Allow the split console to read and write the P2P, relay, NAT, and initiator policy through the Go server's shared database API. Apply validated changes atomically at runtime, keep native systemd and compose paths unchanged, and cover the flow with regression tests and Docker image checks.
Refs #432
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Panel runs as betterdesk and cannot rewrite /etc/systemd/system/*.service.
Write ALLOW_SHARED_NAT_INITIATOR and related flags through the fixed root
broker into a service.d drop-in so Settings no longer fails with EACCES.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Add opt-in OPERATOR_ONLY_OUTBOUND enforcement for PunchHole and RequestRelay, including live role checks, decision auditing, panel RBAC, settings, documentation, and regression tests.\n\nRefs #425\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Expose global connection strategy in the web panel with systemd/Docker persistence, extend server health diagnostics, enforce org network policy in the signal handler, and document when relay fallback is expected vs misconfiguration.