refactor: update system config, sudoers, and install script

system/acme-deploy.py

@@ -13,6 +13,7 @@ try:
     import requests_unixsocket
 
     from daemon.client import post
+    from daemon.iface import POST_NGINX_RELOAD
 
     logging.basicConfig(level=logging.INFO)
     project_dir = os.environ.get("INSTALL_DIR", os.path.dirname(os.path.dirname(__file__)))
@@ -20,7 +21,7 @@ try:
         "VACUUM_WALLD_SOCKET",
         os.path.join(project_dir, "data", "daemon.sock"),
     )
-    post("/nginx/reload", socket_path=socket_path)
+    post(POST_NGINX_RELOAD, socket_path=socket_path)
     sys.exit(0)
 except Exception as exc:
     logging.error("acme-deploy hook failed: %s", exc)

system/dnsmasq.conf

@@ -1,9 +1,13 @@
 # ---- vacuum-wall managed dnsmasq configuration ----
 # generated {{ timestamp }}
 
+bind-interfaces
 {% if interfaces %}
 interface={{ interfaces | join(',') }}
-bind-interfaces
+{% elif listen_addresses %}
+{% for addr in listen_addresses %}
+listen-address={{ addr }}
+{% endfor %}
 {% endif %}
 {% for srv in dns.upstreams %}
 server={{ srv }}

system/nginx/server_block.conf

@@ -39,8 +39,8 @@ server {
 
 {% endif %}
 {% elif is_management %}
-    ssl_certificate     {{ certs_dir }}/{{ domain }}.crt;
-    ssl_certificate_key {{ certs_dir }}/{{ domain }}.key;
+    ssl_certificate     {{ acme_home }}/{{ domain }}/fullchain.cer;
+    ssl_certificate_key {{ acme_home }}/{{ domain }}/{{ domain }}.key;
 
 {% endif %}
     # Shared SSL settings
@@ -57,48 +57,49 @@ server {
     add_header X-Content-Type-Options    nosniff                         always;
     add_header X-Frame-Options           DENY                            always;
     add_header X-XSS-Protection          "1; mode=block"                 always;
-    add_header Referrer-Policy           "strict-origin-when-cross-origin" always;
+    add_header Referrer-Policy            "strict-origin-when-cross-origin" always;
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
-    # Proxy headers
-    proxy_set_header Host              $host;
-    proxy_set_header X-Real-IP         $remote_addr;
-    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
+{% endif %}
+    location / {
+        # Proxy headers
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+{% if not is_management %}
 {% for hname, hval in headers.items() %}
-    proxy_set_header {{ hname }} {{ hval }};
+        proxy_set_header {{ hname }} {{ hval }};
 {% endfor %}
 {% endif %}
-    # Proxy pass to backend
-    proxy_pass {{ backend.proto }}://{{ backend.host }}:{{ backend.port }};
-    proxy_http_version 1.1;
+        # Proxy pass to backend
+        proxy_pass {{ backend.proto }}://{{ backend.host }}:{{ backend.port }};
+        proxy_http_version 1.1;
+
+        # Timeouts
+        proxy_connect_timeout 30s;
+        proxy_send_timeout    60s;
+        proxy_read_timeout    60s;
+        proxy_buffering       off;
+
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+{% if is_management %}
+    location /ws {
+        auth_basic off;
+        proxy_pass http://127.0.0.1:9091;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+{% endif %}
 
 {% if not is_management %}
-    # Timeouts
-    proxy_connect_timeout 30s;
-    proxy_send_timeout    60s;
-    proxy_read_timeout    60s;
-    proxy_buffering       off;
-
     # Access / error logs
     access_log /var/log/nginx/{{ domain }}_access.log;
     error_log  /var/log/nginx/{{ domain }}_error.log  warn;
 {% else %}
-    proxy_set_header Host              $host;
-    proxy_set_header X-Real-IP         $remote_addr;
-    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-
-    proxy_connect_timeout 30s;
-    proxy_send_timeout    60s;
-    proxy_read_timeout    60s;
-    proxy_buffering       off;
-
     access_log /var/log/nginx/wall_mgmt_access.log;
     error_log  /var/log/nginx/wall_mgmt_error.log  warn;
 {% endif %}
-    location / {
-        proxy_set_header Upgrade    $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-    }
 }

system/sudoers.d/vacuum-walld

@@ -41,6 +41,9 @@ Defaults:{{ USER_DAEMON_NAME }} secure_path="/usr/local/sbin:/usr/local/bin:/usr
 {{ USER_DAEMON_NAME }} ALL=(root) NOPASSWD: /usr/bin/rm /etc/systemd/network/*.network
 {{ USER_DAEMON_NAME }} ALL=(root) NOPASSWD: /usr/bin/mkdir -p /etc/systemd/network
 
+# Sysctl
+{{ USER_DAEMON_NAME }} ALL=(root) NOPASSWD: /usr/sbin/sysctl -w *
+
 # Misc
 {{ USER_DAEMON_NAME }} ALL=(root) NOPASSWD: /usr/bin/journalctl --unit=* -n *
 {{ USER_DAEMON_NAME }} ALL=(root) NOPASSWD: /usr/bin/cat /var/log/nginx/*

system/systemd/vacuum-walld.service

@@ -19,7 +19,7 @@ Environment=HOME={{ PROJECT_DIR }}
 
 # Security hardening
 ProtectSystem=strict
-ReadWritePaths={{ PROJECT_DIR }} /tmp /etc/systemd/network
+ReadWritePaths={{ PROJECT_DIR }} /tmp /etc/systemd/network /etc/nginx /etc/dnsmasq.d /etc/wireguard /run/sudo /run/firewalld
 PrivateTmp=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes