feat: add declarative sing-box egress control plane

2026-08-27 00:58:52 +05:00
commit b8d19b2c3e
54 changed files with 3337 additions and 0 deletions
@@ -0,0 +1,27 @@
+[Unit]
+Description=Block direct leaks from the VPN LAN to the upstream interface
+Before=sing-box.service vpn-egress-sync.service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/vpn-egressctl guard-apply
+RemainAfterExit=yes
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+RestrictAddressFamilies=AF_UNIX AF_NETLINK
+ReadOnlyPaths=/etc/vpn-egress/policy.json
+CapabilityBoundingSet=CAP_NET_ADMIN
+AmbientCapabilities=CAP_NET_ADMIN
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,10 @@
+[Unit]
+Description=Watch the Hysteria2 desired-state source
+After=network-online.target
+
+[Path]
+PathChanged=/etc/vpn-egress/hysteria2.uri
+Unit=vpn-egress-sync.service
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,30 @@
+[Unit]
+Description=Reconcile sing-box VPN egress configuration
+After=network-online.target vpn-egress-guard.service
+Wants=network-online.target
+Requires=vpn-egress-guard.service
+ConditionPathExists=/etc/vpn-egress/hysteria2.uri
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+ExecStart=/usr/bin/vpn-egressctl sync
+UMask=0077
+StateDirectory=vpn-egress
+StateDirectoryMode=0700
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+ReadWritePaths=/etc/vpn-egress /etc/sing-box /var/lib/vpn-egress /run/lock
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_DAC_READ_SEARCH