refactor: update lib modules (common, dnsmasq, logging, network, state, nginx)

lib/logging.py

@@ -10,6 +10,7 @@ Output:
       viewing via the WebUI ``/logs`` page.
 """
 
+import contextlib
 import logging
 import os
 import sys
@@ -66,15 +67,59 @@ def setup_logging(level: str | None = None) -> None:
     sh.setFormatter(fmt)
     root.addHandler(sh)
 
-    # rotating file handler
+    class GroupWriteHandler(RotatingFileHandler):
+        """RotatingFileHandler that always opens files with group-write mode.
+
+        Ensures the log file is group-writable so both the WebUI process
+        (vacuum-wall user) and daemon process (vacuum-walld user) can write
+        to it when they share a group.
+        """
+
+        def _open(self):
+            # Ensure group-write on an existing stale file (e.g. left by the
+            # other process with a stricter umask at creation time).
+            with contextlib.suppress(OSError):
+                os.chmod(self.baseFilename, 0o664)
+            # Temporarily clear group-write umask bits so os.open's mode is
+            # not masked away.
+            old = os.umask(0o002)
+            try:
+                fd = os.open(
+                    self.baseFilename, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o664
+                )
+            finally:
+                os.umask(old)
+            return os.fdopen(fd, "a", errors="backslashreplace")
+
+        def doRollover(self):
+            """Override to enforce group-write on rotated files."""
+            super().doRollover()
+            # Set group-write on all log files (current + backups)
+            base = Path(self.baseFilename)
+            for suffix in ("", ".1", ".2", ".3"):
+                fp = str(base.parent / base.name + suffix)
+                with contextlib.suppress(OSError):
+                    os.chmod(fp, 0o664)
+
+    # rotating file handler with group-write permissions
     _LOG_DIR.mkdir(parents=True, exist_ok=True)
-    fh = RotatingFileHandler(
-        str(_LOG_FILE),
-        maxBytes=_MAX_BYTES,
-        backupCount=_BACKUP_COUNT,
-    )
-    fh.setFormatter(fmt)
-    root.addHandler(fh)
+    try:
+        fh = GroupWriteHandler(
+            str(_LOG_FILE),
+            maxBytes=_MAX_BYTES,
+            backupCount=_BACKUP_COUNT,
+        )
+        fh.setFormatter(fmt)
+        root.addHandler(fh)
+    except PermissionError:
+        # Log file exists but is not writable (e.g. stale file from the other
+        # process created with a stricter umask).  Fall back to stderr-only.
+        print(
+            f"WARNING: cannot open log file {_LOG_FILE}, "
+            "logging to stderr only. Fix with: chmod g+w "
+            f"{_LOG_FILE}",
+            file=sys.stderr,
+        )
 
     # Silence noisy third-party loggers in production
     for name in ("werkzeug", "urllib3"):