Initial commit: SSL proxy / firewall appliance

Flask WebUI behind nginx reverse proxy with zone-based firewall, DHCP, WireGuard, and ACME certificate management.
2026-05-07 22:24:24 +00:00
commit e2f56b8cc8
56 changed files with 10013 additions and 0 deletions
@@ -0,0 +1,37 @@
+# Defaults directives
+Defaults:vacuum-wall !requiretty
+Defaults:vacuum-wall secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+# Firewall management
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/firewall-cmd *
+
+# Nginx management
+vacuum-wall ALL=(root) NOPASSWD: /usr/sbin/nginx -s reload
+vacuum-wall ALL=(root) NOPASSWD: /usr/sbin/nginx -t
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/nginx/
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/nginx/conf.d/
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/nginx/snippets/
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/rm /etc/nginx/conf.d/vacuum-wall.conf
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/rm /etc/nginx/snippets/vacuum-wall-ssl.conf
+
+# Dnsmasq management
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/systemctl reload dnsmasq
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/systemctl is-active dnsmasq
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/dnsmasq.d/
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cat /var/lib/dnsmasq/dnsmasq.leases
+
+# WireGuard management
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/wg-quick *
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/wg *
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cp -- * /etc/wireguard/
+
+# Acme.sh (SSL cert management)
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/bash ~/.acme.sh/acme.sh *
+vacuum-wall ALL=(root) NOPASSWD: /usr/local/bin/acme.sh *
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cat /home/*/.acme.sh/*
+
+# Misc
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/journalctl --unit=* -n *
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/cat /var/log/nginx/*
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/mkdir -p /etc/dnsmasq.d
+vacuum-wall ALL=(root) NOPASSWD: /usr/bin/mkdir -p /etc/wireguard