Initial commit: SSL proxy / firewall appliance

Flask WebUI behind nginx reverse proxy with zone-based firewall, DHCP,
WireGuard, and ACME certificate management.

system/wireguard-client.conf

@@ -0,0 +1,16 @@
+# vacuum-wall client config for {{ peer_name }} — generated {{ timestamp }}
+
+[Interface]
+  PrivateKey = {{ client_priv }}
+  Address = {{ client_addr }}
+
+[Peer]
+  PublicKey = {{ server_pubkey }}
+  Endpoint = {{ server_endpoint }}
+  AllowedIPs = {{ allowed_ips | join(',') }}
+{% if preshared_key %}
+  PresharedKey = {{ preshared_key }}
+{% endif %}
+{% if persistent_keepalive is not none %}
+  PersistentKeepalive = {{ persistent_keepalive }}
+{% endif %}