{
  "client_requirement": "client_is_viewer+",
  "items": [
    {
      "type": "header_page_title",
      "items": [
        {
          "type": "h1",
          "text": "VPN"
        },
        {
          "type": "p",
          "text": "WireGuard peer management and server interface configuration."
        }
      ]
    },
    {
      "type": "table",
      "label": "Active Sessions",
      "datasource": "live:vpn_sessions",
      "empty_message": "No active VPN sessions.",
      "columns": [
        {
          "label": "Peer",
          "field": "peer_name"
        },
        {
          "label": "Tunnel IP",
          "field": "tunnel_ip",
          "class": "col-mono"
        },
        {
          "label": "Endpoint",
          "field": "endpoint",
          "class": "col-mono"
        },
        {
          "label": "Last Handshake",
          "field": "last_handshake"
        },
        {
          "label": "Received",
          "field": "rx_bytes",
          "class": "col-mono"
        },
        {
          "label": "Sent",
          "field": "tx_bytes",
          "class": "col-mono"
        }
      ]
    },
    {
      "type": "table",
      "label": "Peers",
      "datasource": "config:vpn_peers",
      "empty_message": "No peers configured. Use Add Peer below.",
      "columns": [
        {
          "label": "Name",
          "field": "name"
        },
        {
          "label": "Assigned VLAN",
          "field": "vlan_display",
          "class": "col-mono"
        },
        {
          "label": "Assigned IP",
          "field": "ip",
          "class": "col-mono"
        },
        {
          "label": "Split Tunnel",
          "field": "split_tunnel"
        },
        {
          "label": "Enabled",
          "field": "enabled",
          "render": "badge_enabled_disabled"
        },
        {
          "label": "Public Key",
          "field": "pubkey_short",
          "class": "col-mono"
        }
      ],
      "row_actions": [
        {
          "client_requirement": "client_is_administrator+",
          "method": "js_edit",
          "target": "add-form",
          "text": "Edit",
          "class": "btn-ghost btn-sm"
        },
        {
          "client_requirement": "client_is_administrator+",
          "action": "/action/vpn/peers_regenerate",
          "method": "post",
          "text": "Regen Conf",
          "class": "btn-ghost btn-sm"
        },
        {
          "client_requirement": "client_is_administrator+",
          "action": "/action/vpn/peers_delete",
          "method": "post",
          "text": "Delete",
          "class": "btn-danger btn-sm"
        }
      ]
    },
    {
      "type": "card",
      "id": "add-form",
      "label": "Add Peer",
      "client_requirement": "client_is_administrator+",
      "items": [
        {
          "type": "form",
          "action": "/action/vpn/addpeer_add",
          "method": "post",
          "items": [
            {
              "type": "hidden",
              "name": "row_index",
              "value": ""
            },
            {
              "type": "field",
              "label": "Name",
              "name": "peer_name",
              "input_type": "text",
              "validate": "VALIDATION_DASH_NAME",
              "placeholder": "e.g. laptop",
              "hint": "Friendly name for this peer."
            },
            {
              "type": "field",
              "label": "Assigned VLAN",
              "name": "peer_vlan",
              "input_type": "select",
              "options": "%VPN_VLAN_OPTIONS%"
            },
            {
              "type": "field",
              "label": "Assigned IP",
              "name": "peer_ip",
              "input_type": "text",
              "validate": "VALIDATION_IPV4_FORMAT",
              "placeholder": "e.g. 192.168.40.2",
              "hint": "Static IP assigned to this peer within the VPN subnet."
            },
            {
              "type": "field",
              "label": "Split Tunnel",
              "name": "split_tunnel",
              "input_type": "checkbox",
              "hint": "Route only VPN subnet traffic through the tunnel. When unchecked all traffic is routed through the VPN."
            },
            {
              "type": "field",
              "label": "Enabled",
              "name": "enabled",
              "input_type": "checkbox",
              "checked": true
            },
            {
              "type": "button_row",
              "items": [
                {
                  "type": "button_primary",
                  "action": "/action/vpn/addpeer_add",
                  "method": "post",
                  "text": "Add Peer & Download Conf"
                },
                {
                  "type": "button_cancel",
                  "text": "Cancel"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "type": "card",
      "label": "WireGuard Interface",
      "client_requirement": "client_is_administrator+",
      "items": [
        {
          "type": "form",
          "action": "/action/vpn/wireguard_apply",
          "method": "post",
          "items": [
            {
              "type": "field",
              "label": "Listen Port",
              "name": "vpn_listen_port",
              "input_type": "number",
              "value": "%VPN_LISTEN_PORT%",
              "min": 1024,
              "max": 65535,
              "hint": "UDP port WireGuard listens on. Must match your port forwarding rule."
            },
            {
              "type": "field",
              "label": "Server Endpoint",
              "name": "vpn_server_endpoint",
              "input_type": "text",
              "validate": "VALIDATION_ENDPOINT",
              "value": "%VPN_SERVER_ENDPOINT%",
              "placeholder": "e.g. vpn.example.com",
              "hint": "Publicly reachable hostname or IP of this server, embedded in client config files."
            },
            {
              "type": "field",
              "label": "Domain",
              "name": "vpn_domain",
              "input_type": "text",
              "validate": "VALIDATION_DASH_NAME",
              "value": "%VPN_DOMAIN%",
              "placeholder": "e.g. local",
              "hint": "DNS search domain pushed to VPN clients."
            },
            {
              "type": "field",
              "label": "DNS Override",
              "name": "vpn_dns_server",
              "input_type": "text",
              "validate": "VALIDATION_IPV4_FORMAT",
              "value": "%VPN_DNS_SERVER%",
              "placeholder": "Leave blank to use gateway IP (%VPN_GATEWAY%)",
              "hint": "Explicit DNS server pushed to peers. Defaults to the gateway IP."
            },
            {
              "type": "field",
              "label": "MTU Override",
              "name": "vpn_mtu",
              "input_type": "number",
              "value": "%VPN_MTU%",
              "placeholder": "Leave blank for default",
              "hint": "Override tunnel MTU. Leave blank for the system default."
            },
            {
              "type": "button_row",
              "items": [
                {
                  "type": "button_primary",
                  "action": "/action/vpn/wireguard_apply",
                  "method": "post",
                  "text": "Save"
                },
                {
                  "type": "button_cancel",
                  "text": "Cancel"
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}