Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

system/acme-deploy.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# acme-deploy.sh — Deploy hook for acme.sh (Vacuum Wall)
+#
+# Called by acme.sh after every successful certificate issue or renewal.
+# The nginx config reads certs directly from ~/.acme.sh/, so we only
+# need to reload nginx.  If the config is invalid (e.g. apply hasn't
+# been called yet) we exit silently — the user will reload via WebUI.
+
+sudo nginx -t 2>/dev/null && sudo nginx -s reload 2>/dev/null
+exit 0

system/nginx/server_block.conf

@@ -21,8 +21,8 @@ server {
 {% if cert.type == "acme" %}
     # Certificate managed by acme.sh
 {% if cert.email %}    # ACME contact: {{ cert.email }}
-{% endif %}    ssl_certificate     /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+{% endif %}    ssl_certificate     /home/vacuum-wall/.acme.sh/{{ domain }}/fullchain.cer;
+    ssl_certificate_key /home/vacuum-wall/.acme.sh/{{ domain }}/{{ domain }}.key;
 
 {% elif cert.type == "file" %}
     ssl_certificate     {{ cert.path }};

system/sudoers.d/vacuum-wall

@@ -19,17 +19,13 @@ vacuum-wall ALL=(root) NOPASSWD: /usr/bin/systemctl reload dnsmasq
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/systemctl is-active dnsmasq
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/dnsmasq.d/
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cat /var/lib/dnsmasq/dnsmasq.leases
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/tee /etc/dnsmasq.d/vacuum-wall.conf
 
 # WireGuard management
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/wg-quick *
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/wg *
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/wireguard/
 
-# Acme.sh (SSL cert management)
-vacuum-wall ALL=(root) NOPASSWD: /usr/bin/bash ~/.acme.sh/acme.sh *
-vacuum-wall ALL=(root) NOPASSWD: /usr/local/bin/acme.sh *
-vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cat /home/*/.acme.sh/*
-
 # Misc
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/journalctl --unit=* -n *
 vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cat /var/log/nginx/*

system/systemd/vacuum-wall.service

@@ -22,11 +22,16 @@ ProtectHome=read-only
 ReadWritePaths=/home/wall/vacuum-wall/data /tmp
 PrivateTmp=yes
 ProtectKernelTunables=yes
+ProtectKernelModules=yes
 ProtectControlGroups=yes
+ProtectHostname=yes
 RestrictSUIDSGID=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
+RestrictNamespaces=yes
 LockPersonality=yes
+SystemCallFilter=@system-service
+PrivateDevices=yes
 
 # Network - only loopback (nginx proxies to us)
 IPAddressDeny=all