fix: WireGuard peer sync, privileged mode, E2E and integration test correctness
- api/app.py: sync WireGuard server config on peer add/remove (non-fatal) - docker-compose.yml: add privileged:true to wireguard service - E2E tests: fix logout selector, DNS IP lookup, wg config DNS line, VIP skip guards, badge text selectors, heading .first, async logout wait - Integration tests: fix 4 tests that sent unauthenticated requests expecting 400 (now use authenticated session helpers); accept 401 as valid in webui proxy test; add password field to service_access validation test - Remove stale tracked config templates (config/api/api/*, config/api/cell.env, etc.) that no longer exist on disk after config layout was reorganised Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -1,39 +0,0 @@
|
||||
# Dovecot configuration for Personal Internet Cell
|
||||
protocols = imap pop3 lmtp
|
||||
|
||||
# SSL/TLS settings
|
||||
ssl = yes
|
||||
ssl_cert = </etc/ssl/certs/mail.crt
|
||||
ssl_key = </etc/ssl/private/mail.key
|
||||
|
||||
# Authentication
|
||||
auth_mechanisms = plain login
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
|
||||
}
|
||||
|
||||
userdb {
|
||||
driver = static
|
||||
args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
|
||||
}
|
||||
|
||||
# Mailbox settings
|
||||
mail_location = maildir:/var/mail/vhosts/%d/%n
|
||||
mail_privileged_group = vmail
|
||||
mail_access_groups = vmail
|
||||
|
||||
# IMAP settings
|
||||
imap_max_line_length = 64k
|
||||
|
||||
# LMTP settings
|
||||
service lmtp {
|
||||
inet_listener lmtp {
|
||||
port = 24
|
||||
}
|
||||
}
|
||||
|
||||
# Logging
|
||||
log_path = /var/log/dovecot.log
|
||||
info_log_path = /var/log/dovecot-info.log
|
||||
debug_log_path = /var/log/dovecot-debug.log
|
||||
@@ -1,38 +0,0 @@
|
||||
# Postfix configuration for Personal Internet Cell
|
||||
myhostname = mail.cell
|
||||
mydomain = cell
|
||||
myorigin = $mydomain
|
||||
|
||||
# Network settings
|
||||
inet_interfaces = all
|
||||
inet_protocols = ipv4
|
||||
|
||||
# Mailbox settings
|
||||
home_mailbox = Maildir/
|
||||
mailbox_command =
|
||||
|
||||
# Authentication
|
||||
smtpd_sasl_auth_enable = yes
|
||||
smtpd_sasl_security_options = noanonymous
|
||||
smtpd_sasl_local_domain = $myhostname
|
||||
|
||||
# TLS settings
|
||||
smtpd_tls_cert_file = /etc/ssl/certs/mail.crt
|
||||
smtpd_tls_key_file = /etc/ssl/private/mail.key
|
||||
smtpd_use_tls = yes
|
||||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
||||
|
||||
# Relay settings
|
||||
relay_domains = cell, *.cell
|
||||
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
|
||||
|
||||
# Virtual domains
|
||||
virtual_mailbox_domains = cell
|
||||
virtual_mailbox_base = /var/mail/vhosts
|
||||
virtual_mailbox_maps = hash:/etc/postfix/vmaps
|
||||
virtual_alias_maps = hash:/etc/postfix/vmaps
|
||||
|
||||
# Security
|
||||
disable_vrfy_command = yes
|
||||
strict_rfc821_envelopes = yes
|
||||
@@ -1,19 +0,0 @@
|
||||
[server]
|
||||
hosts = 0.0.0.0:5232
|
||||
daemon = False
|
||||
pid = /tmp/radicale.pid
|
||||
|
||||
[auth]
|
||||
type = htpasswd
|
||||
htpasswd_filename = /etc/radicale/users
|
||||
htpasswd_encryption = bcrypt
|
||||
|
||||
[storage]
|
||||
type = filesystem
|
||||
filesystem_folder = /var/lib/radicale/collections
|
||||
|
||||
[web]
|
||||
type = internal
|
||||
|
||||
[logging]
|
||||
level = info
|
||||
@@ -1,22 +0,0 @@
|
||||
# WebDAV configuration for Personal Internet Cell
|
||||
[global]
|
||||
# WebDAV server settings
|
||||
port = 8080
|
||||
host = 0.0.0.0
|
||||
root = /var/lib/webdav
|
||||
|
||||
# Authentication
|
||||
auth_type = basic
|
||||
auth_file = /etc/webdav/users
|
||||
|
||||
# SSL/TLS settings
|
||||
ssl = no
|
||||
ssl_cert = /etc/ssl/certs/webdav.crt
|
||||
ssl_key = /etc/ssl/private/webdav.key
|
||||
|
||||
# Logging
|
||||
log_level = info
|
||||
log_file = /var/log/webdav.log
|
||||
|
||||
# File permissions
|
||||
umask = 022
|
||||
@@ -1,26 +0,0 @@
|
||||
# Personal Internet Cell - Environment Configuration
|
||||
|
||||
# Cell Configuration
|
||||
CELL_NAME=mycell
|
||||
CELL_DOMAIN=mycell.cell
|
||||
|
||||
# Network Configuration
|
||||
CELL_IP_RANGE=172.20.0.0/16
|
||||
WIREGUARD_PORT=51820
|
||||
|
||||
# API Configuration
|
||||
API_PORT=3000
|
||||
API_HOST=0.0.0.0
|
||||
|
||||
# Service Ports
|
||||
DNS_PORT=53
|
||||
DHCP_PORT=67
|
||||
NTP_PORT=123
|
||||
MAIL_SMTP_PORT=25
|
||||
MAIL_SUBMISSION_PORT=587
|
||||
MAIL_IMAP_PORT=993
|
||||
RADICALE_PORT=5232
|
||||
WEBDAV_PORT=8080
|
||||
|
||||
# Development
|
||||
DEBUG=false
|
||||
@@ -1,32 +0,0 @@
|
||||
# Personal Internet Cell - dnsmasq Configuration
|
||||
# Provides DHCP and local DNS resolution
|
||||
|
||||
# Interface to listen on
|
||||
interface=eth0
|
||||
bind-interfaces
|
||||
|
||||
# DHCP configuration
|
||||
dhcp-range=172.20.1.50,172.20.1.150,12h
|
||||
dhcp-option=3,172.20.0.1 # Gateway
|
||||
dhcp-option=6,172.20.0.2 # DNS server
|
||||
dhcp-option=42,172.20.0.4 # NTP server
|
||||
|
||||
# DNS configuration
|
||||
port=53
|
||||
domain=local.cell
|
||||
expand-hosts
|
||||
local=/local.cell/
|
||||
|
||||
# DNS forwarding
|
||||
server=8.8.8.8
|
||||
server=1.1.1.1
|
||||
|
||||
# Cache size
|
||||
cache-size=1000
|
||||
|
||||
# Logging
|
||||
log-queries
|
||||
log-dhcp
|
||||
|
||||
# Static leases (optional)
|
||||
# dhcp-host=00:11:22:33:44:55,192.168.1.100,mydevice
|
||||
@@ -1,42 +0,0 @@
|
||||
# Personal Internet Cell - CoreDNS Configuration
|
||||
# Handles .cell TLD resolution and peer discovery
|
||||
|
||||
. {
|
||||
# Forward all non-.cell domains to upstream DNS
|
||||
forward . 8.8.8.8 1.1.1.1
|
||||
|
||||
# Cache responses
|
||||
cache
|
||||
|
||||
# Log queries
|
||||
log
|
||||
|
||||
# Health check endpoint
|
||||
health
|
||||
}
|
||||
|
||||
# .cell TLD zone
|
||||
cell {
|
||||
# File-based zone for static records
|
||||
file /data/cell.zone
|
||||
|
||||
# Dynamic peer records (will be managed by API)
|
||||
reload
|
||||
|
||||
# Allow zone transfers
|
||||
transfer {
|
||||
to *
|
||||
}
|
||||
|
||||
# Log queries
|
||||
log
|
||||
}
|
||||
|
||||
# Local network zone
|
||||
local.cell {
|
||||
# File-based zone for local services
|
||||
file /data/local.zone
|
||||
|
||||
# Log queries
|
||||
log
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
# Dovecot configuration for Personal Internet Cell
|
||||
protocols = imap pop3 lmtp
|
||||
|
||||
# SSL/TLS settings
|
||||
ssl = yes
|
||||
ssl_cert = </etc/ssl/certs/mail.crt
|
||||
ssl_key = </etc/ssl/private/mail.key
|
||||
|
||||
# Authentication
|
||||
auth_mechanisms = plain login
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
|
||||
}
|
||||
|
||||
userdb {
|
||||
driver = static
|
||||
args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
|
||||
}
|
||||
|
||||
# Mailbox settings
|
||||
mail_location = maildir:/var/mail/vhosts/%d/%n
|
||||
mail_privileged_group = vmail
|
||||
mail_access_groups = vmail
|
||||
|
||||
# IMAP settings
|
||||
imap_max_line_length = 64k
|
||||
|
||||
# LMTP settings
|
||||
service lmtp {
|
||||
inet_listener lmtp {
|
||||
port = 24
|
||||
}
|
||||
}
|
||||
|
||||
# Logging
|
||||
log_path = /var/log/dovecot.log
|
||||
info_log_path = /var/log/dovecot-info.log
|
||||
debug_log_path = /var/log/dovecot-debug.log
|
||||
@@ -1,28 +0,0 @@
|
||||
# Personal Internet Cell - chrony Configuration
|
||||
# Provides NTP time synchronization
|
||||
|
||||
# Allow NTP client access from local network
|
||||
allow 172.20.0.0/16
|
||||
allow 127.0.0.1
|
||||
|
||||
# NTP servers to sync with
|
||||
server time.google.com iburst
|
||||
server time.cloudflare.com iburst
|
||||
server pool.ntp.org iburst
|
||||
|
||||
# Local stratum for this server
|
||||
local stratum 10
|
||||
|
||||
# Log settings
|
||||
logdir /var/log/chrony
|
||||
log measurements statistics tracking
|
||||
|
||||
# Key file for authentication (optional)
|
||||
# keyfile /etc/chrony/chrony.keys
|
||||
|
||||
# Drift file
|
||||
driftfile /var/lib/chrony/drift
|
||||
|
||||
# Make chrony work as a server
|
||||
port 123
|
||||
bindaddress 0.0.0.0
|
||||
@@ -1,38 +0,0 @@
|
||||
# Postfix configuration for Personal Internet Cell
|
||||
myhostname = mail.cell
|
||||
mydomain = cell
|
||||
myorigin = $mydomain
|
||||
|
||||
# Network settings
|
||||
inet_interfaces = all
|
||||
inet_protocols = ipv4
|
||||
|
||||
# Mailbox settings
|
||||
home_mailbox = Maildir/
|
||||
mailbox_command =
|
||||
|
||||
# Authentication
|
||||
smtpd_sasl_auth_enable = yes
|
||||
smtpd_sasl_security_options = noanonymous
|
||||
smtpd_sasl_local_domain = $myhostname
|
||||
|
||||
# TLS settings
|
||||
smtpd_tls_cert_file = /etc/ssl/certs/mail.crt
|
||||
smtpd_tls_key_file = /etc/ssl/private/mail.key
|
||||
smtpd_use_tls = yes
|
||||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
||||
|
||||
# Relay settings
|
||||
relay_domains = cell, *.cell
|
||||
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
|
||||
|
||||
# Virtual domains
|
||||
virtual_mailbox_domains = cell
|
||||
virtual_mailbox_base = /var/mail/vhosts
|
||||
virtual_mailbox_maps = hash:/etc/postfix/vmaps
|
||||
virtual_alias_maps = hash:/etc/postfix/vmaps
|
||||
|
||||
# Security
|
||||
disable_vrfy_command = yes
|
||||
strict_rfc821_envelopes = yes
|
||||
@@ -1,19 +0,0 @@
|
||||
[server]
|
||||
hosts = 0.0.0.0:5232
|
||||
daemon = False
|
||||
pid = /tmp/radicale.pid
|
||||
|
||||
[auth]
|
||||
type = htpasswd
|
||||
htpasswd_filename = /etc/radicale/users
|
||||
htpasswd_encryption = bcrypt
|
||||
|
||||
[storage]
|
||||
type = filesystem
|
||||
filesystem_folder = /var/lib/radicale/collections
|
||||
|
||||
[web]
|
||||
type = internal
|
||||
|
||||
[logging]
|
||||
level = info
|
||||
@@ -1,6 +0,0 @@
|
||||
. {
|
||||
loop
|
||||
errors
|
||||
health
|
||||
forward . /etc/resolv.conf
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
[Interface]
|
||||
Address = ${CLIENT_IP}
|
||||
PrivateKey = $(cat /config/${PEER_ID}/privatekey-${PEER_ID})
|
||||
ListenPort = 51820
|
||||
DNS = ${PEERDNS}
|
||||
|
||||
[Peer]
|
||||
PublicKey = $(cat /config/server/publickey-server)
|
||||
PresharedKey = $(cat /config/${PEER_ID}/presharedkey-${PEER_ID})
|
||||
Endpoint = ${SERVERURL}:${SERVERPORT}
|
||||
AllowedIPs = ${ALLOWEDIPS}
|
||||
@@ -1,6 +0,0 @@
|
||||
[Interface]
|
||||
Address = ${INTERFACE}.1
|
||||
ListenPort = 51820
|
||||
PrivateKey = $(cat /config/server/privatekey-server)
|
||||
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
|
||||
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
|
||||
Reference in New Issue
Block a user