mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
9378c8b0ac
Bumps [serde](https://github.com/serde-rs/serde) from 1.0.209 to 1.0.210. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/serde-rs/serde/releases">serde's releases</a>.</em></p> <blockquote> <h2>v1.0.210</h2> <ul> <li>Support serializing and deserializing <code>IpAddr</code> and <code>SocketAddr</code> in no-std mode on Rust 1.77+ (<a href="https://redirect.github.com/serde-rs/serde/issues/2816">#2816</a>, thanks <a href="https://github.com/MathiasKoch"><code>@MathiasKoch</code></a>)</li> <li>Make <code>serde::ser::StdError</code> and <code>serde::de::StdError</code> equivalent to <code>core::error::Error</code> on Rust 1.81+ (<a href="https://redirect.github.com/serde-rs/serde/issues/2818">#2818</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="89c4b02bf3"><code>89c4b02</code></a> Release 1.0.210</li> <li><a href="eeb8e44cda"><code>eeb8e44</code></a> Merge pull request <a href="https://redirect.github.com/serde-rs/serde/issues/2818">#2818</a> from dtolnay/coreerror</li> <li><a href="785c2d9605"><code>785c2d9</code></a> Stabilize no-std StdError trait</li> <li><a href="d549f048e1"><code>d549f04</code></a> Reformat parse_ip_impl definition and calls</li> <li><a href="4c0dd63011"><code>4c0dd63</code></a> Delete attr support from core::net deserialization macros</li> <li><a href="26fb134165"><code>26fb134</code></a> Relocate cfg attrs out of parse_ip_impl and parse_socket_impl</li> <li><a href="07e614b52b"><code>07e614b</code></a> Merge pull request <a href="https://redirect.github.com/serde-rs/serde/issues/2817">#2817</a> from dtolnay/corenet</li> <li><a href="b1f899fbe8"><code>b1f899f</code></a> Delete doc(cfg) attribute from impls that are supported in no-std</li> <li><a href="b4f860e627"><code>b4f860e</code></a> Merge pull request <a href="https://redirect.github.com/serde-rs/serde/issues/2816">#2816</a> from MathiasKoch/chore/core-net</li> <li><a href="d940fe1b49"><code>d940fe1</code></a> Reuse existing Buf wrapper as replacement for std::io::Write</li> <li>Additional commits viewable in <a href="https://github.com/serde-rs/serde/compare/v1.0.209...v1.0.210">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
headless-client
This crate acts as the CLI / headless Client, and the privileged tunnel service for the GUI Client, for both Linux and Windows.
It is built as:
headless-clientto act as the Linux / Windows headless Clientfirezone-headless-clientto act as the Linux tunnel service, Windows headless Client, or Windows tunnel service
In general, the brand name should be part of the file name, but the OS name should not be.
Running
To run the headless Client:
- Generate a new Service account token from the "Actors -> Service Accounts" section of the admin portal and save it in your secrets manager. The Firezone Linux client requires a service account at this time.
- Ensure
/etc/dev.firezone.client/tokenis only readable by root (i.e.chmod 400) - Ensure
/etc/dev.firezone.client/tokencontains the Service account token. The Client needs this before it can start - Set
FIREZONE_IDto a unique string to identify this client in the portal, e.g.export FIREZONE_ID=$(uuidgen). The client requires this variable at startup. - Set
LOG_DIRto a suitable directory for writing logsexport LOG_DIR=/tmp/firezone-logs mkdir $LOG_DIR - Now, you can start the client with:
./firezone-headless-client standalone
If you're running as an unprivileged user, you'll need the CAP_NET_ADMIN
capability to open /dev/net/tun. You can add this to the client binary with:
sudo setcap 'cap_net_admin+eip' /path/to/firezone-headless-client
Building
Assuming you have Rust installed, you can build the headless Client with:
cargo build --release -p firezone-headless-client
The binary will be in target/release/firezone-headless-client
The release on Github are built with musl. To build this way, use:
rustup target add x86_64-unknown-linux-musl
sudo apt-get install musl-tools
cargo build --release -p headless-client --target x86_64-unknown-linux-musl
Files
/etc/dev.firezone.client/token- The service account token, provided by the human administrator. Must be owned by root and have 600 permissions (r/w by owner, nobody else can read) If present, the tunnel will ignore any GUI Client and run as a headless Client. If absent, the tunnel will wait for commands from a GUI Client/usr/bin/firezone-headless-client- The tunnel binary. This must run as root so it can modify the system's DNS settings. If DNS is not needed, it only needs CAP_NET_ADMIN./usr/lib/systemd/system/firezone-headless-client.service- A systemd service unit, installed by the deb package./var/lib/dev.firezone.client/config/firezone-id- The device ID, unique across an organization. The tunnel will generate this if it's not present.