f0210c302b
Optional host-level WireGuard gate for the Clusev panel: install.sh installs wireguard-tools (off), a 'clusev wg setup/up/down/status/add-peer/remove-peer' host CLI sets up wg0 + gates TCP 80/443 to the WG subnet via a dedicated CLUSEV-WG-GATE iptables chain off DOCKER-USER, with 'clusev wg down' as the escape hatch and SSH/WG-UDP never gated. Hardened after an adversarial review: exact ordered firewall rules, persistence skips if wg0 is down (no reboot brick), down isolates Clusev's chain, setup idempotency, precise install wiring (CLUSEV_DIR exec + install_host_watchers). SP1 of 2; dashboard status/traffic is SP2. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| superpowers | ||
| install-update-design.md | ||
| session-handoff.md | ||
| v1-ui-review.md | ||