Add top-level packaging Makefile and README

packaging/Makefile

@@ -0,0 +1,31 @@
+# FIPS Packaging Makefile
+#
+# Builds release packages for supported target platforms.
+# All outputs are placed in deploy/ at the project root.
+#
+# Usage:
+#   make deb        Build a Debian/Ubuntu .deb package
+#   make tarball    Build a systemd install tarball
+#   make ipk        Build an OpenWrt .ipk package
+#   make all        Build deb and tarball (default)
+#   make clean      Remove deploy/ directory
+
+SHELL := /bin/bash
+PACKAGING_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+PROJECT_ROOT  := $(abspath $(PACKAGING_DIR)/..)
+
+.PHONY: all deb tarball ipk clean
+
+all: deb tarball
+
+deb:
+	@bash $(PACKAGING_DIR)/debian/build-deb.sh
+
+tarball:
+	@bash $(PACKAGING_DIR)/systemd/build-tarball.sh
+
+ipk:
+	@bash $(PACKAGING_DIR)/openwrt/build-ipk.sh
+
+clean:
+	rm -rf $(PROJECT_ROOT)/deploy

packaging/README.md

@@ -0,0 +1,86 @@
+# FIPS Packaging
+
+This directory contains packaging for all supported target platforms.
+All build outputs go to `deploy/` at the project root.
+
+## Quick Start
+
+```sh
+make deb        # Debian/Ubuntu .deb
+make tarball    # systemd install tarball
+make ipk        # OpenWrt .ipk
+make all        # deb + tarball (default)
+```
+
+## Directory Structure
+
+```text
+packaging/
+  common/         Shared assets (default config, hosts file)
+  debian/         Debian/Ubuntu .deb packaging via cargo-deb
+  systemd/        Generic Linux systemd tarball packaging
+  openwrt/        OpenWrt .ipk packaging via cargo-zigbuild
+```
+
+## Formats
+
+### Debian/Ubuntu (`.deb`)
+
+Built with [cargo-deb](https://github.com/kornelski/cargo-deb). Installs
+`fips`, `fipsctl`, and `fipstop` to `/usr/bin/`, places config at
+`/etc/fips/fips.yaml` (preserved on upgrade), and enables the systemd
+service.
+
+```sh
+# Build
+make deb
+
+# Install
+sudo dpkg -i deploy/fips_<version>_<arch>.deb
+
+# Remove (preserves config and keys)
+sudo dpkg -r fips
+
+# Purge (removes config and identity keys)
+sudo dpkg -P fips
+```
+
+### systemd Tarball
+
+A self-contained tarball with binaries and an `install.sh` script for
+any systemd-based Linux distribution.
+
+```sh
+# Build
+make tarball
+
+# Install (on target host)
+tar -xzf deploy/fips-<version>-linux-<arch>.tar.gz
+sudo ./fips-<version>-linux-<arch>/install.sh
+```
+
+See [systemd/README.install.md](systemd/README.install.md) for full
+installation and configuration instructions.
+
+### OpenWrt (`.ipk`)
+
+Cross-compiled with cargo-zigbuild and assembled as a standard `.ipk`
+archive. Supports aarch64, mipsel, mips, arm, and x86\_64 targets.
+
+```sh
+# Build (default: aarch64)
+make ipk
+
+# Build for a specific architecture
+bash packaging/openwrt/build-ipk.sh --arch mipsel
+```
+
+See [openwrt/README.md](openwrt/README.md) for router-specific
+installation instructions.
+
+## Shared Assets
+
+`common/` contains assets used across packaging formats:
+
+- `fips.yaml` — default configuration (ephemeral identity, UDP/TCP/TUN/DNS)
+- `hosts` — static hostname-to-npub mappings for `.fips` DNS resolution