mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
74e9d465a8
Packaging directory structure: - packaging/common/ — shared config (fips.yaml) used by all formats - packaging/systemd/ — systemd-specific installer and service units Systemd packaging includes: - build-tarball.sh: builds release binaries and creates a self-contained install tarball with stripped binaries - fips.service: systemd unit running the daemon with security hardening - fips-dns.service: oneshot unit configuring resolvectl to route .fips domain queries to the FIPS DNS shim on 127.0.0.1:5354 - install.sh: deploys binaries to /usr/local/bin, installs systemd units, creates fips group for non-root control socket access - uninstall.sh: removes service and binaries, optional --purge for config and identity key files - README.install.md: installation and configuration guide Default config enables UDP (2121), TCP inbound (8443), TUN, and DNS resolver. Identity is ephemeral by default for privacy; operators can uncomment persistent: true to maintain a stable npub for static peer publishing. Ethernet transport is commented out for per-node setup.
29 lines
682 B
Desktop File
29 lines
682 B
Desktop File
[Unit]
|
|
Description=FIPS Mesh Network Daemon
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/bin/fips --config /etc/fips/fips.yaml
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Logging: RUST_LOG controls verbosity.
|
|
# Use "info" for production, "debug" for troubleshooting.
|
|
Environment=RUST_LOG=info
|
|
|
|
# Control socket directory (/run/fips/).
|
|
# Group-readable so 'fips' group members can use fipsctl/fipstop.
|
|
RuntimeDirectory=fips
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Security hardening (daemon runs as root for TUN and raw sockets)
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=no
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|