Initial commit: SSL proxy / firewall appliance

Flask WebUI behind nginx reverse proxy with zone-based firewall, DHCP, WireGuard, and ACME certificate management.
2026-05-07 22:24:24 +00:00
commit e2f56b8cc8
56 changed files with 10013 additions and 0 deletions
@@ -0,0 +1,8 @@
+[Unit]
+Description=Vacuum Wall ACME Certificate Renewal
+
+[Service]
+Type=oneshot
+User=vacuum-wall
+WorkingDirectory=/home/wall/vacuum-wall
+ExecStart=/usr/local/bin/acme.sh --cron --home /home/vacuum-wall/.acme.sh
@@ -0,0 +1,11 @@
+[Unit]
+Description=Vacuum Wall ACME Certificate Renewal Timer
+
+[Timer]
+OnCalendar=*-*-* 00:00:00
+OnCalendar=*-*-* 12:00:00
+Persistent=true
+RandomizedDelaySec=300
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,36 @@
+[Unit]
+Description=Vacuum Wall Management WebUI
+Documentation=https://github.com/wall/vacuum-wall
+After=network.target firewalld.service nginx.service dnsmasq.service
+Wants=firewalld.service
+
+[Service]
+Type=simple
+User=vacuum-wall
+Group=vacuum-wall
+WorkingDirectory=/home/wall/vacuum-wall
+ExecStart=/home/wall/vacuum-wall/.venv/bin/python webui/server.py
+Restart=on-failure
+RestartSec=5
+Environment=PATH=/usr/local/bin:/usr/bin
+Environment=PYTHONUNBUFFERED=1
+
+# Security hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/home/wall/vacuum-wall/data /tmp
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+LockPersonality=yes
+
+# Network - only loopback (nginx proxies to us)
+IPAddressDeny=all
+IPAddressAllow=localhost
+
+[Install]
+WantedBy=multi-user.target