checkpoint: implement wgcloak v1 foundations

packaging/systemd/wgcloak-client.service

@@ -0,0 +1,39 @@
+[Unit]
+Description=wgcloak UDP transport client
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=wgcloak
+Group=wgcloak
+ExecStart=/usr/bin/wgcloak client --config /etc/wgcloak/client.toml
+Restart=on-failure
+RestartSec=2s
+TimeoutStopSec=15s
+UMask=0077
+
+# Keep the control socket in a private runtime directory.
+RuntimeDirectory=wgcloak-client
+RuntimeDirectoryMode=0750
+Environment=XDG_RUNTIME_DIR=/run/wgcloak-client
+
+# Process and filesystem hardening. Review paths if the deployment changes.
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target

packaging/systemd/wgcloak-server.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=wgcloak UDP transport server
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=wgcloak
+Group=wgcloak
+ExecStart=/usr/bin/wgcloak server --config /etc/wgcloak/server.toml
+Restart=on-failure
+RestartSec=2s
+TimeoutStopSec=15s
+UMask=0077
+
+# Keep the control socket in a private runtime directory.
+RuntimeDirectory=wgcloak-server
+RuntimeDirectoryMode=0750
+Environment=XDG_RUNTIME_DIR=/run/wgcloak-server
+
+# Process and filesystem hardening. Review paths if the deployment changes.
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+
+# Ports below 1024 require this optional capability. Leave commented for the
+# normal unprivileged configuration. Keep the bounding set this narrow.
+# AmbientCapabilities=CAP_NET_BIND_SERVICE
+# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target