feat: add declarative sing-box egress control plane

2026-08-27 00:58:52 +05:00
commit b8d19b2c3e
54 changed files with 3337 additions and 0 deletions
@@ -0,0 +1,5 @@
+vpn-egressctl (0.1.0) unstable; urgency=medium
+
+  * Initial release for sing-box 1.13.19.
+
+ -- Flamy Studio <dev@flamy.studio>  Thu, 27 Aug 2026 00:00:00 +0500
@@ -0,0 +1,14 @@
+Source: vpn-egressctl
+Section: net
+Priority: optional
+Maintainer: Flamy Studio <dev@flamy.studio>
+Build-Depends: debhelper-compat (= 13), dh-python, pybuild-plugin-pyproject, python3-all, python3-setuptools, python3-wheel
+Standards-Version: 4.7.2
+Rules-Requires-Root: no
+
+Package: vpn-egressctl
+Architecture: all
+Depends: ${misc:Depends}, ${python3:Depends}, python3 (>= 3.13), sing-box (= 1.13.19), systemd, nftables, iproute2
+Description: declarative control plane for the sing-box VPN egress gateway
+ Generates, validates and transactionally applies the complete sing-box
+ configuration from a protected Hysteria2 URI and a versioned local policy.
@@ -0,0 +1,8 @@
+docs/architecture.md
+docs/configuration.md
+docs/migration.md
+docs/operations.md
+docs/security.md
+docs/troubleshooting.md
+docs/testing.md
+docs/sing-box-1.14.md
@@ -0,0 +1,4 @@
+config/policy.json usr/share/vpn-egressctl
+packaging/systemd/vpn-egress-guard.service usr/lib/systemd/system
+packaging/systemd/vpn-egress-sync.service usr/lib/systemd/system
+packaging/systemd/vpn-egress-sync.path usr/lib/systemd/system
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+if [ "$1" = configure ]; then
+    install -d -m 0700 -o root -g root /etc/vpn-egress
+    install -d -m 0700 -o root -g root /var/lib/vpn-egress /var/lib/vpn-egress/backups
+    if [ ! -e /etc/vpn-egress/policy.json ]; then
+        install -m 0600 -o root -g root /usr/share/vpn-egressctl/policy.json /etc/vpn-egress/policy.json
+    fi
+    systemctl daemon-reload >/dev/null 2>&1 || true
+fi
+
+# Watcher activation is deliberately left to the documented migration step.
+exit 0
@@ -0,0 +1,7 @@
+#!/bin/sh
+set -eu
+
+systemctl daemon-reload >/dev/null 2>&1 || true
+
+# Secrets, policy and last-good backups are deliberately preserved.
+exit 0
@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+
+if [ "$1" = remove ]; then
+    systemctl stop vpn-egress-sync.path >/dev/null 2>&1 || true
+    systemctl disable vpn-egress-sync.path vpn-egress-guard.service >/dev/null 2>&1 || true
+fi
+
+exit 0
@@ -0,0 +1,7 @@
+#!/usr/bin/make -f
+
+%:
+	dh $@ --with python3 --buildsystem=pybuild
+
+override_dh_installsystemd:
+	dh_installsystemd --no-start --no-enable
@@ -0,0 +1 @@
+3.0 (native)