Initial commit: SSL proxy / firewall appliance

Flask WebUI behind nginx reverse proxy with zone-based firewall, DHCP,
WireGuard, and ACME certificate management.

system/dnsmasq.conf

@@ -0,0 +1,47 @@
+# ---- vacuum-wall managed dnsmasq configuration ----
+# generated {{ timestamp }}
+
+{% if interfaces %}
+interface={{ interfaces | join(',') }}
+bind-interfaces
+{% endif %}
+{% for srv in dns.upstreams %}
+server={{ srv }}
+{% else %}
+no-resolv
+{% endfor %}
+{% if dns.domain %}
+domain={{ dns.domain }}
+expand-hosts
+{% endif %}
+{% for rng in dhcp.ranges %}
+{% if rng.interface %}
+dhcp-range=set:{{ rng.interface }},{{ rng.start }},{{ rng.end }},{{ rng.lease_time }}
+{% else %}
+dhcp-range={{ rng.start }},{{ rng.end }},{{ rng.lease_time }}
+{% endif %}
+{% if rng.gateway %}
+dhcp-option=tag:{{ rng.interface }},3,{{ rng.gateway }}
+{% endif %}
+{% if rng.dns %}
+dhcp-option=tag:{{ rng.interface }},6,{{ rng.dns }}
+{% endif %}
+{% endfor %}
+{% for lease in dhcp.static_leases %}
+{% if lease.hostname %}
+dhcp-host={{ lease.mac }},{{ lease.ip }},{{ lease.hostname }}
+{% else %}
+dhcp-host={{ lease.mac }},{{ lease.ip }}
+{% endif %}
+{% endfor %}
+{% for rec in dns.custom_records %}
+{% if rec.hostname %}
+host-record={{ rec.name }},{{ rec.address }}
+addr/{{ rec.name }}/{{ rec.address }}
+{% else %}
+addr/{{ rec.name }}/{{ rec.address }}
+{% endif %}
+{% endfor %}
+{% if fragments_dir %}
+conf-dir={{ fragments_dir }},optional
+{% endif %}# ---- end vacuum-wall config ----