refactor: unify project structure, improve security, and enhance deployment

- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements

system/nginx/server_block.conf

@@ -7,6 +7,11 @@ server {
     listen [::]:80;
     server_name {{ domain }};
 
+    # ACME HTTP-01 challenge
+    location /.well-known/acme-challenge/ {
+        root {{ acme_webroot }};
+    }
+
     # Redirect all HTTP traffic to HTTPS
     return 301 https://$host$request_uri;
 }

system/sudoers.d/vacuum-wall

@@ -13,6 +13,7 @@ Defaults:{{ USER_NAME }} secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/
 {{ USER_NAME }} ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/nginx/snippets/
 {{ USER_NAME }} ALL=(root) NOPASSWD: /usr/bin/rm /etc/nginx/conf.d/vacuum-wall.conf
 {{ USER_NAME }} ALL=(root) NOPASSWD: /usr/bin/rm /etc/nginx/snippets/vacuum-wall-ssl.conf
+{{ USER_NAME }} ALL=(root) NOPASSWD: /usr/bin/chown root:root /etc/nginx/snippets/vacuum-wall-ssl.conf
 
 # Dnsmasq management
 {{ USER_NAME }} ALL=(root) NOPASSWD: /usr/bin/systemctl reload dnsmasq

system/systemd/vacuum-wall-acme.service

@@ -7,4 +7,4 @@ User={{ USER_NAME }}
 WorkingDirectory={{ PROJECT_DIR }}
 Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
 Environment=HOME={{ PROJECT_DIR }}
-ExecStart=/usr/local/bin/acme.sh --cron --home {{ ACME_HOME }}
+ExecStart={{ ACME_HOME }}/acme.sh --cron --home {{ ACME_HOME }} --config-home {{ ACME_HOME }}

system/systemd/vacuum-wall.service

@@ -20,7 +20,7 @@ Environment=HOME={{ PROJECT_DIR }}
 # Security hardening
 NoNewPrivileges=yes
 ProtectSystem=strict
-ReadWritePaths={{ PROJECT_DIR }}/config {{ PROJECT_DIR }}/data /tmp
+ReadWritePaths={{ PROJECT_DIR }} {{ PROJECT_DIR }}/config {{ PROJECT_DIR }}/data /tmp
 PrivateTmp=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
@@ -34,9 +34,8 @@ LockPersonality=yes
 SystemCallFilter=@system-service
 PrivateDevices=yes
 
-ProtectHome=read-only
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-IPAddressDeny=all
+IPAddressDeny=any
 IPAddressAllow=localhost
 
 [Install]