epic(ui): implement a web UI to manage it

[Byloth]

Implement a web UI to manage the server:

Features

On the Administrator side:

• Statistics about realms load, active users and so on...
• A way to manage the users (adds new users, ban users, reset user passwords, etc...).

On the User side:

• Register a new account.
• Reset a forgotten password.
• Change account informations (e-mail, username, password, etc...).
• Delete the account.

Tasks

• feat: Support SOAP interface #27

[dekuplant]

https://github.com/celguar/mangos-web
https://github.com/celguar/mangos-website
https://github.com/celguar/cmangos-website
https://github.com/celguar/spp-classics-cmangos
(Not sure which one would work best so I linked them all)

SPP-Classics uses a cool Web Server which gives browser access to Armory, player count, create player account, AH listings, player tracking on map, and more. It's a vanilla blizzlike style too! Just have to open a web browser and visit 127.0.0.1 when the Web Server is up.
I installed SPP-classics on Windows 11 OS and it worked well. Only tried the user side of account control for the web server.
Would love to have this website feature with cmangos-docker. (installed on CachyOS for me).

[dekuplant]

[inpencil-bot]

Doing some homework before jumping into code — here's what's already out there, what we can learn from it, and a proposed direction. Feedback more than welcome! 🙂

Landscape survey

I looked at every CMaNGOS web project I could find:

• FusionGEN (PHP/CodeIgniter, AGPL-3.0) — actively maintained, cmangos_soap integration via HEX auth. Best admin-side reference: user management, bans, GM levels, SOAP flows.
• BlizzCMS (PHP/CodeIgniter 3, MIT) — secondary CMS reference; less active lately.
• WoWSimpleRegistration (PHP, GPL-3.0) — actively maintained, explicit CMaNGOS support. Best user-side reference: register, change password, online players.
• celguar/cmangos-website (PHP, CC BY-NC-ND) — visual/flow reference only; license forbids reuse.
• SPP-Classics web server (closed repack) — ambition benchmark: armory, live map, AH, account creation. Not integrable.
• killerwife/cmangos-cms (.NET 8 API + Next.js 14) — registration, account management, 2FA with QR, TBC world view, docker-compose included. From a core CMaNGOS dev; proof a modern non-PHP stack works. Nothing in the Vue ecosystem yet: that space is free. 😉

Technical foundations

• Account creation = SRP6 salt + verifier into realmd.account. CMaNGOS has its own quirks: reversed salt, little-endian export, uppercase username. Schema differs per expansion: Classic/TBC use SRP6v2, WotLK uses sha_pass_hash HEX.
• Read-only features = plain SELECTs against the existing DB; no new infrastructure needed.
• Every mutating admin operation (ban, password reset as admin, shutdown with in-game warning) goes through mangosd's SOAP interface. That's a hard dependency on feat: Support SOAP interface #27 (build flag, exposed port, env credentials — small and well-scoped).

Proposed direction

• Nuxt 4.5.2 with a minimal API layer under server/ (BFF pattern). The frontend never touches MariaDB or mangosd directly; credentials live only in server env. No generic pass-through endpoints — every route validates, authorizes, and exposes an explicit surface.
• Per-expansion core adapter (SRP6v2 vs HEX) selected by config, all three expansions from day one. The rest of the code never branches on expansion.
• Query builder only (leaning Drizzle), no ORM migrations. Dedicated least-privilege DB user: SELECT broadly, INSERT/UPDATE only on account.
• BlizzLike look recreated in modern CSS, no Blizzard assets. Style cues from existing BlizzLike projects' markup.
• Persistence question (reset tokens / 2FA secrets) deliberately postponed — decision when we hit the feature.

Build order

1. Scaffold + SRP6 spike
2. User side (register / login / server status)
3. Account self-service
4. Admin (after feat: Support SOAP interface #27)
5. Packaging (Dockerfile + compose profile)