5 Commits

Include renames

Author	SHA1	Message	Date
iBug	7a220c6cd7	chore: Create /etc/gost directory with package manager	2026-09-24 10:32:53 +08:00
iBug	e9fab95872	Add back SystemCallFilter=@chown (#907) ... Otherwise lumberjack will fail to rotate log files Ref: https://github.com/natefinch/lumberjack/pull/43/changes#diff-7a80b3353ee34c4b79751e1e47e5010af54e82f393aa112770a4d1a731e70ba2R480	2026-09-22 22:06:55 +08:00
ginuerzh	bb45b12809	fix(release): use DynamicUser for gost.service ... systemd-analyze verify warns "Special user nobody configured, this is not safe!": nobody is a shared account, so any other service running as it can read and write /run/gost. DynamicUser= gives the unit its own transient identity, named gost, without adding a static user to the package. Verified under a real systemd: the unit starts, binds :80 through the ambient capabilities, runs as the dynamic user, and is skipped rather than failed when /etc/gost/gost.yml is absent.	2026-09-21 21:15:33 +08:00
ginuerzh	c4e789e2df	fix(release): pin capability bounding set in gost.service ... CapabilityBoundingSet= was dropped when CAP_NET_ADMIN was added for TUN, which leaves the bounding set unrestricted. Pin it to the capabilities the unit actually needs. Restore ~@privileged as well: TUN uses ioctl(TUNSETIFF) and netlink, neither of which is in that group.	2026-09-21 21:03:43 +08:00
iBug	2a6ba4df85	Add DEB and RPM packages for easier installation (#906) ... * Add systemd service file * Add DEB and RPM packages for amd64, amd64v3 and arm64 architectures * Remove GOMEMLIMIT from systemd service * Fix packaged systemd service defaults	2026-09-21 21:01:26 +08:00