fixes in opnsesne addon

opnsense/plugin/src/etc/rc.d/rustproxy

@@ -24,6 +24,7 @@ load_rc_config "$name"
 : ${rustproxy_command:="/usr/local/sbin/rust-proxy"}
 : ${rustproxy_restart_delay:="5"}
 : ${rustproxy_allow_remote_admin:="1"}
+: ${rustproxy_update_check_interval_secs:="3600"}
 # FreeBSD uses jemalloc rather than glibc.  Keep the same low-arena intent as
 # Linux MALLOC_ARENA_MAX=2 with the native jemalloc knob.  rc.conf can override
 # rustproxy_malloc_conf or set it to an empty value to disable the tuning.
@@ -147,7 +148,22 @@ rustproxy_admin_listen_resolved="$(rustproxy_resolve_listener \
     "$rustproxy_admin_listen_legacy" "$rustproxy_admin_listen" \
     "0.0.0.0" "9090" "admin")" || exit 1
 
-rustproxy_runtime_args="--data-dir ${rustproxy_data_dir} --admin-listen ${rustproxy_admin_listen_resolved} --update-check-interval-secs 3600 serve --proxy-listen ${rustproxy_proxy_listen_resolved}"
+# The CLI expects a positive interval (seconds), not a value hardcoded in rc.d.
+# Validate again at runtime for hand-written or stale configurations.
+rustproxy_valid_update_interval()
+{
+    case "$1" in
+        ''|*[!0-9]*) return 1 ;;
+    esac
+    [ "$1" -ge 60 ] 2>/dev/null && [ "$1" -le 604800 ] 2>/dev/null
+}
+
+if ! rustproxy_valid_update_interval "$rustproxy_update_check_interval_secs"; then
+    echo "Invalid RustProxy update check interval: ${rustproxy_update_check_interval_secs} (60-604800 seconds)" >&2
+    exit 1
+fi
+
+rustproxy_runtime_args="--data-dir ${rustproxy_data_dir} --admin-listen ${rustproxy_admin_listen_resolved} --update-check-interval-secs ${rustproxy_update_check_interval_secs} serve --proxy-listen ${rustproxy_proxy_listen_resolved}"
 if [ "$rustproxy_tls_enabled" = "1" ]; then
     rustproxy_runtime_args="${rustproxy_runtime_args} --tls-listen ${rustproxy_tls_listen_resolved}"
 fi
@@ -201,6 +217,7 @@ rustproxy_prestart()
     if [ -n "${rustproxy_malloc_conf}" ]; then
         echo "RustProxy allocator: MALLOC_CONF=${rustproxy_malloc_conf}"
     fi
+    echo "RustProxy update check interval: ${rustproxy_update_check_interval_secs}s"
     echo "RustProxy exec: ${rustproxy_command} ${rustproxy_runtime_args}"
     printf '%s\n' "${rustproxy_command} ${rustproxy_runtime_args}" > "${rustproxy_run_dir}/command.txt"
     /bin/chmod 0640 "${rustproxy_run_dir}/command.txt"

opnsense/plugin/src/etc/rc.syshook.d/start/50-rustproxy.start

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# OPNsense invokes this hook after networking and configd are available.
+# Regenerate from config.xml on every boot: /var and /usr/local/etc may have
+# been restored, or the administrator may have changed the GUI settings.
+# Retry briefly if configd is still finishing startup on slower firewalls.
+attempt=1
+while ! /usr/local/sbin/configctl template reload OPNsense/RustProxy; do
+    if [ "$attempt" -ge 3 ]; then
+        echo "RustProxy: failed to render configuration during boot (3 attempts)" >&2
+        exit 1
+    fi
+    attempt=$((attempt + 1))
+    /bin/sleep 2
+done
+
+# Use the helper directly: its enabled check is based on the freshly rendered
+# configuration and it does not rely on configd reloading our action registry.
+exec /usr/local/opnsense/scripts/rustproxy/service.sh boot