From 4c62b1436ae3b6770add63cce66312c478b1ef9e Mon Sep 17 00:00:00 2001
From: Mohammadreza Khani <mohamadkhani14@gmail.com>
Date: Mon, 6 Jul 2026 18:46:47 +0330
Subject: [PATCH] feat: add Arch Linux package (PKGBUILD, systemd service,
 sysusers)

- PKGBUILD for building the package
- Systemd service with CAP_NET_BIND_SERVICE for port 53
- sysusers.d config to create doh-forwarder system user
- Default config at /etc/doh-forwarder/config.toml
---
 pkg/arch/PKGBUILD               | 46 +++++++++++++++++++++++++++++++++
 pkg/arch/doh-forwarder.conf     | 17 ++++++++++++
 pkg/arch/doh-forwarder.service  | 27 +++++++++++++++++++
 pkg/arch/doh-forwarder.sysusers |  2 ++
 4 files changed, 92 insertions(+)
 create mode 100644 pkg/arch/PKGBUILD
 create mode 100644 pkg/arch/doh-forwarder.conf
 create mode 100644 pkg/arch/doh-forwarder.service
 create mode 100644 pkg/arch/doh-forwarder.sysusers

diff --git a/pkg/arch/PKGBUILD b/pkg/arch/PKGBUILD
new file mode 100644
index 0000000..6161eb7
--- /dev/null
+++ b/pkg/arch/PKGBUILD
@@ -0,0 +1,46 @@
+# Maintainer: Mohammadreza Khani <mohamadreza.khani@proton.me>
+pkgname=doh-forwarder
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="A lightweight DNS-over-HTTPS forwarder"
+arch=('x86_64')
+url="https://gitea.logi.camp/LogiCrew/doh-forwarder"
+license=('MIT')
+depends=('gcc-libs')
+makedepends=('rust' 'cargo')
+backup=('etc/doh-forwarder/config.toml')
+source=("$pkgname-$pkgver.tar.gz::https://git.logicamp.dev/LogiCrew/doh-forwarder/archive/v${pkgver}.tar.gz"
+        'doh-forwarder.service'
+        'doh-forwarder.sysusers'
+        'doh-forwarder.conf')
+sha256sums=('SKIP'
+            'SKIP'
+            'SKIP'
+            'SKIP')
+
+build() {
+    cd "$pkgname"
+    cargo build --release --locked
+}
+
+check() {
+    cd "$pkgname"
+    cargo test --release --locked
+}
+
+package() {
+    cd "$pkgname"
+
+    # Binary
+    install -Dm755 "target/release/doh-forwarder" "$pkgdir/usr/bin/doh-forwarder"
+
+    # Config
+    install -Dm644 "$srcdir/doh-forwarder.conf" "$pkgdir/etc/doh-forwarder/config.toml"
+
+    # Systemd
+    install -Dm644 "$srcdir/doh-forwarder.service" "$pkgdir/usr/lib/systemd/system/doh-forwarder.service"
+    install -Dm644 "$srcdir/doh-forwarder.sysusers" "$pkgdir/usr/lib/sysusers.d/doh-forwarder.conf"
+
+    # License
+    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}
diff --git a/pkg/arch/doh-forwarder.conf b/pkg/arch/doh-forwarder.conf
new file mode 100644
index 0000000..88622f6
--- /dev/null
+++ b/pkg/arch/doh-forwarder.conf
@@ -0,0 +1,17 @@
+[server]
+listen = "0.0.0.0:8800"
+
+[dns]
+listen = "0.0.0.0:53"
+
+[upstream]
+resolvers = [
+    { name = "cloudflare", url = "https://cloudflare-dns.com/dns-query" },
+    { name = "google", url = "https://dns.google/dns-query" },
+]
+strategy = "round-robin"
+
+[cache]
+enabled = true
+max_entries = 10000
+max_ttl_secs = 3600
diff --git a/pkg/arch/doh-forwarder.service b/pkg/arch/doh-forwarder.service
new file mode 100644
index 0000000..06b899a
--- /dev/null
+++ b/pkg/arch/doh-forwarder.service
@@ -0,0 +1,27 @@
+[Unit]
+Description=DoH Forwarder - DNS-over-HTTPS forwarder
+Documentation=https://gitea.logi.camp/LogiCrew/doh-forwarder
+After=network.target
+
+[Service]
+Type=simple
+User=doh-forwarder
+Group=doh-forwarder
+ExecStart=/usr/bin/doh-forwarder --config /etc/doh-forwarder/config.toml
+Restart=on-failure
+RestartSec=5
+
+# Allow binding to port 53 without root
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ReadWritePaths=/var/lib/doh-forwarder
+
+[Install]
+WantedBy=multi-user.target
diff --git a/pkg/arch/doh-forwarder.sysusers b/pkg/arch/doh-forwarder.sysusers
new file mode 100644
index 0000000..228b335
--- /dev/null
+++ b/pkg/arch/doh-forwarder.sysusers
@@ -0,0 +1,2 @@
+# Type Name ID GECOS Home Shell
+u doh-forwarder - "DoH Forwarder daemon" /var/lib/doh-forwarder -