Home
OPNGMS (OPNsense Global Management System) is a multi-tenant MSP console for centrally managing and monitoring a fleet of OPNsense firewalls. One operator team runs many customer firewalls from a single pane of glass: per-tenant isolation, version-aware configuration, scheduled PDF reporting, and an optional full syslog log lake.
This wiki is the complete operator and contributor manual. Start with Installation to deploy, or jump to any topic below.
| Capability | Page |
|---|---|
| Fleet management — onboard tenants and OPNsense devices, poll telemetry, push configuration | Architecture |
| Version-aware configuration editor — the flagship feature: a generic, version/edition-aware editor for every API-modifiable OPNsense setting, plus an MSP-wide template library | Configuration-Editor |
| Per-tenant PDF reporting — scheduled, white-labelled security/health reports delivered by email | Reporting |
| Security / Perimeter — attacker IPs at the firewall perimeter (failed logins to the box + firewall blocks) with GeoIP country, as Overview cards, a dedicated Perimeter page, and two PDF report sections toggled alongside the other report sections | Security |
| Syslog log lake — opt-in mTLS syslog ingest into OpenSearch with an in-app investigation page | Log-Lake |
Configurable tunables & retention — deploy-time .env knobs (worker concurrency, DB pool, connector timeout) plus runtime-editable settings on the superadmin System page (env default + live DB override), including per-tenant data-retention overrides for perimeter, events, metrics, and the log lake |
Configuration |
| Audit log — every state-changing and privileged action recorded in an append-only ledger (actor + IP, tenant, action, target), CI-enforced for completeness, with a superadmin Audit viewer (filters + CSV export) | Security |
| Multi-tenant security — Postgres Row-Level Security, encrypted credentials at rest, MFA; UI fully translated across all 12 languages with full RTL | Security |
OPNGMS ships as pre-built multi-arch container images (amd64 + arm64) from the GitHub Container Registry and runs via Docker Compose:
cp .env.example .env # then edit secrets (see Installation)
docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml up -dThe full, step-by-step walkthrough — prerequisites, the four TLS models, first-run superadmin creation, SMTP, and onboarding — is in Installation.
- Installation — prerequisites, TLS models, pull & start, first run
- Configuration — complete environment-variable reference
- Upgrading — upgrades, version pinning, backups, key rotation
- Reporting — SMTP delivery, report settings, schedules
- Log-Lake — the optional syslog → OpenSearch log lake
- Troubleshooting — symptom → cause → fix, grouped by area
- Screenshots — a visual tour of the console
- Architecture — components, data flows, multi-tenancy model
- Configuration-Editor — the version-aware editor & catalog pipeline
- Security — the security model and operator hardening checklist
- Development — local dev setup, tests, CI, contribution flow
OPNsense® is a registered trademark of Deciso B.V. All other product names, logos, and brands are the property of their respective owners. OPNGMS is an independent, third-party project and is not affiliated with, endorsed by, sponsored by, or supported by Deciso B.V. or the OPNsense project. References to "OPNsense" are used solely for identification and to describe interoperability.