internal/

Package accounting implements the traffic accounting pipeline and the limit enforcement the product can never afford to lie about (docs/product/requirements.md §Accounting, docs/architecture/database.md).

Package admin manages panel accounts (owner + admins) — the human layer above the token API.

Package api implements the REST management surface /api/v1 (a V1 compatibility contract — additive only, docs/architecture/api.md): token auth with scopes, one error envelope, cursor pagination, idempotency keys, rate limits, durable webhook management, and hand-authored OpenAPI kept accurate by a route-coverage test.

Package audit appends security-relevant activity to audit_log.

Package auth provides the centralized permission registry, argon2id password hashing, and admin session management.

Package awgparam implements the scalar-or-range values used by the pinned AmneziaWG configuration contract.

Package backup implements the .wgg archive engine, schedules and delivery sinks (docs/operations/backup-restore.md).

Package boot brings the node to the state described by the database — the single orchestration used at service start (`serve`) and on demand from the CLI (`wg-guard reconcile`).

Package cleanup performs reviewed, bounded maintenance on application data.

Package clientconf renders AmneziaWG client configurations and QR codes.

Package config loads the boot configuration: the small, restart-required layer (paths, listener, TLS mode) stored as TOML.

Package database opens the SQLite store with the pragmas required by the low-RAM contract and provides transaction helpers.

Package device implements the peer/device domain service.

Package distribution acquires candidates without changing active deployments.

Package doctor implements `wg-guard doctor` (docs/operations/runbook.md): read-only environment and state checks with actionable remedies, plus `--fix` which re-runs the boot repairs (interface reconciliation, nftables, tc, sysctls) through the same orchestration `serve` uses.

Package domain holds types shared across services: identifiers, lifecycle enums, and machine error codes (the codes exposed by the REST API error envelope are a V1 compatibility contract — see docs/architecture/api.md).

Package domainqueue is the bounded certificate-specific host mailbox.

Package domaintls defines approved HTTP origins, hostname roles and certificate identity.

Package firewall owns the namespaced nftables table `table inet wgguard` (ADR-0004): one forward-accept chain (priority 10, after standard filter chains) and one srcnat masquerade chain.

Package hoststats reads host-level metrics (CPU, memory, disk, load, uptime) for the dashboard.

Package i18n provides the panel's server-side string tables (fa default, en), locale helpers, and locale-aware formatting.

Package iface manages tunnel interfaces/profiles (`awg0…awgN`): ports, IPv4 pools, MTU, and the one obfuscation profile per interface (ADR-0002).

Package install implements the deployment layer: the interactive `wg-guard install` wizard (Docker production runtime), `update` with a pre-upgrade backup and health-checked rollback, and `uninstall --dry-run` that removes only WG-Guard-owned artifacts.

Package integration implements durable, principal-scoped automation operations.

Package ipam defines the shared, bounded IPv4-pool contract.

Package layout defines current node/host path ownership without performing filesystem operations or changing a deployment.

Package logsafe provides the only production entry point for structured logging.

Package metrics serves the lightweight observability surface: public liveness/readiness probes and an optional hand-written /metrics endpoint (Prometheus text format, no client library — SPEC §40: "Do not embed a heavy metrics stack").

Package network owns the host-level state around tunnel links: link creation/deletion and addressing via iproute2 (`ip`), and sysctls such as IPv4 forwarding.

Package nodestate owns the live DB/key opening sequence.

Package nodestatus composes safe operational receipts for panel and REST.

Package operation defines shared presentation states without granting host or filesystem authority.

Package plan manages reusable subscription presets (quota, duration, device limit, speed limit, profile selector).

Package reconcile makes the tunnel backend match the database — the DB is the source of truth (docs/architecture/overview.md).

Package reseller owns the node-local reseller registry.

Package runtimeapply owns bounded serialized application of desired node state.

Package scheduler is the single centralized scheduler for all periodic and deferred work: accounting cycles, expiry enforcement, housekeeping, later webhooks and backups.

Package secrets provides the node-local secret-at-rest primitive: AES-256-GCM under a 32-byte master key stored outside the database (0600 file).

Package serve composes the long-running WG-Guard node: database → master key → settings → services → boot bring-up → HTTP listener → the central scheduler.

Package settings is the typed runtime-settings registry: a code-defined catalog of keys with kinds, defaults, and validators, backed by the `settings` table.

Package shaper applies speed limits with Linux tc (HTB), independently per direction (docs/architecture/networking.md §Shaping): download (server→client) on the tunnel interface EGRESS, upload (client→server) via an IFB-mirrored INGRESS qdisc.

Package subprocess is WG-Guard's single choke point for executing external programs (awg, ip, nft, sysctl — ADR-0001).

Package subscription manages per-user subscription links: an unguessable capability token that grants read-only access to one user's subscription page (traffic, expiry, devices, per-device QR/config).

Package telemetry owns the bounded live operational snapshot shared by dashboard, API and metrics readers.

Package terminal provides a small, streaming English terminal interface.

Package token manages REST API tokens: `wg_`-prefixed bearer tokens, stored hashed with an indexed lookup prefix, scoped, optionally expiring, optionally CIDR-restricted (docs/architecture/api.md, security.md).

Package tunnel defines the TunnelBackend abstraction: the seam between domain services and the AmneziaWG implementation (ADR-0001 — AWG is driven through its pinned CLI as a subprocess; nothing AWG-specific leaks above this interface).

Package updatequeue bridges the unprivileged web workflow to the existing host-owned lifecycle manager.

Package user implements the subscription-owner domain service: creation (single + bulk), lifecycle (enable/disable/suspend/renew), soft delete/restore, limit bookkeeping, and cursor-paginated listing.

Package version holds the build identity of the wg-guard binary.

Package web is the admin panel: server-rendered html/template pages with htmx partial swaps, session cookie auth, per-request CSRF tokens, and a strict content security policy.

Package webhook implements durable, restart-safe outbound webhooks (docs/integrations/webhooks.md): the event row is inserted in the SAME transaction as the state change (events cannot disappear), one pending delivery row per subscribed enabled endpoint is created at emit time, and a single worker pass (part of the central scheduler) delivers due rows with exponential backoff to a dead-letter state.