Major updates

src/scripts/install-wg-ui.sh

@@ -12,10 +12,8 @@ log() { echo "==> $*"; }
 fail() { echo "error: $*" >&2; exit 1; }
 
 WGUI_LIB_DIR="/var/lib/wgui"
-WG_QUICK_HELPER="$WGUI_LIB_DIR/scripts/wg-quick-systemd.sh"
+WG_QUICK_HELPER="$WGUI_LIB_DIR/scripts/wg-quick-manage.sh"
 INSTALL_DIR="${INSTALL_DIR:-}"
-SERVICE_USER="${SERVICE_USER:-}"
-SERVICE_GROUP="${SERVICE_GROUP:-}"
 SERVICE_NAME="${SERVICE_NAME:-wgui}"
 REPO_URL="${REPO_URL:-}"
 BRANCH="${BRANCH:-main}"
@@ -42,18 +40,8 @@ require_root() {
     fi
 }
 
-resolve_service_user() {
-    if [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ] && id -u "$SUDO_USER" >/dev/null 2>&1; then
-        echo "$SUDO_USER"
-    else
-        echo "root"
-    fi
-}
-
 require_root
-SERVICE_USER="${SERVICE_USER:-$(resolve_service_user)}"
-SERVICE_GROUP="${SERVICE_GROUP:-$(id -gn "$SERVICE_USER")}"
-log "running the wg-ui service as $SERVICE_USER (group: $SERVICE_GROUP)"
+log "running the wg-ui service as root"
 
 if [ "$DEV_MODE" = true ]; then
     INSTALL_DIR="${INSTALL_DIR:-$REPO_ROOT}"
@@ -125,10 +113,10 @@ install_bun() {
     log "bun: $($BUN_BIN --version)"
 }
 
-setup_service_user() {
+setup_lib_dirs() {
     mkdir -p "$WGUI_LIB_DIR/iptables" "$WGUI_LIB_DIR/keys" "$WGUI_LIB_DIR/clients" "$WGUI_LIB_DIR/hosts" "$WGUI_LIB_DIR/scripts"
-    chown -R "$SERVICE_USER:$SERVICE_GROUP" "$WGUI_LIB_DIR"
-    chmod 770 "$WGUI_LIB_DIR/hosts"
+    chmod 700 "$WGUI_LIB_DIR/iptables" "$WGUI_LIB_DIR/keys" "$WGUI_LIB_DIR/clients" "$WGUI_LIB_DIR/hosts"
+    chmod 755 "$WGUI_LIB_DIR/scripts"
 }
 
 clone_or_update() {
@@ -149,22 +137,12 @@ clone_or_update() {
         log "cloning wg-ui ($REPO_URL, branch $BRANCH) ..."
         git clone --depth 1 --branch "$BRANCH" "$REPO_URL" "$INSTALL_DIR"
     fi
-    chown -R "$SERVICE_USER:$SERVICE_GROUP" "$INSTALL_DIR"
-}
-
-run_as_service_user() {
-    local cmd
-    cmd="cd $(printf '%q' "$INSTALL_DIR") && export PATH=/usr/local/bin:/usr/bin:/bin && $(printf '%q ' "$@")"
-    if command -v runuser >/dev/null 2>&1; then
-        runuser -u "$SERVICE_USER" -- bash -c "$cmd"
-    else
-        su -s /bin/bash -c "$cmd" "$SERVICE_USER"
-    fi
 }
 
 install_dependencies() {
     log "installing app dependencies with bun ..."
-    run_as_service_user "$BUN_BIN" install
+    cd "$INSTALL_DIR"
+    "$BUN_BIN" install
 }
 
 ensure_env_file() {
@@ -176,7 +154,6 @@ ensure_env_file() {
             echo "ENCRYPTION_SALT=$(openssl rand -base64 32 | tr -d '\n')"
             echo "DATA_DIR=$INSTALL_DIR/.data"
         } > "$INSTALL_DIR/.env"
-        chown "$SERVICE_USER:$SERVICE_GROUP" "$INSTALL_DIR/.env"
         chmod 600 "$INSTALL_DIR/.env"
     fi
 }
@@ -190,31 +167,14 @@ setup_wireguard() {
 }
 
 install_wg_quick_helper() {
-    local helper_src="$INSTALL_DIR/src/scripts/wg-quick-systemd.sh"
+    local helper_src="$INSTALL_DIR/src/scripts/wg-quick-manage.sh"
     if [ ! -f "$helper_src" ]; then
-        fail "missing $helper_src — cannot install the wg-quick systemd helper"
+        fail "missing $helper_src — cannot install the wg-quick helper"
     fi
-    log "installing wg-quick systemd helper to $WG_QUICK_HELPER ..."
+    log "installing wg-quick helper to $WG_QUICK_HELPER ..."
     install -m 755 -o root -g root "$helper_src" "$WG_QUICK_HELPER"
 }
 
-install_wg_quick_sudoers() {
-    if [ "$SERVICE_USER" = "root" ]; then
-        return 0
-    fi
-    if ! command -v visudo >/dev/null 2>&1; then
-        log "visudo not found — skipping sudoers entry for $SERVICE_USER (tunnel management will require root)"
-        return 0
-    fi
-    local sudoers_file="/etc/sudoers.d/wgui-wg-quick"
-    log "granting $SERVICE_USER passwordless access to $WG_QUICK_HELPER ..."
-    cat > "$sudoers_file" <<EOF
-$SERVICE_USER ALL=(root) NOPASSWD: $WG_QUICK_HELPER *
-EOF
-    chmod 440 "$sudoers_file"
-    visudo -cf "$sudoers_file" >/dev/null 2>&1 || fail "invalid sudoers file $sudoers_file"
-}
-
 install_systemd_unit() {
     local unit="/etc/systemd/system/$SERVICE_NAME.service"
     log "writing systemd unit $unit ..."
@@ -226,8 +186,8 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-User=$SERVICE_USER
-Group=$SERVICE_GROUP
+User=root
+Group=root
 WorkingDirectory=$INSTALL_DIR
 Environment=NODE_ENV=production
 ExecStart=$BUN_BIN src/server.ts
@@ -257,7 +217,7 @@ name="$SERVICE_NAME"
 description="Wireguard UI"
 command="$BUN_BIN"
 command_args="src/server.ts"
-command_user="$SERVICE_USER"
+command_user="root"
 directory="$INSTALL_DIR"
 output_log="/var/log/$SERVICE_NAME.log"
 error_log="/var/log/$SERVICE_NAME.log"
@@ -288,7 +248,7 @@ grab_port() {
 
 install_deps
 install_bun
-setup_service_user
+setup_lib_dirs
 if [ "$DEV_MODE" = false ]; then
     clone_or_update
 fi
@@ -296,7 +256,6 @@ install_dependencies
 ensure_env_file
 setup_wireguard
 install_wg_quick_helper
-install_wg_quick_sudoers
 
 if [ "$DEV_MODE" = false ]; then
     case "$INIT_SYSTEM" in
@@ -308,7 +267,7 @@ if [ "$DEV_MODE" = false ]; then
             ;;
         *)
             log "no supported init system found — start manually with:
-  su -s /bin/bash $SERVICE_USER -c 'cd $INSTALL_DIR && NODE_ENV=production $BUN_BIN src/server.ts'
+  cd $INSTALL_DIR && NODE_ENV=production $BUN_BIN src/server.ts
 (add the line above to your boot scripts)"
             ;;
     esac
@@ -318,9 +277,9 @@ PORT="$(grab_port)"
 log "wg-ui install complete."
 log "webapp:      $INSTALL_DIR"
 log "runtime:     $WGUI_LIB_DIR (host configs, keys, iptables, client configs)"
-log "tunnels:     systemd units wg-quick@wgui<host_id>.service (configs in $WGUI_LIB_DIR/hosts — /etc/wireguard is never touched)"
+log "tunnels:     managed by the web server via wg-quick up/down (configs in $WGUI_LIB_DIR/hosts — /etc/wireguard is never touched)"
 if [ "$DEV_MODE" = true ]; then
-    log "process:     development mode — no system service installed"
+    log "process:     development mode — no system service installed; run the dev server as root (e.g. after sudo -i)"
 else
     log "process:     managed by $INIT_SYSTEM as $SERVICE_NAME"
 fi