fix29: удалён legacy, введён Debian 13-only и обновлён rollback

2026-05-12 17:26:41 +05:00
parent 69c737bcf4
commit 44a62cf634
23 changed files with 211 additions and 1316 deletions
@@ -290,7 +290,7 @@ The binary should not blindly flush unrelated host firewall rules, Docker NAT ru

 ## 11. Anti-torrent firewall guard

-This is a new module, not part of old bash parity. It fits the multi-orchestrator model because the server is dedicated and the binary is allowed to own host/network rules required for the VPN product. The rule must still be scoped narrowly and observable.
+This is part of the AWG2 production contract. It fits the multi-orchestrator model because the server is dedicated and the binary is allowed to own host/network rules required for the VPN product. The rule must still be scoped narrowly and observable.

 Goal: limit concurrent conntrack flows per VPN peer IP. This is not torrent protocol detection. It is a generic connection-count guard that makes high-peer-count P2P workloads unattractive while leaving normal browsing, streaming, gaming and messaging traffic unaffected.

@@ -456,7 +456,7 @@ Unit tests:
 - `wg show all allowed-ips` parser;
 - `wg show` fallback parser;
 - CIDR filtering;
- deterministic class assignment with lexicographic bash parity;
+- deterministic class assignment with lexicographic class-id stability contract;
 - nftables ruleset rendering and parsing for the AWG2-owned table;
 - `tc` parser for qdisc/class/filter snapshots;
 - drift diff;