mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
05524f37565014405e383a93c7261b621fa136b6
vacuum-wall/daemon/iface.py
T
mteehan 05524f3756 fix: critical bugs + security hardening 
Phase 1 (critical bugs):
- Fix firewall import string-to-list bug (system_import.py)
- Add rich rules removal in firewall config apply (handlers/firewall.py)

Phase 2 (security hardening):
- Restrict sudo wildcards to specific paths (sudoers.d/vacuum-walld)
- Fix TOCTOU: use /run/vacuum-wall/ for temp files (nginx, dnsmasq, network handlers)
- Remove unnecessary sudo from wg genkey/pubkey (handlers/wireguard.py)

Phase 3 (validation):
- Validate poll intervals > 0 (daemon/server.py)
- Restrict sysctl to whitelisted parameters (handlers/network.py)

Phase 4 (defensive programming):
- Enforce shell=False in run() and run_proc() (lib/common.py)
- Track issuance tasks for graceful shutdown (handlers/acme.py)
- Add nginx template marker consistency tests (tests/test_system_import.py)
2026-07-11 12:21:36 +00:00

163 lines
7.7 KiB
Python
Raw Blame History

"""Shared walld interface definitions.
This module is the **single source of truth** for all daemon API endpoints.
Every endpoint is a frozen tuple of (method, path). Both the server's
registry.register() and the client's request/get/post/patch/delete() accept
an Endpoint in addition to a plain string path, so renaming an endpoint here
automatically updates both sides.
Usage:
# Server (daemon/handlers/)
from daemon.iface import GET_FIREWALL_ZONES
@registry.register(GET_FIREWALL_ZONES)
def get_zones(_request, _body):
...
# Client (webui/api/)
from daemon.iface import GET_FIREWALL_ZONES
from daemon.client import get
data = get(GET_FIREWALL_ZONES)
"""
from __future__ import annotations
Endpoint = tuple[str, str]
PathLike = str | Endpoint
def _ep(method: str, path: str) -> Endpoint:
return (method, path)
# ---- Nginx / Proxy ----
GET_NGINX_CONFIG: Endpoint = _ep("GET", "/nginx/config")
POST_NGINX_CONFIG: Endpoint = _ep("POST", "/nginx/config")
PATCH_NGINX_CONFIG: Endpoint = _ep("PATCH", "/nginx/config")
GET_NGINX_DOMAINS: Endpoint = _ep("GET", "/nginx/domains")
POST_NGINX_DOMAINS_ADD: Endpoint = _ep("POST", "/nginx/domains/add")
DELETE_NGINX_DOMAINS_REMOVE: Endpoint = _ep("DELETE", "/nginx/domains/remove")
POST_NGINX_DOMAINS_UPDATE: Endpoint = _ep("POST", "/nginx/domains/update")
POST_NGINX_APPLY: Endpoint = _ep("POST", "/nginx/apply")
POST_NGINX_TEST: Endpoint = _ep("POST", "/nginx/test")
POST_NGINX_SSL_APPLY: Endpoint = _ep("POST", "/nginx/ssl-apply")
POST_NGINX_RELOAD: Endpoint = _ep("POST", "/nginx/reload")
GET_NGINX_BACKENDS: Endpoint = _ep("GET", "/nginx/backends")
PATCH_NGINX_BACKENDS: Endpoint = _ep("PATCH", "/nginx/backends")
POST_NGINX_BACKENDS_ADD: Endpoint = _ep("POST", "/nginx/backends/add")
DELETE_NGINX_BACKENDS_REMOVE: Endpoint = _ep("DELETE", "/nginx/backends/remove")
# ---- Firewall ----
GET_FIREWALL_INTERFACES: Endpoint = _ep("GET", "/firewall/interfaces")
GET_FIREWALL_ZONES: Endpoint = _ep("GET", "/firewall/zones")
GET_FIREWALL_ZONES_INFO: Endpoint = _ep("GET", "/firewall/zones/info")
GET_FIREWALL_ZONES_ALL: Endpoint = _ep("GET", "/firewall/zones/all")
GET_FIREWALL_SERVICES: Endpoint = _ep("GET", "/firewall/services")
GET_FIREWALL_CONFIG: Endpoint = _ep("GET", "/firewall/config")
POST_FIREWALL_CONFIG: Endpoint = _ep("POST", "/firewall/config")
PATCH_FIREWALL_CONFIG: Endpoint = _ep("PATCH", "/firewall/config")
GET_FIREWALL_CONFIG_PENDING: Endpoint = _ep("GET", "/firewall/config/pending")
POST_FIREWALL_CONFIG_APPLY: Endpoint = _ep("POST", "/firewall/config/apply")
POST_FIREWALL_ZONES_CREATE: Endpoint = _ep("POST", "/firewall/zones/create")
DELETE_FIREWALL_ZONES_DELETE: Endpoint = _ep("DELETE", "/firewall/zones/delete")
POST_FIREWALL_ZONES_INTERFACES: Endpoint = _ep("POST", "/firewall/zones/interfaces")
POST_FIREWALL_ZONES_SERVICES: Endpoint = _ep("POST", "/firewall/zones/services")
POST_FIREWALL_RICH_RULES_ADD: Endpoint = _ep("POST", "/firewall/rich-rules/add")
DELETE_FIREWALL_RICH_RULES_REMOVE: Endpoint = _ep(
"DELETE", "/firewall/rich-rules/remove"
)
GET_FIREWALL_RICH_RULES: Endpoint = _ep("GET", "/firewall/rich-rules")
POST_FIREWALL_MASQUERADE: Endpoint = _ep("POST", "/firewall/masquerade")
POST_FIREWALL_FORWARD_PORT_ADD: Endpoint = _ep("POST", "/firewall/forward-port/add")
DELETE_FIREWALL_FORWARD_PORT_REMOVE: Endpoint = _ep(
"DELETE", "/firewall/forward-port/remove"
)
GET_FIREWALL_STATE: Endpoint = _ep("GET", "/firewall/state")
# ---- WireGuard ----
GET_WIREGUARD_CONFIG: Endpoint = _ep("GET", "/wireguard/config")
POST_WIREGUARD_CONFIG: Endpoint = _ep("POST", "/wireguard/config")
PATCH_WIREGUARD_CONFIG: Endpoint = _ep("PATCH", "/wireguard/config")
POST_WIREGUARD_APPLY: Endpoint = _ep("POST", "/wireguard/apply")
POST_WIREGUARD_DOWN: Endpoint = _ep("POST", "/wireguard/down")
GET_WIREGUARD_STATUS: Endpoint = _ep("GET", "/wireguard/status")
POST_WIREGUARD_INITIALIZE: Endpoint = _ep("POST", "/wireguard/initialize")
POST_WIREGUARD_PEERS_ADD: Endpoint = _ep("POST", "/wireguard/peers/add")
DELETE_WIREGUARD_PEERS_REMOVE: Endpoint = _ep("DELETE", "/wireguard/peers/remove")
GET_WIREGUARD_PEERS: Endpoint = _ep("GET", "/wireguard/peers")
GET_WIREGUARD_PEER_STATUS: Endpoint = _ep("GET", "/wireguard/peer-status")
POST_WIREGUARD_GENERATE_CLIENT: Endpoint = _ep("POST", "/wireguard/generate-client")
# ---- ACME / Certs ----
GET_ACME_LIST: Endpoint = _ep("GET", "/acme/list")
GET_ACME_INFO: Endpoint = _ep("GET", "/acme/info")
POST_ACME_VALIDATE: Endpoint = _ep("POST", "/acme/validate")
POST_ACME_ISSUE: Endpoint = _ep("POST", "/acme/issue")
GET_ACME_ISSUE_STATUS: Endpoint = _ep("GET", "/acme/issue/status")
POST_ACME_RENEW: Endpoint = _ep("POST", "/acme/renew")
DELETE_ACME_REMOVE: Endpoint = _ep("DELETE", "/acme/remove")
POST_ACME_EMAIL: Endpoint = _ep("POST", "/acme/email")
GET_ACME_EMAIL: Endpoint = _ep("GET", "/acme/email")
GET_ACME_PATHS: Endpoint = _ep("GET", "/acme/paths")
POST_ACME_SELF_SIGNED: Endpoint = _ep("POST", "/acme/self-signed")
GET_ACME_ACCOUNT: Endpoint = _ep("GET", "/acme/account")
POST_ACME_ACCOUNT_REGISTER: Endpoint = _ep("POST", "/acme/account/register")
DELETE_ACME_ACCOUNT_DEACTIVATE: Endpoint = _ep("DELETE", "/acme/account/deactivate")
# ---- Dnsmasq / DHCP ----
GET_DNSMASQ_CONFIG: Endpoint = _ep("GET", "/dnsmasq/config")
POST_DNSMASQ_CONFIG: Endpoint = _ep("POST", "/dnsmasq/config")
PATCH_DNSMASQ_CONFIG: Endpoint = _ep("PATCH", "/dnsmasq/config")
POST_DNSMASQ_APPLY: Endpoint = _ep("POST", "/dnsmasq/apply")
GET_DNSMASQ_STATUS: Endpoint = _ep("GET", "/dnsmasq/status")
POST_DNSMASQ_RANGES_ADD: Endpoint = _ep("POST", "/dnsmasq/ranges/add")
DELETE_DNSMASQ_RANGES_REMOVE: Endpoint = _ep("DELETE", "/dnsmasq/ranges/remove")
GET_DNSMASQ_LEASES: Endpoint = _ep("GET", "/dnsmasq/leases")
POST_DNSMASQ_STATIC_LEASE_ADD: Endpoint = _ep("POST", "/dnsmasq/static-lease/add")
DELETE_DNSMASQ_STATIC_LEASE_REMOVE: Endpoint = _ep(
"DELETE", "/dnsmasq/static-lease/remove"
)
POST_DNSMASQ_DNS_RECORD_ADD: Endpoint = _ep("POST", "/dnsmasq/dns-record/add")
DELETE_DNSMASQ_DNS_RECORD_REMOVE: Endpoint = _ep("DELETE", "/dnsmasq/dns-record/remove")
POST_DNSMASQ_UPSTREAMS: Endpoint = _ep("POST", "/dnsmasq/upstreams")
POST_DNSMASQ_DOMAIN: Endpoint = _ep("POST", "/dnsmasq/domain")
# ---- Network ----
GET_NETWORK_INTERFACES: Endpoint = _ep("GET", "/network/interfaces")
GET_NETWORK_INTERFACE_NAME: Endpoint = _ep("GET", "/network/interfaces/<name>")
POST_NETWORK_INTERFACE_NAME: Endpoint = _ep("POST", "/network/interfaces/<name>")
POST_NETWORK_INTERFACE_RELOAD: Endpoint = _ep(
"POST", "/network/interfaces/<name>/reload"
)
POST_NETWORK_APPLY: Endpoint = _ep("POST", "/network/apply")
GET_NETWORK_INFER_DHCP_RANGES: Endpoint = _ep("GET", "/network/infer-dhcp-ranges")
GET_NETWORK_INFER_ZONES: Endpoint = _ep("GET", "/network/infer-zones")
POST_NETWORK_SYSCTL_SET: Endpoint = _ep("POST", "/network/sysctl/set")
# ---- Logs ----
GET_LOGS_JOURNAL: Endpoint = _ep("GET", "/logs/journal")
GET_LOGS_NGINX_ACCESS: Endpoint = _ep("GET", "/logs/nginx/access")
GET_LOGS_NGINX_ERROR: Endpoint = _ep("GET", "/logs/nginx/error")
GET_LOGS_DNSMASQ: Endpoint = _ep("GET", "/logs/dnsmasq")
GET_LOGS_APP: Endpoint = _ep("GET", "/logs/app")
# ---- Server infra (not going through client) ----
GET_HEALTH: Endpoint = _ep("GET", "/health")
GET_STATUS_ALL: Endpoint = _ep("GET", "/status/all")
POST_STATUS_REFRESH: Endpoint = _ep("POST", "/status/refresh")
GET_WS: Endpoint = _ep("GET", "/ws")
POST_BATCH: Endpoint = _ep("POST", "/batch")
GET_STATUS_PENDING: Endpoint = _ep("GET", "/status/pending")
POST_STATUS_APPLY_ALL: Endpoint = _ep("POST", "/status/apply-all")
# Collect all endpoint module-level constants for __all__ verification
_all_endpoints = [
name
for name, val in globals().items()
if isinstance(val, tuple) and len(val) == 2 and all(isinstance(x, str) for x in val)
]
__all__ = ["Endpoint", "PathLike", *sorted(_all_endpoints)]
Reference in New Issue View Git Blame Copy Permalink