mteehan
bc72db903c
Phase 1-4: Networkd subsystem - lib/network.py: systemd-networkd config renderer (.network INI files) with full schema support: [Match], [Link], [Network], [Address], [Route], [DHCPv4], [DHCPv6] sections. One Address/=DNS= line per value per spec. Route sections use #N suffix per systemd.syntax(7). - lib/network.py: generate_network_files() with 50-<name>.network prefix and stale file cleanup - lib/network.py: collect_upstream_dns() filters local/private DNS - lib/network.py: infer_dhcp_ranges() and infer_zones() helpers - daemon/handlers/network.py: routes for GET/POST /network/interfaces and full apply with DNS upstream sync to dnsmasq - webui/api/network.py: Flask blueprint for /api/network/* endpoints - webui/api: interfaces page updated with IP config inline editing - lib/state.py: networkd collector using parse_networkctl_status() - system/sudoers.d/vacuum-walld: networkctl + systemd-network rules - system/systemd/vacuum-walld.service: ReadWritePaths for /etc/systemd/network - install.sh: ACME email now optional, configured from WebUI - lib/acme.py: get_email() falls back to declarative config Phase 5: Code review fixes - daemon/server.py: path params now win over JSON body and query params in request body merge (prevents config save name override) - daemon/server.py: remove dead 'import re' - daemon/handlers/network.py: replace Path.mkdir() with sudo mkdir for /etc/systemd/network (ProtectSystem=strict compatibility) - system/sudoers.d/vacuum-walld: pin systemctl to specific commands (reload/is-active dnsmasq instead of wildcard) - system/sudoers.d/vacuum-walld: restore !requiretty and section comment - lib/network.py: remove unused _MANAGEMENT_PORTS constant - webui/api/network.py: remove redundant body[\name\] = name in save_interface Tests: 332 passing (110 new/updated), ruff clean
43 lines
1.0 KiB
Desktop File
43 lines
1.0 KiB
Desktop File
[Unit]
|
|
Description=Vacuum Wall Daemon (privileged backend)
|
|
Documentation=https://github.com/wall/vacuum-wall
|
|
After=network.target firewalld.service
|
|
Wants=firewalld.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User={{ USER_DAEMON_NAME }}
|
|
Group={{ USER_GROUP }}
|
|
WorkingDirectory={{ PROJECT_DIR }}
|
|
ExecStart={{ PROJECT_DIR }}/.venv/bin/python -m daemon
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
Environment=PATH=/usr/local/bin:/usr/bin
|
|
Environment=PYTHONUNBUFFERED=1
|
|
Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
|
|
Environment=HOME={{ PROJECT_DIR }}
|
|
|
|
# Security hardening
|
|
ProtectSystem=strict
|
|
ReadWritePaths={{ PROJECT_DIR }} /tmp /etc/systemd/network
|
|
PrivateTmp=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHostname=yes
|
|
RestrictSUIDSGID=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
LockPersonality=yes
|
|
SystemCallFilter=@system-service
|
|
PrivateDevices=yes
|
|
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
IPAddressDeny=any
|
|
IPAddressAllow=localhost
|
|
NoNewPrivileges=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|