Until PassGate is listed in Community Applications, add its template by hand. In the Unraid terminal, run:

wget -qO /boot/config/plugins/dockerMan/templates-user/my-PassGate.xml https://raw.githubusercontent.com/Axon07/Passgate/main/unraid/passgate.xml

then Docker → Add Container → Template: PassGate. The defaults run in bridge mode for trying it out. For real use, give it its own address: Network Type br0.51 and Fixed IP 10.51.0.2 for the OPNsense layout, or Custom: br0 and a free lan IP (e.g. 192.168.1.20) for OpenWrt.

• Use a secret key, or a restricted key with write access to Checkout Sessions, Customers, Products, Subscriptions, Subscription Items and Billing Portal, plus read access to Balance for the test button.
• Nothing to create in Stripe. PassGate sends prices with each checkout, so you manage prices only in PassGate.
• Turn on the Customer portal (Stripe → Settings → Billing → Customer portal) so guests can cancel or update their card. The Manage billing button uses it.
• Webhooks are optional. They only help if Stripe can reach your portal, for example through a Cloudflare Tunnel. Endpoint: https://your-public-name/stripe/webhook. Events: checkout.session.completed, customer.subscription.updated, customer.subscription.deleted, invoice.paid. Paste the signing secret into Settings.
• Refunds and cancellations happen in the Stripe dashboard. PassGate picks them up within 5 minutes.

How a device joins an account. Guests never type a MAC. When a page is opened, PassGate asks the router's ARP table which MAC is using that IP. The phone that pays becomes device 1, and logging in on another device adds it. The router filters by IP, and every 30 seconds PassGate maps each registered MAC to its current IP.

Device limit = devices included + extra slots bought. Included devices come from the best active pass, or from a custom limit you set on the guest's admin page. A custom limit of 5 plus one bought slot means 6 devices.

Hitting the limit. The account page lists devices with Swap for this device buttons. If someone pays from a new device while full, the payment still goes through and they get the swap choice straight away, with no cooldown that time.

Swap cooldown (Settings, default 60 min, 0 = off). After removing or swapping a device, guests wait before the next swap. That makes sharing one login by swapping back and forth impractical. You can lift it per guest.

A device that's already on someone else's account:

Adding by MAC (TVs, consoles, streaming sticks). Guests can do this from their account page (you can turn it off), and the owner can from the admin page. It counts toward the limit. The MAC must be the one the device uses on this network, because phones and some TVs use a private MAC per Wi-Fi network.

Always online. Admin → Always online. These MACs get internet with no account or pass.

Off by default, and set per plan: Plans → Edit → Extra device slots.

• Price per extra device covers the plan's full length, or each billing period for subscriptions, up to Most extras per account.
• Discount on each further extra (optional): percent or fixed amount off each additional slot, never below Never cheaper than. For example, $3 with 10% off makes $3, $2.70, $2.40.
• At checkout guests pick "+1 / +2 / +3 devices" under the plan, and Stripe shows it as a second line.
• Later, Buy device slots charges only for the time left. Halfway through a weekend pass, a $3 slot costs $1.50. Stripe's minimum card charge of $0.50 applies.
  • On one-time passes, extras last until the guest's current access ends.
  • On subscriptions, the prorated amount covers the rest of this period, then the slot is added to the subscription at full price. PassGate reads extras back from Stripe, so removing the item there removes the slot.

On the account page, Connect a family member's device makes a one-time code like K7P-42Q, valid for 24 hours. On the other device, the sign-in page has Have a join code?

The device takes one of the account's slots and shows "Connected through pa•••@example.com's pass". It never gets the account itself: no billing, device list or password. Ten wrong codes in an hour locks that device out for a while. A full account refuses the code with a clear message.

Card details never pass through PassGate, since guests enter them on Stripe's page. But emails, passwords and login cookies typed into the portal cross an open Wi-Fi network unencrypted unless the portal uses HTTPS.

Admin → HTTPS → Free certificate from Let's Encrypt: enter a name in a domain you own (e.g. wifi.yourdomain.com), an email, and a Cloudflare API token, then Get certificate now. PassGate proves you own the domain with a DNS challenge, so the portal never has to be reachable from the internet. It renews automatically. Other DNS providers work through the advanced option, and you can upload your own certificate files instead. Full steps are in section 10 of the network guide.

Admin → Promotions. Set a start and end time, a headline and a message (for example "Free Wi-Fi this long weekend! Like it? The monthly plan is $25"). During the promotion the sign-in page shows a Connect free button: one tap, no account or card, online until the promotion ends. Paid plans are shown right underneath, and paying guests aren't affected.

When it ends (or you press End it now), free devices go back to the sign-in page, which shows them your thank-you note for a set number of days. Setting new dates starts a fresh promotion. Consider a per-device speed cap on your router before a busy free weekend.

For access you hand out yourself: a comp for a neighbour, Wi-Fi included with a campsite booking, a prize, or pre-paid cards sold at the store. Admin → Vouchers → Make vouchers: a name, how many codes (up to 500), how long each lasts, devices per code, and an optional use-by date, speed tier and printed note.

• Codes look like JBJ7-ZPUS: no look-alike characters, and case and dashes don't matter.
• Guests enter them on the sign-in page under Have a voucher or a join code?. There's no account or card. The time starts at first use, and with a multi-device voucher, each device enters the same code.
• Print a sheet of cut-out cards with your network name, the code and short instructions, or download a CSV.
• Track each code: unused, in use (and until when), used up, expired or cancelled. Cancel a single code or a whole batch, or delete unused codes.
• Wrong codes are rate-limited per device, just like join codes. Vouchers never show up in the guest list or revenue figures.

Admin → Free Wi-Fi → Free basic tier. The sign-in page then offers Use free basic Wi-Fi next to the paid plans: one tap, no account or card. Optionally limit it to a number of minutes per device per day (it resets at midnight).

Free devices go into the normal allow-list and a second router list (free_clients) that your router holds to a low speed, e.g. 2 Mbit/s. On OpenWrt the setup script creates that limit for you. On OPNsense it's two shaper rules (guide). A device that buys a pass, is on the always-online list, or is in the middle of paying always gets full speed.

The daily limit is per device, and someone determined can change their device's MAC address to get more. That's why the tier should be slow rather than relied on as a hard cap.

Speeds are enforced by the router. PassGate can't do it because guest traffic never passes through it.

• One cap for everyone: no PassGate setup needed. OPNsense: a shaper pipe with a per-IP mask (guide). OpenWrt: the nft-qos package (guide).
• Different speeds per plan (OPNsense): in Settings → Speed tiers, list tiers as Name = alias (e.g. Basic = paid_basic, Premium = paid_premium) and pick a tier on each plan. PassGate puts each paid device in the main alias (internet on/off) and its tier alias, which your shaper rules match. Limits are per device.

• Data lives in /data/passgate.db (SQLite). Back up that folder.
• Payment window: unpaid devices get a few minutes of internet (default 15) to reach Stripe's page, limited to a few tries per device per day.
• Time zone and season end are in Settings. Subscriptions created while a season end is set get cancel_at set to that date in Stripe.

No. Any access point that can put guests on a VLAN works: UniFi, TP-Link Omada, OpenWrt, MikroTik, long-range point-to-multipoint links, HaLow bridges. Turn off the AP's own guest portal and turn on client isolation.

Yes. Many ISPs put customers behind CGNAT, so nothing on the internet can reach your server. PassGate only makes outgoing calls to Stripe and checks payment status itself, so you don't need webhooks or port forwarding.

MAC addresses are visible over the air and can be copied. That's true of every open-network captive portal, commercial ones included. Someone who copies a paying guest's MAC can use their pass while that guest is offline. Client isolation on your APs and a short always-online list help. The complete fix is per-user Wi-Fi credentials (WPA2/3-Enterprise), which is outside PassGate's scope.

Usually not inside the pop-up sign-in sheet on phones, which is a limitation of those mini-browsers. Cards always work, and guests can open the portal address in their normal browser to use wallet payments.

PassGate controls OPNsense (through its API) and OpenWrt 22.03+ (through a small helper that a setup script installs). Both are open source and run on cheap hardware. Router support lives in app/gateway.py: a driver needs list / allow / revoke on an allow-list, plus an IP→MAC lookup. Pull requests for more drivers, such as pfSense or MikroTik, are very welcome.

That depends on your internet plan and where you are. Check that your provider's terms allow resale. Some providers and satellite services require a business plan, and some regions require registering as a reseller.