Access admin
Every user and every network belongs to a Tenant.
Pick the Tenant from the dropdown when creating or editing.
Gateway adds a stable site-to-site peer into firm CIDRs (hub iface ≠ wg0).
Protected iface wg0 / port 51820 are refused.
Tenants
| ID | Name | Slug | Active |
|---|
Create tenant
Users
| ID | Role | Tenant | TOTP |
|---|
Create user
User can only use networks of this Tenant (unless role=admin, who sees all on Access).
One-time enroll — copy/scan now
![TOTP QR]()
Secret:
Edit user
Networks
| ID | Tenant | Name | Iface / Port | Endpoint | AllowedIPs |
|---|
Create network
Assign to a Tenant via the dropdown. New iface/port needs Hetzner UDP open. Never wg0 / 51820.
Edit network
Site-to-site gateway
One gateway link per Tenant. Stable peer on the hub network iface; optional inject of firm CIDRs into client AllowedIPs. Never uses wg0 / 51820.
| ID | Tenant | Name | Endpoint | Hub | Firm CIDRs | Inject | Active / Peer |
|---|