UltradesuandClaude Opus 4.8
63178574ce
Release / tsunagi-linux-aarch64 (push) Successful in 2m39s
Release / tsunagi-linux-x86_64 (push) Successful in 2m32s
Release / tsunagi-macos-aarch64 (push) Canceled after 0s
Release / tsunagi-windows-x86_64 (push) Canceled after 0s
Release / Publish release (push) Canceled after 0s
Reworks the Linux packaging so the service runs as an unprivileged, dedicated "tsunagi" user instead of root — the point of a native package is to set things up properly for that OS's users — and adds Arch Linux packages beside the deb. Both package families are built from the already-compiled static binary; nothing is recompiled. Service model (shared systemd unit, dist/linux/tsunagi.service): - User=tsunagi with AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE, so it creates the TUN and binds low ports without root. - StateDirectory/CacheDirectory/RuntimeDirectory give it /var/lib/tsunagi, /var/cache/tsunagi and /run/tsunagi, and the agent is pointed at them (and the socket at /run/tsunagi/agent.sock) through TSUNAGI_* env in the unit. - The polkit rule now grants the resolve1 actions to the "tsunagi" group; the service user is in it, and admins can add themselves. CLI: when no state dir is chosen, the control commands prefer the system service's socket at /run/tsunagi/agent.sock when it exists, so `sudo tsunagi status`/`join` reach the packaged daemon with no flags. A per-user agent (its socket absent from /run) still uses its own. Packaging: - deb (build-deb.sh): postinst now creates the tsunagi system user+group; unit installed to /lib/systemd/system, binary to /usr/bin. - Arch (new dist/arch/build-pkg.sh): a dependency-free .pkg.tar.zst assembled with bsdtar + zstd (no makepkg, no Arch host) — .PKGINFO, a .INSTALL scriptlet that creates the user and reloads systemd, and a gzipped .MTREE; unit to /usr/lib/systemd/system. - The polkit rule moved to dist/linux (shared by deb, Arch and the tarball), and the tarball install.sh now creates the user and installs the unit + rule. - Both release workflows build the deb and the Arch package on the two Linux matrix entries (deb_arch/pkg_arch), install libarchive-tools+zstd for it, and attach both to the release (Gitea API loop / gh). Not exercised in this session: the .deb and .pkg.tar.zst build and install only on Linux (no dpkg-deb/bsdtar+pacman locally); CLI build, clippy, fmt and tests pass, and all shell/YAML is syntax-checked. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
2.3 KiB
Bash
Executable File
66 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# Installs the static tsunagi binary and, where systemd is present, a service
|
|
# that runs the agent as a dedicated unprivileged "tsunagi" user. Run as root:
|
|
#
|
|
# sudo ./install.sh
|
|
#
|
|
# PREFIX overrides the install prefix (default /usr/local); if you change it,
|
|
# edit ExecStart in tsunagi.service to match.
|
|
set -eu
|
|
|
|
PREFIX="${PREFIX:-/usr/local}"
|
|
here="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "This installer writes to ${PREFIX}/bin and /etc; re-run it as root (sudo)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Installing tsunagi to ${PREFIX}/bin"
|
|
install -d "${PREFIX}/bin"
|
|
install -m 0755 "${here}/tsunagi" "${PREFIX}/bin/tsunagi"
|
|
|
|
# The dedicated system user the service runs as (works with either shadow's
|
|
# useradd or Debian's adduser).
|
|
if ! getent group tsunagi >/dev/null 2>&1; then
|
|
groupadd -r tsunagi 2>/dev/null || addgroup --system tsunagi 2>/dev/null || true
|
|
fi
|
|
if ! getent passwd tsunagi >/dev/null 2>&1; then
|
|
useradd -r -g tsunagi -d /var/lib/tsunagi -s /usr/sbin/nologin -c "tsunagi agent" tsunagi 2>/dev/null \
|
|
|| adduser --system --ingroup tsunagi --home /var/lib/tsunagi --no-create-home \
|
|
--gecos "tsunagi agent" --disabled-login tsunagi 2>/dev/null || true
|
|
fi
|
|
|
|
# polkit rule so the agent (as the tsunagi user) may configure systemd-resolved.
|
|
install -d /etc/polkit-1/rules.d
|
|
install -m 0644 "${here}/50-tsunagi-resolved.rules" /etc/polkit-1/rules.d/50-tsunagi-resolved.rules
|
|
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
echo "Installing the systemd service (runs as the tsunagi user)"
|
|
install -m 0644 "${here}/tsunagi.service" /etc/systemd/system/tsunagi.service
|
|
systemctl daemon-reload
|
|
cat <<EOF
|
|
|
|
Done. Start the agent with:
|
|
|
|
sudo systemctl enable --now tsunagi
|
|
|
|
Control it with sudo (the CLI finds the service's socket automatically):
|
|
|
|
sudo tsunagi status
|
|
sudo tsunagi join <network-name> <tsn1…secret>
|
|
EOF
|
|
else
|
|
cat <<EOF
|
|
|
|
Installed the binary; no systemd found, so no service was set up. Either:
|
|
|
|
* run it as root: sudo ${PREFIX}/bin/tsunagi up
|
|
* or as your own user: sudo setcap cap_net_admin,cap_net_bind_service+p ${PREFIX}/bin/tsunagi
|
|
tsunagi up
|
|
(add yourself to the tsunagi group so the resolver works:
|
|
sudo usermod -aG tsunagi "\$USER")
|
|
* or without touching the OS: tsunagi up --no-tun
|
|
EOF
|
|
fi
|