My OPNsense home-lab gateway dashboard with a separate Coraza WAF edge

[jahmed]

Hi everyone,

I've been building a self-hosted gateway portal for my OPNsense home lab and have published the code:

Source code and README on GitHub

It runs as a separate portal alongside OPNsense and brings connectivity, clients, traffic, DNS, VPNs and security alerts into one place.

Some of the dashboard features:

• Latency/loss, bandwidth and availability graphs, with local-time axes, timestamp tooltips and visible gaps when telemetry is missing.
• A separate two-second interface-counter feed and rolling live WAN graph. Historical charts refresh every minute while the page and charts stay mounted.
• A network flow map with current network rates, stable device ordering and separate device/topology refreshes. Expanding a network only loads the map fragment.
• Device search, alert filters, bounded historical queries and CSV exports.
• CrowdSec information refreshed in the background with visible freshness.

The web application firewall runs separately at the edge: Caddy + Coraza + OWASP CRS, alongside CrowdSec. The supplied configuration starts in DetectionOnly mode for tuning. The portal reports Coraza matches and interruptions; it does not count every application HTTP 403 as a WAF block. Installing the portal alone does not protect a website.

For access, the portal supports passkeys/security keys or password + TOTP. Optional firewall actions require an operator signature that the OPNsense agent verifies independently. The example agent configuration starts with actions disabled.

This is a home-lab project under active development. Automated tests cover authentication, signed actions, metrics, filters and exports; deployment checks and rule tuning still matter. I'd welcome feedback on the dashboard, deployment documentation, false-positive tuning and how others separate their edge and management networks.

What would make a gateway dashboard more useful in your own lab?