mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update .gitignore, AGENTS.md, README.md for config/ split and deployment model

Browse Source
This commit is contained in:
Mike Teehan
2026-05-14 03:32:06 +00:00
parent dcb581a359
commit 0e7090a2cb
3 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3 -1
View File
@@ -16,5 +16,7 @@ __pycache__/
opencode.json opencode.json
# Runtime data configs (source-of-truth for services) # Runtime data configs (source-of-truth for services)
data/dnsmasq/config.json config/dnsmasq/config.json
config/nginx/config.json
config/wireguard/config.json
data/nginx/sites-enabled/ data/nginx/sites-enabled/
AGENTS.md
+9 -4
View File
@@ -3,7 +3,7 @@
## What This Is ## What This Is
SSL proxy / firewall appliance. Python 3 Flask WebUI behind nginx reverse proxy. SSL proxy / firewall appliance. Python 3 Flask WebUI behind nginx reverse proxy.
Deploys on Debian 13 (trixie). Target system: `/home/wall/vacuum-wall`. Deploys on Debian 13 (trixie). Install dir: `/opt/vacuum-wall`.
## Architecture ## Architecture
@@ -15,14 +15,17 @@ Flask ──→ lib/*.py ──→ sudo <cmd> ──→ system service
- `webui/server.py` — Flask app entry point. **Only** file that creates the `app`. - `webui/server.py` — Flask app entry point. **Only** file that creates the `app`.
- `webui/api/*.py` — Flask blueprints, one per subsystem. Routes prefix `/api/<subsystem>/`. - `webui/api/*.py` — Flask blueprints, one per subsystem. Routes prefix `/api/<subsystem>/`.
- `lib/*.py` — Backend modules. Wrap system commands via `subprocess.run(["sudo", ...])`. - `lib/*.py` — Backend modules. Wrap system commands via `subprocess.run(["sudo", ...])`.
- `data/` — Declarative JSON configs (source of truth). Generated `.conf` in `data/nginx/sites-enabled/`. - `data/` — Runtime artifacts (generated .confs, `.htpasswd`, ACME certs, firewall backup, dnsmasq fragments).
- `config/<subsystem>/config.json` — Declarative JSON configs (source of truth). Generated `.conf` in `data/nginx/sites-enabled/`. Certs in `data/acme/`.
- `system/` — System file templates. `systemd/` (service units installed to `/etc/systemd/system/`), `sudoers.d/`, `nginx/`. - `system/` — System file templates. `systemd/` (service units installed to `/etc/systemd/system/`), `sudoers.d/`, `nginx/`.
Project uses `.venv`. Install deps with `pip install -e .` (from `pyproject.toml`). `__init__.py` files in `webui/` and `lib/` are intentionally empty — no `sys.path` boilerplate needed. Project uses `.venv`. Install deps with `pip install -e .` (from `pyproject.toml`). `__init__.py` files in `webui/` and `lib/` are intentionally empty — no `sys.path` boilerplate needed.
## Fixed Path ## Deployment
Every module hardcodes `/home/wall/vacuum-wall`. Changing it requires updating `lib/*.py`, `system/systemd/*.service`, `install.sh`, and `system/sudoers.d/vacuum-wall`. `install.sh` deploys to `/opt/vacuum-wall` by rsyncing the repo. The `vacuum-wall` system user has `HOME=/opt/vacuum-wall` but no actual home directory (`--no-create-home`).
All Python modules use `Path(__file__).resolve().parent.parent` for `PROJECT_DIR` — no hardcoded paths. ACME certs live at `PROJECT_DIR/data/acme/`.
## Local Dev ## Local Dev
@@ -46,6 +49,8 @@ In production the systemd unit runs as the `vacuum-wall` system user (`NoNewPriv
`lib/` modules call `sudo` for everything that touches system services. Whitelist is `system/sudoers.d/vacuum-wall`. `lib/` modules call `sudo` for everything that touches system services. Whitelist is `system/sudoers.d/vacuum-wall`.
**acme.sh must never run as root** — always as the service user via `sudo -u`.
Pattern for mutations: write JSON → render native config → `sudo <cmd>` to apply. Pattern for mutations: write JSON → render native config → `sudo <cmd>` to apply.
Adding a new privileged command requires a sudoers entry **and** the `lib/` code. Adding a new privileged command requires a sudoers entry **and** the `lib/` code.
README.md
+3 -3
View File
@@ -7,7 +7,7 @@ A zone-based firewall appliance with a built-in SSL reverse proxy. Combines fire
- Debian 13 (trixie) target platform - Debian 13 (trixie) target platform
- Python 3.13+, Flask 3.x web UI - Python 3.13+, Flask 3.x web UI
- firewalld (nftables backend), dnsmasq, nginx, WireGuard - firewalld (nftables backend), dnsmasq, nginx, WireGuard
- acme.sh for Let's Encrypt - acme.sh for ACME certificates (ZeroSSL)
- HTMX + Jinja2 templates - HTMX + Jinja2 templates
--- ---
@@ -37,7 +37,7 @@ bash install.sh
| `MGMT_DOMAIN` | Yes | Public domain for the management WebUI | | `MGMT_DOMAIN` | Yes | Public domain for the management WebUI |
| `MGMT_PASS` | Yes | HTTP basic auth password for the WebUI | | `MGMT_PASS` | Yes | HTTP basic auth password for the WebUI |
| `MGMT_USER` | No | WebUI username (defaults to `admin`) | | `MGMT_USER` | No | WebUI username (defaults to `admin`) |
| `ACME_EMAIL` | Yes | Let's Encrypt registration email | | `ACME_EMAIL` | Yes | ACME registration email (ZeroSSL by default) |
After installation, access the WebUI at `https://<MGMT_DOMAIN>`. The initial certificate is self-signed — use the Certs tab to issue a real one once DNS is propagating. After installation, access the WebUI at `https://<MGMT_DOMAIN>`. The initial certificate is self-signed — use the Certs tab to issue a real one once DNS is propagating.
@@ -45,7 +45,7 @@ After installation, access the WebUI at `https://<MGMT_DOMAIN>`. The initial cer
1. **Assign interfaces** to zones from the Interfaces tab 1. **Assign interfaces** to zones from the Interfaces tab
2. **Configure DHCP** ranges for your LAN 2. **Configure DHCP** ranges for your LAN
3. **Add proxy domains** with Let's Encrypt certificates 3. **Add proxy domains** with ACME certificates
4. **Set up WireGuard** (optional) 4. **Set up WireGuard** (optional)
See [docs/deployment.md](docs/deployment.md) for the full guide, including troubleshooting. See [docs/deployment.md](docs/deployment.md) for the full guide, including troubleshooting.