Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

webui/api/certs.py

@@ -28,10 +28,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 # ---------------------------------------------------------------------------
@@ -70,14 +67,11 @@ def issue_bp():
     if not domain:
         return _error("'domain' is required", 400)
     webroot = body.get("webroot")
-    standalone = body.get("standalone", False)
     try:
-        result = issue(domain, webroot=webroot, standalone=standalone)
+        result = issue(domain, webroot=webroot)
         if result.get("success"):
-            return _ok(result)
-        return jsonify(
-            {"ok": False, "error": result.get("error", "Unknown error"), "data": result}
-        ), 400
+            return _ok(None)
+        return _error(result.get("error", "Unknown error"), 500)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -92,10 +86,8 @@ def renew_bp(domain):
     try:
         result = renew(domain)
         if result.get("success"):
-            return _ok(result)
-        return jsonify(
-            {"ok": False, "error": result.get("error", "Unknown error"), "data": result}
-        ), 400
+            return _ok(None)
+        return _error(result.get("error", "Unknown error"), 500)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -107,10 +99,16 @@ def renew_bp(domain):
 
 @bp.route("/<domain>", methods=["DELETE"])
 def remove_bp(domain):
+    try:
+        get_cert_info(domain)
+    except ValueError as exc:
+        return _error(str(exc), 404)
+    except RuntimeError as exc:
+        return _error(str(exc), 500)
     try:
         remove(domain)
-        return _ok({"domain": domain})
-    except (RuntimeError, FileNotFoundError) as exc:
+        return _ok(None)
+    except RuntimeError as exc:
         return _error(str(exc), 500)
 
 

webui/api/dhcp.py

@@ -30,10 +30,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 def _deep_merge(base, overrides):
@@ -66,7 +63,7 @@ def post_config():
         return _error("Request body must be a JSON object", 400)
     try:
         save_config(body)
-        return _ok(body)
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -80,7 +77,7 @@ def patch_config():
         current = get_config()
         merged = _deep_merge(current, body)
         save_config(merged)
-        return _ok(merged)
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -89,7 +86,7 @@ def patch_config():
 def apply_bp():
     try:
         apply_config()
-        return _ok({"message": "dnsmasq configuration applied"})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -132,9 +129,16 @@ def remove_static_lease_bp():
     mac = request.args.get("mac", "").strip()
     if not mac:
         return _error("Query parameter 'mac' is required", 400)
+    current = get_config()
+    found = any(
+        lease["mac"].lower() == mac.lower()
+        for lease in current.get("dhcp", {}).get("static_leases", [])
+    )
+    if not found:
+        return _error(f"No static lease found for MAC '{mac}'", 404)
     try:
         remove_static_lease(mac)
-        return _ok({"mac": mac})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -164,8 +168,14 @@ def remove_dns_record_bp():
     name = request.args.get("name", "").strip()
     if not name:
         return _error("Query parameter 'name' is required", 400)
+    current = get_config()
+    found = any(
+        r["name"] == name for r in current.get("dns", {}).get("custom_records", [])
+    )
+    if not found:
+        return _error(f"No DNS record found for '{name}'", 404)
     try:
         remove_dns_record(name)
-        return _ok({"name": name})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)

webui/api/firewall.py

@@ -37,10 +37,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 # ---------------------------------------------------------------------------
@@ -69,6 +66,8 @@ def list_zones():
 @bp.route("/zones/<name>", methods=["GET"])
 def zone_details(name):
     try:
+        if name not in get_available_zones():
+            return _error(f"Zone '{name}' does not exist", 404)
         info = get_zone_info(name)
         return jsonify({"ok": True, "data": info})
     except RuntimeError as exc:
@@ -86,7 +85,7 @@ def create_zone_bp():
         if zone_name in get_available_zones():
             return _error(f"Zone '{zone_name}' already exists", 400)
         create_zone(zone_name, target)
-        return _ok({"name": zone_name, "target": target})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -98,7 +97,7 @@ def delete_zone_bp(name):
         if name not in available:
             return _error(f"Zone '{name}' does not exist", 404)
         delete_zone(name)
-        return _ok({"name": name})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 

webui/api/proxy.py

@@ -30,10 +30,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 # ---------------------------------------------------------------------------
@@ -120,7 +117,7 @@ def remove_domain_bp(domain):
 def apply_bp():
     try:
         apply()
-        return _ok({"message": "nginx configuration applied and reloaded"})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -128,10 +125,10 @@ def apply_bp():
 @bp.route("/test", methods=["POST"])
 def test_bp():
     try:
-        ok, message = test_config()
-        if ok:
-            return _ok({"passed": True, "message": message})
-        return jsonify({"ok": False, "error": message, "passed": False}), 400
+        valid, output = test_config()
+        if valid:
+            return _ok({"valid": True, "output": output})
+        return jsonify({"ok": False, "error": output, "valid": False}), 400
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -153,7 +150,7 @@ def management_bp():
     auth_pass = body.get("auth_pass")
     try:
         set_management_proxy(domain, flask_host, int(flask_port), auth_user, auth_pass)
-        return _ok({"domain": domain})
+        return _ok(None)
     except (ValueError, RuntimeError) as exc:
         code = 400 if isinstance(exc, ValueError) else 500
         return _error(str(exc), code)

webui/api/wireguard.py

@@ -33,10 +33,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 # ---------------------------------------------------------------------------
@@ -82,7 +79,7 @@ def post_config():
 def apply_bp():
     try:
         apply()
-        return _ok({"message": "WireGuard configuration applied and tunnel brought up"})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -91,7 +88,7 @@ def apply_bp():
 def down_bp():
     try:
         down()
-        return _ok({"message": "WireGuard tunnel brought down"})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -117,12 +114,8 @@ def status_bp():
 @bp.route("/initialize", methods=["POST"])
 def initialize_bp():
     try:
-        cfg = initialize()
-        safe = dict(cfg)
-        if "interface" in safe:
-            safe["interface"] = dict(safe["interface"])
-            safe["interface"].pop("private_key", None)
-        return _ok(safe)
+        initialize()
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -208,7 +201,7 @@ def generate_client_bp():
                 "Field 'server_endpoint' is required (e.g., '203.0.113.1:51820')", 400
             )
         conf_text = generate_client_conf(name, server_endpoint, server_pubkey)
-        return _ok({"config": conf_text, "name": name})
+        return _ok({"config": conf_text})
     except (KeyError, ValueError, RuntimeError) as exc:
         code = 404 if isinstance(exc, (KeyError, ValueError)) else 500
         return _error(str(exc), code)