Function loadSecurityConfig

web/scripts/ragnar_modern.js:5523–5657

()

        if (ve) {
            let veHtml;
            if (ve.via_vpn) {
                const via = escapeHtml(String(ve.interface || 'tunnel'))
                    + (ve.kind ? ' · ' + escapeHtml(ve.kind) : '')
                    + (ve.endpoint ? ' → ' + escapeHtml(ve.endpoint) : '');
                veHtml = '<span class="text-amber-300">yes</span> <span class="text-gray-500">(via ' + via + ')</span>';
            } else {
                veHtml = '<span id="vpn-egress-result" class="text-gray-500">no local tunnel</span> '
                    + '<select id="vpn-egress-iface" class="bg-slate-800 border border-slate-700 rounded text-xs text-gray-300 px-1 py-0.5 mx-1">'
                    + '<option value="">auto (default route)</option></select>'
                    + '<button onclick="checkVpnEgress()" class="text-xs text-cyan-400 hover:text-cyan-300 underline">check egress (catches VPN/Tor on the router)</button>';
            }
            row('Traffic via VPN', veHtml);
        }

        const scopeNote = d.interface
            ? `<p class="text-[11px] text-cyan-400/80 mt-2">Scoped to <span class="font-mono">${escapeHtml(d.interface)}</span> — gateway + nameservers are what this interface's own network provides.</p>` : '';
        const src = (d.sources && d.sources.length)
            ? `<p class="text-[11px] text-gray-500 mt-2">Sources: ${d.sources.map(escapeHtml).join(', ')}</p>` : '';
        out.innerHTML = `<table class="min-w-full text-sm">
            <tbody>${rows.join('')}</tbody></table>${scopeNote}${src}`;
        // Fill the egress-check interface selector (auto + each real NIC) so
        // the LAN path can be tested even when WiFi carries the default route.
        const sel = document.getElementById('vpn-egress-iface');
        if (sel) {
            fetchAPI('/api/net/interfaces').then(x => {
                (x.interfaces || []).forEach(i => {
                    const o = document.createElement('option');
                    o.value = i.name;
                    o.textContent = i.name + (i.type && i.type !== 'ethernet' ? ' (' + i.type + ')' : '');
                    sel.appendChild(o);
                });
                // A scoped identity view should test the same interface's egress.
                if (d.interface) sel.value = d.interface;
            }).catch(() => {});
        }
    } catch (e) {
        out.innerHTML = '<p class="text-red-400">Failed: ' + escapeHtml(e.message) + '</p>';
    }
}

async function checkVpnEgress() {
    const cell = document.getElementById('vpn-egress-result');
    if (!cell) return;
    const sel = document.getElementById('vpn-egress-iface');
    const iface = sel && sel.value ? sel.value : '';
    const label = iface ? 'via ' + escapeHtml(iface) : 'default route';
    cell.innerHTML = '<span class="text-gray-400">checking egress ' + label + '… (public IP, known-VPN IP list, Tor exit)</span>';
    try {
        const d = await fetchAPI('/api/net/vpn-check' + (iface ? '?interface=' + encodeURIComponent(iface) : ''));
        const ifNote = d.interface ? ' <span class="text-gray-500">[' + escapeHtml(d.interface) + ']</span>' : '';
        const why = (d.reasons && d.reasons.length)
            ? ' <span class="text-gray-500">(' + d.reasons.map(escapeHtml).join('; ') + ')</span>' : '';
        if (d.verdict === 'vpn') {
            cell.innerHTML = '<span class="text-amber-300">yes</span>' + ifNote + why;
        } else if (d.verdict === 'likely') {
            cell.innerHTML = '<span class="text-amber-300">likely</span>' + ifNote + why;
        } else if (d.verdict === 'no') {
            const via = [d.isp, d.public_ip].filter(Boolean).map(escapeHtml).join(' · ');