mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: unify project structure, improve security, and enhance deployment

Browse Source 
- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements
This commit is contained in:
Mike Teehan
2026-05-25 00:53:32 +00:00
parent 8829ac579d
commit d1ab717c0f
36 changed files with 857 additions and 626 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/overview.md
+11 -5
View File
@@ -29,7 +29,7 @@ WireGuard support provides server-side VPN tunnel management. Peers are added th
## Tech Stack
- Debian 13 (trixie) target platform
- Python 3, Flask 3.x for web management
- Python 3.13+, Flask 3.x for web management
- firewalld (nftables backend)
- nginx 1.26+
- dnsmasq
@@ -40,14 +40,17 @@ WireGuard support provides server-side VPN tunnel management. Peers are added th
## Quick Start
To install Vacuum Wall on a Debian 13 system, run `install.sh` as root with the required environment variables:
To install Vacuum Wall on a Debian 13 system, run `install.sh` as root with required settings (CLI flags or environment variables):
```bash
MGMT_PASS=yourpassword ACME_EMAIL=admin@example.com \
bash install.sh
# Production
./install.sh --mgmt-pass yourpassword --acme-email "admin@example.com"
# Development (auto-detects your user)
./install.sh --dev --mgmt-pass yourpassword --acme-email "admin@example.com"
```
After installation, access the management interface at `https://<hostname>.local` using the credentials you configured. The `install.sh` script auto-detects the system hostname (use `MGMT_DOMAIN` to override), provisions nginx, sets up authentication, generates an initial self-signed certificate, and starts all services.
After installation, access the management interface at `https://<hostname>.local` using the credentials you configured. The `install.sh` script auto-detects the system hostname, network interfaces, and provisions nginx, authentication, an initial self-signed certificate, and all services. Run `./install.sh --help` for all options.
## Project Structure
@@ -74,6 +77,8 @@ After installation, access the management interface at `https://<hostname>.local
│ ├── dnsmasq.conf # Dnsmasq template (rendered at runtime)
│ └── wireguard*.conf # WireGuard templates (rendered at runtime)
├── lib/ # Subsystem abstraction layer
│ ├── common.py # Shared utilities (run, run_proc, load_json, save_json, deep_merge, ensure_dirs)
│ ├── logging.py # Logging setup
│ ├── firewall.py # firewalld bindings
│ ├── dnsmasq.py # DHCP/DNS configuration
│ ├── nginx.py # Reverse proxy configuration
@@ -82,6 +87,7 @@ After installation, access the management interface at `https://<hostname>.local
├── webui/ # Flask web application
│ ├── server.py # Application entry point
│ ├── api/ # REST API route modules
│ │ └── common.py # Shared API response helpers (_ok, _error)
│ ├── templates/ # Jinja2/HTMX templates
│ └── static/ # CSS and client-side JS
└── docs/ # Documentation