Rename wild-cloud → wild-central for all managed config files and nftables table

Completes the naming separation: nftables table, rules file, dnsmasq config,
resolved config, systemd unit, sudoers rule, and temp files now all use
the wild-central name.

internal/nftables/manager.go

@@ -11,7 +11,7 @@ import (
 	"github.com/wild-cloud/wild-central/internal/storage"
 )
 
-const defaultRulesPath = "/etc/nftables.d/wild-cloud.nft"
+const defaultRulesPath = "/etc/nftables.d/wild-central.nft"
 
 // Manager handles nftables rule generation and application
 type Manager struct {
@@ -68,15 +68,15 @@ func (m *Manager) Generate(haproxyPorts []int, extraTCPPorts []int, extraUDPPort
 
 	var sb strings.Builder
 
-	sb.WriteString("# Wild Cloud nftables rules\n")
-	sb.WriteString("# Managed by Wild Cloud Central API — do not edit manually\n\n")
+	sb.WriteString("# Wild Central nftables rules\n")
+	sb.WriteString("# Managed by Wild Central — do not edit manually\n\n")
 
 	// Delete and recreate the table so re-applying never accumulates stale set elements.
 	// The first line ensures the table exists (so delete never errors on first run).
-	sb.WriteString("table inet wild-cloud {}\n")
-	sb.WriteString("delete table inet wild-cloud\n\n")
+	sb.WriteString("table inet wild-central {}\n")
+	sb.WriteString("delete table inet wild-central\n\n")
 
-	sb.WriteString("table inet wild-cloud {\n")
+	sb.WriteString("table inet wild-central {\n")
 	sb.WriteString("    # TCP ports allowed through the firewall (HAProxy + extra TCP)\n")
 	sb.WriteString("    set allowed_tcp_ports {\n")
 	sb.WriteString("        type inet_service\n")
@@ -148,7 +148,7 @@ func ValidateWANInterface(name string) error {
 // On apply failure, rolls back to the previous rules.
 func (m *Manager) SafeApply(content string) error {
 	// Validate syntax
-	tmpFile := "/tmp/wild-cloud-nft-safeapply.tmp"
+	tmpFile := "/tmp/wild-central-nft-safeapply.tmp"
 	if err := os.WriteFile(tmpFile, []byte(content), 0644); err != nil {
 		return fmt.Errorf("writing validation file: %w", err)
 	}
@@ -204,7 +204,7 @@ func (m *Manager) verify() error {
 // Validation uses a temp file in /tmp (world-writable) to avoid needing
 // write permission on the /etc/nftables.d/ directory itself.
 func (m *Manager) WriteRules(content string) error {
-	tempFile := "/tmp/wild-cloud-nft-validate.tmp"
+	tempFile := "/tmp/wild-central-nft-validate.tmp"
 
 	if err := os.WriteFile(tempFile, []byte(content), 0644); err != nil {
 		return fmt.Errorf("writing temp rules: %w", err)
@@ -224,9 +224,9 @@ func (m *Manager) WriteRules(content string) error {
 }
 
 // ApplyRules loads the rules file into the kernel via a systemd oneshot service.
-// The wildcloud user has polkit permission to start wild-cloud-nftables-reload.service.
+// The wildcloud user has polkit permission to start wild-central-nftables-reload.service.
 func (m *Manager) ApplyRules() error {
-	cmd := exec.Command("systemctl", "start", "wild-cloud-nftables-reload.service")
+	cmd := exec.Command("systemctl", "start", "wild-central-nftables-reload.service")
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("applying nftables rules: %w (output: %s)", err, string(output))
@@ -235,13 +235,13 @@ func (m *Manager) ApplyRules() error {
 	return nil
 }
 
-// WriteDisabledRules writes a rules file that flushes the wild-cloud table,
-// removing all Wild Cloud firewall rules from the kernel when applied.
+// WriteDisabledRules writes a rules file that flushes the wild-central table,
+// removing all Wild Central firewall rules from the kernel when applied.
 func (m *Manager) WriteDisabledRules() error {
-	content := "# Wild Cloud nftables rules — firewall disabled\n" +
-		"# Managed by Wild Cloud Central API — do not edit manually\n\n" +
-		"table inet wild-cloud {}\n" +
-		"delete table inet wild-cloud\n"
+	content := "# Wild Central nftables rules — firewall disabled\n" +
+		"# Managed by Wild Central — do not edit manually\n\n" +
+		"table inet wild-central {}\n" +
+		"delete table inet wild-central\n"
 	if err := storage.WriteFileAtomic(m.rulesPath, []byte(content), 0644); err != nil {
 		return fmt.Errorf("writing disabled rules file: %w", err)
 	}
@@ -249,10 +249,10 @@ func (m *Manager) WriteDisabledRules() error {
 	return nil
 }
 
-// GetStatus returns the current wild-cloud nftables table as a string.
+// GetStatus returns the current wild-central nftables table as a string.
 // Uses sudo to allow the wildcloud user to read kernel state.
 func (m *Manager) GetStatus() (string, error) {
-	cmd := exec.Command("sudo", "nft", "list", "table", "inet", "wild-cloud")
+	cmd := exec.Command("sudo", "nft", "list", "table", "inet", "wild-central")
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		// Table may not exist yet — not an error

internal/nftables/manager_test.go

@@ -13,9 +13,9 @@ func TestNewManager_DefaultPath(t *testing.T) {
 }
 
 func TestNewManager_CustomPath(t *testing.T) {
-	m := NewManager("/tmp/wild-cloud.nft")
-	if m.GetRulesPath() != "/tmp/wild-cloud.nft" {
-		t.Errorf("got %q, want /tmp/wild-cloud.nft", m.GetRulesPath())
+	m := NewManager("/tmp/wild-central.nft")
+	if m.GetRulesPath() != "/tmp/wild-central.nft" {
+		t.Errorf("got %q, want /tmp/wild-central.nft", m.GetRulesPath())
 	}
 }
 
@@ -40,7 +40,7 @@ func TestGenerate_AlwaysIncludesStructure(t *testing.T) {
 	out := m.Generate([]int{80, 443}, nil, nil, "")
 
 	for _, want := range []string{
-		"table inet wild-cloud",
+		"table inet wild-central",
 		"set allowed_tcp_ports",
 		"chain input",
 		"type filter hook input priority filter; policy accept;",