debian: add package building (#20)

This only builds on a debian system, because it uses the dpkg-helper
and other utils. But it builds! Multiarch is supported, you can easily
build a package for amd64, arm and arm64. The Makefile does this by
default.

Massively update the systemd file.

Makefile

@@ -0,0 +1,10 @@
+# Makefile for building packages for CoreDNS.
+
+# Build the debian packages
+.PHONY: debian
+debian:
+	dpkg-buildpackage -us -uc -b --target-arch amd64   
+	dpkg-buildpackage -us -uc -b --target-arch arm
+	dpkg-buildpackage -us -uc -b --target-arch arm64
+	# debs are one up
+	ls ../*.deb

README.md

@@ -1,8 +1,9 @@
-# deployment
+# Deployment
+
 Scripts, utilities, and examples for deploying CoreDNS.
 
-
 ## MacOS
+
 The default settings will proxy all requests to hostnames not found in your host file to Google's DNS-over-HTTPS.
 
 To install:
@@ -20,3 +21,18 @@ Using CoreDNS as your default resolver:
  - Type `127.0.0.1` and hit enter
  - Click `OK`
  - Click `Apply`
+
+# Debian
+
+On a debian system:
+
+  - Run `dpkg-buildpackage -us -uc -b  --target-arch ARCH`
+    Where ARCH can be any of the released architectures, like "amd64" or "arm".
+  - Most users will just run: `dpkg-buildpackage -us -uc -b`
+
+To install:
+
+  - Run `dpkg -i coredns_0.9.10-0~9.20_amd64.deb`.
+
+This installs the coredns binary in /usr/bin, adds a coredns user (homedir set to /var/lib/coredns)
+and a small Corefile /etc/coredns.

debian/Corefile

@@ -0,0 +1,9 @@
+# Default Corefile, see https://coredns.io for more information.
+
+# Answer every below the root, with the whoami plugin. Log all queries
+# and errors on standard output.
+. {
+    whoami  # coredns.io/plugins/whoami
+    log     # coredns.io/plugins/log
+    errors  # coredns.io/plugins/errors
+}

debian/changelog

@@ -0,0 +1,5 @@
+coredns (0-0) UNRELEASED; urgency=medium
+
+  * Package for Debian.
+
+ -- Miek Gieben <miek@coredns.io>  Sat, 11 Nov 2017 09:52:00 +0000

debian/compat

@@ -0,0 +1 @@
+10

debian/control

@@ -0,0 +1,8 @@
+Source: coredns
+Maintainer: Miek Gieben <miek@coredns.io>
+Build-Depends: debhelper (>= 9), ca-certificates, wget, dh-systemd
+
+Package: coredns
+Architecture: any
+Description: DNS server that chains plugins
+Depends: adduser

debian/coredns.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=CoreDNS DNS server
+Documentation=https://coredns.io
+After=network.target
+
+[Service]
+PermissionsStartOnly=true
+LimitNOFILE=1048576
+LimitNPROC=512
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE 
+AmbientCapabilities=CAP_NET_BIND_SERVICE 
+NoNewPrivileges=true 
+User=coredns
+WorkingDirectory=~
+ExecStart=/usr/bin/coredns -conf=/etc/coredns/Corefile
+ExecReload=/bin/kill -SIGUSR1 $MAINPID
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target

debian/rules

@@ -0,0 +1,29 @@
+#!/usr/bin/make -f
+
+VERSION := 0.9.10
+
+DEB_HOST_ARCH   := $(DEB_TARGET_ARCH)
+DISTRIBUTION    := $(shell lsb_release -sr)
+PACKAGEVERSION  := $(VERSION)-0~$(DISTRIBUTION)0
+TARBALL         := coredns_$(VERSION)_linux_$(DEB_TARGET_ARCH).tgz
+URL             := https://github.com/coredns/coredns/releases/download/v$(VERSION)/$(TARBALL)
+
+%:
+	dh_clean
+	dh $@ --with systemd
+
+override_dh_strip:
+	# don't perform dh_strip
+	echo dh_strip
+
+override_dh_auto_clean:
+override_dh_auto_test:
+override_dh_auto_build:
+override_dh_auto_install:
+	wget -N --progress=dot:mega $(URL)
+	mkdir -p debian/coredns/usr/bin debian/coredns/etc/coredns
+	tar -xf $(TARBALL) -C debian/coredns/usr/bin
+	cp debian/Corefile debian/coredns/etc/coredns/Corefile
+
+override_dh_gencontrol:
+	dh_gencontrol -- -v$(PACKAGEVERSION)

systemd/README.md

@@ -1,4 +1,5 @@
 # Systemd Service File
 
-Use `coredns.service` as a systemd service file. It defaults to a coredns with a homedir of `/home/coredns`
-and the binary lives in `/opt/bin` and the config in `/etc/coredns/Corefile`.
+Use `coredns.service` as a systemd service file. It defaults to using a "coredns" user with
+a homedir of `/var/lib/coredns` and the binary lives in `/usr/bin` and the config in
+`/etc/coredns/Corefile`.

systemd/coredns.service

@@ -5,11 +5,14 @@ After=network.target
 
 [Service]
 PermissionsStartOnly=true
-LimitNOFILE=8192
+LimitNOFILE=1048576
+LimitNPROC=512
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE 
+AmbientCapabilities=CAP_NET_BIND_SERVICE 
+NoNewPrivileges=true 
 User=coredns
-WorkingDirectory=/home/coredns
-ExecStartPre=/sbin/setcap cap_net_bind_service=+ep /opt/bin/coredns
-ExecStart=/opt/bin/coredns -conf=/etc/coredns/Corefile
+WorkingDirectory=~
+ExecStart=/usr/bin/coredns -conf=/etc/coredns/Corefile
 ExecReload=/bin/kill -SIGUSR1 $MAINPID
 Restart=on-failure