From 328ade651c2d1504eba3e2d2d1016ab1341db10f Mon Sep 17 00:00:00 2001
From: iRedTea <red__tea@outlook.com>
Date: Tue, 13 Oct 2026 16:16:31 +0300
Subject: [PATCH] fix: fix ufw

---
 deploy/lpra-server.service         | 27 ++++++++++-----------------
 internal/server/web/static/app.css |  6 +++++-
 2 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/deploy/lpra-server.service b/deploy/lpra-server.service
index b61b1b0..1c2c83e 100644
--- a/deploy/lpra-server.service
+++ b/deploy/lpra-server.service
@@ -1,20 +1,15 @@
 # systemd unit for the LPRA host (server).
 #
-# Unlike the agent, the server does NOT need root: it listens on a high local
-# port (127.0.0.1:8091) behind nginx, so run it as an unprivileged user.
+# The server runs as root so that the panel can open forwarded ports in ufw;
+# it listens on a high local port (127.0.0.1:8091) behind nginx.
 #
 # Install:
-#   sudo useradd --system --home /opt/lpra --shell /usr/sbin/nologin lpra
-#   sudo mkdir -p /opt/lpra /var/lib/lpra
+#   sudo mkdir -p /opt/lpra
 #   sudo cp bin/lpra-server /opt/lpra/
 #   sudo cp -r dist /opt/lpra/dist           # agent binaries served at /download/
-#   sudo chown -R lpra:lpra /opt/lpra /var/lib/lpra
 #   sudo cp deploy/lpra-server.service /etc/systemd/system/
 #   sudo systemctl daemon-reload && sudo systemctl enable --now lpra-server
 #
-# Config overrides can go in /etc/lpra-server.env (see EnvironmentFile below),
-# e.g.  LPRA_ADDR=127.0.0.1:8091
-#
 # Direct port forwarding (tcp/udp modes) uses port 8446 on the host — open it in
 # the firewall:  ufw allow 8446/tcp ; ufw allow 8446/udp
 # (The "http" forward mode and terminal/files go through nginx :8445 and need
@@ -22,10 +17,8 @@
 # The port, and the host agents dial for it, can also be changed in the panel
 # settings; agents pick the new address up from the panel by themselves.
 #
-# ufw integration (the panel opening forwarded ports itself) needs the server
-# to run as root, and ufw's state must be writable despite ProtectSystem=strict
-# below — otherwise "ufw status" works but "ufw allow" fails:
-#   ReadWritePaths=/etc/ufw /run
+# ufw integration (the panel opening forwarded ports itself) needs root and a
+# writable /etc/ufw and /run — see ReadWritePaths below.
 
 [Unit]
 Description=LPRA remote access host (admin panel + agent rendezvous)
@@ -35,9 +28,6 @@ Wants=network-online.target
 [Service]
 WorkingDirectory=/opt/lpra
 
-# Optional environment overrides; "-" means the file is not required.
-
-
 ExecStart=/opt/lpra/lpra-server \
     -addr 127.0.0.1:8091 \
     -db /opt/lpra/lpra.db \
@@ -55,8 +45,11 @@ PrivateDevices=true
 ProtectKernelTunables=true
 ProtectControlGroups=true
 RestrictSUIDSGID=true
-# The server only needs to write its SQLite database here.
-ReadWritePaths=/opt/lpra
+# The SQLite database, plus what ufw writes: its rules in /etc/ufw and the
+# ufw/xtables locks in /run. Without the last two "ufw status" works but
+# "ufw allow" fails with "'/etc/ufw/user.rules' is not writable".
+ReadWritePaths=/opt/lpra /etc/ufw /run
+ReadWritePaths-=/etc/ufw /run
 
 [Install]
 WantedBy=multi-user.target
diff --git a/internal/server/web/static/app.css b/internal/server/web/static/app.css
index debd36d..efade99 100644
--- a/internal/server/web/static/app.css
+++ b/internal/server/web/static/app.css
@@ -34,10 +34,14 @@ header.topbar nav a:hover { color: var(--text); }
 h1 { font-size: 22px; margin: 0 0 18px; }
 h2 { font-size: 17px; margin: 0 0 14px; }
 label { display: block; margin: 12px 0 4px; color: var(--muted); font-size: 13px; }
-input[type=text], input[type=password] {
+input[type=text], input[type=password], input[type=number] {
   width: 100%; padding: 10px 12px; border-radius: 8px;
   border: 1px solid var(--border); background: #0c0f13; color: var(--text); font-size: 14px;
 }
+/* No native spinner: it is drawn light and breaks the dark field. */
+input[type=number] { -moz-appearance: textfield; appearance: textfield; }
+input[type=number]::-webkit-inner-spin-button,
+input[type=number]::-webkit-outer-spin-button { -webkit-appearance: none; margin: 0; }
 /* Sized and shaped like .btn.ghost so it lines up with the buttons next to it. */
 select {
   -webkit-appearance: none; appearance: none; cursor: pointer;