mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
eaba693b18
The generic systemd install tarball is the catch-all install path
for systemd Linux distros that don't have a per-format package
(Fedora, RHEL/CentOS, openSUSE, Alpine, etc.). It had drifted
behind the .deb and AUR packages and was missing fips-gateway, the
mesh-interface firewall baseline, and the multi-backend DNS helper
in the shipped tarball. Bring it to parity:
- New `packaging/systemd/fips-gateway.service` (clone of the .deb
unit; ExecStart pointed at `/usr/local/bin/fips-gateway`). Not
enabled at install time; operator opt-in.
- New `packaging/systemd/fips-firewall.service` (clone of the .deb
unit; nft path unchanged at `/usr/sbin/nft`). Not enabled at
install time; operator opt-in.
- `build-tarball.sh` now bundles the `fips-gateway` binary, the two
new units, the `fips.nft` baseline conffile, and the
`fips-dns-setup` / `fips-dns-teardown` multi-backend helpers from
`packaging/common/`.
- `install.sh` now installs `fips-gateway` to `/usr/local/bin/`,
installs both new units to `/etc/systemd/system/` (without
enabling them), preserves `/etc/fips/fips.nft` on upgrade like
`fips.yaml`, and creates the `/etc/fips/fips.d/` operator drop-in
directory. Post-install messaging mentions both opt-in services.
- `uninstall.sh` stops and disables the optional services in
dependency order (firewall, gateway, dns, daemon), removes the
new unit files, and removes the gateway binary. `--purge` already
handles `/etc/fips/` removal which covers `fips.nft` and
`fips.d/`.
- `README.install.md` documents all of the above: expanded
"What Gets Installed" table, new sections covering the firewall
baseline and the LAN gateway, refreshed DNS section reflecting
the multi-backend setup helper (systemd dns-delegate /
systemd-resolved drop-in / per-link resolvectl / dnsmasq /
NetworkManager-dnsmasq), and updated Service Management.
Also fixes a latent packaging bug: `install.sh` previously
referenced `${SCRIPT_DIR}/../common/fips-dns-setup`, a path that
exists only in the source-repo layout and not in the extracted
tarball. The script now resolves the helper from the staging
directory first (the tarball case), falling back to the source-repo
relative path. Bug latent since the multi-backend DNS helpers
landed.
CHANGELOG `[Unreleased]` documents the parity bump under Changed
and the path-resolution fix under Fixed.
Closes the longest-standing parity gap for non-Debian / non-Arch
systemd Linux distros installing from the release-distribution
tarball.
34 lines
1.3 KiB
Desktop File
34 lines
1.3 KiB
Desktop File
# Gateway is not enabled by default. Enable with: systemctl enable --now fips-gateway
|
|
[Unit]
|
|
Description=FIPS Outbound LAN Gateway
|
|
After=fips.service
|
|
Requires=fips.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Wait up to 30s for the fips daemon's TUN to come up before launching
|
|
# the gateway. fips-gateway hard-fails on a missing fips0 interface; with
|
|
# Requires=fips.service the daemon unit is started, but the TUN device
|
|
# itself is brought up some time after the daemon process starts. Without
|
|
# this wait the gateway's first ExecStart tends to lose a race on fresh
|
|
# boot, exit, and rely on Restart=on-failure for ~5s of recovery. Bounded
|
|
# wait avoids the noisy restart cycle while still surfacing real failures
|
|
# (if fips0 never appears, the wait expires and the gateway's existing
|
|
# error path runs).
|
|
ExecStartPre=/bin/sh -c 'for i in $(seq 1 30); do ip link show fips0 >/dev/null 2>&1 && exit 0; sleep 1; done; echo "fips0 did not appear within 30s" >&2; exit 1'
|
|
ExecStart=/usr/local/bin/fips-gateway --config /etc/fips/fips.yaml
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
TimeoutStopSec=15
|
|
|
|
# Security hardening (needs CAP_NET_ADMIN for nftables and proxy NDP)
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=no
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|