Amnezia VPN Web Panel

Amnezia VPN Web Panel is a management interface for Amnezia AWG (WireGuard) VPN servers. It allows for deploying VPN servers via SSH (using passwords or SSH keys) and importing configurations from existing panels like wg-easy or 3x-ui.

Key Features:

• Protocol Management: Supports WireGuard, AmneziaWG, OpenVPN, Shadowsocks, XRay VLESS, MTProxy, SMB, AIVPN, and Cloudflare WARP Proxy.
• Client Control: Manage client configurations with expiration dates and automatic traffic limits.
• Automation: Automatic checking of client expiration and traffic limits via cron.
• AI Integration: Optional AI-driven protocol configuration via OpenRouter.
• Monitoring & Logs: Traffic statistics monitoring and advanced log management (system and container logs).
• API: REST API with JWT authentication.
• Backup: Server backup and recovery capabilities.

The project follows a standard PHP structure with the following key directories and components:

• public/index.php: The main entry point and router.
• inc/: Contains core logic classes:
  • Auth.php: Authentication logic.
  • DB.php: Database connection management.
  • Router.php: URL routing.
  • View.php: Twig template rendering.
  • VpnServer.php: Server management.
  • VpnClient.php: Client management.
  • Translator.php: Multi-language support.
  • JWT.php: Token-based authentication.
  • QrUtil.php: QR code generation.
  • PanelImporter.php: Import functionality for wg-easy or 3x-ui.
  • InstallProtocolManager.php: Core protocol management.
  • OpenRouterService.php: AI integration services.
• templates/: Twig template files.
• migrations/: SQL migration files, executed in alphabetical order.

Creating a new VPN client involves several automated steps to ensure the client is correctly provisioned and configured on the server:

1. Form Submission: User submits a client name via POST /servers/{id}/clients/create.
2. Logic Execution: VpnClient::create($serverId, $userId, $name) is called.
3. Provisioning Steps:
   • Retrieve server data.
   • Generate client keys via SSH execution on the remote server.
   • Assign the next available free IP address.
   • Construct the WireGuard configuration text.
   • Add the peer to the server by appending to wg0.conf and running wg syncconf.
   • Generate a QR code using QrUtil.
   • Insert the client record into the database.
4. Completion: The user is redirected to /clients/{id} to view the configuration and QR code.

The project is built using the following technologies:

• PHP: version 8.2
• MySQL: version 8.0
• Twig: version 3 (Templating engine)
• Tailwind CSS: (Styling framework)
• Docker: (Containerization)

Cloudflare WARP transparently proxies all TCP traffic from VPN clients through the Cloudflare network, hiding the server's real IP address.

⚠️ IMPORTANT: Install WARP LAST — Install WARP after all other protocols (AWG, X-Ray, AIVPN, etc.) have been set up. During installation, WARP automatically detects active VPN containers and interfaces to configure routing.

Supported Protocols:

• AWG / AWG2: Via container IP + host redsocks routing.
• X-Ray VLESS: Via warp-out SOCKS5 outbound in X-Ray configuration.
• AIVPN / WireGuard: Via host-level iptables + redsocks routing.

Verification: Connect to the VPN and visit https://1.1.1.1/cdn-cgi/trace. The field warp=on confirms it is working correctly.

When a user initiates a server creation, the system follows a specific automated sequence to provision a remote VPN server:

1. Form Submission: The user submits the creation form.
2. Routing: The request is handled by POST /servers/create.
3. Database Entry: VpnServer::create() inserts the initial server record into the database.
4. Deployment Trigger: The user is redirected to /servers/{id}/deploy, which triggers VpnServer->deploy().
5. Remote Provisioning: The system connects via SSH to the remote server to:
   • Install Docker
   • Pull the AWG (Amnezia WireGuard) image
   • Generate necessary keys
   • Create the configuration
   • Start the container
6. Finalization: The database is updated with the new server details, and the user is redirected to the server dashboard at /servers/{id}.

The Cloudflare WARP Proxy transparently proxies all TCP traffic from VPN clients through the Cloudflare network, masking the server's real IP.

⚠️ Critical Installation Order: Always install WARP last, after all other protocols (AWG, X-Ray, AIVPN, etc.) have been set up. During installation, WARP automatically detects active VPN containers and interfaces to configure routing.

Protocol Support:

• AWG / AWG2: Routing via container IP + host redsocks.
• X-Ray VLESS: Outbound warp-out via SOCKS5 in X-Ray configuration.
• AIVPN / WireGuard: Routing via iptables + host redsocks.

Verification: Connect to the VPN and visit https://1.1.1.1/cdn-cgi/trace. If warp=on is present, it is working correctly.

When importing from existing panels, the following data fields are handled:

From wg-easy:

• Client names
• Public/private keys
• Pre-shared keys
• IP addresses
• Enabled/disabled status
• Creation timestamps

From 3x-ui:

• Client names (mapped from the email field)
• Traffic limits (totalGB)
• Expiration dates
• Enabled/disabled status
• ⚠️ Keys: Will be auto-generated (3x-ui does not export them)
• ⚠️ IP addresses: Will be auto-assigned

The API returns QR codes as Base64 encoded data URIs (e.g., data:image/png;base64,...). You can use these directly in an HTML <img> tag's src attribute to display the connection code to users.

<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..." alt="QR Code" />

The project follows a Model-View-Controller (MVC) pattern. The request lifecycle flows as follows:

1. Request: An incoming HTTP request.
2. Router: Matches the request to a specific route.
3. Controller Logic: Executes the business logic (often defined within the router handler).
4. Model: Interacts with the database or external services (e.g., VpnServer, VpnClient).
5. Database: Persists or retrieves data.
6. View (Twig): Renders the response using Twig templates.
7. Response: The final output sent to the user.