Initial commit: SSL proxy / firewall appliance

Flask WebUI behind nginx reverse proxy with zone-based firewall, DHCP,
WireGuard, and ACME certificate management.

system/systemd/vacuum-wall.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=Vacuum Wall Management WebUI
+Documentation=https://github.com/wall/vacuum-wall
+After=network.target firewalld.service nginx.service dnsmasq.service
+Wants=firewalld.service
+
+[Service]
+Type=simple
+User=vacuum-wall
+Group=vacuum-wall
+WorkingDirectory=/home/wall/vacuum-wall
+ExecStart=/home/wall/vacuum-wall/.venv/bin/python webui/server.py
+Restart=on-failure
+RestartSec=5
+Environment=PATH=/usr/local/bin:/usr/bin
+Environment=PYTHONUNBUFFERED=1
+
+# Security hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/home/wall/vacuum-wall/data /tmp
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+LockPersonality=yes
+
+# Network - only loopback (nginx proxies to us)
+IPAddressDeny=all
+IPAddressAllow=localhost
+
+[Install]
+WantedBy=multi-user.target