wingman-git.install


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# wingman runs rootless: the daemon runs as your user, but it needs two file
# capabilities on the netbird binary — CAP_NET_ADMIN (create the WireGuard
# interface) and CAP_NET_BIND_SERVICE (bind the DNS resolver to port 53, where
# systemd-resolved sends queries). Rather than running netbird as root, we grant
# just those. pacman strips file capabilities on every (re)install of netbird, so
# the shipped pacman hook (/usr/share/libalpm/hooks/wingman-netbird-setcap.hook)
# reapplies them after each netbird transaction. Here we apply them once at
# wingman install time so things work immediately, before that hook ever fires.

_apply_cap() {
	caps=cap_net_admin,cap_net_raw,cap_net_bind_service+eip
	if [ -x /usr/bin/netbird ]; then
		setcap "$caps" /usr/bin/netbird || \
			echo ">>> wingman: could not setcap netbird; run it yourself:" \
			     "sudo setcap $caps /usr/bin/netbird"
	fi
}

post_install() {
	_apply_cap
	cat <<'EOF'
>>> wingman installed (rootless).
    Bring an instance up as your normal user (no sudo):
        wingman up <name> --setup-key <KEY>
    To start instances on boot without an active login session, enable linger:
        sudo loginctl enable-linger "$USER"
    NetBird DNS works rootless via CAP_NET_BIND_SERVICE (granted above) plus
    the shipped polkit rule (50-wingman-netbird-dns.rules), which authorizes
    the wheel group to set per-interface DNS. Not in wheel? Edit that rule's
    group.
EOF
}

post_upgrade() {
	_apply_cap
}