subnetrad.service

[Unit]
Description=Subnetra pure-Zig L3 UDP tunnel
Documentation=https://github.com/jamiesun/subnetra
# network-online: the underlay must be up before the daemon binds its UDP socket.
# time-sync: the session key is derived from a CLOCK_REALTIME boot epoch and peers
# order sessions forward-only, so a clock that runs backward across a restart makes
# the new (lower) epoch be rejected until peers' clocks catch up. Ordering after
# time-sync.target keeps the clock monotonic across restarts on RTC-less hardware
# (see "Time synchronization (required)" in docs/deployment.md).
After=network-online.target time-sync.target
Wants=network-online.target time-sync.target

[Service]
Type=simple

# The daemon reads ./config.json from its working directory. Keep the per-node
# config (with its private PSKs) here, root-owned and mode 0600 (see the
# deployment guide). The control socket and policy snapshot live under /run.
WorkingDirectory=/etc/subnetra
RuntimeDirectory=subnetra
# RuntimeDirectory= creates/owns /run/subnetra (0700, root). This is also the
# compiled-in default socket path on Linux, so SUBNETRA_SOCK is redundant for a
# current binary — kept explicit as self-documentation and to pin the path for
# any older binary whose default differs.
Environment=SUBNETRA_SOCK=/run/subnetra/subnetra.sock

# Fail fast on a bad config instead of crash-looping the data plane. The config
# path is explicit (--config) so it does not silently depend on WorkingDirectory.
ExecStartPre=/usr/local/bin/subnetrad --check --config /etc/subnetra/config.json
ExecStart=/usr/local/bin/subnetrad --config /etc/subnetra/config.json

# subnetra only PRINTS the host network plan (`--print-network-plan`); it never
# mutates routes itself. The TUN device exists only while the daemon runs, so
# configure addressing/routes AFTER start. Replace the commands below with the
# output of `subnetrad --print-network-plan` for this node (spokes only; a relay
# hub usually needs no overlay address). Uncomment to enable:
# ExecStartPost=/sbin/ip link set snr0 mtu 1400 up
# ExecStartPost=/sbin/ip addr add 10.0.0.2/24 dev snr0
# ExecStartPost=/sbin/ip route add 192.168.31.0/24 dev snr0

Restart=on-failure
RestartSec=2

# --- Privileges: the ONLY capability subnetra needs is CAP_NET_ADMIN (create the
# TUN device and, if you enable the ExecStartPost hooks, configure routes). ---
AmbientCapabilities=CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_ADMIN
DeviceAllow=/dev/net/tun rw

# --- Sandboxing: subnetra is a single static binary with no dynamic allocation
# on the data path and no need to touch the filesystem beyond its config + /run. ---
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
# Allow only the address families subnetra uses (UDP/IP + the AF_UNIX control plane).
RestrictAddressFamilies=AF_INET AF_UNIX
# /run/subnetra is writable via RuntimeDirectory; everything else stays read-only.

[Install]
WantedBy=multi-user.target