feat: add declarative sing-box egress control plane

2026-08-27 00:58:52 +05:00
commit b8d19b2c3e
54 changed files with 3337 additions and 0 deletions
@@ -0,0 +1,30 @@
+[Unit]
+Description=Reconcile sing-box VPN egress configuration
+After=network-online.target vpn-egress-guard.service
+Wants=network-online.target
+Requires=vpn-egress-guard.service
+ConditionPathExists=/etc/vpn-egress/hysteria2.uri
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+ExecStart=/usr/bin/vpn-egressctl sync
+UMask=0077
+StateDirectory=vpn-egress
+StateDirectoryMode=0700
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+ReadWritePaths=/etc/vpn-egress /etc/sing-box /var/lib/vpn-egress /run/lock
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_DAC_READ_SEARCH