WolfStack

https://github.com/wolfsoftwaresystemsltd/wolfstack
Admin
WolfStack is a comprehensive Proxmox-like server management platform built with Rust, offering a...
Tokens:90,464
Snippets:1,047
Trust Score:9.2
Update:3 months ago
Show doc for...
Tokens:
Raw
### Install Docker Compose App

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/app-store-compose.md

Handles the installation of an app using Docker Compose. It renders the compose YAML, writes it to the correct directory, and starts the Docker Compose stack.

```shell
docker compose -p appstore-{install_id} up -d
```

--------------------------------

### Install WolfProxy

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/index.html

Run this command on any server or inside a container to install WolfProxy.

```bash
curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfProxy/main/setup.sh | sudo bash
```

--------------------------------

### Install WolfDisk

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/index.html

Run this command on any server or inside a container to install WolfDisk.

```bash
curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfScale/main/setup.sh | sudo bash
```

--------------------------------

### Install WolfStack

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/infographic.html

Use this command to install WolfStack. It fetches the installation script and pipes it to bash for execution.

```bash
curl -sSL wolfstack.org/install | sudo bash
```

--------------------------------

### Setup Script Proxy

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/docs/xcp-ng-integration.md

Provides a cached proxy to the WolfStack setup script. This endpoint is intentionally public and used by cloud-init during the initial VM setup to download and execute the installation script.

```APIDOC
## GET /api/install/setup.sh

### Description
Provides a cached proxy to the WolfStack setup script. This endpoint is intentionally public and used by cloud-init during the initial VM setup to download and execute the installation script. It falls back to GitHub if the SP is unreachable.

### Method
GET

### Endpoint
/api/install/setup.sh

### Response
#### Success Response (200)
- The content of the WolfStack setup script (shell script).

### Response Example
```bash
#!/bin/bash
# WolfStack setup script content...
```
```

--------------------------------

### Install WolfServe

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/index.html

Run this command on any server or inside a container to install WolfServe.

```bash
curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfServe/main/setup.sh | sudo bash
```

--------------------------------

### Install WolfScale Load Balancer

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/index.html

Run this command on any server or inside a container to install WolfScale load balancer.

```bash
curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfScale/main/setup_lb.sh | sudo bash
```

--------------------------------

### Cloud-init User Data for WolfStack Installation

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/docs/xcp-ng-integration.md

This cloud-config YAML payload is used for the initial setup of WolfStack on a new VM. It handles package updates, WolfStack installation via a setup script, and service enablement. Ensure cloud-init guest tools are installed on the VM template.

```yaml
#cloud-config
hostname: <provided>
package_update: false
package_upgrade: false
runcmd:
  - bash -lc 'hostnamectl set-hostname '
```

```yaml
'<hostname>'
```

```yaml
''
  - bash -lc 'curl -fsSL --max-time 30 "<sp_url>/api/install/setup.sh"
              || curl -fsSL --max-time 60 "<github_raw>" -o /tmp/wolfstack-setup.sh;
              sudo bash /tmp/wolfstack-setup.sh --yes [--agent]'
  - bash -lc 'systemctl enable wolfstack || true'
  - bash -lc 'systemctl restart wolfstack || true'
final_message: "WolfStack first-boot finished after $UPTIME seconds. ..."

```

--------------------------------

### Install Certificate via API

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Installs a provided certificate and private key pair. This endpoint is used for manual certificate installations.

```javascript
POST /api/certificates/install
```

--------------------------------

### Install WolfNet Locally

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/wolfnet-global.html

This bash script installs WolfNet on your local machine. Follow the prompts to choose a WolfNet IP and configure gateway mode.

```bash
curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfScale/main/wolfnet/setup.sh | sudo bash
```

--------------------------------

### Install Certificate via Let's Encrypt API

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Initiates the process of obtaining and installing a certificate using Let's Encrypt.

```javascript
POST /api/certificates
```

--------------------------------

### Install WolfStack™

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/README.md

Run this command to install WolfStack™ on your machine. It works on most Linux versions and can be run on a single machine. After installation, access the dashboard via http://your-server:8553.

```bash
curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfStack/master/setup.sh | sudo bash
```

--------------------------------

### Setup Script Proxy Endpoint

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/docs/xcp-ng-integration.md

The Service Provider's WolfStack exposes this endpoint as a cached proxy for the setup script. It allows cloud-init to fetch the script from the SP's origin, falling back to GitHub if the SP is unreachable. This endpoint is intentionally public.

```http
GET /api/install/setup.sh
```

--------------------------------

### Path B Install Proxy

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/docs/xcp-ng-integration.md

A public endpoint to proxy the installation script with caching.

```APIDOC
## GET /api/install/setup.sh

### Description
Proxies the upstream installation script (`setup.sh`) with a 5-minute cache. This endpoint is public and requires no authentication.

### Method
GET

### Endpoint
/api/install/setup.sh

### Response
#### Success Response (200)
- **script** (string) - The content of the setup script.
```

--------------------------------

### Quick Setup for WAN and LAN

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/index.html

Automates the creation of WAN uplink, LAN segment, and router IP once at least one interface is designated as WAN and another as LAN.

```bash
Quick Setup
```

--------------------------------

### Install Antivirus Stack

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Installs the full antivirus and rootkit scanning stack on the node.

```APIDOC
## POST /api/antivirus/install

### Description
Installs the necessary antivirus and rootkit scanning tools (ClamAV, rkhunter, chkrootkit) on the current node using the system's package manager.

### Method
POST

### Endpoint
/api/antivirus/install

### Request Body
None

### Response
#### Success Response (200)
Indicates that the installation process has been initiated successfully.

#### Response Example
(No specific example provided in source)
```

--------------------------------

### Example Firewall Command for WolfStack with firewalld

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Shows the exact command to allow WolfStack traffic through firewalld if it's active and port 8553 is not already allowed.

```bash
firewall-cmd --add-port=8553/tcp --permanent && firewall-cmd --reload
```

--------------------------------

### Example Firewall Command for WolfStack

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Shows the exact command to allow WolfStack traffic through ufw if it's active and port 8553 is not already allowed.

```bash
ufw allow 8553
```

--------------------------------

### Atomic Certificate Installation

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Ensures certificate and key pair integrity during installation by writing to a temporary '.new' file, verifying the pair, and then atomically renaming it. This prevents overwriting a working certificate with a bad upload.

```bash
<path>.new
```

--------------------------------

### Install Encrypted PKCS#8 Private Key

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Handles installation of private keys that are encrypted using PKCS#8 format. The passphrase is provided via a 'key_passphrase' field and securely passed to openssl.

```bash
Proc-Type: 4,ENCRYPTED
```

--------------------------------

### WolfStack Starting Overlay Animation

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/login.html

CSS keyframe animation for the WolfStack loading overlay spinner.

```css
@keyframes ws-spin { to { transform: rotate(360deg); } }
```

--------------------------------

### Initiate Passkey Login

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/login.html

Starts the passkey login process by sending a POST request to the server. It retrieves the challenge and ceremony ID required for the WebAuthn API.

```javascript
async function passkeyLogin() {
  const btn = document.getElementById('passkey-btn');
  const errEl = document.getElementById('passkey-error');
  errEl.style.display = 'none';
  btn.disabled = true;
  const orig = btn.innerHTML;
  btn.innerHTML = 'Waiting for passkey…';
  try {
    const startResp = await fetch('/api/auth/passkey/login/start', {
      method: 'POST',
      headers: {'Content-Type':'application/json'},
      body: '{}'
    });
    if (!startResp.ok) {
      const data = await startResp.json().catch(() => ({}));
      throw new Error(data.error || ('Server returned ' + startResp.status));
    }
    const { challenge, ceremony_id } = await startResp.json();
    // Convert the challenge JSON's base64url fields into ArrayBuffers // for the WebAuthn API. webauthn-rs delivers 
    // 

```

--------------------------------

### Dockerfile for WolfDisk

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/wolfnet-wolfdisk-docker.md

Builds the WolfDisk Docker image using a Debian base. Installs FUSE, copies the WolfDisk binary and entrypoint script, and configures necessary directories and ports.

```dockerfile
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
    fuse3 libfuse3-3 ca-certificates && rm -rf /var/lib/apt/lists/* \
    && echo "user_allow_other" >> /etc/fuse.conf
RUN mkdir -p /etc/wolfdisk /var/lib/wolfdisk /mnt/wolfdisk
COPY wolfdisk /usr/local/bin/wolfdisk
COPY docker-entrypoint.sh /entrypoint.sh
RUN chmod +x /usr/local/bin/wolfdisk /entrypoint.sh
EXPOSE 8550/tcp
VOLUME ["/etc/wolfdisk", "/var/lib/wolfdisk", "/mnt/wolfdisk"]
ENTRYPOINT ["/entrypoint.sh"]
```

--------------------------------

### Inspect container files

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/learn/5-2-container-shell.md

Use common shell commands like `ls` and `cat` to view files and configurations within a container. This is useful for understanding the container's setup.

```bash
ls
```

```bash
cat some-config-file
```

--------------------------------

### Initialize VNC Connection Logic

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/vnc.html

Handles VNC connection setup by parsing URL parameters for VM name, port, host, WebSocket path, and ticket. It supports both WolfStack-proxied VNC and native QEMU/libvirt VMs, including fetching VNC passwords for authentication.

```javascript
import RFB from 'https://esm.sh/@novnc/novnc@1.4.0/lib/rfb.js';
const params = new URLSearchParams(window.location.search);
const vmName = params.get('name') || 'unknown';
const wsPort = parseInt(params.get('port') || '0');
const host = params.get('host') || window.location.hostname;
const wsPath = params.get('ws_path') || '';
const vncTicket = params.get('ticket') || '';
// Node id when the VM lives on ANOTHER cluster node. The websocket and
// the password fetch must then go through this (admin) node's
// remote-console / node-proxy routes — the session cookie only
// authenticates here, and the VM doesn't exist here locally.
const nodeId = params.get('node') || '';
document.getElementById('vm-name').textContent = vmName;
document.title = `${vmName} — VNC Console`;
let rfb = null;
window.rfb = null; // expose for VR terminal access
if (wsPath) {
  // WolfStack-proxied VNC. resizeSession asks the server to
  // resize its display to match our viewport — desirable for
  // container VNC (TigerVNC honours it), avoids the
  // scale-down + centre-and-clip dance that hides the top
  // edge of the desktop. Disabled for Proxmox VMs because
  // Windows 11 applies 125%+ display scaling after a resize,
  // mangling mouse coordinates.
  //
  // Heuristic: container VNC paths (/ws/container-vnc/... or
  // remote-console with -vnc ctype) want resize; everything
  // else (Proxmox /ws/pve-vnc/...) does not.
  const isContainerVnc = /\/(container-vnc|lxc-vnc|docker-vnc|pct-vnc)\//.test(wsPath);
  const wsProtocol = window.location.protocol === 'https:' ? 'wss' : 'ws';
  const wsUrl = `${wsProtocol}://${window.location.host}${wsPath}`;
  connectProxiedVNC(wsUrl, vncTicket, isContainerVnc);
} else if (wsPort) {
  // Native QEMU / libvirt VMs — proxy through WolfStack to avoid
  // mixed-content issues. When the VM is on another node, go through
  // the remote-console bridge on THIS node (cluster-secret-authed
  // hop) — connecting straight to /ws/vm-vnc here found no such VM
  // and the console died with "Connection lost" (klasSponsor
  // 2026-06-10).
  const wsProtocol = window.location.protocol === 'https:' ? 'wss' : 'ws';
  const proxyUrl = nodeId ? `${wsProtocol}://${window.location.host}/ws/remote-console/${encodeURIComponent(nodeId)}/vm-vnc/${encodeURIComponent(vmName)}` : `${wsProtocol}://${window.location.host}/ws/vm-vnc/${encodeURIComponent(vmName)}`;
  // An external-VNC VM has a password; fetch it so the console auths
  // seamlessly. None/empty (the default) → connect without a password,
  // exactly as before. If the fetch fails the RFB credentials prompt
  // is the fallback, so this never makes a console worse. Remote VMs
  // fetch via the node proxy for the same reason as the websocket.
  let ticket = vncTicket;
  if (!ticket) {
    const passUrl = nodeId ? `/api/nodes/${encodeURIComponent(nodeId)}/proxy/vms/${encodeURIComponent(vmName)}/vnc-password` : `/api/vms/${encodeURIComponent(vmName)}/vnc-password`;
    try {
      const r = await fetch(passUrl, { credentials: 'include' });
      if (r.ok) {
        const d = await r.json();
        if (d && d.password) ticket = d.password;
      }
    } catch (e) {
      /* fall through to no-password / prompt */
    }
  }
  connectProxiedVNC(proxyUrl, ticket, true);
} else {
  document.getElementById('status-overlay').innerHTML = '<p style="color:#fca5a5;">No VNC connection parameters specified.<br>The VM may not be running.</p>';
}
function connectProxiedVNC(wsUrl, ticket, resizeSession) {
  const container = 
```

--------------------------------

### Get Antivirus Status and Scan Progress

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Retrieves the current status of installed antivirus tools and ongoing scan progress.

```APIDOC
## GET /api/antivirus/status

### Description
Retrieves the status of installed antivirus and rootkit scanning tools, as well as the progress of any currently running scans. This endpoint provides information on whether the stack is installed and operational.

### Method
GET

### Endpoint
/api/antivirus/status

### Response
#### Success Response (200)
Returns details about the installed tools and current scan progress.

#### Response Example
{
  "installed_tools": {
    "clamav": true,
    "rkhunter": true,
    "chkrootkit": true
  },
  "scan_progress": {
    "scanning": true,
    "current_file": "/path/to/large/file.dat",
    "percentage_complete": 45.5
  }
}
```

--------------------------------

### Get Compose File API

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/app-store-compose.md

Endpoint to retrieve the current rendered Docker Compose YAML file for an installed app.

```http
GET /api/appstore/installed/{install_id}/compose.yaml
```

--------------------------------

### WolfStack Installer Flags

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Common flags for customizing the WolfStack installation process, such as using the beta branch or skipping confirmation.

```bash
--beta (use beta branch)
--yes/-y (skip confirmation)
--agent (agent-only install — see Clustering)
--install-dir <path> (redirect Cargo target dir to external mount for low-disk hosts)
```

--------------------------------

### Join WolfNet Network from Local Machine

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/wolfnet-global.html

Executes the join command on your local machine using the token provided by the server's `wolfnet invite` command. Requires the path to your WolfNet configuration file.

```bash
# Copy the output command to your LOCAL machine and run it:
sudo wolfnet --config /etc/wolfnet/config.toml join eyJwa...
```

--------------------------------

### Initialize RFB with Options and Event Listeners

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/vnc.html

Initializes a new RFB (VNC client) instance with various options and sets up event listeners for connection, disconnection, and credential requirements. This is used when a ticket is available for authentication.

```javascript
document.getElementById('vnc-container'); try { const opts = { scaleViewport: true, resizeSession: resizeSession, clipViewport: true, showDotCursor: true, }; if (ticket) { opts.credentials = { password: ticket }; } rfb = new RFB(container, wsUrl, opts); window.rfb = rfb; rfb.addEventListener('connect', () => { document.getElementById('status-badge').textContent = 'Connected'; document.getElementById('status-badge').className = 'badge'; const overlay = document.getElementById('status-overlay'); if (overlay) overlay.remove(); window._vncConnected = true; }); rfb.addEventListener('disconnect', (e) => { document.getElementById('status-badge').textContent = 'Disconnected'; document.getElementById('status-badge').className = 'badge disconnected'; if (!e.detail.clean) { const c = document.getElementById('vnc-container'); c.innerHTML = ` <div class="status-overlay"> <p style="color:#fca5a5;">Connection lost.<br> <button onclick="location.reload()" style="margin-top:12px; padding:6px 16px; background:#1f2937; border:1px solid #374151; color:#d1d5db; border-radius:4px; cursor:pointer;"> Reconnect </button></p> </div>`; } }); rfb.addEventListener('credentialsrequired', () => { if (ticket) { rfb.sendCredentials({ password: ticket }); } else { rfb.sendCredentials({ password: prompt('VNC Password:') || '' }); } }); } catch (e) { document.getElementById('status-overlay').innerHTML = `<p style="color:#fca5a5;">Failed to connect: ${e.message}</p>`; }
```

--------------------------------

### Dockerfile for WolfNet Container

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/wolfnet-wolfdisk-docker.md

This Dockerfile sets up a Debian Bookworm Slim environment, installs necessary networking tools, copies WolfNet binaries and entrypoint script, and configures exposed ports and volumes.

```dockerfile
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
    iproute2 iptables procps ca-certificates && rm -rf /var/lib/apt/lists/*
RUN mkdir -p /etc/wolfnet /var/run/wolfnet
COPY wolfnet /usr/local/bin/wolfnet
COPY wolfnetctl /usr/local/bin/wolfnetctl
COPY docker-entrypoint.sh /entrypoint.sh
RUN chmod +x /usr/local/bin/wolfnet /usr/local/bin/wolfnetctl /entrypoint.sh
EXPOSE 9600/udp 9601/udp
VOLUME ["/etc/wolfnet"]
ENTRYPOINT ["/entrypoint.sh"]
```

--------------------------------

### Get Update History

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/docker-update-watcher.md

Retrieves a history of all update and rollback events.

```APIDOC
## GET /api/image-watcher/history

### Description
Update history

### Method
GET

### Endpoint
/api/image-watcher/history
```

--------------------------------

### WebAuthn Configuration File

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/oidc-passkeys.md

Example JSON configuration for WebAuthn (Passkey) authentication. This file enables WebAuthn, sets the Relying Party ID and name, specifies the origin, and lists registered credentials with their details.

```json
{
  "enabled": true,
  "rp_id": "wolfstack.example.com",
  "rp_name": "WolfStack",
  "rp_origin": "https://wolfstack.example.com:8553",
  "credentials": [
    {
      "username": "admin",
      "credential_id": "base64-credential-id",
      "public_key": "base64-cose-key",
      "counter": 42,
      "registered_at": "2026-04-09T10:00:00Z",
      "label": "YubiKey 5C"
    }
  ]
}
```

--------------------------------

### Get Current Quarantine Inventory

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Lists all files currently held in quarantine.

```APIDOC
## GET /api/antivirus/quarantine

### Description
Retrieves a list of all files that have been automatically quarantined due to confirmed antivirus or rootkit hits. These files are stored in `/var/quarantine/wolfstack`.

### Method
GET

### Endpoint
/api/antivirus/quarantine

### Response
#### Success Response (200)
Returns a list of quarantined files.

#### Response Example
[
  {
    "path": "/var/quarantine/wolfstack/malware.php",
    "original_location": "/var/www/html/malware.php",
    "quarantined_at": "2024-07-26T10:30:00Z"
  },
  {
    "path": "/var/quarantine/wolfstack/suspicious_script.sh",
    "original_location": "/tmp/suspicious_script.sh",
    "quarantined_at": "2024-07-26T09:15:00Z"
  }
]
```

--------------------------------

### Console Initialization and Node Loading

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/web/console.html

Loads the cluster node list to enable the pop-out's New Tab picker and then mounts the console. It handles potential errors during node fetching.

```javascript
function loadNodesThenMount() {
  fetch('/api/nodes')
    .then(r => r.ok ? r.json() : [])
    .then(nodes => mountConsole(Array.isArray(nodes) ? nodes : []))
    .catch(() => mountConsole([]));
}

const ONE_SHOT = ['install', 'upgrade', 'pkg-install', 'appstore-install'];
const noReconnect = ONE_SHOT.indexOf(type) !== -1;

function mountConsole(nodes) {
  const self = nodes.find(n => n.is_self) || null;
  let initial;
  if (isPve) {
    initial = {
      type: 'pve',
      nodeId: pveNodeId,
      vmid: pveVmid,
      name: name,
      noReconnect: noReconnect
    };
  } else {
    initial = {
      type: type,
      nodeId: nodeId || (self ? self.id : null),
      name: name,
      noReconnect: noReconnect
    };
  }
  // ... rest of mountConsole logic
```

--------------------------------

### Get Watcher Status

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/docker-update-watcher.md

Retrieves the cached status of recent image checks.

```APIDOC
## GET /api/image-watcher/status

### Description
Cached check results

### Method
GET

### Endpoint
/api/image-watcher/status
```

--------------------------------

### OIDC Configuration File

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/plans/oidc-passkeys.md

Example JSON configuration for OIDC providers. This file enables OIDC, defines multiple identity providers with their specific settings (issuer URL, client ID, scopes, role mapping), and configures user creation and session management.

```json
{
  "enabled": true,
  "providers": [
    {
      "id": "authentik-1",
      "name": "Authentik (Home Lab)",
      "issuer_url": "https://auth.example.com/application/o/wolfstack/",
      "client_id": "wolfstack-oidc",
      "client_secret": "encrypted:aes256:…",
      "scopes": ["openid", "profile", "email", "groups"],
      "role_mapping": {
        "claim": "groups",
        "admin_values": ["wolfstack-admins"],
        "viewer_values": ["wolfstack-viewers"],
        "default_role": "viewer"
      },
      "username_claim": "preferred_username",
      "auto_create_users": true,
      "button_label": "Sign in with Authentik",
      "button_icon": "authentik"
    }
  ],
  "redirect_uri_base": "https://wolfstack.example.com",
  "session_lifetime_hours": 8,
  "allow_local_fallback": true
}
```

--------------------------------

### Certificate Management Endpoints

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

These endpoints allow for the installation, generation, and listing of SSL/TLS certificates.

```APIDOC
## POST /api/certificates/install

### Description
Installs a new certificate and private key pair. Supports encrypted PKCS#8 and legacy PEM formats. The private key passphrase is handled securely.

### Method
POST

### Endpoint
/api/certificates/install

### Parameters
#### Request Body
- **cert** (string) - Required - The certificate in PEM format.
- **key** (string) - Required - The private key in PEM format.
- **key_passphrase** (string) - Optional - The passphrase for an encrypted private key.

### Response
#### Success Response (200)
- **message** (string) - Confirmation message.
- **restart_service** (string) - The service that needs to be restarted (e.g., "wolfstack" or "pveproxy").

#### Response Example
{
  "message": "Certificate installed successfully.",
  "restart_service": "wolfstack"
}
```

```APIDOC
## POST /api/certificates/self-signed

### Description
Generates a self-signed SSL/TLS certificate.

### Method
POST

### Endpoint
/api/certificates/self-signed

### Parameters
#### Request Body
- **common_name** (string) - Required - The common name for the certificate.
- **sans** (array of strings) - Optional - Subject Alternative Names (DNS or IP addresses).
- **validity_days** (integer) - Optional - Number of days the certificate should be valid (default: 825).

### Response
#### Success Response (200)
- **message** (string) - Confirmation message.
- **restart_service** (string) - The service that needs to be restarted (e.g., "wolfstack" or "pveproxy").

#### Response Example
{
  "message": "Self-signed certificate generated successfully.",
  "restart_service": "wolfstack"
}
```

```APIDOC
## POST /api/certificates/restart-service

### Description
Schedules a deferred restart for a specified service.

### Method
POST

### Endpoint
/api/certificates/restart-service

### Parameters
#### Request Body
- **service** (string) - Required - The name of the service to restart (e.g., "wolfstack" or "pveproxy").

### Response
#### Success Response (200)
- **message** (string) - Confirmation message indicating the service restart has been scheduled.

#### Response Example
{
  "message": "Service restart scheduled."
}
```

```APIDOC
## GET /api/certificates/list

### Description
Retrieves a list of available SSL/TLS certificates.

### Method
GET

### Endpoint
/api/certificates/list

### Response
#### Success Response (200)
- **certificates** (array of objects) - A list of certificates, each with details like path, type, and expiry.

#### Response Example
{
  "certificates": [
    {
      "path": "/etc/wolfstack/cert.pem",
      "type": "custom",
      "expiry": "2025-12-31T23:59:59Z"
    },
    {
      "path": "/etc/letsencrypt/live/example.com/fullchain.pem",
      "type": "letsencrypt",
      "expiry": "2024-08-15T12:00:00Z"
    }
  ]
}
```

```APIDOC
## POST /api/certificates

### Description
Requests a new certificate using Let's Encrypt (certbot).

### Method
POST

### Endpoint
/api/certificates

### Parameters
#### Request Body
- **domain** (string) - Required - The domain name for which to obtain a certificate.
- **email** (string) - Required - The email address for Let's Encrypt notifications.

### Response
#### Success Response (200)
- **message** (string) - Confirmation message.
- **restart_service** (string) - The service that needs to be restarted (e.g., "wolfstack" or "pveproxy").

#### Response Example
{
  "message": "Let's Encrypt certificate request initiated.",
  "restart_service": "wolfstack"
}
```

--------------------------------

### Get Recent Antivirus Findings

Source: https://github.com/wolfsoftwaresystemsltd/wolfstack/blob/master/src/ai/wolfstack-kb.md

Retrieves a list of recent antivirus and rootkit findings.

```APIDOC
## GET /api/antivirus/findings

### Description
Fetches a list of the most recent antivirus and rootkit findings, ordered from newest to oldest. This includes details about detected threats.

### Method
GET

### Endpoint
/api/antivirus/findings

### Response
#### Success Response (200)
Returns a list of findings.

#### Response Example
[
  {
    "timestamp": "2024-07-26T10:30:00Z",
    "file": "/var/www/html/malware.php",
    "threat_name": "PHP.Trojan.Generic",
    "action_taken": "quarantined"
  },
  {
    "timestamp": "2024-07-26T09:15:00Z",
    "file": "/tmp/suspicious_script.sh",
    "threat_name": "Shell.Exploit.CVE-2023-XXXX",
    "action_taken": "killed"
  }
]
```
Tokens:
Raw