mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 08:14:42 +00:00
Origami74andJohnathan Corgan
1e4f375dcc
Add fips-gateway binary to CI artifact and Docker build. Systemd service unit with After=fips.service dependency and security hardening. Debian and AUR package entries. OpenWrt packaging: procd init script managing dnsmasq forwarding, proxy NDP, RA route advertisements for the virtual IP pool, and a global IPv6 prefix on br-lan to work around Android suppressing AAAA queries on ULA-only networks. Sysctl config for IPv6 forwarding. Gateway enabled by default in OpenWrt config. Ethernet transport enabled by default. Default gateway config section (commented out) in common fips.yaml.
24 lines
541 B
Desktop File
24 lines
541 B
Desktop File
# Gateway is not enabled by default. Enable with: systemctl enable --now fips-gateway
|
|
[Unit]
|
|
Description=FIPS Outbound LAN Gateway
|
|
After=fips.service
|
|
Requires=fips.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/fips-gateway --config /etc/fips/fips.yaml
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
TimeoutStopSec=15
|
|
|
|
# Security hardening (needs CAP_NET_ADMIN for nftables and proxy NDP)
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=no
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|