Рефакторинг под прод: nsenter-first транспорт, drift-aware reconcile, hardening daemon/lock/reboot/swap, расширенный status и build-скрипт

traffic_core/src/config.rs

@@ -1,4 +1,4 @@
-use std::{fs, net::Ipv4Addr, path::Path};
+use std::{fs, net::Ipv4Addr, path::Path, process::Command};
 
 use serde::Deserialize;
 
@@ -72,10 +72,38 @@ impl Config {
         if self.swap.swappiness > 100 {
             anyhow::bail!("swap.swappiness must be <= 100");
         }
+        if self.traffic.container_ready_timeout_secs == 0 {
+            anyhow::bail!("traffic.container_ready_timeout_secs must be > 0");
+        }
+        if self.traffic.reconcile_interval_secs == 0 {
+            anyhow::bail!("traffic.reconcile_interval_secs must be > 0");
+        }
+        if self.reboot.enabled && self.reboot.window_start_utc == self.reboot.window_end_utc {
+            anyhow::bail!("reboot window start and end must differ");
+        }
         parse_cidr_v4(&self.amnezia.peer_ipv4_cidr)?;
         parse_cidr_v4(&self.anti_torrent.peer_ipv4_cidr)?;
+        self.check_host_tools()?;
         Ok(())
     }
+
+    fn check_host_tools(&self) -> anyhow::Result<()> {
+        let mut required = vec!["tc", "ip", "wg", "nsenter", "docker", "modprobe"];
+        if self.anti_torrent.enabled {
+            required.push("nft");
+        }
+
+        for tool in required {
+            if !tool_exists(tool) {
+                anyhow::bail!("required host tool not found in PATH: {tool}");
+            }
+        }
+        Ok(())
+    }
+}
+
+fn tool_exists(tool: &str) -> bool {
+    Command::new(tool).arg("--version").output().is_ok()
 }
 
 pub fn parse_cidr_v4(cidr: &str) -> anyhow::Result<(Ipv4Addr, u8)> {
@@ -106,3 +134,22 @@ pub fn ip_in_cidr(ip: Ipv4Addr, cidr: &str) -> anyhow::Result<bool> {
     Ok((ip_u & mask) == (base_u & mask))
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_cidr_invalid_prefix() {
+        let err = parse_cidr_v4("10.8.1.0/33").err();
+        assert!(err.is_some());
+    }
+
+    #[test]
+    fn ip_membership() {
+        let ok = ip_in_cidr("10.8.1.10".parse().expect("ip"), "10.8.1.0/24").expect("cidr");
+        assert!(ok);
+        let no = ip_in_cidr("10.9.1.10".parse().expect("ip"), "10.8.1.0/24").expect("cidr");
+        assert!(!no);
+    }
+}
+