Rewrite README as a short project front page; add a Nix flake

The README is now a landing page: the idea (a mesh VPN with no server, joined
with a network name and a secret), install and platform tables, exit nodes,
and a short build section. Implementation detail stays in docs/.

The flake builds tsng and the tray from source and ships a NixOS module
(services.tsunagi). Dist install notes now show the real `join -n -s` syntax,
and two links that pointed into the old README are redirected.

Co-Authored-By: Claude <noreply@anthropic.com>

nix/module.nix

@@ -0,0 +1,132 @@
+flake:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.tsunagi;
+  socket = "/run/tsunagi/agent.sock";
+in
+{
+  options.services.tsunagi = {
+    enable = lib.mkEnableOption "the tsunagi mesh agent";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default =
+        if cfg.tray.enable then
+          flake.packages.${pkgs.stdenv.hostPlatform.system}.tsunagi
+        else
+          flake.packages.${pkgs.stdenv.hostPlatform.system}.tsunagi-cli;
+      defaultText = lib.literalExpression "tsunagi.packages.\${system}.tsunagi (tsunagi-cli without the tray)";
+      description = "The tsunagi package to run.";
+    };
+
+    tray.enable = lib.mkEnableOption "the tray client, started with every graphical session";
+
+    users = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "alice" ];
+      description = ''
+        Users allowed to talk to the agent without sudo (`tsng status`, `tsng join`,
+        the tray). They are added to the `tsunagi` group.
+      '';
+    };
+
+    protocols = lib.mkOption {
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
+      default = null;
+      example = [
+        "wg-quic"
+        "wg"
+      ];
+      description = "Packet protocols for `tsng up --protocol`, best first. Null keeps the agent's default.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.tsunagi = { };
+    users.users = {
+      tsunagi = {
+        isSystemUser = true;
+        group = "tsunagi";
+        home = "/var/lib/tsunagi";
+        description = "tsunagi agent";
+      };
+    }
+    // lib.genAttrs cfg.users (_: {
+      extraGroups = [ "tsunagi" ];
+    });
+
+    systemd.services.tsunagi = {
+      description = "tsunagi mesh agent";
+      documentation = [ "https://github.com/house-of-vanity/tsunagi" ];
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      environment = {
+        TSUNAGI_STATE_DIR = "/var/lib/tsunagi";
+        TSUNAGI_CACHE_DIR = "/var/cache/tsunagi";
+        TSUNAGI_CONTROL_SOCKET = socket;
+        TSUNAGI_CONTROL_GROUP = "tsunagi";
+      };
+      serviceConfig = {
+        ExecStart = lib.concatStringsSep " " (
+          [ "${cfg.package}/bin/tsng up" ]
+          ++ lib.optional (cfg.protocols != null) "--protocol ${lib.concatStringsSep "," cfg.protocols}"
+        );
+        User = "tsunagi";
+        Group = "tsunagi";
+        AmbientCapabilities = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+        ];
+        CapabilityBoundingSet = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_BIND_SERVICE"
+        ];
+        StateDirectory = "tsunagi";
+        StateDirectoryMode = "0700";
+        CacheDirectory = "tsunagi";
+        RuntimeDirectory = "tsunagi";
+        RuntimeDirectoryMode = "0755";
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+    };
+
+    # Exit nodes: the agent looks for iptables only in fixed FHS directories.
+    systemd.tmpfiles.rules = [
+      "L+ /usr/bin/iptables - - - - ${pkgs.iptables}/bin/iptables"
+    ];
+
+    # Names of mesh members are served locally and handed to the system resolver.
+    services.resolved.enable = lib.mkDefault true;
+
+    # polkit decides by group, not capability, who may configure systemd-resolved.
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+          var allowed = [
+              "org.freedesktop.resolve1.set-dns-servers",
+              "org.freedesktop.resolve1.set-domains",
+              "org.freedesktop.resolve1.set-default-route",
+              "org.freedesktop.resolve1.revert"
+          ];
+          if (allowed.indexOf(action.id) >= 0 && subject.isInGroup("tsunagi")) {
+              return polkit.Result.YES;
+          }
+      });
+    '';
+
+    environment.systemPackages = [ cfg.package ];
+    environment.sessionVariables.TSUNAGI_CONTROL_SOCKET = socket;
+
+    environment.etc."xdg/autostart/tsunagi-tray.desktop" = lib.mkIf cfg.tray.enable {
+      source = "${cfg.package}/share/applications/tsunagi-tray.desktop";
+    };
+  };
+}

nix/package.nix

@@ -0,0 +1,94 @@
+{
+  withTray ? true,
+  lib,
+  rustPlatform,
+  pkg-config,
+  copyDesktopItems,
+  wrapGAppsHook3,
+  gtk3,
+  libayatana-appindicator,
+  libglvnd,
+  libxkbcommon,
+  vulkan-loader,
+  wayland,
+  xdotool,
+  libx11,
+  libxcursor,
+  libxi,
+  libxrandr,
+}:
+
+let
+  # The tray is an egui app that loads graphics, windowing and appindicator
+  # libraries at run time, so they have to be put on its library path by hand.
+  trayRuntimeLibs = [
+    libayatana-appindicator
+    libglvnd
+    libxkbcommon
+    vulkan-loader
+    wayland
+    libx11
+    libxcursor
+    libxi
+    libxrandr
+  ];
+in
+rustPlatform.buildRustPackage {
+  pname = if withTray then "tsunagi" else "tsunagi-cli";
+  version = "0.1.0";
+
+  src = lib.cleanSource ../.;
+  cargoLock.lockFile = ../Cargo.lock;
+
+  cargoBuildFlags = [
+    "--bin"
+    "tsng"
+  ]
+  ++ lib.optionals withTray [
+    "--bin"
+    "tsunagi-tray"
+  ];
+
+  # The suite opens real sockets and interfaces; it runs in CI instead.
+  doCheck = false;
+
+  nativeBuildInputs = [ pkg-config ] ++ lib.optionals withTray [
+    copyDesktopItems
+    wrapGAppsHook3
+  ];
+  buildInputs = lib.optionals withTray [
+    gtk3
+    libayatana-appindicator
+    xdotool
+  ];
+
+  dontWrapGApps = true;
+
+  postInstall = ''
+    install -Dm644 dist/linux/50-tsunagi-resolved.rules \
+      "$out/share/doc/tsunagi/50-tsunagi-resolved.rules"
+  ''
+  + lib.optionalString withTray ''
+    install -Dm644 dist/linux/tsunagi.svg \
+      "$out/share/icons/hicolor/scalable/apps/tsunagi.svg"
+    install -Dm644 dist/linux/tsunagi-tray.desktop \
+      "$out/share/applications/tsunagi-tray.desktop"
+  '';
+
+  postFixup = lib.optionalString withTray ''
+    wrapProgram "$out/bin/tsunagi-tray" \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath trayRuntimeLibs}:/run/opengl-driver/lib
+  '';
+
+  meta = {
+    description = "Serverless mesh VPN: join a network with a name and a secret";
+    homepage = "https://github.com/house-of-vanity/tsunagi";
+    license = lib.licenses.wtfpl;
+    mainProgram = "tsng";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+  };
+}