Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

install.sh

@@ -45,16 +45,7 @@ apt-get install -y -qq \
     nftables \
     apache2-utils
 
-# Install acme.sh under the project user's home
-if [[ ! -d "$USER_HOME/.acme.sh" ]]; then
-    log "Installing acme.sh..."
-    mkdir -p "$USER_HOME"
-    ACME_HOME="$USER_HOME/.acme.sh" curl -sS https://get.acme.sh | sh
-else
-    log "acme.sh already installed."
-fi
-
-# Setup Python venv with project dependencies
+# --- 1b. Setup Python venv ---
 log "Setting up Python virtual environment..."
 python3 -m venv "${PROJECT_DIR}/.venv"
 "${PROJECT_DIR}/.venv/bin/pip" install -q "${PROJECT_DIR}"
@@ -68,6 +59,21 @@ else
     log "User $USER_NAME already exists."
 fi
 
+# --- 2b. Install acme.sh as the vacuum-wall user ---
+if [[ ! -d "$USER_HOME/.acme.sh" ]]; then
+    log "Installing acme.sh for $USER_NAME..."
+    su -s /bin/sh "$USER_NAME" -c \
+        "ACME_HOME='$USER_HOME/.acme.sh' curl -sS https://get.acme.sh | sh"
+else
+    log "acme.sh already installed."
+fi
+
+# Ensure the vacuum-wall user owns the acme.sh directory
+chown -R "$USER_NAME:$USER_NAME" "$USER_HOME/.acme.sh"
+
+# Ensure the acme deploy hook script has correct permissions
+chmod 0755 "${PROJECT_DIR}/system/acme-deploy.sh"
+
 # --- 3. Setup directories ---
 log "Creating data directories..."
 mkdir -p "${PROJECT_DIR}/data"/{nginx/sites-enabled,dnsmasq,firewall,wireguard}
@@ -138,6 +144,10 @@ with open('$USER_HOME/vacuum-wall/.htpasswd', 'w') as f:
 
 chown "$USER_NAME:$USER_NAME" "$USER_HOME/vacuum-wall/.htpasswd" 2>/dev/null
 
+# Copy .htpasswd to the path expected by the running app (data/nginx/.htpasswd)
+cp "$USER_HOME/vacuum-wall/.htpasswd" "${PROJECT_DIR}/data/nginx/.htpasswd" 2>/dev/null || true
+chown "$USER_NAME:$USER_NAME" "${PROJECT_DIR}/data/nginx/.htpasswd" 2>/dev/null || true
+
 # Write WebSocket upgrade map (nginx conf.d/ is already inside http {} context)
 cat > /etc/nginx/conf.d/vacuum-wall-map.conf <<'MAPEOF'
 # Vacuum Wall - WebSocket upgrade map
@@ -223,7 +233,8 @@ systemctl start vacuum-wall 2>/dev/null || warn "Could not start vacuum-wall Web
 
 # --- 12. Configure acme.sh default email ---
 log "Configuring acme.sh default email..."
-"$USER_HOME/.acme.sh/acme.sh" --register-account -m "$ACME_EMAIL" 2>/dev/null || \
+su -s /bin/sh "$USER_NAME" -c \
+        "$USER_HOME/.acme.sh/acme.sh --register-account -m '$ACME_EMAIL'" 2>/dev/null || \
     warn "Could not register acme.sh account (will be done from WebUI)"
 
 # --- Done ---