ToolActive

NetAdmin

Self-hosted network management with monitoring, RBAC and TOTP 2FA – in plain PHP, no framework overhead.

About this Project

NetAdmin is a self-hosted web application for managing and monitoring home and small business networks. It bundles device management, network scanning, ping/traceroute monitoring and a visual network topology editor into a single, deliberately lean PHP application – no Composer, no JavaScript framework.

NetAdmin demonstrates how much can be built cleanly in plain PHP without a framework – from a custom TOTP implementation per RFC 6238 to stateful alerting and a complete RBAC system with automatic migration of existing installations. The focus throughout was on transparent, well-reasoned security architecture rather than feature sprawl.

Architecture

PHP 8.1+ Backend (no framework)

The entire backend is written in plain PHP 8.1+ with no Composer dependencies. PDO/MySQL handles database access; all security mechanisms – TOTP, CSRF, rate limiting – are self-implemented.

No external dependencies – complete control
PDO/MySQL for secure, parameterized database access
Schema migrations run automatically on startup
TOTP per RFC 6238 without any library

Bootstrap 5 + Vanilla JavaScript

The frontend uses no JavaScript framework. Chart.js powers the dashboard's live charts; Vis.js drives the interactive topology editor.

Responsive UI with Bootstrap 5
Live charts with Chart.js
Interactive drag-and-drop topology editor with Vis.js
No build step, no Node dependencies

Background Workers (systemd / Cron)

Ping and traceroute monitoring runs as standalone CLI worker processes outside the web request. A status page shows whether workers are actually active based on their last run timestamps.

Standalone CLI workers for ping and traceroute
Controlled via systemd or cron
fping, mtr and traceroute as system tools
Worker status detection without external process monitoring

Stateful Alerting

Notifications are only sent on state transitions (online → offline) – not on every failed ping. This prevents notification spam during extended outages.

State machine per device for availability tracking
Alerting only on state transitions
Email and webhooks (Slack, Discord, ntfy)
Configurable thresholds for packet loss

Umfang & Zahlen

0Benutzerrollen (RBAC)

0RFC 6238TOTP-2FA selbst implementiert

0Composer-Pakete

0PHP 8.1+ohne Framework

Core Features

Device Management & Network

Central management of all network devices – with categorization, network groups and automatic scanning.

Device management with categorization and network groups
CSV import and export
Automatic network scan (fping, mDNS, NetBIOS, MAC detection)
Wake-on-LAN with one click from the device list
IP pool overview: free addresses per configured subnet
VLAN management

Monitoring & Alerting

Continuous ping and traceroute monitoring with live charts and stateful alerting – no notification spam.

Continuous ping and traceroute monitoring via background workers
Dashboard with live charts (Chart.js) and CSV export
Worker status page detecting inactive monitoring processes
Email alerting on outages and packet loss
Webhook alerting (Slack, Discord, ntfy-compatible)
Stateful alerting – no notification spam

Network Topology

Interactive editor for visually mapping your network structure.

Interactive topology editor with drag & drop (Vis.js)
Add devices and connections visually
Clear overview of your entire network structure

Security & Access Control

Role-based permissions, TOTP 2FA per RFC 6238 and comprehensive protection against common attack vectors.

Three user roles: Admin, Operator, Viewer
Server-side enforcement on every write action
Optional TOTP 2FA per RFC 6238 – self-implemented, no external dependencies
Self-service: manage your own password and 2FA in your account
IP-based rate limiting against brute force (not bypassable via session reset)
CSRF protection on every form, audit logging of security-relevant actions
bcrypt password hashing, security headers (CSP, X-Frame-Options, etc.)

Challenges & Solutions

Problem

Implementing TOTP 2FA without an external library

Solution

A complete TOTP implementation per RFC 6238 in plain PHP – HMAC-SHA1, Base32 decoding, time window tolerance and QR code generation for authenticator setup, without a single Composer dependency.

Problem

Alerting without notification spam

Solution

Stateful alerting with a simple state machine per device: notifications are only triggered on state transitions (online ↔ offline), not on every individual failed ping.

Problem

Schema migrations without an ORM or migration tool

Solution

Automatic schema migrations on application startup: the app compares the current database version to the target state and runs any missing ALTER TABLE and INSERT statements automatically.

Technologies

PHPMySQLBootstrapJavaScriptChart.jsVis.js

Vision

NetAdmin demonstrates how much can be built cleanly in plain PHP without a framework – from a custom TOTP implementation to stateful alerting and a complete RBAC system. Built for home networks and small businesses that want to monitor their infrastructure without relying on cloud services.