
+  }
+});
+
+const _submit = useSubmit(
+  (data) =>
+    $fetch('/api/auth/password', {
+      method: 'post',
+      body: data,
+    }),
+  {
+    revert: async (success, data) => {
+      if (success) {
+        if (data?.status === 'success') {
+          await navigateTo('/');
+        } else if (data?.status === 'TOTP_REQUIRED') {
+          authenticating.value = false;
+          await navigateTo('/login/2fa');
+          return;
+        } else if (data?.status === 'INVALID_TOTP_CODE') {
+          authenticating.value = false;
+          toast.showToast({
+            title: t('general.2fa'),
+            message: t('login.2faWrong'),
+            type: 'error',
+          });
+          return;
+        }
+      }
+      authenticating.value = false;
+      password.value = '';
+    },
+    noSuccessToast: true,
+  }
+);
+
+async function submit() {
+  if (!username.value || !password.value || authenticating.value) return;
+
+  authenticating.value = true;
+
+  return _submit({
+    username: username.value,
+    password: password.value,
+    remember: remember.value,
+  });
+}
+</script>
@@ -2,7 +2,9 @@
  <main>
    <Panel>
      <PanelHead>
-        <PanelHeadTitle :text="$t('pages.me')" />
+        <PanelHeadTitle>
+          {{ $t('pages.me') }}
+        </PanelHeadTitle>
      </PanelHead>
      <PanelBody class="dark:text-neutral-200">
        <FormElement @submit.prevent="submit">
@@ -25,6 +27,7 @@
          <FormGroup>
            <FormHeading>{{ $t('general.password') }}</FormHeading>
            <FormPasswordField
+              v-if="hasPassword"
              id="current-password"
              v-model="currentPassword"
              autocomplete="current-password"
@@ -44,24 +47,25 @@
            />
            <FormSecondaryActionField
              type="submit"
-              :label="$t('general.updatePassword')"
+              :label="
+                hasPassword
+                  ? $t('general.updatePassword')
+                  : $t('general.addPassword')
+              "
            />
          </FormGroup>
        </FormElement>
        <FormElement @submit.prevent>
          <FormGroup>
            <FormHeading>{{ $t('general.2fa') }}</FormHeading>
-            <div
-              v-if="!authStore.userData?.totpVerified && !twofa"
-              class="col-span-2 flex flex-col"
-            >
+            <template v-if="!authStore.userData?.totpVerified && !twofa">
              <FormSecondaryActionField
                :label="$t('me.enable2fa')"
                @click="setup2fa"
              />
-            </div>
+            </template>
            <div
-              v-if="!authStore.userData?.totpVerified && twofa"
+              v-else-if="!authStore.userData?.totpVerified && twofa"
              class="col-span-2"
            >
              <p class="text-sm text-gray-500 dark:text-gray-400">
@@ -91,7 +95,7 @@
              </div>
            </div>
            <div
-              v-if="authStore.userData?.totpVerified"
+              v-else-if="authStore.userData?.totpVerified"
              class="col-span-2 flex flex-col gap-2"
            >
              <p class="text-sm text-gray-500 dark:text-gray-400">
@@ -111,6 +115,60 @@
            </div>
          </FormGroup>
        </FormElement>
+        <FormElement v-if="authMethods?.oauthEnabled" @submit.prevent>
+          <FormGroup>
+            <FormHeading>{{ $t('general.externalAuth') }}</FormHeading>
+            <template v-if="oauthProvider && oauthProviderInfo?.enabled">
+              <div class="flex items-center gap-2">
+                <IconsBrandsProvider
+                  :provider="oauthProvider"
+                  class="h-4 w-4"
+                />
+                <span>
+                  {{ $t('me.linkedWith', [oauthProviderInfo.friendlyName]) }}
+                </span>
+              </div>
+              <div>
+                <FormSecondaryActionField
+                  :label="$t('me.unlinkOauth')"
+                  class="w-full"
+                  :disabled="!hasPassword"
+                  @click="unlinkOauth"
+                />
+              </div>
+            </template>
+            <template v-else-if="oauthProvider && !oauthProviderInfo?.enabled">
+              <span class="flex items-center">
+                {{ $t('me.providerDisabled') }}
+              </span>
+              <div>
+                <FormSecondaryActionField
+                  :label="$t('me.unlinkOauth')"
+                  class="w-full"
+                  :disabled="!hasPassword"
+                  @click="unlinkOauth"
+                />
+              </div>
+            </template>
+            <template v-else>
+              <div class="flex items-center">
+                <span>{{ $t('me.linkOauth') }}</span>
+              </div>
+              <div class="flex flex-col gap-2">
+                <BaseFormSecondaryButton
+                  v-for="(info, provider) in authMethods.providers"
+                  :key="provider"
+                  class="flex items-center gap-2 p-2"
+                  as="a"
+                  :href="`/api/auth/${provider}?link=true`"
+                >
+                  <IconsBrandsProvider :provider="provider" class="h-4 w-4" />
+                  <span>{{ info.friendlyName }}</span>
+                </BaseFormSecondaryButton>
+              </div>
+            </template>
+          </FormGroup>
+        </FormElement>
      </PanelBody>
    </Panel>
  </main>
@@ -121,14 +179,25 @@ import { encodeQR } from 'qr';

 const authStore = useAuthStore();

+const { data: authMethods } = await useFetch('/api/auth/methods');
+
 const name = ref(authStore.userData?.name);
 const email = ref(authStore.userData?.email);
+const hasPassword = computed(() => authStore.userData?.hasPassword);
+const oauthProvider = computed(() => authStore.userData?.oauthProvider);
+const oauthProviderInfo = computed(() => {
+  if (!authStore.userData?.oauthProvider) {
+    return null;
+  }
+  return authMethods.value?.providers?.[authStore.userData.oauthProvider];
+});

 const _submit = useSubmit(
-  `/api/me`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/me`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: () => {
      return authStore.update();
@@ -145,22 +214,24 @@ const newPassword = ref('');
 const confirmPassword = ref('');

 const _updatePassword = useSubmit(
-  `/api/me/password`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/me/password`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async () => {
      currentPassword.value = '';
      newPassword.value = '';
      confirmPassword.value = '';
+      return authStore.update();
    },
  }
 );

 function updatePassword() {
  return _updatePassword({
-    currentPassword: currentPassword.value,
+    currentPassword: hasPassword.value ? currentPassword.value : null,
    newPassword: newPassword.value,
    confirmPassword: confirmPassword.value,
  });
@@ -169,10 +240,11 @@ function updatePassword() {
 const twofa = ref<{ key: string; qrcode: string } | null>(null);

 const _setup2fa = useSubmit(
-  `/api/me/totp`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/me/totp`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async (success, data) => {
      if (success && data?.type === 'setup') {
@@ -197,10 +269,11 @@ async function setup2fa() {
 const code = ref<string>('');

 const _enable2fa = useSubmit(
-  `/api/me/totp`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/me/totp`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async (success, data) => {
      if (success && data?.type === 'created') {
@@ -222,10 +295,11 @@ async function enable2fa() {
 const disable2faPassword = ref('');

 const _disable2fa = useSubmit(
-  `/api/me/totp`,
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch(`/api/me/totp`, {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async (success, data) => {
      if (success && data?.type === 'deleted') {
@@ -242,4 +316,21 @@ async function disable2fa() {
    currentPassword: disable2faPassword.value,
  });
 }
+
+const _unlinkOauth = useSubmit(
+  (data) =>
+    $fetch(`/api/auth/unlink`, {
+      method: 'post',
+      body: data,
+    }),
+  {
+    revert: async () => {
+      return authStore.update();
+    },
+  }
+);
+
+async function unlinkOauth() {
+  return _unlinkOauth({});
+}
 </script>
@@ -50,10 +50,11 @@ const password = ref<string>('');
 const confirmPassword = ref<string>('');

 const _submit = useSubmit(
-  '/api/setup/2',
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch('/api/setup/2', {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async (success) => {
      if (success) {
@@ -43,10 +43,11 @@ const host = ref<null | string>(null);
 const port = ref<number>(51820);

 const _submit = useSubmit(
-  '/api/setup/4',
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch('/api/setup/4', {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async (success) => {
      if (success) {
@@ -36,10 +36,11 @@ function onChangeFile(evt: Event) {
 }

 const _submit = useSubmit(
-  '/api/setup/migrate',
-  {
-    method: 'post',
-  },
+  (data) =>
+    $fetch('/api/setup/migrate', {
+      method: 'post',
+      body: data,
+    }),
  {
    revert: async (success) => {
      if (success) {
@@ -1,5 +1,4 @@
 import type { H3Event } from 'h3';
-import type { SharedPublicUser } from '~~/shared/utils/permissions';

 export const useAuthStore = defineStore('Auth', () => {
  const userData = useState<SharedPublicUser | null>('user-data', () => null);
@@ -31,9 +31,12 @@ export const useClientsStore = defineStore('Clients', () => {
  const clients = ref<null | LocalClient[]>(null);
  const clientsPersist = ref<Record<string, ClientPersist>>({});

-  const searchParams = ref({
-    filter: undefined as string | undefined,
-  });
+  const filter = ref<string | undefined>(undefined);
+
+  const searchParams = computed(() => ({
+    filter: filter.value,
+    sort: globalStore.sortClient,
+  }));

  const { data: _clients, refresh: _refresh } = useFetch('/api/client', {
    method: 'get',
@@ -43,7 +46,7 @@ export const useClientsStore = defineStore('Clients', () => {
  // TODO: rewrite
  async function refresh({ updateCharts = false } = {}) {
    await _refresh();
-    let transformedClients = _clients.value?.map((client) => {
+    const transformedClients = _clients.value?.map((client) => {
      let avatar = undefined;
      if (client.name.includes('@') && client.name.includes('.')) {
        avatar = `https://gravatar.com/avatar/${sha256(client.name.toLowerCase().trim())}.jpg`;
@@ -126,21 +129,12 @@ export const useClientsStore = defineStore('Clients', () => {
      };
    });

-    // TODO: move sort to backend
-    if (transformedClients !== undefined) {
-      transformedClients = sortByProperty(
-        transformedClients,
-        'name',
-        globalStore.sortClient
-      );
-    }
-
    clients.value = transformedClients ?? null;
  }

-  function setSearchQuery(filter: string) {
+  function setSearchQuery(query: string) {
    clients.value = null;
-    searchParams.value.filter = filter || undefined;
+    filter.value = query || undefined;
  }

  return { clients, clientsPersist, refresh, _clients, setSearchQuery };
--- a/Show More
+++ b/Show More