feat(packaging): systemd unit + D-Bus activation/policy files

debian/authforge-daemon.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=AuthForge MFA daemon
+Documentation=https://github.com/dangerousthings/authforge
+After=dbus.service
+Requires=dbus.service
+
+[Service]
+Type=dbus
+BusName=io.dangerousthings.AuthForge
+ExecStart=/usr/sbin/authforged
+Restart=on-failure
+RestartSec=2
+# Hardening — daemon needs to read /etc/authforge and /var/lib/authforge,
+# write to /etc/pam.d via pam-auth-update, and call libfido2 (USB hid).
+NoNewPrivileges=yes
+ProtectSystem=full
+ProtectHome=read-only
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ReadWritePaths=/etc/authforge /var/lib/authforge /etc/pam.d /usr/share/pam-configs /etc/u2f_mappings
+
+[Install]
+WantedBy=multi-user.target

debian/io.dangerousthings.AuthForge.conf

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+
+  <!-- Only root can own the well-known name. -->
+  <policy user="root">
+    <allow own="io.dangerousthings.AuthForge"/>
+  </policy>
+
+  <!-- Any local user may call the interface; method-level authz is enforced
+       by polkit inside the daemon. -->
+  <policy context="default">
+    <allow send_destination="io.dangerousthings.AuthForge"
+           send_interface="io.dangerousthings.AuthForge1"/>
+    <allow send_destination="io.dangerousthings.AuthForge"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+    <allow send_destination="io.dangerousthings.AuthForge"
+           send_interface="org.freedesktop.DBus.Properties"/>
+  </policy>
+
+</busconfig>

debian/io.dangerousthings.AuthForge.service

@@ -0,0 +1,5 @@
+[D-BUS Service]
+Name=io.dangerousthings.AuthForge
+Exec=/bin/false
+User=root
+SystemdService=authforge-daemon.service