Steward 0.1.0 (in development): a DHCPv4 server with a web UI, API and CLI

Subnets served per interface, pools, reservations, options at three
levels, leases in SQLite saved before the ACK, ping and decline conflict
checks, validated changes with history and undo, users and tokens, an
audit log, a Kea importer, a sandboxed systemd unit and Debian packages.
Tested with real udhcpc and dhcpcd clients in Docker (scripts/e2e.sh).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/steward-backup.service

@@ -0,0 +1,44 @@
+# Steward: one database backup, run daily by steward-backup.timer.
+# Installed as /etc/systemd/system/steward-backup.service (see
+# docs/operations.md#backups). What to keep, and where, is in the backup:
+# section of /etc/steward/steward.yaml.
+[Unit]
+Description=Steward database backup
+Documentation=file:///usr/local/share/doc/steward/docs/operations.md
+# Nothing to back up before 'stewardd init'.
+ConditionPathExists=/var/lib/steward/steward.db
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/stewardd --config /etc/steward/steward.yaml backup
+User=steward
+Group=steward
+UMask=0077
+Nice=10
+IOSchedulingClass=idle
+
+# If you change backup.dir in steward.yaml, allow the new one too:
+# 'systemctl edit steward-backup.service' and add ReadWritePaths=/new/dir.
+ProtectSystem=strict
+ReadWritePaths=/var/lib/steward -/var/backups/steward
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM

deploy/systemd/steward-backup.timer

@@ -0,0 +1,20 @@
+# Steward: runs steward-backup.service (a database backup) every day.
+# Installed as /etc/systemd/system/steward-backup.timer. Change the schedule
+# with 'systemctl edit steward-backup.timer', e.g.
+#   [Timer]
+#   OnCalendar=
+#   OnCalendar=*-*-* 02:30
+# and keep backup.retention in steward.yaml above the new interval.
+[Unit]
+Description=Daily Steward database backup
+Documentation=file:///usr/local/share/doc/steward/docs/operations.md
+
+[Timer]
+OnCalendar=daily
+# Spread the start over an hour, and catch up on a run missed while the
+# machine was off.
+RandomizedDelaySec=1h
+Persistent=true
+
+[Install]
+WantedBy=timers.target

deploy/systemd/steward.service

@@ -0,0 +1,63 @@
+# Steward: the DHCP server, its REST API and web UI.
+# Installed as /etc/systemd/system/steward.service (see docs/install.md).
+[Unit]
+Description=Steward DHCP server (with web UI and API)
+Documentation=file:///usr/local/share/doc/steward/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=notify
+NotifyAccess=main
+ExecStart=/usr/local/bin/stewardd --config /etc/steward/steward.yaml serve
+# SIGHUP rereads the TLS certificate.
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=2s
+
+User=steward
+Group=steward
+UMask=0027
+
+# /var/lib/steward: the database (configuration and leases).
+StateDirectory=steward
+StateDirectoryMode=0750
+ConfigurationDirectory=steward
+ConfigurationDirectoryMode=0750
+# /run/steward: the local API socket (steward.sock), for root and the
+# steward user.
+RuntimeDirectory=steward
+RuntimeDirectoryMode=0750
+
+# Sandboxing: stewardd writes only its own state.
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+NoNewPrivileges=yes
+# The only privilege stewardd gets: listening on ports below 1024 (DHCP's
+# port 67). Binding each socket to its interface (SO_BINDTODEVICE) and the
+# ping check (an unprivileged ping socket) need nothing more.
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+# AF_NETLINK lets stewardd read the interfaces and their addresses.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target
+# 'systemctl restart stewardd' works too (the daemon's binary is stewardd).
+Alias=stewardd.service