initial commit

2026-04-29 07:52:29 +07:00
commit e1154c49a4
11 changed files with 2173 additions and 0 deletions
@@ -0,0 +1,28 @@
+[Unit]
+Description=WireGuard Dynamic Policy Firewall Watcher
+After=network-online.target wg-quick@wg0.service
+Wants=wg-quick@wg0.service network-online.target
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+ExecStartPre=/usr/local/bin/wg-policy-engine.sh --health-check
+ExecStart=/usr/local/bin/wg-sync-watch.sh
+ExecStopPost=/usr/local/bin/wg-policy-cleanup.sh
+Restart=always
+RestartSec=10
+User=root
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=wg-policy
+
+# Hardening
+ProtectSystem=strict
+ReadWritePaths=/etc/wireguard /var/lock /tmp
+ProtectHome=yes
+NoNewPrivileges=no
+PrivateTmp=yes
+
+[Install]
+WantedBy=multi-user.target