Adds dist.

dist/debian/etc/nginx/sites-available/wild-central

@@ -0,0 +1,34 @@
+server {
+    listen 80;
+    server_name _;
+
+    # Wild Central Management Interface
+    root /var/www/html/wild-central;
+    index index.html;
+
+    # API proxy to wild-central service
+    location /api/ {
+        proxy_pass http://localhost:5055;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # SSE events proxy (long-lived connections)
+    location /api/v1/events {
+        proxy_pass http://localhost:5055;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+    }
+
+    # Static files - SPA routing support
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}

dist/debian/etc/systemd/system/wild-central-nftables-reload.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Apply Wild Central nftables rules
+Documentation=https://mywildcloud.org
+After=network.target nftables.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/wild-cloud.nft
+RemainAfterExit=no

dist/debian/etc/systemd/system/wild-central.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=Wild Central Service
+Documentation=https://mywildcloud.org
+After=network.target
+Wants=network.target
+
+[Service]
+Type=simple
+User=wildcloud
+Group=wildcloud
+ExecStart=/usr/bin/wild-central
+Restart=always
+RestartSec=5
+Environment=WILD_CENTRAL_DATA_DIR=/var/lib/wild-central
+Environment=WILD_CENTRAL_STATIC_DIR=/var/www/html/wild-central
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=wild-central
+
+# Security settings
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=yes
+ReadWritePaths=/etc/wild-central /var/lib/wild-central /var/log/wild-central /etc/dnsmasq.d /etc/systemd/resolved.conf.d /etc/haproxy /etc/nftables.d /etc/wireguard
+
+[Install]
+WantedBy=multi-user.target

dist/debian/etc/wild-central/config.yaml.example

@@ -0,0 +1,42 @@
+cloud:
+    router:
+        ip: 192.168.8.1
+    dnsmasq:
+        ip: 192.168.8.50
+        interface: eth0
+        # DHCP server (disabled by default — enable to take over DHCP from your router)
+        # dhcp:
+        #     enabled: false
+        #     rangeStart: "192.168.8.100"
+        #     rangeEnd: "192.168.8.200"
+        #     leaseTime: "24h"
+        #     gateway: ""      # defaults to cloud.router.ip
+        #     staticLeases:    # managed via POST /api/v1/dnsmasq/dhcp/static
+        #       - mac: "aa:bb:cc:dd:ee:ff"
+        #         ip: "192.168.8.10"
+        #         hostname: "node1"
+
+    # HAProxy ingress proxy — routes external traffic by SNI.
+    # Use POST /api/v1/haproxy/generate to apply after changing this config.
+    haproxy:
+        # Optional custom TCP routes for non-Wild Cloud services on your network.
+        # customRoutes:
+        #   - name: civil_ssh
+        #     port: 2222           # external listen port
+        #     backend: 192.168.8.10:22
+
+    # nftables host firewall — tracks ports HAProxy is serving.
+    # Set wanInterface to enable strict WAN filtering (drops all unrecognised inbound traffic).
+    # Leave unset for default accept-all policy (safe during initial setup).
+    # nftables:
+    #     wanInterface: eth0
+
+    # Dynamic DNS — updates DNS A records when your public IP changes.
+    # API token goes in secrets.yaml under cloudflare.apiToken.
+    # ddns:
+    #     enabled: false
+    #     provider: cloudflare
+    #     records:
+    #       - cloud.example.com
+    #       - cloud2.example.com
+    #     intervalMinutes: 5