mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: unify project structure, improve security, and enhance deployment

Browse Source 
- Fix WireGuard private key leak in API responses and config updates
- Update systemd service to serve from repo root with adjusted sandbox
- Add CLI flags, idempotency, and dev mode to install.sh
- Extract common utilities to lib/common.py and webui/api/common.py
- Migrate frontend to htmx for simpler, more maintainable UI
- Update docs to reflect current architecture and deployment model
- Vendor htmx dependencies per project requirements
This commit is contained in:
Mike Teehan
2026-05-25 00:53:32 +00:00
parent 8829ac579d
commit d1ab717c0f
36 changed files with 857 additions and 626 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webui/api/firewall.py
+51 -46
View File
@@ -1,74 +1,63 @@
"""
webui/api/firewall.py - Firewall (firewalld) management API blueprint.
"""Firewall (firewalld) management API blueprint.
Exposed at /api/firewall/* and delegates all mutations to lib.firewall.
Exposed at /api/firewall/* and delegates all mutations to lib.firewall.
"""
import logging
from flask import Blueprint, jsonify, request
from flask import Blueprint, request
from lib.common import deep_merge
from lib.firewall import (
add_forward_port,
add_rich_rule,
config_get,
config_apply,
config_pending,
config_set,
create_zone,
delete_zone,
get_active_zones,
get_available_zones,
get_config,
get_interfaces,
get_rich_rules,
get_services,
get_zone_info,
remove_forward_port_by_id,
remove_rich_rule_by_id,
save_config,
set_masquerade,
set_zone_interfaces,
set_zone_services,
)
from webui.api.common import _error, _ok
logger = logging.getLogger(__name__)
bp = Blueprint("firewall", __name__)
# ---------------------------------------------------------------------------
# Error helpers
# ---------------------------------------------------------------------------
def _error(msg, code=400):
return jsonify({"ok": False, "error": msg}), code
def _ok(data=None):
return jsonify({"ok": True, "data": data})
# ---------------------------------------------------------------------------
# Declarative config (two-step: save -> apply)
# ---------------------------------------------------------------------------
@bp.route("/config", methods=["GET"])
def config_get_bp():
def config_list():
try:
return _ok(config_get())
except Exception as exc:
return _ok(get_config())
except RuntimeError as exc:
logger.error("Failed to read firewall config: %s", exc)
return _error(str(exc), 500)
@bp.route("/config", methods=["POST"])
def config_set_bp():
def config_save():
body = request.get_json(silent=True) or {}
if "zones" not in body:
return _error("'zones' key is required", 400)
if not isinstance(body["zones"], dict):
return _error("'zones' must be a dict", 400)
try:
config_set(body)
save_config(body)
pending_info = config_pending()
logger.info("Firewall config saved (%d zones)", len(body["zones"]))
return _ok(
@@ -79,20 +68,42 @@ def config_set_bp():
"unmanaged_zones": pending_info.get("unmanaged_zones", {}),
}
)
except Exception as exc:
except RuntimeError as exc:
logger.error("Failed to save firewall config: %s", exc)
return _error(str(exc), 500)
@bp.route("/config", methods=["PATCH"])
def patch_config():
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
try:
current = get_config()
merged = deep_merge(current, body)
save_config(merged)
pending_info = config_pending()
logger.info("Firewall config patched: %s", sorted(body.keys()))
return _ok(
{
"config_saved": True,
"pending": pending_info["pending"],
"needs_apply": pending_info["needs_apply"],
"unmanaged_zones": pending_info.get("unmanaged_zones", {}),
}
)
except RuntimeError as exc:
logger.error("Failed to patch firewall config: %s", exc)
return _error(str(exc), 500)
@bp.route("/config/apply", methods=["POST"])
def config_apply_bp():
try:
from lib.firewall import config_apply as _config_apply
result = _config_apply()
result = config_apply()
logger.info("Firewall config applied: %s", result.get("applied_zones", []))
return _ok(result)
except Exception as exc:
except RuntimeError as exc:
logger.error("Failed to apply firewall config: %s", exc)
return _error(str(exc), 500)
@@ -101,7 +112,7 @@ def config_apply_bp():
def config_pending_bp():
try:
return _ok(config_pending())
except Exception as exc:
except RuntimeError as exc:
logger.error("Failed to check pending config: %s", exc)
return _error(str(exc), 500)
@@ -123,7 +134,7 @@ def list_zones():
@bp.route("/zones/<name>", methods=["GET"])
def zone_details(name):
def zone_details(name: str):
try:
if name not in get_available_zones():
return _error(f"Zone '{name}' does not exist", 404)
@@ -153,7 +164,7 @@ def create_zone_bp():
@bp.route("/zones/<name>", methods=["DELETE"])
def delete_zone_bp(name):
def delete_zone_bp(name: str):
try:
available = get_available_zones()
if name not in available:
@@ -172,7 +183,7 @@ def delete_zone_bp(name):
@bp.route("/zones/<name>/interfaces", methods=["POST"])
def set_zone_interfaces_bp(name):
def set_zone_interfaces_bp(name: str):
body = request.get_json(silent=True) or {}
interfaces = body.get("interfaces", [])
if not isinstance(interfaces, list):
@@ -192,7 +203,7 @@ def set_zone_interfaces_bp(name):
@bp.route("/zones/<name>/services", methods=["POST"])
def set_zone_services_bp(name):
def set_zone_services_bp(name: str):
body = request.get_json(silent=True) or {}
services = body.get("services", [])
if not isinstance(services, list):
@@ -250,18 +261,14 @@ def add_rich_rule_bp():
@bp.route("/rich-rules/<zone>", methods=["GET"])
def list_rich_rules(zone):
def list_rich_rules(zone: str):
try:
rules = get_rich_rules(zone)
from lib.firewall import config_get as firewall_config_get
cfg = firewall_config_get()
cfg = get_config()
cfg_entries = cfg.get("zones", {}).get(zone, {}).get("rich_rules", [])
result = []
for rule_str in rules:
matched = next(
(e for e in cfg_entries if e.get("rule") == rule_str), None
)
matched = next((e for e in cfg_entries if e.get("rule") == rule_str), None)
if matched:
result.append({"id": matched["id"], "rule": rule_str})
else:
@@ -273,7 +280,7 @@ def list_rich_rules(zone):
@bp.route("/rich-rules/<zone>/<rule_id>", methods=["DELETE"])
def remove_rich_rule_bp(zone, rule_id):
def remove_rich_rule_bp(zone: str, rule_id: str):
try:
remove_rich_rule_by_id(zone, rule_id)
logger.info("Rich rule '%s' removed from zone '%s'", rule_id, zone)
@@ -333,9 +340,7 @@ def add_forward_port_bp():
toaddr=str(toaddr) if toaddr else None,
toport=int(toport) if toport else None,
)
return _ok(
{"zone": zone, "id": entry["id"], "port": int(port), "proto": proto}
)
return _ok({"zone": zone, "id": entry["id"], "port": int(port), "proto": proto})
except (ValueError, RuntimeError) as exc:
code = 400 if isinstance(exc, ValueError) else 500
logger.error("Failed to add forward port: %s", exc)
@@ -343,7 +348,7 @@ def add_forward_port_bp():
@bp.route("/forward-port/<zone>/<int:port>/<proto>", methods=["DELETE"])
def remove_forward_port_bp(zone, port, proto):
def remove_forward_port_bp(zone: str, port: int, proto: str):
try:
remove_forward_port_by_id(zone, port, proto)
logger.info("Forward port %s/%s removed from zone '%s'", port, proto, zone)