Initial commit: SSL proxy / firewall appliance

Flask WebUI behind nginx reverse proxy with zone-based firewall, DHCP, WireGuard, and ACME certificate management.
2026-05-07 22:24:24 +00:00
commit e2f56b8cc8
56 changed files with 10013 additions and 0 deletions
@@ -0,0 +1,99 @@
+# Auto-generated by Vacuum Wall — do not edit manually
+# Domain: {{ domain }}
+
+{% if force_ssl %}
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ domain }};
+
+    # Redirect all HTTP traffic to HTTPS
+    return 301 https://$host$request_uri;
+}
+
+{% endif %}
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ domain }};
+
+{% if cert %}
+{% if cert.type == "acme" %}
+    # Certificate managed by acme.sh
+{% if cert.email %}    # ACME contact: {{ cert.email }}
+{% endif %}    ssl_certificate     /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+
+{% elif cert.type == "file" %}
+    ssl_certificate     {{ cert.path }};
+    ssl_certificate_key {{ cert.key_path }};
+
+{% elif cert.type == "selfsigned" %}
+    ssl_certificate     /home/wall/vacuum-wall/data/certs/{{ domain }}.crt;
+    ssl_certificate_key /home/wall/vacuum-wall/data/certs/{{ domain }}.key;
+
+{% endif %}
+{% elif is_management %}
+    ssl_certificate     /home/wall/vacuum-wall/data/certs/{{ domain }}.crt;
+    ssl_certificate_key /home/wall/vacuum-wall/data/certs/{{ domain }}.key;
+
+{% endif %}
+    # Shared SSL settings
+    include snippets/vacuum-wall-ssl.conf;
+
+{% if auth %}
+    # HTTP basic authentication
+    auth_basic           "{{ "Vacuum Wall" if is_management else "Restricted" }}";
+    auth_basic_user_file {{ auth.htpasswd }};
+
+{% endif %}
+{% if not is_management %}
+    # Security hardening headers
+    add_header X-Content-Type-Options    nosniff                         always;
+    add_header X-Frame-Options           DENY                            always;
+    add_header X-XSS-Protection          "1; mode=block"                 always;
+    add_header Referrer-Policy           "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # Proxy headers
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+{% for hname, hval in headers.items() %}
+    proxy_set_header {{ hname }} {{ hval }};
+{% endfor %}
+{% endif %}
+    # Proxy pass to backend
+    proxy_pass {{ backend.proto }}://{{ backend.host }}:{{ backend.port }};
+    proxy_http_version 1.1;
+
+{% if not is_management %}
+    # Timeouts
+    proxy_connect_timeout 30s;
+    proxy_send_timeout    60s;
+    proxy_read_timeout    60s;
+    proxy_buffering       off;
+
+    # Access / error logs
+    access_log /var/log/nginx/{{ domain }}_access.log;
+    error_log  /var/log/nginx/{{ domain }}_error.log  warn;
+{% else %}
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    proxy_connect_timeout 30s;
+    proxy_send_timeout    60s;
+    proxy_read_timeout    60s;
+    proxy_buffering       off;
+
+    access_log /var/log/nginx/wall_mgmt_access.log;
+    error_log  /var/log/nginx/wall_mgmt_error.log  warn;
+{% endif %}
+    location / {
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}