feat(wg): clusev-wg-request watcher (path+service) + install wiring

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/wg/clusev-wg-request.path

@@ -0,0 +1,13 @@
+# Watches for a dashboard WireGuard write-request and fires the handler the moment it appears. The
+# handler consumes the request, so a re-arm cannot double-run it. install.sh rewrites the path.
+[Unit]
+Description=Clusev WireGuard write-request — watch for a dashboard request
+After=docker.service
+Wants=docker.service
+
+[Path]
+PathExists=/home/nexxo/clusev/run/wg-request.json
+Unit=clusev-wg-request.service
+
+[Install]
+WantedBy=multi-user.target

docker/wg/clusev-wg-request.service

@@ -0,0 +1,14 @@
+# Clusev WireGuard write-request handler — oneshot (HOST-side). Triggered by clusev-wg-request.path
+# when the dashboard writes run/wg-request.json. Runs `clusev-wg.sh serve-request`, which consumes
+# the request, whitelists the action + re-validates args, runs the fixed command, and writes a
+# result file the app reads once. install.sh rewrites the /home/nexxo/clusev paths.
+[Unit]
+Description=Clusev WireGuard write-request handler
+After=docker.service
+
+[Service]
+Type=oneshot
+User=root
+Environment=CLUSEV_DIR=/home/nexxo/clusev
+WorkingDirectory=/home/nexxo/clusev
+ExecStart=/home/nexxo/clusev/docker/wg/clusev-wg.sh serve-request

install.sh

@@ -289,6 +289,7 @@ install_host_watchers() {
   tmp_path="$(mktemp)"; tmp_svc="$(mktemp)"; tmp_upath="$(mktemp)"; tmp_usvc="$(mktemp)"
   local tmp_gate; tmp_gate="$(mktemp)"
   local tmp_csvc tmp_ctimer; tmp_csvc="$(mktemp)"; tmp_ctimer="$(mktemp)"
+  local tmp_rsvc tmp_rpath; tmp_rsvc="$(mktemp)"; tmp_rpath="$(mktemp)"
   # Restart units run as the clusev user.
   sed "s#/home/nexxo/clusev#${proj}#g" "${src}/clusev-restart.path" > "$tmp_path"
   sed -e "s#/home/nexxo/clusev#${proj}#g" -e "s/^User=.*/User=clusev/" "${src}/clusev-restart.service" > "$tmp_svc"
@@ -299,6 +300,8 @@ install_host_watchers() {
   sed "s#/home/nexxo/clusev#${proj}#g" "docker/wg/clusev-wg-gate.service" > "$tmp_gate"
   sed "s#/home/nexxo/clusev#${proj}#g" "docker/wg/clusev-wg-collect.service" > "$tmp_csvc"
   sed "s#/home/nexxo/clusev#${proj}#g" "docker/wg/clusev-wg-collect.timer"   > "$tmp_ctimer"
+  sed "s#/home/nexxo/clusev#${proj}#g" "docker/wg/clusev-wg-request.service" > "$tmp_rsvc"
+  sed "s#/home/nexxo/clusev#${proj}#g" "docker/wg/clusev-wg-request.path"    > "$tmp_rpath"
   if install -m 0644 "$tmp_path" "${dst}/clusev-restart.path" \
      && install -m 0644 "$tmp_svc" "${dst}/clusev-restart.service" \
      && install -m 0644 "$tmp_upath" "${dst}/clusev-update.path" \
@@ -306,16 +309,19 @@ install_host_watchers() {
      && install -m 0644 "$tmp_gate" "${dst}/clusev-wg-gate.service" \
      && install -m 0644 "$tmp_csvc"   "${dst}/clusev-wg-collect.service" \
      && install -m 0644 "$tmp_ctimer" "${dst}/clusev-wg-collect.timer" \
+     && install -m 0644 "$tmp_rsvc"  "${dst}/clusev-wg-request.service" \
+     && install -m 0644 "$tmp_rpath" "${dst}/clusev-wg-request.path" \
      && systemctl daemon-reload \
      && systemctl enable --now clusev-restart.path \
      && systemctl enable --now clusev-update.path \
      && systemctl enable clusev-wg-gate.service \
-     && systemctl enable --now clusev-wg-collect.timer; then
+     && systemctl enable --now clusev-wg-collect.timer \
+     && systemctl enable --now clusev-wg-request.path; then
     info "Host-Watcher aktiv (clusev-restart.path User=clusev, clusev-update.path User=root)"
   else
     warn "Host-Watcher konnten nicht installiert werden — siehe ${src}/README.md."
   fi
-  rm -f "$tmp_path" "$tmp_svc" "$tmp_upath" "$tmp_usvc" "$tmp_gate" "$tmp_csvc" "$tmp_ctimer"
+  rm -f "$tmp_path" "$tmp_svc" "$tmp_upath" "$tmp_usvc" "$tmp_gate" "$tmp_csvc" "$tmp_ctimer" "$tmp_rsvc" "$tmp_rpath"
 }
 install_host_watchers