Рефакторинг под прод: nsenter-first транспорт, drift-aware reconcile, hardening daemon/lock/reboot/swap, расширенный status и build-скрипт

traffic_core/src/swap.rs

@@ -8,7 +8,17 @@ pub fn ensure_swap(cfg: &Config) -> anyhow::Result<()> {
     }
 
     let path = &cfg.swap.path;
-    if !std::path::Path::new(path).exists() {
+    let expected_size = cfg.swap.size_mb * 1024 * 1024;
+    if std::path::Path::new(path).exists() {
+        let actual_size = fs::metadata(path)?.len();
+        if actual_size != expected_size {
+            anyhow::bail!(
+                "existing swapfile has wrong size: {} bytes, expected {} bytes; manual intervention required",
+                actual_size,
+                expected_size
+            );
+        }
+    } else {
         run("fallocate", &["-l", &format!("{}M", cfg.swap.size_mb), path])?;
         run("chmod", &["600", path])?;
         run("mkswap", &[path])?;
@@ -22,6 +32,7 @@ pub fn ensure_swap(cfg: &Config) -> anyhow::Result<()> {
 
     ensure_fstab(path, cfg.swap.priority)?;
     run("sysctl", &["-w", &format!("vm.swappiness={}", cfg.swap.swappiness)])?;
+    ensure_swappiness_persist(cfg.swap.swappiness)?;
     Ok(())
 }
 
@@ -49,3 +60,13 @@ fn run(program: &str, args: &[&str]) -> anyhow::Result<()> {
     Ok(())
 }
 
+fn ensure_swappiness_persist(swappiness: u8) -> anyhow::Result<()> {
+    let conf_path = "/etc/sysctl.d/99-awg2-harness.conf";
+    let expected = format!("vm.swappiness = {}\n", swappiness);
+    let current = fs::read_to_string(conf_path).unwrap_or_default();
+    if current != expected {
+        fs::write(conf_path, expected)?;
+    }
+    Ok(())
+}
+