Settings

Hub

Security model

There are no passwords anywhere in this system. The WireGuard key is the identity: a device with a key has full access to the home network, and revoking its key cuts it off at once.

The dashboard is served at https://vpn.byteflyo.shop behind an admin login (session cookie, 12h). The backend API itself listens on 127.0.0.1:18083 only — never expose that port directly. The hub endpoint clients use is … (DDNS-kept, so a hub IP change does not break configs). Failover status lives on the Security page.

Two-factor authentication

The backend does not serve /api/auth/2fa/* yet — 2FA setup is not available. Login stays password-only until the endpoint lands.

Agent updates

PC and Android agents serve each device's files on :8787 inside the VPN. Whether each agent is running right now is shown on the Files page (Agent status). Version and update controls will live here once agents report a version.

Backup

The dashboard keeps its device registry, users and activity log in its data directory (/var/lib/homevpn: devices.json, users.json, activity.jsonl). Copy that directory to back up every key and name; restore it to bring a rebuilt dashboard back.

Backup & restore

⚠ A backup contains private keys — anyone with the file has full access to the home network. Store it somewhere safe, never share it.

Restore validates the file first and reports what it found (users, devices) before replacing anything. Download/Restore need the backend endpoints (GET /api/backup, POST /api/restore) — not served yet.