5 files changed, 83 insertions, 0 deletions
diff --git a/assets/org.roentgen.Controller1.conf b/assets/org.roentgen.Controller1.conf
new file mode 100644
index 0000000..1fe7e39
--- /dev/null
+++ b/assets/org.roentgen.Controller1.conf
@@ -0,0 +1,9 @@
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN" "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <policy user="root">
+    <allow own="org.roentgen.Controller1"/>
+  </policy>
+  <policy context="default">
+    <allow send_destination="org.roentgen.Controller1"/>
+  </policy>
+</busconfig>
diff --git a/assets/org.roentgen.policy b/assets/org.roentgen.policy
new file mode 100644
index 0000000..aceff5e
--- /dev/null
+++ b/assets/org.roentgen.policy
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>Roentgen</vendor>
+  <action id="org.roentgen.control">
+    <description>Control this machine's proxy and saved subscriptions</description>
+    <message>Administrator authentication is required to control Roentgen</message>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin</allow_active>
+    </defaults>
+  </action>
+</policyconfig>
diff --git a/assets/roentgen-guard.service b/assets/roentgen-guard.service
new file mode 100644
index 0000000..8f04600
--- /dev/null
+++ b/assets/roentgen-guard.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=Roentgen persistent traffic guard and incoming-flow classification
+DefaultDependencies=no
+After=local-fs.target
+Before=network-pre.target NetworkManager.service systemd-networkd.service roentgen.service
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/roentgen guard
+RemainAfterExit=yes
+UMask=0077
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+
+[Install]
+WantedBy=network-pre.target
diff --git a/assets/roentgen-xray.service b/assets/roentgen-xray.service
new file mode 100644
index 0000000..7cbdaea
--- /dev/null
+++ b/assets/roentgen-xray.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Roentgen-owned system Xray process
+Requires=roentgen-guard.service
+After=roentgen-guard.service
+
+[Service]
+Type=simple
+User=roentgen-xray
+Group=roentgen-xray
+ExecStart=/usr/bin/xray run -config /run/roentgen/xray.json
+Restart=on-failure
+RestartSec=5
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+UMask=0077
diff --git a/assets/roentgen.service b/assets/roentgen.service
new file mode 100644
index 0000000..c988d7d
--- /dev/null
+++ b/assets/roentgen.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=Roentgen proxy controller
+Requires=roentgen-guard.service
+After=roentgen-guard.service dbus.service
+
+[Service]
+Type=dbus
+BusName=org.roentgen.Controller1
+ExecStart=/usr/local/bin/roentgen daemon
+Restart=on-failure
+RestartSec=5
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+ReadWritePaths=/etc/roentgen /var/lib/roentgen /run/roentgen
+RuntimeDirectory=roentgen
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+
+[Install]
+WantedBy=multi-user.target