Replace WireGuard prototype with native host service and scoped access

server.py

@@ -173,6 +173,9 @@ class Handler(BaseHTTPRequestHandler):
 
     def ingress(self):
         token = os.environ.get('DECK_PROXY_TOKEN', '')
+        if os.environ.get('DECK_PROXY_TOKEN_FILE'):
+            try:token=Path(os.environ['DECK_PROXY_TOKEN_FILE']).read_text().strip()
+            except OSError:pass
         if token and secrets.compare_digest(self.headers.get('X-Deck-Proxy', ''), token):
             return self.headers.get('X-Deck-Ingress', 'management')
         return 'management'
@@ -288,6 +291,8 @@ class Handler(BaseHTTPRequestHandler):
     def valid_host(self):
         if os.environ.get('DECK_PROXY_TOKEN'):
             return self.ingress() in ('lan','tunnel')
+        if os.environ.get('DECK_PROXY_TOKEN_FILE') and self.ingress() in ('lan','tunnel'):
+            return True
         allowed = {f'127.0.0.1:{self.server.server_port}', f'localhost:{self.server.server_port}'}
         allowed.update(filter(None,os.environ.get('DECK_ALLOWED_HOSTS','').split(',')))
         return self.headers.get('Host') in allowed
@@ -715,7 +720,7 @@ class Handler(BaseHTTPRequestHandler):
                     if set(data) != fields:
                         raise ValueError('Ungültige Netzwerkparameter.')
                     if action == 'import':
-                        parse_config(data.get('config'))
+                        parse_config(data.get('config'),native=self.server.network.native)
                     result = self.server.network.call(action, data, self.ingress())
                     self.server.network.cached = None
                 return self.respond(result)