mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
74e9d465a8
Packaging directory structure: - packaging/common/ — shared config (fips.yaml) used by all formats - packaging/systemd/ — systemd-specific installer and service units Systemd packaging includes: - build-tarball.sh: builds release binaries and creates a self-contained install tarball with stripped binaries - fips.service: systemd unit running the daemon with security hardening - fips-dns.service: oneshot unit configuring resolvectl to route .fips domain queries to the FIPS DNS shim on 127.0.0.1:5354 - install.sh: deploys binaries to /usr/local/bin, installs systemd units, creates fips group for non-root control socket access - uninstall.sh: removes service and binaries, optional --purge for config and identity key files - README.install.md: installation and configuration guide Default config enables UDP (2121), TCP inbound (8443), TUN, and DNS resolver. Identity is ephemeral by default for privacy; operators can uncomment persistent: true to maintain a stable npub for static peer publishing. Ethernet transport is commented out for per-node setup.
76 lines
1.8 KiB
Bash
Executable File
76 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# FIPS Uninstall Script
|
|
#
|
|
# Removes the FIPS daemon, service, and optionally configuration.
|
|
#
|
|
# Usage: sudo ./uninstall.sh [--purge]
|
|
# --purge Also remove /etc/fips/ and the fips system group
|
|
|
|
set -euo pipefail
|
|
|
|
PURGE=false
|
|
if [ "${1:-}" = "--purge" ]; then
|
|
PURGE=true
|
|
fi
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "Error: This script must be run as root (use sudo)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# --- Stop and disable service ---
|
|
|
|
if systemctl is-active --quiet fips-dns.service 2>/dev/null; then
|
|
echo "Stopping fips-dns service..."
|
|
systemctl stop fips-dns.service
|
|
fi
|
|
|
|
if systemctl is-enabled --quiet fips-dns.service 2>/dev/null; then
|
|
systemctl disable fips-dns.service
|
|
fi
|
|
|
|
if systemctl is-active --quiet fips.service 2>/dev/null; then
|
|
echo "Stopping fips service..."
|
|
systemctl stop fips.service
|
|
fi
|
|
|
|
if systemctl is-enabled --quiet fips.service 2>/dev/null; then
|
|
systemctl disable fips.service
|
|
fi
|
|
|
|
# --- Remove systemd units ---
|
|
|
|
rm -f /etc/systemd/system/fips.service
|
|
rm -f /etc/systemd/system/fips-dns.service
|
|
systemctl daemon-reload
|
|
echo "systemd units removed."
|
|
|
|
# --- Remove tmpfiles.d entry ---
|
|
|
|
rm -f /etc/tmpfiles.d/fips.conf
|
|
|
|
# --- Remove binaries ---
|
|
|
|
rm -f /usr/local/bin/fips /usr/local/bin/fipsctl /usr/local/bin/fipstop
|
|
echo "Binaries removed."
|
|
|
|
# --- Optionally remove configuration and group ---
|
|
|
|
if $PURGE; then
|
|
echo "Purging /etc/fips/ (including identity key files)..."
|
|
rm -rf /etc/fips/
|
|
|
|
if getent group fips &>/dev/null; then
|
|
groupdel fips
|
|
echo "System group 'fips' removed."
|
|
fi
|
|
|
|
echo "Configuration and group removed."
|
|
else
|
|
echo "Configuration and identity preserved at /etc/fips/"
|
|
echo " Use --purge to remove everything (including key files and group)."
|
|
fi
|
|
|
|
echo ""
|
|
echo "Uninstall complete."
|