🚧 WIP

deploy/hostnet-agent.yaml

@@ -0,0 +1,32 @@
+# Host-side agent config for the web UI's host network settings page
+# (spec §15, FR-15.2.7). Used by `wago-sim hostnet-agent --config ...`.
+#
+# This file lives on the DOCKER HOST (not inside the container), e.g.
+# /etc/wago-sim/hostnet.yaml. The agent must run as root or with
+# CAP_NET_ADMIN; the whitelist is the safety rail that keeps the
+# privileged surface as small as the FAT bench needs.
+#
+# socket: the Unix domain socket the container connects through.
+#   docker-compose.yml mounts /run/wago-sim read-write into the
+#   simulator container, which is why this path is fixed by default.
+#   The agent refuses to start with an empty whitelist.
+socket: /run/wago-sim/hostnet.sock
+
+# whitelist: interfaces the settings page may manipulate. Operations
+#   on any other interface are refused by the agent and surfaced as
+#   errors on the page (FR-15.2.5). List the bench NIC(s) only.
+whitelist:
+  - enp3s0
+  - eth0
+
+# backend: how the agent performs changes on the host.
+#   iproute2 — the `ip` tool (+ pyroute2 for reads when installed);
+#              the production backend for Linux bench hosts (v1)
+#   fake    — in-memory model: rehearses FAT cases and demos the page
+#              without touching any real interface
+backend: iproute2
+
+# audit_path: optional file for the single-line audit trail in
+#   addition to the service log (stdout/journald, FR-12.2.6). The
+#   directory is created if missing; leave out to log only.
+audit_path: /var/log/wago-sim/hostnet-audit.log