RootGuard WebApp

RootGuard WebApp is the secure browser interface for the RootGuard self-hosted DNS stack. It provides guided setup, service health, Unbound configuration, AdGuard Home access, updates, rollback, and local password recovery without receiving the Docker socket.

RootGuard · Live product view · Manual · Roadmap

Important

The WebApp is one component of RootGuard. Use the versioned Compose quick start to evaluate the complete stack.

What users get

• Guided all-in-one setup with non-mutating preflight checks and persistent progress.
• A dashboard based on real installation, container, DNSSEC, and upstream health.
• Guided and expert Unbound configuration with preview, validation, history, diagnostics, and rollback.
• Protected access to the native AdGuard Home interface without a separate public administration port.
• Controlled service and control-plane updates with visible status.
• German and English UI plus local token-based password recovery.

Browser → WebApp (Go + React) → token-protected Core API → DNS services

Local development

Backend

cd backend
ROOTGUARD_CORE_URL=http://localhost:8081 \
ROOTGUARD_API_TOKEN=development-token \
ROOTGUARD_ADMIN_PASSWORD=replace-with-a-strong-password \
ROOTGUARD_RECOVERY_TOKEN=separate-long-random-recovery-key \
go run ./cmd/rootguard-webapp

Frontend

cd frontend
npm ci
npm run dev

Run the checks before opening a pull request:

cd backend && go test ./...
cd ../frontend && npm ci && npm run lint && npm run build

The full RootGuard development stack is available from the main repository.

Architecture and security

The Go backend owns authentication, sessions, same-origin checks, API proxying, and static frontend delivery. The React frontend contains presentation and guided workflows.

• No Docker socket or arbitrary host command execution.
• HttpOnly, SameSite-Strict sessions.
• Internal Core and updater calls use a separate API token.
• Distroless runtime image and deterministic frontend build.
• Password resets require an independent local recovery token, store only a salted verifier, and invalidate existing sessions.

The complete trust model is documented in the RootGuard architecture.

Contributing

Read CONTRIBUTING.md before opening a pull request. Good starting points are issues labeled good first issue or help wanted. Visible changes should include a screenshot. Report vulnerabilities privately through SECURITY.md.

License

RootGuard WebApp is licensed under GNU AGPL-3.0-or-later. The software license does not grant rights to the RootGuard or Foxly IT names or logos.