v0.3.0: OpenWrt support and a free basic tier

PassGate now works with OpenWrt as well as OPNsense, and can offer a free, slow tier with your passes as the upgrade.

New

OpenWrt support
PassGate can now control an OpenWrt router (22.03 or newer) instead of OPNsense, so a single consumer router can run the whole setup. One script on the router does the firewall side:

• a list of paid devices, plus rules that let them reach the internet but never your private networks
• sends unpaid web traffic to the sign-in page
• a login for PassGate that can only change that list (it can't open LuCI or change anything else)

It's safe to run again, and sh setup.sh remove undoes it. In PassGate, choose Settings → Router: OpenWrt.
Guide: docs/openwrt-setup.md

Free basic tier
Offer an always-available slow connection for messages, email and simple browsing. Guests tap Use free basic Wi-Fi, with no account or card, and see your paid plans as "Upgrade to full speed".

• optionally limited to a number of minutes per device per day (resets at midnight)
• free devices go in a free_clients router list that the router slows down:
  • OpenWrt: the setup script creates the limit (default 2 Mbit/s down, 1 Mbit/s up per device; change it with FREE_DOWN / FREE_UP)
  • OPNsense: two shaper rules (network guide, section 8)
• devices that have paid, are on the always-online list, or are checking out always get full speed

Changed

• The Promotions admin page is now Free Wi-Fi and holds both the free tier and scheduled promotions.
• Settings show only the connection fields for the router you picked.
• The README and Unraid template cover both routers.

Upgrading

Pull the new image and recreate the container; the database updates itself. Nothing changes for existing OPNsense setups.
If you want the free tier on OPNsense, add the free_clients alias and its two shaper rules before turning it on, or free guests get full speed.

Image: ghcr.io/axon07/passgate:0.3.0 (amd64 and arm64)

v0.2.0 — HTTPS and free promotions

New

• Built-in HTTPS. Free Let's Encrypt certificates via DNS challenge (Cloudflare in one field, or any of 150+ providers), renewed automatically with no restart. Works behind CGNAT since nothing needs to be reachable from the internet. Or upload your own certificate files. Plain-HTTP visits are redirected to HTTPS and login cookies are marked Secure. New admin page: HTTPS.
• Free-access promotions. Schedule a free period (e.g. a long weekend): the sign-in page shows your message and a one-tap Connect free button (no account or card), with the paid plans underneath. Afterwards, those devices see your thank-you note. New admin page: Promotions.

Upgrading: pull the new image and recreate the container; the database updates itself. If you want HTTPS, also allow guests to reach port 443 on the portal (network guide, section 5) and see section 10.

Try it: docker run -d -p 8090:80 -p 8443:443 -p 8091:8081 -v passgate:/data ghcr.io/axon07/passgate:0.2.0, then open port 8091.

v0.1.0 — first public release

PassGate is a self-hosted captive portal that sells Wi-Fi access through Stripe.

Selling access

• Plans you define: hours, days, "until end of season", or recurring subscriptions that stop billing at season end
• One-time passes stack: extra time starts when the current pass ends
• Extra device slots at checkout or later, prorated for the time left, with optional per-slot discounts
• Works without Stripe webhooks (polls Stripe), so it runs behind CGNAT with no open ports

Guests and devices

• Email accounts with a per-plan device limit; guests add and swap their own devices
• Join codes so family members' devices can use a pass without the account password
• Add TVs and consoles by MAC address
• Access follows devices across IP changes

For the owner

• First-run setup wizard and browser-based admin: plans, guests, comp passes, password resets, blocking, activity log
• Per-guest device limits, swap cooldown, always-online MAC list
• Optional speed tiers per plan through OPNsense's traffic shaper

Platform

• OPNsense driver (firewall aliases via the API); dry-run mode for trying it out
• Single Python process + SQLite; multi-arch Docker image (amd64, arm64) on GHCR; Unraid template

Try it: docker run -d -p 8090:80 -p 8091:8081 -v passgate:/data ghcr.io/axon07/passgate:latest, then open port 8091.