Add update-vendor.sh symlink support, unify install.sh vendor flow

- update-vendor.sh now creates webui/vendor symlinks (htm.js)
- install.sh calls update-vendor.sh after package install
- Add vendor/.empty and webui/vendor/.empty as directory placeholders in git

daemon/handlers/dnsmasq.py

@@ -1,6 +1,5 @@
 """Dnsmasq daemon handler."""
 
-import hashlib
 import logging
 from copy import deepcopy
 from datetime import UTC, datetime
@@ -26,7 +25,15 @@ from daemon.iface import (
     POST_DNSMASQ_UPSTREAMS,
 )
 from daemon.server import NotFoundError, refresh_state, registry
-from lib.common import deep_merge, ensure_dirs, load_json, run, save_json
+from lib.common import (
+    _APPLY_HASH_KEY,
+    config_hash,
+    deep_merge,
+    ensure_dirs,
+    load_json,
+    run,
+    save_json,
+)
 from lib.sync import SyncEvent, bus
 
 logger = logging.getLogger(__name__)
@@ -51,20 +58,6 @@ DEFAULT_CFG: dict[str, Any] = {
     "dns": {"upstreams": ["8.8.8.8", "1.1.1.1"], "domain": None, "custom_records": []},
 }
 
-# Internal field for tracking applied config version
-_APPLY_HASH_KEY = "_last_applied_hash"
-
-
-def _config_hash(cfg: dict[str, Any]) -> str:
-    """Compute a hash of the config, excluding the _last_applied_hash field.
-
-    Used to detect whether the JSON config has changed since the last apply.
-    """
-    import json
-
-    clean = {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
-    return hashlib.sha256(json.dumps(clean, sort_keys=True).encode()).hexdigest()
-
 
 def _get_state() -> dict[str, Any] | None:
     """Retrieve cached dnsmasq state from the state store."""
@@ -144,7 +137,8 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     dm = _get_dnsmasq_state()
     if dm:
         return dm.get("config", {})
-    return _get_config()
+    cfg = _get_config()
+    return {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
 
 
 @registry.register(POST_DNSMASQ_CONFIG)
@@ -199,11 +193,11 @@ def apply_config(_request: Any, _body: Any) -> dict[str, Any]:
         f.write(conf_text)
     run(["cp", str(tmp), DNSMASQ_CONF], sudo=True)
     tmp.unlink(missing_ok=True)
-    run(["systemctl", "reload", "dnsmasq"], sudo=True)
-    logger.info("dnsmasq config written and reloaded")
+    run(["systemctl", "restart", "dnsmasq"], sudo=True)
+    logger.info("dnsmasq config written and restarted")
     # Store the config hash so state collector can detect pending changes
     cfg_after = _get_config()
-    cfg_after[_APPLY_HASH_KEY] = _config_hash(cfg_after)
+    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
     _save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("dnsmasq", "config_saved", {"action": "config_applied"})

daemon/handlers/firewall.py

@@ -39,6 +39,7 @@ from lib.firewall import (
     _normalize_target,
     _parse_active_zones,
     _parse_zone_output,
+    fw_change_summary,
 )
 from lib.firewall import (
     save_backup as _save_backup,
@@ -378,7 +379,15 @@ def patch_config(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
 @registry.register(GET_FIREWALL_CONFIG_PENDING)
 def config_pending_handler(_request: Any, _body: Any) -> dict[str, Any]:
     fw = _get_fw_state()
-    return fw.get("pending", {})
+    pending = fw.get("pending", {})
+
+    changes = pending.get("pending", [])
+
+    summaries = [
+        fw_change_summary(c.get("zone", "unknown"), c.get("type", "unknown"), c)
+        for c in changes
+    ]
+    return {**pending, "pending_summary": summaries}
 
 
 @registry.register(POST_FIREWALL_CONFIG_APPLY)

daemon/handlers/network.py

@@ -21,7 +21,9 @@ from daemon.iface import (
     POST_NETWORK_SYSCTL_SET,
 )
 from daemon.server import NotFoundError, refresh_state, registry
-from lib.common import run, validate_interface_name
+from lib.common import _APPLY_HASH_KEY, config_hash, run, validate_interface_name
+from lib.dnsmasq import get_config as _get_dm_cfg
+from lib.dnsmasq import save_config as _save_dm_cfg
 from lib.dnsmasq import set_upstreams
 from lib.network import (
     KNOWN_INTERFACE_KEYS,
@@ -195,6 +197,10 @@ def save_interface(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]
         )
 
     logger.info("Interface '%s' config saved (applied=%s)", name, deployed)
+    if deployed:
+        cfg_after = get_config()
+        cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+        save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent(
             "network", "config_saved", {"action": "interface_saved", "interface": name}
@@ -258,10 +264,17 @@ def apply_all(_request: Any, _body: Any) -> dict[str, Any]:
         upstreams = collect_upstream_dns(cfg)
         if upstreams:
             set_upstreams(upstreams)
+            # Update dnsmasq apply hash so pending-changes detection stays correct
+            dm_cfg = _get_dm_cfg()
+            dm_cfg[_APPLY_HASH_KEY] = config_hash(dm_cfg)
+            _save_dm_cfg(dm_cfg)
             logger.info("Synced %d DNS upstreams to dnsmasq", len(upstreams))
     except Exception:
         logger.warning("Failed to sync DNS upstreams to dnsmasq", exc_info=True)
 
+    cfg_after = get_config()
+    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("network", "config_saved", {"action": "config_applied"})
     )

daemon/handlers/nginx.py

@@ -23,7 +23,15 @@ from daemon.iface import (
 )
 from daemon.server import NotFoundError, refresh_state, registry
 from lib.acme import find_cert_dir
-from lib.common import ensure_dirs, load_json, run, run_proc, save_json
+from lib.common import (
+    _APPLY_HASH_KEY,
+    config_hash,
+    ensure_dirs,
+    load_json,
+    run,
+    run_proc,
+    save_json,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -300,7 +308,8 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     ng = _get_nginx_state()
     if ng:
         return ng.get("config", {})
-    return _get_config()
+    cfg = _get_config()
+    return {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
 
 
 @registry.register(POST_NGINX_CONFIG)
@@ -507,6 +516,9 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
     if not ok:
         raise RuntimeError(f"nginx config test failed: {msg}")
     _reload_nginx()
+    cfg_after = _get_config()
+    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    _save_config(cfg_after)
     refresh_state(["nginx"])
     return {"applied": True}
 

daemon/handlers/status.py

@@ -0,0 +1,146 @@
+"""Aggregate status handler.
+
+Exposes pending changes across all subsystems and a single apply-all
+endpoint that invokes each subsystem's apply in the correct order.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from daemon.handlers.dnsmasq import apply_config as dnsmasq_apply_config
+from daemon.handlers.firewall import config_apply as firewall_config_apply
+from daemon.handlers.network import apply_all as network_apply_all
+from daemon.handlers.nginx import apply as nginx_apply
+from daemon.handlers.wireguard import apply as wireguard_apply
+from daemon.iface import GET_STATUS_PENDING, POST_STATUS_APPLY_ALL
+from daemon.server import refresh_state, registry
+from lib.firewall import fw_change_summary
+from lib.state import state as state_store
+
+logger = logging.getLogger(__name__)
+
+SYS_ORDER = ["networkd", "firewall", "wireguard", "dnsmasq", "nginx"]
+SYS_LABELS = {
+    "networkd": "Network",
+    "firewall": "Firewall",
+    "wireguard": "WireGuard",
+    "dnsmasq": "DHCP/DNS",
+    "nginx": "Nginx",
+}
+SYS_APPLY = {
+    "networkd": network_apply_all,
+    "firewall": firewall_config_apply,
+    "wireguard": wireguard_apply,
+    "dnsmasq": dnsmasq_apply_config,
+    "nginx": nginx_apply,
+}
+
+
+@registry.register(GET_STATUS_PENDING)
+def status_pending(_request: Any, _body: Any) -> dict[str, Any]:
+    """Aggregate pending changes across all subsystems.
+
+    Returns:
+        Dict with per-subsystem pending status and total change count.
+    """
+    fw = state_store.get("firewall") or {}
+    pending_fw = fw.get("pending", {})
+    fw_needs_apply = pending_fw.get("needs_apply", False)
+    fw_pending_list = pending_fw.get("pending", [])
+
+    fw_changes = []
+    for c in fw_pending_list:
+        zone = c.get("zone", "unknown")
+        ctype = c.get("type", "unknown")
+        summary = fw_change_summary(zone, ctype, c)
+        fw_changes.append({"summary": summary, "detail": ""})
+
+    fw_result = {
+        "needs_apply": fw_needs_apply,
+        "change_count": len(fw_changes),
+        "changes": fw_changes,
+    }
+
+    hash_subsystems = {
+        "dnsmasq": _hash_subsystem("dnsmasq", state_store.get("dnsmasq")),
+        "nginx": _hash_subsystem("nginx", state_store.get("nginx")),
+        "wireguard": _hash_subsystem("wireguard", state_store.get("wireguard")),
+        "networkd": _hash_subsystem("networkd", state_store.get("networkd")),
+    }
+
+    total = len(fw_changes)
+    for _name, result in hash_subsystems.items():
+        total += len(result["changes"])
+
+    return {
+        "firewall": fw_result,
+        "dnsmasq": hash_subsystems["dnsmasq"],
+        "nginx": hash_subsystems["nginx"],
+        "wireguard": hash_subsystems["wireguard"],
+        "networkd": hash_subsystems["networkd"],
+        "total_changes": total,
+    }
+
+
+@registry.register(POST_STATUS_APPLY_ALL)
+def status_apply_all(_request: Any, _body: Any) -> dict[str, Any]:
+    """Apply pending changes for all subsystems in dependency order.
+
+    Order: network -> firewall -> wireguard -> dnsmasq -> nginx.
+
+    Returns:
+        Dict with applied subsystems and any errors encountered.
+    """
+    applied = []
+    errors = {}
+
+    pending_data = status_pending(None, None)
+    fw_pending = pending_data["firewall"]["needs_apply"]
+    hash_pending = {
+        "dnsmasq": pending_data["dnsmasq"]["pending_changes"],
+        "nginx": pending_data["nginx"]["pending_changes"],
+        "wireguard": pending_data["wireguard"]["pending_changes"],
+        "networkd": pending_data["networkd"]["pending_changes"],
+    }
+
+    for name in SYS_ORDER:
+        if name == "firewall":
+            if not fw_pending:
+                continue
+        else:
+            if not hash_pending.get(name, False):
+                continue
+
+        handler = SYS_APPLY[name]
+        try:
+            handler(None, None)
+            applied.append(name)
+        except Exception as exc:
+            label = SYS_LABELS.get(name, name)
+            errors[label] = str(exc)
+            logger.error("Apply-all failed for %s: %s", name, exc)
+
+    refresh_state(SYS_ORDER)
+    return {"applied": applied, "errors": errors}
+
+
+def _hash_subsystem(name: str, state: dict[str, Any] | None) -> dict[str, Any]:
+    """Build pending result for a hash-based subsystem."""
+    if state is None:
+        return {"pending_changes": False, "summary": "Up to date", "changes": []}
+
+    status = state.get("status", {})
+    pending = status.get("pending_changes", False)
+    label = SYS_LABELS.get(name, name)
+
+    if pending:
+        summary = f"{label} configuration has unapplied changes"
+        return {
+            "pending_changes": True,
+            "summary": summary,
+            "changes": [{"summary": summary, "detail": ""}],
+        }
+
+    return {"pending_changes": False, "summary": "Up to date", "changes": []}

daemon/handlers/wireguard.py

@@ -24,7 +24,15 @@ from daemon.iface import (
     POST_WIREGUARD_PEERS_ADD,
 )
 from daemon.server import NotFoundError, refresh_state, registry
-from lib.common import deep_merge, load_json, run, run_proc, save_json
+from lib.common import (
+    _APPLY_HASH_KEY,
+    config_hash,
+    deep_merge,
+    load_json,
+    run,
+    run_proc,
+    save_json,
+)
 from lib.sync import SyncEvent, bus
 
 logger = logging.getLogger(__name__)
@@ -102,7 +110,7 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
     if wg:
         return wg.get("config", {})
     cfg = _get_config()
-    safe = dict(cfg)
+    safe = {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
     if "interface" in safe:
         safe["interface"] = dict(safe["interface"])
         safe["interface"].pop("private_key", None)
@@ -174,6 +182,9 @@ def apply(_request: Any, _body: Any) -> dict[str, Any]:
     local_tmp.unlink(missing_ok=True)
     run([WG_QUICK_BIN, "up", cfg["interface"]["name"]], sudo=True)
     logger.info("WireGuard tunnel '%s' brought up", cfg["interface"]["name"])
+    cfg_after = _get_config()
+    cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
+    _save_config(cfg_after)
     sync_result = bus.emit(
         SyncEvent("wireguard", "config_saved", {"action": "config_applied"})
     )

daemon/iface.py

@@ -146,6 +146,8 @@ GET_STATUS_ALL: Endpoint = _ep("GET", "/status/all")
 POST_STATUS_REFRESH: Endpoint = _ep("POST", "/status/refresh")
 GET_WS: Endpoint = _ep("GET", "/ws")
 POST_BATCH: Endpoint = _ep("POST", "/batch")
+GET_STATUS_PENDING: Endpoint = _ep("GET", "/status/pending")
+POST_STATUS_APPLY_ALL: Endpoint = _ep("POST", "/status/apply-all")
 
 # Collect all endpoint module-level constants for __all__ verification
 _all_endpoints = [

daemon/server.py

@@ -506,6 +506,7 @@ def _register_routes() -> None:
         logs,  # noqa: F401
         network,  # noqa: F401
         nginx,  # noqa: F401
+        status,  # noqa: F401
         wireguard,  # noqa: F401
     )
 
@@ -538,7 +539,7 @@ def main() -> None:
         _stop_polling()
         try:
             await asyncio.wait_for(runner.cleanup(), timeout=5)
-        except asyncio.TimeoutError:
+        except TimeoutError:
             logger.warning("Runner cleanup timed out, abandoning")
         if Path(socket_path).exists():
             os.unlink(socket_path)