$ show opnsense/core
OPNsense core is the central management and control plane for the OPNsense open-source firewall distribution. It implements a complete MVC web application (PHP) that provides a graphical user interface and RESTful API for configuring firewall rules, VPNs (IPsec, OpenVPN, WireGuard), DNS/DHCP services, traffic shaping, intrusion detection, captive portal, system settings, and monitoring. The backend relies on a custom daemon (`configd`) that executes actions via Unix socket, running Python and shell scripts for system-level operations (e.g., pfctl, ipfw, swanctl, wg). Configuration is stored in XML files and managed through an extensive model layer with field types, validators, and migrations. The system is deeply integrated with FreeBSD and uses FreeBSD-specific tools and kernel subsystems (pf, carp, netgraph). The architecture is a monolithic PHP MVC framework (originally based on Phalcon, now with a custom dispatcher) with a clear separation: controllers handle HTTP requests, models manage XML-based configuration, and views are Volt templates. The API controllers extend `ApiMutableModelControllerBase` and provide standard CRUD operations plus service actions (start, stop, reconfigure). System scripts are organized under `src/opnsense/scripts/` and are invoked by configd or system hooks. Dashboard widgets (JavaScript) fetch real-time data via API endpoints or event streams. External dependencies include FreeBSD base system tools, PHP (with Phalcon or custom replacement), Python 3, and libraries like ujson, requests. Key entry points are the web UI (`/index.php`), the API (`/api.php`), and the configd daemon (`configd.py`). Data flows primarily from user input through controllers to model validation, then to configd actions that generate configuration files (templates) or execute system commands. The system is actively maintained with frequent commits, extensive unit tests for both PHP and Python components, and a well-structured migration framework for upgrading configurations.
The LLM identified 5 files worth highlighting for reuse:
Base class for all model field types in OPNsense. Provides a consistent interface for validation, serialization, and option generation. Subclasses (e.g., TextField, PortField, NetworkField) implement specific domain logic. The pattern is cleanly isolated and could be extracted to build a configuration model framework for any XML-based system.
Base API controller providing generic CRUD operations (search, get, set, add, del, toggle) for any model extending BaseModel. Implements consistent JSON response formatting, error handling, and privilege checks. Demonstrates a reusable controller pattern that can be adapted for other RESTful model management APIs.
Singleton wrapper for communicating with the configd daemon over a Unix socket. Provides methods like configdRun, configdpRun (streaming), configdStream, and configdLock. Isolates IPC details and is used across all PHP controllers. Could be extracted as a lightweight RPC client for other projects needing socket-based action execution.
Abstract base class for model migrations. Each migration implements run() and post() methods to transform legacy configuration data into new model structures. Migrations are versioned (e.g., M1_0_0) and executed sequentially. This pattern is reusable for any XML or JSON configuration migration system.
Generates PF rdr (port forwarding) rules from model data. Handles complex scenarios like NAT reflection, alias expansion, port ranges, and loopback interfaces. The `parseRdrRules()` method yields individual PF rule strings. Demonstrates a clean rule-to-text pattern that could be adapted for other firewall or routing rule generators.