fixes in opnsesne addon

opnsense/plugin/Makefile

@@ -1,6 +1,6 @@
 PLUGIN_NAME= rustproxy
 PLUGIN_VERSION?= 0.23.3
-PLUGIN_REVISION?= 1
+PLUGIN_REVISION?= 2
 PLUGIN_COMMENT= RustProxy reverse proxy service
 PLUGIN_MAINTAINER?= local@localhost
 PLUGIN_WWW?= https://git.linuxiarz.pl/gru/RustProxy

opnsense/plugin/src/etc/rc.d/rustproxy

@@ -24,6 +24,7 @@ load_rc_config "$name"
 : ${rustproxy_command:="/usr/local/sbin/rust-proxy"}
 : ${rustproxy_restart_delay:="5"}
 : ${rustproxy_allow_remote_admin:="1"}
+: ${rustproxy_update_check_interval_secs:="3600"}
 # FreeBSD uses jemalloc rather than glibc.  Keep the same low-arena intent as
 # Linux MALLOC_ARENA_MAX=2 with the native jemalloc knob.  rc.conf can override
 # rustproxy_malloc_conf or set it to an empty value to disable the tuning.
@@ -147,7 +148,22 @@ rustproxy_admin_listen_resolved="$(rustproxy_resolve_listener \
     "$rustproxy_admin_listen_legacy" "$rustproxy_admin_listen" \
     "0.0.0.0" "9090" "admin")" || exit 1
 
-rustproxy_runtime_args="--data-dir ${rustproxy_data_dir} --admin-listen ${rustproxy_admin_listen_resolved} --update-check-interval-secs 3600 serve --proxy-listen ${rustproxy_proxy_listen_resolved}"
+# The CLI expects a positive interval (seconds), not a value hardcoded in rc.d.
+# Validate again at runtime for hand-written or stale configurations.
+rustproxy_valid_update_interval()
+{
+    case "$1" in
+        ''|*[!0-9]*) return 1 ;;
+    esac
+    [ "$1" -ge 60 ] 2>/dev/null && [ "$1" -le 604800 ] 2>/dev/null
+}
+
+if ! rustproxy_valid_update_interval "$rustproxy_update_check_interval_secs"; then
+    echo "Invalid RustProxy update check interval: ${rustproxy_update_check_interval_secs} (60-604800 seconds)" >&2
+    exit 1
+fi
+
+rustproxy_runtime_args="--data-dir ${rustproxy_data_dir} --admin-listen ${rustproxy_admin_listen_resolved} --update-check-interval-secs ${rustproxy_update_check_interval_secs} serve --proxy-listen ${rustproxy_proxy_listen_resolved}"
 if [ "$rustproxy_tls_enabled" = "1" ]; then
     rustproxy_runtime_args="${rustproxy_runtime_args} --tls-listen ${rustproxy_tls_listen_resolved}"
 fi
@@ -201,6 +217,7 @@ rustproxy_prestart()
     if [ -n "${rustproxy_malloc_conf}" ]; then
         echo "RustProxy allocator: MALLOC_CONF=${rustproxy_malloc_conf}"
     fi
+    echo "RustProxy update check interval: ${rustproxy_update_check_interval_secs}s"
     echo "RustProxy exec: ${rustproxy_command} ${rustproxy_runtime_args}"
     printf '%s\n' "${rustproxy_command} ${rustproxy_runtime_args}" > "${rustproxy_run_dir}/command.txt"
     /bin/chmod 0640 "${rustproxy_run_dir}/command.txt"

opnsense/plugin/src/etc/rc.syshook.d/start/50-rustproxy.start

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# OPNsense invokes this hook after networking and configd are available.
+# Regenerate from config.xml on every boot: /var and /usr/local/etc may have
+# been restored, or the administrator may have changed the GUI settings.
+# Retry briefly if configd is still finishing startup on slower firewalls.
+attempt=1
+while ! /usr/local/sbin/configctl template reload OPNsense/RustProxy; do
+    if [ "$attempt" -ge 3 ]; then
+        echo "RustProxy: failed to render configuration during boot (3 attempts)" >&2
+        exit 1
+    fi
+    attempt=$((attempt + 1))
+    /bin/sleep 2
+done
+
+# Use the helper directly: its enabled check is based on the freshly rendered
+# configuration and it does not rely on configd reloading our action registry.
+exec /usr/local/opnsense/scripts/rustproxy/service.sh boot

opnsense/plugin/src/opnsense/mvc/app/controllers/OPNsense/RustProxy/forms/general.xml

@@ -76,4 +76,16 @@
         <type>checkbox</type>
         <help>Pass --allow-remote-admin so the RustProxy panel accepts non-loopback clients. Keep firewall access restricted to trusted networks; do not expose the admin port to WAN unless this is intentional.</help>
     </field>
+
+    <field>
+        <label>Updates</label>
+        <type>header</type>
+        <static>true</static>
+    </field>
+    <field>
+        <id>rustproxy.general.updateCheckIntervalSecs</id>
+        <label>Update check interval (seconds)</label>
+        <type>text</type>
+        <help>How often RustProxy checks for new application versions. Default: 3600 seconds (1 hour). Allowed range: 60-604800 seconds. Changes take effect after Apply.</help>
+    </field>
 </form>

opnsense/plugin/src/opnsense/mvc/app/models/OPNsense/RustProxy/Migrations/M1_5_0.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace OPNsense\RustProxy\Migrations;
+
+use OPNsense\Base\BaseModelMigration;
+
+/** Fill the new update-check interval for existing installations. */
+class M1_5_0 extends BaseModelMigration
+{
+    public function run($model)
+    {
+        parent::run($model);
+        if (trim((string)$model->general->updateCheckIntervalSecs) === '') {
+            $model->general->updateCheckIntervalSecs = '3600';
+        }
+    }
+}

opnsense/plugin/src/opnsense/mvc/app/models/OPNsense/RustProxy/RustProxy.xml

@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/rustproxy</mount>
-    <version>1.4.0</version>
+    <version>1.5.0</version>
     <description>RustProxy service settings</description>
     <items>
         <general>
@@ -57,6 +57,13 @@
                 <Default>1</Default>
                 <Required>Y</Required>
             </allowRemoteAdmin>
+            <updateCheckIntervalSecs type="IntegerField">
+                <Default>3600</Default>
+                <MinimumValue>60</MinimumValue>
+                <MaximumValue>604800</MaximumValue>
+                <Required>Y</Required>
+                <ValidationMessage>Enter the number of seconds between update checks (60-604800).</ValidationMessage>
+            </updateCheckIntervalSecs>
 
             <!-- Legacy combined listener values retained for seamless upgrades. -->
             <proxyListen type="IPPortField"/>

opnsense/plugin/src/opnsense/scripts/rustproxy/service.sh

@@ -16,6 +16,11 @@ start_service()
         echo "RustProxy is disabled in OPNsense configuration"
         return 0
     fi
+    # OPNsense may invoke rc.d in addition to this boot hook. Avoid a second
+    # daemon supervisor when the service is already running.
+    if "$RC_SCRIPT" status >/dev/null 2>&1; then
+        return 0
+    fi
     "$RC_SCRIPT" onestart
 }
 

opnsense/plugin/src/opnsense/service/templates/OPNsense/RustProxy/rustproxy.conf

@@ -10,6 +10,8 @@ rustproxy_tls_port="{% if not helpers.empty('OPNsense.rustproxy.general.tlsPort'
 rustproxy_admin_address="{% if not helpers.empty('OPNsense.rustproxy.general.adminAddress') %}{{ OPNsense.rustproxy.general.adminAddress }}{% endif %}"
 rustproxy_admin_port="{% if not helpers.empty('OPNsense.rustproxy.general.adminPort') %}{{ OPNsense.rustproxy.general.adminPort }}{% endif %}"
 rustproxy_allow_remote_admin="{% if not helpers.empty('OPNsense.rustproxy.general.allowRemoteAdmin') %}1{% else %}0{% endif %}"
+# Existing installations without this setting use the 3600-second default.
+rustproxy_update_check_interval_secs="{% if not helpers.empty('OPNsense.rustproxy.general.updateCheckIntervalSecs') %}{{ OPNsense.rustproxy.general.updateCheckIntervalSecs }}{% else %}3600{% endif %}"
 
 # Legacy 1.2.x combined settings.  They are only used when the corresponding
 # new split address/port fields are both empty.