Production sysctl_tuning hardening and upgrade-safe defaults

traffic_core/src/config.rs

@@ -26,11 +26,18 @@ fn default_input_policy() -> String {
     "drop".to_string()
 }
 
+fn default_sysctl_tuning_for_missing_block() -> SysctlTuningConfig {
+    SysctlTuningConfig {
+        enabled: false,
+        ..SysctlTuningConfig::default()
+    }
+}
+
 #[derive(Debug, Clone, Deserialize)]
 pub struct Config {
     pub amnezia: AmneziaConfig,
     pub traffic: TrafficConfig,
-    #[serde(default)]
+    #[serde(default = "default_sysctl_tuning_for_missing_block")]
     pub sysctl_tuning: SysctlTuningConfig,
     pub host_firewall: HostFirewallConfig,
     pub anti_torrent: AntiTorrentConfig,
@@ -296,7 +303,7 @@ impl Config {
             required.push("sysctl");
         }
         if self.sysctl_tuning.enabled
-            && self.sysctl_tuning.tcp_bbr.trim().to_ascii_lowercase() != "off"
+            && self.sysctl_tuning.tcp_bbr.trim().to_ascii_lowercase() == "require"
         {
             required.push("modprobe");
         }
@@ -649,4 +656,55 @@ swappiness = 1
         let parsed = toml::from_str::<Config>(raw);
         assert!(parsed.is_err());
     }
+
+    #[test]
+    fn missing_sysctl_tuning_block_defaults_to_disabled() {
+        let raw = r#"
+[amnezia]
+container_names = ["amnezia-awg2"]
+interface_candidates = ["awg0"]
+interface_patterns = ["awg*"]
+peer_ipv4_cidr = "10.8.1.0/24"
+
+[traffic]
+enabled = true
+peer_limit = "70mbit"
+root_rate = "1000mbit"
+reconcile_interval_secs = 15
+container_ready_timeout_secs = 30
+class_start_id = 10
+ifb_name = "ifb0"
+
+[host_firewall]
+enabled = true
+ssh_port = 2323
+amnezia_port = 443
+amnezia_protocols = ["udp"]
+allow_icmp = true
+default_input_policy = "drop"
+
+[anti_torrent]
+enabled = false
+max_connections_per_peer = 100
+peer_ipv4_cidr = "10.8.1.0/24"
+apply_in_amnezia_netns = false
+
+[reboot]
+enabled = false
+window_start_utc = "01:00"
+window_end_utc = "02:00"
+
+[swap]
+enabled = false
+path = "/swapfile"
+size_mb = 2048
+priority = 1
+swappiness = 1
+"#;
+
+        let cfg = toml::from_str::<Config>(raw).expect("config parse");
+        assert!(!cfg.sysctl_tuning.enabled);
+        assert!(cfg.sysctl_tuning.apply_on_daemon_start);
+        assert_eq!(cfg.sysctl_tuning.tcp_bbr, "auto");
+    }
 }