From 8f35c88b5463eeda54e6eb68dfd4ad3c6509e168 Mon Sep 17 00:00:00 2001
From: michael <operations@dangerousthings.com>
Date: Sun, 26 Apr 2026 20:41:56 -0700
Subject: [PATCH] feat(packaging): systemd unit + D-Bus activation/policy files

---
 debian/authforge-daemon.service             | 25 +++++++++++++++++++++
 debian/io.dangerousthings.AuthForge.conf    | 23 +++++++++++++++++++
 debian/io.dangerousthings.AuthForge.service |  5 +++++
 3 files changed, 53 insertions(+)
 create mode 100644 debian/authforge-daemon.service
 create mode 100644 debian/io.dangerousthings.AuthForge.conf
 create mode 100644 debian/io.dangerousthings.AuthForge.service

diff --git a/debian/authforge-daemon.service b/debian/authforge-daemon.service
new file mode 100644
index 0000000..569f216
--- /dev/null
+++ b/debian/authforge-daemon.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=AuthForge MFA daemon
+Documentation=https://github.com/dangerousthings/authforge
+After=dbus.service
+Requires=dbus.service
+
+[Service]
+Type=dbus
+BusName=io.dangerousthings.AuthForge
+ExecStart=/usr/sbin/authforged
+Restart=on-failure
+RestartSec=2
+# Hardening — daemon needs to read /etc/authforge and /var/lib/authforge,
+# write to /etc/pam.d via pam-auth-update, and call libfido2 (USB hid).
+NoNewPrivileges=yes
+ProtectSystem=full
+ProtectHome=read-only
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ReadWritePaths=/etc/authforge /var/lib/authforge /etc/pam.d /usr/share/pam-configs /etc/u2f_mappings
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/io.dangerousthings.AuthForge.conf b/debian/io.dangerousthings.AuthForge.conf
new file mode 100644
index 0000000..9dab269
--- /dev/null
+++ b/debian/io.dangerousthings.AuthForge.conf
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+
+  <!-- Only root can own the well-known name. -->
+  <policy user="root">
+    <allow own="io.dangerousthings.AuthForge"/>
+  </policy>
+
+  <!-- Any local user may call the interface; method-level authz is enforced
+       by polkit inside the daemon. -->
+  <policy context="default">
+    <allow send_destination="io.dangerousthings.AuthForge"
+           send_interface="io.dangerousthings.AuthForge1"/>
+    <allow send_destination="io.dangerousthings.AuthForge"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+    <allow send_destination="io.dangerousthings.AuthForge"
+           send_interface="org.freedesktop.DBus.Properties"/>
+  </policy>
+
+</busconfig>
diff --git a/debian/io.dangerousthings.AuthForge.service b/debian/io.dangerousthings.AuthForge.service
new file mode 100644
index 0000000..320223c
--- /dev/null
+++ b/debian/io.dangerousthings.AuthForge.service
@@ -0,0 +1,5 @@
+[D-BUS Service]
+Name=io.dangerousthings.AuthForge
+Exec=/bin/false
+User=root
+SystemdService=authforge-daemon.service