docs: update API conflict status, ACME config, request flow, deployment, and security sudoers

docs/api.md

@@ -32,6 +32,7 @@ Error responses carry one of the following HTTP status codes:
 |------|---------|
 | `400` | Bad request — invalid body, missing required field, or malformed value |
 | `404` | Not found — the requested resource does not exist |
+| `409` | Conflict — the requested operation conflicts with an existing resource |
 | `500` | Internal server error — unexpected failure in the backend |
 
 ### Route Patterns
@@ -910,7 +911,7 @@ Request a new certificate for a domain. Returns HTTP `500` if issuance fails.
 
 **Response:** `data` is `null` on success.
 
-Returns HTTP `400` if the domain is missing. An ACME account must be registered before issuance (verified by the `account_registered` blocking check in the validation pipeline).
+Returns HTTP `400` if the domain is missing. Returns HTTP `409` if a valid certificate already exists for the domain (renew instead). An ACME account must be registered before issuance (verified by the `account_registered` blocking check in the validation pipeline).
 
 ---
 

docs/architecture.md

@@ -38,7 +38,7 @@ Flask WebUI ──→ daemon/client.py (path resolution, Unix socket) ──→
 vacuum-walld ──→ daemon/handlers/firewall.py ──→ sudo firewall-cmd ──→ firewalld / D-Bus ──→ nftables
 vacuum-walld ──→ daemon/handlers/nginx.py ──→ write local .conf files ──→ sudo cp to /etc/nginx/ ──→ sudo nginx -t && sudo nginx -s reload
 vacuum-walld ──→ daemon/handlers/dnsmasq.py ──→ render config ──→ sudo tee /etc/dnsmasq.d/vacuum-wall.conf ──→ sudo systemctl reload dnsmasq
-vacuum-walld ──→ daemon/handlers/acme.py ──→ acme.sh (subprocess) ──→ deploy hook (daemon API) ──→ ZeroSSL ACME
+vacuum-walld ──→ daemon/handlers/acme.py ──→ acme.sh (subprocess) ──→ deploy hook (daemon API) ──→ ACME provider
 vacuum-walld ──→ daemon/handlers/wireguard.py ──→ render data/wireguard/wg0.conf ──→ sudo cp to /etc/wireguard/ ──→ sudo wg-quick up wg0
 vacuum-walld ──→ daemon/handlers/network.py ──→ render 50-<name>.network ──→ sudo cp to /etc/systemd/network/ ──→ sudo networkctl reload
 vacuum-walld ──→ daemon/handlers/logs.py ──→ sudo journalctl ──→ systemd journal
@@ -79,7 +79,7 @@ Vacuum Wall uses a declarative configuration model. Persistent user-facing confi
 | nginx | `config/nginx/config.json` | `data/nginx/.htpasswd`, `data/nginx/sites-enabled/` | `data/nginx/sites-enabled/<domain>.conf` + `/etc/nginx/conf.d/vacuum-wall.conf` | All proxy and management domain definitions are derived from the JSON config. Generated `.conf` files are overwritten on each apply. |
 | WireGuard | `config/wireguard/config.json` | `data/wireguard/` | `/etc/wireguard/wg0.conf` | The JSON file defines the interface and all peers. The rendered WireGuard config is overwritten on each apply. |
 | networkd | `config/network/config.json` | `data/networkd/` | `/etc/systemd/network/50-<name>.network` | The JSON file defines per-interface static addresses, routes, DNS, DHCP, and link settings. Each entry renders to a `50-<name>.network` INI file. Stale files are cleaned on apply. Public DNS servers are auto-synced to dnsmasq upstreams. |
-| ACME | N/A (`~/.acme.sh/` managed by acme.sh) | `data/acme/` | Certificate and key files | acme.sh manages its own state, renewal scheduling, and account keys. Vacuum Wall triggers issuance and renewal but does not maintain independent ACME state. |
+| ACME | `config/acme/config.json` | `data/acme/` | Certificate and key files | acme.sh manages its own state, renewal scheduling, and account keys. Vacuum Wall triggers issuance and renewal but does not maintain independent ACME state. Account registration (email, CA provider) is stored in the declarative config. |
 
 #### Background Polling
 
@@ -169,14 +169,16 @@ The web UI is a single-page application built on **Hoover**, a custom lightweigh
 ### Request Flow (Frontend)
 
 ```
-Client requests index.html ──→ nginx ──→ Flask (server-side __WS_URL_PLACEHOLDER__ substitution)
+Client requests / ──→ nginx ──→ Flask (server-side __WS_URL_PLACEHOLDER__ substitution)
-Client loads app.js ──→ Hoover initializes, mounts #sidebar and #main render roots
+Client loads /static/app.js ──→ Hoover initializes, mounts #sidebar and #main render roots
 Hoover connects WebSocket ──→ daemon/ws (127.0.0.1:9091)
 Page navigate (hash change) ──→ reactive router state updates ──→ render engine re-executes ──→ VDOM diff patches DOM
 User action (form submit) ──→ apiFetch() ──→ Flask REST API ──→ daemon/client.py ──→ vacuum-walld
 WebSocket message (versions) ──→ topic match ──→ page load() re-executed ──→ state updated ──→ render engine patches DOM
 ```
 
+The SPA entry point only serves `index.html` at `/`. All other paths return 404. Non-API, non-static paths are not served by Flask — the client-side router handles all navigation via hash changes. A dedicated `/vendor/<path>` route serves vendored JS libraries.
+
 ### Component Model
 
 Each route is a `definePage()` component with reactive state, async data loading, and WebSocket auto-refresh. Pages are mounted using `hComp(page, key)` in the router, where the key determines lifecycle boundaries. The same key reuses the component instance (preserving state); a different key unmounts the old page and mounts the new one.

docs/config.md

@@ -153,7 +153,7 @@ The `domains` object maps domain names (keys) to proxy configurations. Each entr
 | `paths` | object | Yes | Path-to-config map. Each key is a URL path (e.g., `"/"`, `"/api"`). No catch-all unless `"/"` is explicitly defined. |
 | `force_ssl` | boolean | No | Enable HTTPS redirect. HTTP requests to this domain receive a 301 redirect to HTTPS. Default: `true`. |
 | `cert` | string | No | Certificate provisioning method. One of: `"acme"`, `"file"`, or `"selfsigned"`. Omit for domains that don't need a dedicated cert. |
-| `auth` | object | No | Domain-level HTTP basic auth configuration (`{ user, htppasswd }`). Applies to all paths unless overridden at the path level. |
+| `auth` | object | No | Domain-level HTTP basic auth configuration (`{ user, htpasswd }`). Applies to all paths unless overridden at the path level. |
 
 ### Path Entries
 
@@ -166,7 +166,7 @@ Each entry under `paths` defines a location block and its proxy backend.
 | `backend.port` | integer | Yes | Port the backend service is listening on. |
 | `backend.proto` | string | No | Protocol: `http` or `https`. Default: `http`. |
 | `headers` | object | No | Custom proxy headers (key-value pairs). Supports nginx variable interpolation. |
-| `auth` | object \| null | No | Path-level auth override. `{ user, htppasswd }` replaces domain-level auth. `null` disables auth for this path. |
+| `auth` | object \| null | No | Path-level auth override. `{ user, htpasswd }` replaces domain-level auth. `null` disables auth for this path. |
 | `is_management` | boolean | No | Marks this path as the Vacuum Wall WebUI backend. Suppresses security headers (X-Frame-Options, etc.) so the SPA works correctly. |
 | `is_websocket` | boolean | No | Marks this path as a WebSocket pass-through. Disables auth, sets Upgrade/Connection headers, uses extended timeouts. |
 
@@ -264,49 +264,6 @@ acme.sh stores its state under `data/acme/` (the ACME home directory). Key files
 
 The application reads `.account.conf` to determine registration status. If the file is missing or lacks required keys, the account is considered unregistered.
 
-## ACME Configuration
-
-**File**: `config/acme/config.json`
-
-This file stores the ACME account settings used by vacuum-wall for automatic certificate issuance via acme.sh. Account registration is performed exclusively through the WebUI — the Certificates page provides a "Register Account" modal where the user enters an email and selects a CA provider.
-
-```json
-{
-  "email": "",
-  "ca": ""
-}
-```
-
-### ACME Config Fields
-
-| Field | Type | Required | Description |
-|---|---|---|---|
-| `email` | string | No (WebUI) | Contact email for the ACME account, used for certificate expiry notifications and recovery. Populated when the user registers an account via the WebUI. Default: `""`. |
-| `ca` | string | No (defaults to `letsencrypt`) | ACME CA provider. One of: `"letsencrypt"`, `"zerossl"`. Populated during account registration. Default: `""` (acme.sh defaults to Let's Encrypt if omitted). |
-
-### Account Registration Flow
-
-1. User navigates to the Certificates page in the WebUI.
-2. Clicks "Register Account" and provides an email address, optionally selecting a CA provider.
-3. The application calls `acme.sh --register-account -m <email> --server <ca>` as a privileged operation via the daemon.
-4. On success, `config/acme/config.json` is updated with the email and CA. acme.sh writes its own state to `data/acme/.account.conf`.
-5. The `account_registered` check in the certificate validation pipeline transitions from blocking to passing, enabling certificate issuance.
-
-The `account_registered` check is **blocking** — certificate issuance and validation will fail until an ACME account is registered. The `email_configured` check is **non-blocking** — it produces a warning if the email is empty but does not prevent issuance.
-
-### Account Management API
-
-| Endpoint | Method | Description |
-|---|---|---|
-| `/api/certs/account` | `GET` | Returns account status: registered, email, CA provider. |
-| `/api/certs/account/register` | `POST` | Registers a new ACME account. Body: `{ "email": "..." }`. Optional: `{ "server": "letsencrypt" }`. |
-| `/api/certs/account` | `DELETE` | Deactivates the ACME account via `acme.sh --deactivate-account`. Clears email and CA from config. |
-| `/api/certs/email` | `POST` | Updates the contact email on an existing account. Body: `{ "email": "..." }`. |
-
-### ACME Home Directory
-
-acme.sh stores its operational state under `data/acme/`. The application reads `data/acme/.account.conf` to determine whether an account is registered. Required keys: `ACME_LEEMAIL` and `ACME_MCA`. Their absence or the file's absence means the account is unregistered.
-
 ## WireGuard Configuration
 
 **File**: `config/wireguard/config.json`

docs/deployment.md

@@ -114,10 +114,9 @@ The installer performs the following steps automatically:
 - **Dnsmasq initialization**: Starts and enables dnsmasq for future DHCP/DNS serving on internal interfaces.
 - **mDNS broadcast**: Enables and starts avahi-daemon so the appliance advertises its hostname (`<hostname>.local`) on the local network.
 - **Self-signed certificate**: Generates a temporary self-signed X.509 certificate for the management domain with the correct CN and SAN, placed where acme.sh would store a real cert. Skips if a certificate already exists (preserves real ACME certs).
-- **Management proxy configuration**: Configures nginx as a reverse proxy that forward-proxies to the WebUI at `127.0.0.1:9090`, with HTTP-to-HTTPS redirect, basic auth, and WebSocket upgrade support.
+- **Management proxy configuration**: Calls the daemon API (`POST_NGINX_DOMAINS_ADD`) to register the management domain as a regular proxy entry with paths-based config (`/` → Flask, `/ws` → WebSocket). Then applies nginx via `POST_NGINX_APPLY`.
 - **Credentials**: Generates an htpasswd file using `apache2-utils` (with a Python fallback) for the management proxy's basic auth. Updates existing file if already present.
-- **Initial nginx config**: Writes `$PROJECT_DIR/config/nginx/config.json` with the management domain and auth settings pre-configured. Skips if the file already exists (preserves user-customized config).
+- **Initial configs**: Firewall config and nginx proxy config are written via daemon API (skips if already exists).
-- **Initial firewall config**: Writes `$PROJECT_DIR/config/firewall/config.json` with auto-detected WAN/LAN interfaces. Skips if the file already exists.
 - **Systemd units**: Installs four units (rendered from Jinja2 templates):
   - `vacuum-walld.service` — the privileged background daemon (aiohttp, daemon socket).
   - `vacuum-wall.service` — the Flask WebUI backend.
@@ -326,7 +325,7 @@ Verify that:
 
 1. Verify nginx is running: `systemctl status nginx`.
 2. Test nginx configuration: `nginx -t`.
-3. Check the management proxy configuration at `/etc/nginx/conf.d/vacuum-wall-mgmt.conf` (initial) or via the WebUI Proxy tab (after first apply).
+3. Check the management proxy domain configuration via the WebUI Proxy tab, or by inspecting `config/nginx/config.json`.
 4. Ensure the WebUI service is listening on port 9090: `ss -tlnp | grep 9090`.
 5. If using the self-signed cert, confirm your browser trusts it or use the WebUI to issue a real ACME certificate.
 
@@ -338,7 +337,7 @@ Verify that:
 |---|---|---|
 | Daemon (privileged) | `vacuum-walld.service` | `daemon/` |
 | WebUI backend | `vacuum-wall.service` | `webui/` |
-| Reverse proxy | `nginx` | `/etc/nginx/conf.d/vacuum-wall-mgmt.conf` |
+| Reverse proxy | `nginx` | `config/nginx/config.json` (via daemon) |
 | Firewall | `firewalld` | Managed via WebUI and `firewall-cmd` |
 | DHCP/DNS | `dnsmasq` | `config/dnsmasq/` |
 | VPN | wireguard-tools | `config/wireguard/` |

docs/overview.md

@@ -66,7 +66,8 @@ After installation, access the management interface at `https://<hostname>.local
 │   ├── network/             # systemd-networkd per-interface config
 │   ├── firewall/            # Firewall zone & rule config
 │   ├── nginx/               # Proxy domain & SSL config
-│   └── wireguard/           # VPN interface & peer config
+│   ├── wireguard/           # VPN interface & peer config
+│   └── acme/                # ACME account settings (email, CA provider)
 ├── data/                    # Runtime artifacts & generated files
 │   ├── nginx/sites-enabled/ # Generated server blocks
 │   ├── dnsmasq/fragments/   # User config fragments
@@ -97,8 +98,8 @@ After installation, access the management interface at `https://<hostname>.local
 │   ├── dnsmasq.py           # DHCP/DNS configuration
 │   ├── nginx.py             # Reverse proxy configuration
 │   ├── state.py             # State collector (uses lib.network.parse_networkctl_status)
-│   ├── acme.py              # Certificate management
+│   ├── acme.py              # Certificate management (ACME helpers)
-│   └── wireguard.py         # VPN tunnel management
+│   └── wireguard.py         # VPN tunnel and peer management
 ├── webui/                   # Flask web application
 │   ├── server.py            # Application entry point
 │   ├── api/                 # REST API route modules (blueprints)
@@ -123,6 +124,9 @@ After installation, access the management interface at `https://<hostname>.local
 │       │   ├── helpers.js
 │       │   └── components/  # Layout, data display, modal, toast
 │       └── pages/           # Page modules (each defines a route via definePage)
+├── vendor/                  # Vendored scripts and JS libraries
+│   ├── acme.sh              # ACME certificate client
+│   └── htm.js               # JS tagged-template HTML adapter
 ├── docs/                    # Documentation
 │   ├── overview.md          # This file
 │   ├── deployment.md
@@ -132,7 +136,7 @@ After installation, access the management interface at `https://<hostname>.local
 │   ├── config.md
 │   └── hoover.md            # Hoover SPA framework
 └── scripts/                   # Utility scripts
-    └── update-vendor.sh      # Vendor frontend library updates
+    └── update-vendor.sh      # Download acme.sh binary
 ```
 
 ## Documentation

docs/security.md

@@ -7,7 +7,7 @@ Vacuum Wall uses two distinct system users bridged by a shared group (the WebUI
 - **`vacuum-walld`** (daemon user): Runs the `vacuum-walld` background daemon, which is the only process with sudo access. The daemon communicates with the WebUI over a Unix socket at `data/daemon.sock`. All privileged operations — firewall rule changes, nginx reloads, dnsmasq config writes, WireGuard tunnel management — are executed by the daemon through a restricted sudo whitelist at `/etc/sudoers.d/vacuum-walld`.
 - **WebUI user** (default: repo owner in `--dev` mode): Runs the Flask management WebUI. Has **zero** sudo access. If the WebUI process is compromised, an attacker cannot invoke sudo directly — they are confined to the sandboxed Flask process with no privilege escalation path.
 
-ACME certificate operations via `acme.sh` run as the WebUI user — not as root, and not as the daemon user. The automated renewal timer (`vacuum-wall-acme.timer`) runs `acme.sh --cron` as `{{ USER_NAME }}`. When triggered from the WebUI or daemon, acme.sh also runs as the non-root process invoking it, using webroot validation that does not require binding to privileged ports.
+ACME certificate operations via `acme.sh` run as the daemon user — not as root. The automated renewal timer (`vacuum-wall-acme.timer`) runs `acme.sh --cron` as `{{ USER_NAME }}`. When triggered from the WebUI or daemon, acme.sh runs as the daemon process invoking it, using webroot validation that does not require binding to privileged ports.
 
 This design follows the principle of least privilege: only the daemon process holds sudo access, and only for explicitly enumerated commands. The WebUI user is completely isolated from sudo.
 
@@ -24,25 +24,32 @@ The file `/etc/sudoers.d/vacuum-walld` grants the daemon user (`vacuum-walld`) p
 | Firewall | `firewall-cmd *` | All firewalld operations (zone management, rules, services, ports) |
 | Nginx | `nginx -s reload` | Graceful nginx configuration reload |
 | Nginx | `nginx -t` | Nginx configuration syntax validation |
-| Nginx file ops | `cp -- * /etc/nginx/`, `/etc/nginx/conf.d/`, `/etc/nginx/snippets/` | Copy rendered config files to system paths |
+| Nginx file ops | `cp -- * /etc/nginx/*` | Copy rendered config files to system paths |
+| Nginx file ops | `cp -- * /etc/nginx/conf.d/*` | Copy rendered config files to system paths |
+| Nginx file ops | `cp -- * /etc/nginx/snippets/*` | Copy rendered config files to system paths |
 | Nginx file ops | `rm /etc/nginx/conf.d/vacuum-wall.conf`, `/etc/nginx/snippets/vacuum-wall-ssl.conf` | Clean up generated nginx config files |
-| Nginx file ops | `chown root:root /etc/nginx/snippets/vacuum-wall-ssl.conf` | Ensure correct ownership of SSL snippet |
+| Nginx file ops | `chown root:root /etc/nginx/conf.d/vacuum-wall.conf`, `/etc/nginx/snippets/vacuum-wall-ssl.conf` | Ensure correct ownership of nginx config files |
 | Dnsmasq | `systemctl reload dnsmasq` | Apply updated dnsmasq configuration |
 | Dnsmasq | `systemctl is-active dnsmasq` | Check dnsmasq service status |
-| Dnsmasq file ops | `cp -- * /etc/dnsmasq.d/` | Copy rendered config files |
+| Networkd | `systemctl is-active dnsmasq` | Check dnsmasq service status |
 | Dnsmasq file ops | `tee /etc/dnsmasq.d/vacuum-wall.conf` | Write dnsmasq configuration |
 | Dnsmasq file ops | `mkdir -p /etc/dnsmasq.d` | Ensure target directory exists |
+| Dnsmasq file ops | `cp -- * /etc/dnsmasq.d/*` | Copy rendered config files |
 | Dnsmasq leases | `cat /var/lib/dnsmasq/dnsmasq.leases` | Read dnsmasq lease table |
 | WireGuard | `wg-quick *` | WireGuard tunnel lifecycle (up, down, save, show) |
 | WireGuard | `wg *` | WireGuard status and peer management |
-| WireGuard file ops | `cp -- * /etc/wireguard/` | Copy rendered config files |
+| WireGuard file ops | `cp -- * /etc/wireguard/*` | Copy rendered config files |
 | WireGuard file ops | `chown root:root /etc/wireguard/wg0.conf` | Ensure correct ownership of WG config |
-| Certificates | (none) | acme.sh runs as the non-root service user directly; no sudo escalation is needed (webroot validation is used) |
+| Certificates | (none) | acme.sh runs as the non-root daemon user directly; no sudo escalation is needed (webroot validation is used) |
 | Network queries | `ip -o link show` | List network interfaces |
 | Network queries | `ip -o addr show` | List IP addresses on interfaces |
 | Networkd | `networkctl status *` | Query interface status from networkd |
 | Networkd | `networkctl reload *` | Reload networkd for a specific interface |
 | Networkd | `networkctl reload` | Reload networkd for all interfaces |
+| Networkd file ops | `cp -- * /etc/systemd/network/*` | Copy rendered network unit files |
+| Networkd file ops | `rm /etc/systemd/network/*.network` | Remove stale network unit files |
+| Networkd file ops | `mkdir -p /etc/systemd/network` | Ensure target directory exists |
+| Sysctl | `sysctl -w *` | Set kernel parameters |
 | Logs | `journalctl --unit=* -n *` | Query systemd journal for managed services |
 | Logs | `cat /var/log/nginx/*` | Read nginx access and error logs |
 
@@ -77,7 +84,7 @@ Every proxied domain configured in Vacuum Wall enforces:
   - `X-XSS-Protection: 1; mode=block` — Enables browser XSS filtering.
   - `Referrer-Policy: strict-origin-when-cross-origin` — Limits referrer information leakage.
 
-Additional proxy headers (`extra_headers` in the domain config) are delivered to the upstream backend via nginx `proxy_set_header` directives — they are not sent as response headers to clients.
+Additional proxy headers (`headers` in the path-level config) are delivered to the upstream backend via nginx `proxy_set_header` directives — they are not sent as response headers to clients.
 
 ### TLS Configuration