Add Debian package

[Daniel15]

Updates the GoReleaser config to generate a Debian package as part of the build.

The Debian package:

1. Prompts for bind address, port, and token. Support for edge mode can be added as a followup.
2. Creates a hawser user and group.
3. Adds the hawser user to the docker group so it can access the socket.
4. Creates a config file based on the answers to the questions.

This is still a draft because I need to test/change a few things:

• Randomly generate authentication token if it's left blank during package configuration.
• Harden the systemd unit a bit more.
• Test on Ubuntu. So far I've just tested on a base Debian + Docker installation.
• Test on a VM. I've just tested on LXC so far, and LXC disables some of the security settings in systemd units since they don't work properly. Need to test in a VM to ensure the systemd unit works properly.
• Add GitHub Action for full E2E test (build package, install package, verify it runs properly)

Test Plan

Run the build:

goreleaser release --snapshot --clean

Create fresh Debian LXC container
Install Docker
Install the package:

root@debiantest2:/mnt/debian-temp# apt install ./hawser_0.0.0-SNAPSHOT-9967fa8_linux_amd64.deb 
Installing:
  hawser

Summary:
  Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 0
  Download size: 0 B / 3,315 kB
  Space needed: 7,816 kB / 704 GB available

Get:1 /mnt/debian-temp/hawser_0.0.0-SNAPSHOT-9967fa8_linux_amd64.deb hawser amd64 0.0.0~SNAPSHOT-9967fa8 [3,315 kB]
Preconfiguring packages ...  
Selecting previously unselected package hawser.
(Reading database ... 34533 files and directories currently installed.)
Preparing to unpack .../hawser_0.0.0-SNAPSHOT-9967fa8_linux_amd64.deb ...
Unpacking hawser (0.0.0~SNAPSHOT-9967fa8) ...
Setting up hawser (0.0.0~SNAPSHOT-9967fa8) ...
Created symlink '/etc/systemd/system/multi-user.target.wants/hawser.service' → '/usr/lib/systemd/system/hawser.service'.

Verify config was created:

root@debiantest2:/mnt/debian-temp# cat /etc/hawser/config 
# Hawser Configuration
# See https://github.com/Finsys/hawser for documentation

DOCKER_SOCKET=/run/docker.sock
BIND_ADDRESS=10.123.1.70
PORT=2376
TOKEN=helloworldtest

Verify service starts successfully:

root@debiantest2:/mnt/debian-temp# service hawser status
● hawser.service - Hawser - Remote Docker Agent for Dockhand
     Loaded: loaded (/usr/lib/systemd/system/hawser.service; enabled; preset: enabled)
    Drop-In: /run/systemd/system/service.d
             └─zzz-lxc-service.conf
     Active: active (running) since Mon 2026-08-10 04:29:51 UTC; 1min 13s ago
 Invocation: c2b137dd0f424b67a2736d2fdbb13a70
       Docs: https://github.com/Finsys/hawser
   Main PID: 4074 (hawser)
      Tasks: 8 (limit: 154019)
     Memory: 5.3M (peak: 6.8M)
        CPU: 12ms
     CGroup: /system.slice/hawser.service
             └─4074 /usr/bin/hawser

Aug 10 04:29:51 debiantest2 hawser[4074]: │           Dockhand                  │
Aug 10 04:29:51 debiantest2 hawser[4074]: ╰─────────────────────────────────────╯
Aug 10 04:29:51 debiantest2 hawser[4074]: Version: 0.0.0-SNAPSHOT-9967fa8 (9967fa8)
Aug 10 04:29:51 debiantest2 hawser[4074]: Agent ID: 7a502229-d2d1-4a78-841f-e355150270a2
Aug 10 04:29:51 debiantest2 hawser[4074]: Agent Name: debiantest2
Aug 10 04:29:51 debiantest2 hawser[4074]: Docker Socket: /run/docker.sock
Aug 10 04:29:51 debiantest2 hawser[4074]: Log Level: INFO
Aug 10 04:29:51 debiantest2 hawser[4074]: 2026/08/10 04:29:51 [INFO] Starting in Standard mode on port 2376
Aug 10 04:29:51 debiantest2 hawser[4074]: 2026/08/10 04:29:51 [INFO] Connected to Docker 29.7.2 (API 1.55)
Aug 10 04:29:51 debiantest2 hawser[4074]: 2026/08/10 04:29:51 [INFO] Starting HTTP server on 10.123.1.70:2376

[Daniel15]

As a followup (separate PR), I can modify this to ask for the mode (normal or edge), and only show questions relevant to that mode. debconf does support boolean questions.

[Daniel15]

This is essentially the systemd unit from the install scriot, but with the path changed from /usr/local/bin/hawser to /usr/bin/hawser`. I want to try to add more security hardening though.

[Daniel15]

This should be /run/docker.sock. Will adjust.