feat: add one-line install script

.github/workflows/installer.yml

@@ -0,0 +1,98 @@
+name: Installer
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "install.sh"
+      - ".github/workflows/installer.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "install.sh"
+      - ".github/workflows/installer.yml"
+  # Also catch new releases that break the installer.
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run shellcheck
+        run: shellcheck install.sh
+
+  # Installs published releases on a real Ubuntu 24.04 VM with systemd, as a
+  # non-root user with sudo, the way most people will run it.
+  ubuntu:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install binary only
+        run: |
+          sh install.sh --no-service
+          nylon version
+          test ! -e /etc/systemd/system/nylon.service
+      - name: Re-run is a no-op
+        run: |
+          version=$(nylon version | sed 's/^Version: //')
+          sh install.sh --no-service 2>&1 | grep -Fx "==> nylon $version is already installed"
+      - name: Install service (default) without configs
+        run: |
+          # A pre-existing config dir must still end up root-only.
+          sudo mkdir -m 0755 /etc/nylon
+          sh install.sh
+          systemctl is-enabled nylon
+          test "$(systemctl is-active nylon)" = inactive
+          test "$(sudo stat -c %a /etc/nylon)" = 700
+      - name: Start service with a single-node config
+        run: |
+          key=$(nylon key 2>pub)
+          printf 'id: ci\nkey: %s\nport: 57175\n' "$key" | sudo tee /etc/nylon/node.yaml >/dev/null
+          printf 'routers:\n  - id: ci\n    pubkey: %s\n    addresses: [10.99.0.1]\n' "$(cat pub)" | sudo tee /etc/nylon/central.yaml >/dev/null
+          sudo nylon verify /etc/nylon/central.yaml --node /etc/nylon/node.yaml
+          sh install.sh 2>&1 | grep -Fx "==> started nylon.service"
+          # Same PID after a while, so it isn't crash-looping.
+          sleep 2
+          pid=$(systemctl show -p MainPID --value nylon)
+          sleep 10
+          test "$pid" != 0
+          test "$(systemctl show -p MainPID --value nylon)" = "$pid"
+          ip -br addr | grep 10.99.0.1
+      - name: Re-running leaves it running
+        run: |
+          pid=$(systemctl show -p MainPID --value nylon)
+          sh install.sh 2>&1 | grep -Fx "==> nylon.service is already running"
+          test "$(systemctl show -p MainPID --value nylon)" = "$pid"
+      - name: Changing version restarts the service
+        run: |
+          sh install.sh --version v0.4.5 2>&1 | grep -Fx "==> restarted nylon.service"
+          nylon version | grep -Fx "Version: v0.4.5"
+          sh install.sh 2>&1 | grep -Fx "==> restarted nylon.service"
+          sleep 2
+          pid=$(systemctl show -p MainPID --value nylon)
+          sleep 10
+          test "$pid" != 0
+          test "$(systemctl show -p MainPID --value nylon)" = "$pid"
+      - name: Uninstall
+        run: |
+          sh install.sh --uninstall
+          test "$(systemctl is-active nylon)" != active
+          if ip link show nylon 2>/dev/null; then exit 1; fi
+          test ! -e /usr/local/bin/nylon
+          test ! -e /etc/systemd/system/nylon.service
+          sudo test -f /etc/nylon/node.yaml
+      - name: Leaves a hand-written unit alone
+        run: |
+          printf '[Service]\nExecStart=/bin/true\n' | sudo tee /etc/systemd/system/nylon.service >/dev/null
+          if sh install.sh; then exit 1; fi
+          sh install.sh --uninstall
+          sudo test -f /etc/systemd/system/nylon.service
+      - name: Logs
+        if: failure()
+        run: sudo journalctl -u nylon --no-pager

.github/workflows/release.yml

@@ -30,6 +30,7 @@ jobs:
           goos: ${{ matrix.goos }}
           goarch: ${{ matrix.goarch }}
           asset_name: nylon-${{ matrix.goos }}-${{ matrix.goarch }}
+          sha256sum: TRUE
   release-windows:
     name: Release Go Binary (Windows) # Windows requires the wintun driver, so we use a separate action
     runs-on: ubuntu-latest
@@ -53,3 +54,14 @@ jobs:
           goarch: ${{ matrix.goarch }}
           extra_files: 'wintun/bin/${{ matrix.goarch }}/wintun.dll'
           asset_name: nylon-${{ matrix.goos }}-${{ matrix.goarch }}
+          sha256sum: TRUE
+  release-installer:
+    name: Attach install.sh
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Upload install.sh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: gh release upload "$TAG" install.sh --clobber

README.md

@@ -20,7 +20,15 @@ Nylon targets under 10 seconds of convergence time after a link failure, as you
 
 ## Getting Started
 
-Download the latest release binary from the [releases page](https://github.com/encodeous/nylon/releases), then head to the [docs](https://nylon.jq.ax) for setup instructions.
+Install the latest release on Linux, along with a systemd service that runs it with the configs in `/etc/nylon`:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/encodeous/nylon/main/install.sh | sh
+```
+
+You can also download binaries directly from the [releases page](https://github.com/encodeous/nylon/releases).
+
+Then head to the [docs](https://nylon.jq.ax) for setup instructions.
 
 > **[Read the full documentation at nylon.jq.ax](https://nylon.jq.ax)**
 > includes configuration reference, guides for connecting WireGuard clients, port forwarding, and comparisons with Tailscale/Nebula.

docs/guides/getting-started.mdx

@@ -17,7 +17,13 @@ graph LR
 ## Prerequisites
 
 - Two machines with UDP port `57175` open (can configure with a different port).
-- The `nylon` binary downloaded on both machines from the [releases page](https://github.com/encodeous/nylon/releases).
+- The `nylon` binary installed on both machines. On Linux:
+
+  ```bash
+  curl -fsSL https://raw.githubusercontent.com/encodeous/nylon/main/install.sh | sh
+  ```
+
+  On other platforms, download it from the [releases page](https://github.com/encodeous/nylon/releases).
 
 :::note
 The Linux and macOS versions are well tested, but the Windows TUN interface has known stability issues. For Windows, we recommend using [WireGuard for Windows](https://www.wireguard.com/install/) and connecting to a Linux/macOS machine as a [passive client](/guides/wg-clients).
@@ -96,6 +102,17 @@ The Linux and macOS versions are well tested, but the Windows TUN interface has
 
    After a few seconds, the nodes will discover each other and establish a secure tunnel. You should be able to ping `10.0.0.2` from `node-1`.
 
+   :::tip[Running as a service]
+   On Linux with systemd, the installer also set nylon up as a service. To run it that way instead, stop the nylon you started above (Ctrl+C), then run:
+
+   ```bash
+   sudo mv node.yaml central.yaml /etc/nylon/
+   sudo systemctl start nylon
+   ```
+
+   The service reads its configs from `/etc/nylon` (readable only by root) and starts on boot. Follow its logs with `journalctl -u nylon -f`. Re-running the installer upgrades nylon and restarts the service if it's running.
+   :::
+
 </Steps>
 
 ## Next Steps

example/nylon.service

@@ -1,10 +1,15 @@
+# Sample unit; install.sh --service installs an equivalent one.
 [Unit]
-Description=Nylon Service
+Description=nylon mesh network
+Documentation=https://nylon.jq.ax
 After=network-online.target
+Wants=network-online.target
 
 [Service]
-ExecStart=/usr/bin/nylon run
-WorkingDirectory=/home/encodeous
+ExecStart=/usr/local/bin/nylon run -c /etc/nylon/central.yaml -n /etc/nylon/node.yaml
+WorkingDirectory=/etc/nylon
+Restart=on-failure
+RestartSec=5
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target