Create debs

assets/systemd/roowho2-client.socket

@@ -0,0 +1,10 @@
+[Unit]
+Description=Roowho2 Client Communication Socket
+
+[Socket]
+FileDescriptorName=client_socket
+Service=roowho2.service
+ListenStream=/run/roowho2/roowho2.varlink
+
+[Install]
+WantedBy=sockets.target

assets/systemd/roowho2-rwhod.socket

@@ -0,0 +1,11 @@
+[Unit]
+Description=Roowho2 Rwhod Socket
+
+[Socket]
+FileDescriptorName=rwhod_socket
+Service=roowho2.service
+ListenDatagram=0.0.0.0:513
+Broadcast=true
+
+[Install]
+WantedBy=sockets.target

assets/systemd/roowho2.service

@@ -0,0 +1,43 @@
+[Unit]
+
+[Service]
+Type=notify
+Restart=on-failure
+DynamicUser=true
+ExecStart=/usr/bin/roowhod
+
+ConfigurationDirectory=roowho2
+
+AmbientCapabilities=CAP_DAC_READ_SEARCH
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH
+DeviceAllow=
+DevicePolicy=closed
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateIPC=true
+PrivateMounts=true
+PrivateTmp=true
+ProcSubset=pid
+ProtectClock=true
+ProtectControlGroups=strict
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+RemoveIPC=true
+RestrictAddressFamilies=AF_INET
+RestrictAddressFamilies=AF_INET6
+RestrictAddressFamilies=AF_UNIX
+RestrictAddressFamilies=AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SocketBindDeny=any
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged
+SystemCallFilter=~@resources
+UMask=0077