Use CAP_NET_BIND_SERVICE

Author: moubctez

.github/workflows/release.yml

@@ -1,6 +1,8 @@
 name: Make a new release
 on:
   push:
+    branches:
+      - pkg
     tags:
       - v*.*.*
 
@@ -55,6 +57,8 @@ jobs:
         with:
           draft: true
           generate_release_notes: true
+          package_name: pkg
+          tag_name: pkg
 
   create-sbom:
     needs:
@@ -75,7 +79,8 @@ jobs:
       # Store the version, stripping any v-prefix
       - name: Write release version
         run: |
-          VERSION=${GITHUB_REF_NAME#v}
+          # VERSION=${GITHUB_REF_NAME#v}
+          VERSION=2.0.0
           echo Version: $VERSION
           echo "VERSION=$VERSION" >> $GITHUB_ENV
 
@@ -215,9 +220,7 @@ jobs:
             --version ${{ env.VERSION }}
             --package defguard-proxy-${{ env.VERSION }}_x86_64-unknown-freebsd.pkg
             --freebsd-osversion '*'
-            --depends openssl
-            --before-install freebsd/preinst
-            --after-remove freebsd/postrm"
+            --depends openssl"
 
       - name: Upload Linux x86_64 archive
         uses: shogo82148/actions-upload-release-asset@v1

docs/header.png

@@ -7,6 +7,8 @@ After=network-online.target
 [Service]
 User=defguard
 Group=defguard
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 ExecReload=/bin/kill -HUP $MAINPID
 ExecStart=/usr/bin/defguard-proxy --config /etc/defguard/proxy.toml
 KillMode=process

freebsd/postrm

@@ -14,8 +14,8 @@ case "${1}" in
 abort-upgrade | abort-remove | abort-deconfigure)
 	if [ -x /usr/bin/systemctl ]; then
 		/usr/bin/systemctl daemon-reload
-		if /usr/bin/systemctl is-enabled ${SERVICE_NAME} >/dev/null 2>&1; then
-			/usr/bin/systemctl start ${SERVICE_NAME} || true
+		if /usr/bin/systemctl is-enabled --quiet ${SERVICE_NAME}; then
+			/usr/bin/systemctl --no-block restart ${SERVICE_NAME}
 		fi
 	fi
 	;;

freebsd/preinst

@@ -4,10 +4,9 @@ set -e
 USERNAME=defguard
 
 if [ -x /usr/bin/systemctl ]; then
-	/usr/bin/systemctl daemon-reload >/dev/null 2>&1 || true
+	/usr/bin/systemctl --quiet daemon-reload || true
 fi
 
-if id -u ${USERNAME} >/dev/null 2>&1
-then
-    echo "If no longer needed, remove ${USERNAME} manually: userdel ${USERNAME}"
+if id -u ${USERNAME} >/dev/null 2>&1; then
+	echo "If no longer needed, remove ${USERNAME} manually: userdel ${USERNAME}"
 fi

linux/defguard-proxy.service

@@ -4,5 +4,5 @@ set -e
 SERVICE_NAME='defguard-proxy'
 
 if [ -x /usr/bin/systemctl ]; then
-	/usr/bin/systemctl --no-block stop ${SERVICE_NAME} >/dev/null 2>&1 || true
+	/usr/bin/systemctl --no-block --quiet stop ${SERVICE_NAME} || true
 fi