Add runtime observation and systemd restart adapter

2026-10-20 23:01:43 +03:00
parent 5418841b92
commit 6ec593c783
18 changed files with 6001 additions and 66 deletions
@@ -16,18 +16,20 @@ The user has approved the following choices. They may be introduced when their i
 | QR encoding                 | `qrcode`               | Additional terminal delivery of client configurations                |
 | Backup archives             | `tar`                  | Archives with manifests; initially without compression               |
 | Temporary files             | `tempfile`             | Staged file replacement and isolated test directories                |
-| Linux operations            | `rustix`               | User checks and controlled low-level filesystem operations           |
+| Linux operations            | `rustix`               | User checks, controlled filesystem operations, and bounded Generic Netlink runtime reads |
 | Encrypted vault             | `age`                  | Recipient encryption and password protection of the vault secret key |
 | WireGuard key pairs         | `x25519-dalek`         | Key generation and public/private key matching                       |
 | Secure randomness           | `getrandom`            | Operating-system randomness for key generation                       |
 | WireGuard key encoding      | `base64`               | Reading and writing WireGuard key representations                    |
 | Secret handling             | `secrecy`, `zeroize`   | Explicit secret exposure and supported memory cleanup                |
 | WireGuard runtime           | `wireguard-uapi`       | Direct Linux interface, peer, handshake, and traffic queries         |
-| Service management          | `zbus`                 | Direct systemd D-Bus requests and job completion tracking            |
+| Service management          | `zbus` 5.19.0          | Async systemd D-Bus requests and job completion tracking              |
 | Container integration tests | `testcontainers`       | Alpine server/client lifecycle; development dependency only          |

 - Use a separate vault key pair from all WireGuard client/server key pairs. Encrypt each client secret to the vault public key; protect the vault secret key with password-based encryption using the established `age` format. Do not replace this with password-only encryption of every new client record, which would require a password on creation.
- Validate `wireguard-uapi` against the isolated integration environment before relying on it. A systemd D-Bus request being accepted is not proof of job completion or successful VPN application.
+- `wireguard-uapi` remains an approved option but is not selected for the bounded runtime reader: its public read API does not expose a receive deadline or a complete-dump guarantee. A systemd D-Bus request being accepted is not proof of job completion or successful VPN application.
+- Runtime observation uses the already approved `rustix` 1.1.5 safe `net` and `event` APIs for a nonblocking Linux Generic Netlink socket, polling and datagram I/O. This keeps one monotonic deadline and exact truncation/sender checks around the checked WireGuard decoder. It does not add a direct dependency or use a subprocess.
+- The systemd adapter pins `zbus` 5.19.0 with default features disabled and only `async-io` enabled. It uses zbus's asynchronous signal and method APIs, driven by a small standard-library wake/park loop so every call shares the caller's monotonic deadline. zbus's async-io backend owns internal I/O executor thread(s); callers must allow the connection to be dropped after each operation. Signal polling uses zbus 5.19.0's doc-hidden `export::futures_core` re-export to avoid another direct dependency; keep zbus pinned until that implementation is deliberately migrated.
 - Avoid incompatible duplicate versions of secret-handling types where library APIs exchange them. Use supported re-exports where appropriate rather than adding redundant direct dependencies.
 - Additional direct dependencies still require the comparison and prior agreement required by [AGENTS.md](../AGENTS.md), including any test/build helpers. Transitive dependencies of approved crates are resolved through Cargo; review their compatibility and runtime requirements. Do not add a direct `tokio` dependency merely because an approved library uses an async runtime internally.
 - `clap`, `chrono`, SQLite, a generic INI writer, a mocking framework, and archive compression libraries are not part of the approved initial set. Use the standard library for the small startup argument surface and background threads/channels where sufficient.