Рефакторинг под прод: nsenter-first транспорт, drift-aware reconcile, hardening daemon/lock/reboot/swap, расширенный status и build-скрипт

traffic_core/src/status.rs

@@ -1,7 +1,18 @@
-use crate::{config::Config, docker, wg};
+use crate::{config::Config, docker, traffic, wg};
+
+use std::{fs, process::Command};
 
 pub fn print_status(cfg: &Config) -> anyhow::Result<()> {
     println!("System:");
+    let svc = Command::new("systemctl")
+        .args(["is-active", "awg2-harness"])
+        .output();
+    match svc {
+        Ok(out) if out.status.success() => println!("  service: active"),
+        Ok(_) => println!("  service: inactive"),
+        Err(_) => println!("  service: unknown"),
+    }
+
     let target = match docker::discover_target(cfg) {
         Ok(t) => t,
         Err(e) => {
@@ -16,7 +27,11 @@ pub fn print_status(cfg: &Config) -> anyhow::Result<()> {
     println!("  netns: {}", target.netns_path);
     println!("  interface: {}", target.interface_name);
 
-    let peers = wg::discover_peers(&target.container_name, &cfg.amnezia.peer_ipv4_cidr)?;
+    let peers = wg::discover_peers(
+        target.container_pid,
+        &target.container_name,
+        &cfg.amnezia.peer_ipv4_cidr,
+    )?;
     println!("Peers:");
     println!("  total: {}", peers.len());
     for p in peers {
@@ -29,12 +44,70 @@ pub fn print_status(cfg: &Config) -> anyhow::Result<()> {
     println!("  ifb_name: {}", cfg.traffic.ifb_name);
     println!("  class_start_id: {}", cfg.traffic.class_start_id);
 
+    println!("Traffic actual:");
+    match traffic::inspect_drift_summary(cfg) {
+        Ok(None) => println!("  drift: no"),
+        Ok(Some(reason)) => {
+            println!("  drift: yes");
+            println!("  reason: {}", reason);
+        }
+        Err(e) => println!("  drift: unknown ({e})"),
+    }
+
     println!("Anti-torrent:");
     println!("  enabled: {}", cfg.anti_torrent.enabled);
     println!(
         "  max_connections_per_peer: {}",
         cfg.anti_torrent.max_connections_per_peer
     );
+
+    if cfg.anti_torrent.enabled {
+        let fw = Command::new("nsenter")
+            .args([
+                "-t",
+                &target.container_pid.to_string(),
+                "-n",
+                "--",
+                "nft",
+                "list",
+                "table",
+                "inet",
+                "awg2_harness",
+            ])
+            .output();
+        match fw {
+            Ok(out) if out.status.success() => println!("  actual: table present"),
+            Ok(_) => println!("  actual: table missing or drift"),
+            Err(_) => println!("  actual: unable to inspect"),
+        }
+    }
+
+    let ct_count = Command::new("sysctl")
+        .args(["-n", "net.netfilter.nf_conntrack_count"])
+        .output()
+        .ok()
+        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+        .unwrap_or_else(|| "n/a".to_string());
+    let ct_max = Command::new("sysctl")
+        .args(["-n", "net.netfilter.nf_conntrack_max"])
+        .output()
+        .ok()
+        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+        .unwrap_or_else(|| "n/a".to_string());
+    println!("Conntrack:");
+    println!("  nf_conntrack_count: {}", ct_count);
+    println!("  nf_conntrack_max: {}", ct_max);
+
+    println!("Last actions:");
+    let last = fs::read_to_string("/run/awg2-harness/last_action.state").unwrap_or_default();
+    if last.trim().is_empty() {
+        println!("  no persisted state");
+    } else {
+        for line in last.lines() {
+            println!("  {}", line);
+        }
+    }
+
     Ok(())
 }