openwisp-luci: open the LuCI of a router from the OpenWISP device page

11 views

Skip to first unread message

Michele Salerno

unread,

Oct 23, 2026, 2:43:48 PMOct 23

to OpenWISP

Hi,
after openwisp-netconsole, I would like to share another small OpenWISP add-on: openwisp-luci.
It adds a LuCI ↗ button to the tab bar of the device page. The button opens the web interface of the router in a new browser tab, through an nginx proxy on the OpenWISP server. The router only needs to be reachable from the server, not from your browser.

The LuCI button in the tab bar of the device page

How it was born: we run the OpenWISP instance of NINUX Basilicata, a community network in southern Italy. Our routers sit behind LAN, mesh and VPN links that the browser of an operator cannot always reach, so opening LuCI was never a single click. We already had everything in OpenWISP: the management IP, the permissions, the SSH credentials. One button was missing.
How it works:

Every router gets its own host, <device uuid>.luci.example.com, so the cookies and the JavaScript of one router never see those of the others.

The button gives a signed, single-use link (60 seconds), then a __Host- cookie bound to the user, the device and the user's password.

On every request nginx asks Django (auth_request) whether the user can still change the device and where the router is. The proxy only goes to the management IP, and only inside the networks you allow.

Optional automatic login for superusers: OpenWISP uses the SSH connection it already has to create a LuCI session on the router for a dedicated user (never root), with the same permissions that rpcd would give that user at login. No router password is stored on the server. Everybody else gets the normal LuCI login page.

Like netconsole, it is a small Django app that extends the existing device admin, plus an nginx virtual host and an example Ansible role for ansible-openwisp2. I paid particular attention to security, and the README explains every choice. It has CI (with checks of the nginx configuration), CodeQL, a security policy and releases with a built wheel.
It is a 0.2 born for our needs, so feedback, issues and pull requests are very welcome. If you think something like this could be useful in OpenWISP itself, I would be glad to discuss it.