refactor: migrate flags/routes to UCI lists; tighten rpcd ACL

Author: vad-b

deploy/README.md .deploy/README.mddeploy/README.md renamed to .deploy/README.md

@@ -4,10 +4,10 @@ This folder contains a deploy workflow to push files on router for testing based
 
 ## Files
 
-- `deploy/deploy.sh` - main deploy script (single pipeline mode)
-- `deploy/mapping.tsv` - explicit file mapping (`src -> dst -> mode`)
-- `deploy/target.env.example` - target configuration template
-- `deploy/target.env` - local router access settings (ignored by git)
+- `.deploy/deploy.sh` - main deploy script (single pipeline mode)
+- `.deploy/mapping.tsv` - explicit file mapping (`src -> dst -> mode`)
+- `.deploy/target.env.example` - target configuration template
+- `.deploy/target.env` - local router access settings (ignored by git)
 
 ## Requirements
 
@@ -20,7 +20,7 @@ This folder contains a deploy workflow to push files on router for testing based
 
 Each row contains three columns separated by one or more tabs:
 
-1. local path relative to `deploy/`
+1. local path relative to `.deploy/`
 2. absolute remote path on router
 3. mode (for example `644`, `755`)
 
@@ -48,11 +48,11 @@ Expected variables:
 ## SSH Key Bootstrap
 
 - If `SSH_KEY_PATH` is set, deploy uses that key.
-- If `SSH_KEY_PATH` is empty, deploy uses project key `deploy/.ssh/id_ed25519`.
+- If `SSH_KEY_PATH` is empty, deploy uses project key `.deploy/.ssh/id_ed25519`.
 - If the project key does not exist, deploy prompts to generate it on first run.
 - Deploy tries to publish the public key to `/etc/dropbear/authorized_keys`.
 - If auto-publish is not possible, deploy exits with exact manual commands to install the key on router.
-- For non-interactive runs, set `DEPLOY_AUTO_YES=1` to auto-confirm key generation.
+- For non-interactive runs, set `.deploy_AUTO_YES=1` to auto-confirm key generation.
 
 ## Usage
 
@@ -74,4 +74,4 @@ Modes:
 - Uploads mapped files via `scp -p`
 - Applies `chmod` only when remote mode differs from expected mode
 - Runs post-sync commands after copy/perms (deploy mode only)
-- Post-sync commands are defined in `deploy.sh` (currently `rpcd restart`)
+- Post-sync commands are defined in `.deploy.sh` (currently `rpcd restart`)

deploy/deploy.sh .deploy/deploy.shdeploy/deploy.sh renamed to .deploy/deploy.sh

@@ -4,7 +4,7 @@
 ../htdocs/luci-static/resources/view/tailscale-ng/index.js  	/www/luci-static/resources/view/tailscale-ng/index.js	644
 ../root/etc/config/luci-app-tailscale-ng					    /etc/config/luci-app-tailscale-ng					    644
 ../root/etc/hotplug.d/iface/40-luci-app-tailscale-ng		    /etc/hotplug.d/iface/40-luci-app-tailscale-ng		    755
-../root/etc/init.d/luci-app-tailscale-ng					    /etc/init.d/luci-app-tailscale-ng				      	755
+../root/etc/init.d/luci-app-tailscale-ng						/etc/init.d/luci-app-tailscale-ng						755
 ../root/etc/uci-defaults/40_luci-app-tailscale-ng			    /etc/uci-defaults/40_luci-app-tailscale-ng			    755
 ../root/usr/share/luci/menu.d/luci-app-tailscale-ng.json	    /usr/share/luci/menu.d/luci-app-tailscale-ng.json	    644
 ../root/usr/share/rpcd/acl.d/luci-app-tailscale-ng.json 	    /usr/share/rpcd/acl.d/luci-app-tailscale-ng.json	    644

deploy/mapping.tsv .deploy/mapping.tsvdeploy/mapping.tsv renamed to .deploy/mapping.tsv

@@ -1,3 +1,3 @@
-*index-status-synthetic.js
-deploy/target.env
-deploy/.ssh/
+.deploy/target.env
+.deploy/.ssh/
+.private

deploy/target.env.example .deploy/target.env.exampledeploy/target.env.example renamed to .deploy/target.env.example

@@ -9,7 +9,7 @@ LUCI_TITLE:=LuCI for Tailscale (NG)
 LUCI_DEPENDS:=+tailscale
 LUCI_PKGARCH:=all
 
-PKG_VERSION:=0.1.0
+PKG_VERSION:=0.1.1
 
 include $(TOPDIR)/feeds/luci/luci.mk
 

.gitignore

@@ -1,8 +1,20 @@
 # luci-app-tailscale-ng
 
-LuCI web interface for managing [Tailscale](https://tailscale.com/) on OpenWRT routers.
+LuCI web interface for managing [Tailscale](https://tailscale.com/) on OpenWrt routers.
 
-Inspired by [asvow/luci-app-tailscale](https://github.com/asvow/luci-app-tailscale), this project is a ground-up redesign that eliminates conflicts with the standard OpenWRT `tailscale` package.
+Inspired by [asvow/luci-app-tailscale](https://github.com/asvow/luci-app-tailscale), this project is a major redesign that eliminates conflicts with the standard OpenWrt `tailscale` package. See [Motivation](#motivation) for details.
+
+## Quick Install
+
+Auto-detects `opkg` / `apk` and installs the latest release:
+
+```shell
+wget -qO- https://raw.githubusercontent.com/vad-b/luci-app-tailscale-ng/main/install.sh | sh
+```
+
+After installation, navigate to **VPN -> Tailscale NG** in the LuCI web interface.
+
+Need manual package install options instead? See [Manual Installation](#manual-installation).
 
 ## Screenshots
 
@@ -21,18 +33,23 @@ Inspired by [asvow/luci-app-tailscale](https://github.com/asvow/luci-app-tailsca
 
 ## Motivation
 
-The goals of `luci-app-tailscale-ng` are:
-
-- keep integration non-conflicting with the standard OpenWRT `tailscale` package
-- make the OpenWRT Tailscale UI closer to the Tailscale management UI in pfSense and OPNsense
+### Problem
 
-The original [asvow/luci-app-tailscale](https://github.com/asvow/luci-app-tailscale) project is excellent and inspired this work, but its integration model is tightly coupled to core files from the OpenWRT `tailscale` package, which leads to two operational drawbacks:
+The original [asvow/luci-app-tailscale](https://github.com/asvow/luci-app-tailscale) project is excellent and inspired this work, but its integration model is tightly coupled to core files from the OpenWrt `tailscale` package, which leads to three operational drawbacks:
 
-- **Invasive Installation** - installation overwrites original `/etc/init.d/tailscale` and `/etc/config/tailscale` files.
-- **Breaking Uninstallation** - uninstall removes these required files; restoring normal Tailscale operation requires manual file recreation or reinstalling the `tailscale` package.
+- **Invasive install:** During installation, `asvow/luci-app-tailscale` replaces core `tailscale` files (`/etc/init.d/tailscale` and `/etc/config/tailscale`) and takes ownership of them.
+- **Breaking uninstallation:** When `asvow/luci-app-tailscale` is removed, those same files are deleted, leaving the stock `tailscale` package non-functional.
+- **Restore normal operation:** To recover normal Tailscale operation, you must recreate the removed files manually or reinstall the `tailscale` package.
 
 See [asvow/luci-app-tailscale#31](https://github.com/asvow/luci-app-tailscale/issues/31) for details.
 
+### Solution
+
+The goals of `luci-app-tailscale-ng` are:
+
+- keep integration non-conflicting with the standard OpenWrt `tailscale` package
+- make the OpenWrt Tailscale UI closer to the Tailscale management UI in pfSense and OPNsense
+
 ## How it works
 
 **luci-app-tailscale-ng** takes a non-invasive approach:
@@ -57,9 +74,7 @@ This means you can install and remove the package at any time without breaking y
 - Live status dashboard (tailscale status, IP, interface, netcheck, DNS)
 - Automatic settings reapply on network interface changes via hotplug
 
-## Current limitations
-
-This package focuses on managing `tailscale up` command-line parameters. It does **not** automatically create network interfaces or firewall rules for Tailscale traffic - you may need to configure these manually if your setup requires it.
+> **Right now** this package provides Tailscale management in LuCI (service control, `tailscale up` settings, and status visibility). It does **not** automatically create Tailscale interfaces or firewall rules yet. See [Roadmap](#roadmap) for planned automation.
 
 ## Roadmap
 
@@ -68,32 +83,24 @@ This package focuses on managing `tailscale up` command-line parameters. It does
 - Backup and restore of the Tailscale state file
 - Update Tailscale directly from the web UI (both standard and size-optimized builds for memory-constrained devices)
 
-## Installation
+## Manual Installation
 
-### Quick install (auto-detects `opkg` / `apk`)
-
-```shell
-wget -qO- https://raw.githubusercontent.com/vad-b/luci-app-tailscale-ng/main/install.sh | sh
-```
-
-### Manual install (`opkg` / `.ipk`)
+### Install with `opkg` (`.ipk`)
 
 Download the latest `.ipk` package from [Releases](https://github.com/vad-b/luci-app-tailscale-ng/releases), upload it to the router's `/tmp` directory, then:
 
 ```shell
 opkg install /tmp/luci-app-tailscale-ng_*.ipk
 ```
 
-### Manual install (`apk` / `.apk`)
+### Install with `apk` (`.apk`)
 
 Download the latest `.apk` package from [Releases](https://github.com/vad-b/luci-app-tailscale-ng/releases), upload it to the router's `/tmp` directory, then:
 
 ```shell
 apk add --allow-untrusted --upgrade /tmp/luci-app-tailscale-ng_*.apk
 ```
 
-After installation, navigate to **VPN -> Tailscale NG** in the LuCI web interface.
-
 ## Credits
 
 - [asvow/luci-app-tailscale](https://github.com/asvow/luci-app-tailscale) - the project that inspired this work