use systemd overrides to avoid modifying service unit in /lib

dist/dist-packages/linux/nfpm-openziti-controller.yaml

@@ -18,6 +18,9 @@ contents:
   - dst: /lib/systemd/system/
     src: ./dist/dist-packages/linux/openziti-controller/ziti-controller.service
 
+  - dst: /etc/systemd/system/ziti-controller.service.d/override.conf
+    src: ./dist/dist-packages/linux/openziti-controller/ziti-controller.service.override.conf
+
   - dst: /opt/openziti/etc/controller
     type: dir
     file_info:

dist/dist-packages/linux/nfpm-openziti-router.yaml

@@ -18,6 +18,9 @@ contents:
   - dst: /lib/systemd/system/
     src: ./dist/dist-packages/linux/openziti-router/ziti-router.service
 
+  - dst: /etc/systemd/system/ziti-router.service.d/override.conf
+    src: ./dist/dist-packages/linux/openziti-router/ziti-router.service.override.conf
+
   - dst: /opt/openziti/etc/router
     type: dir
     file_info:

dist/dist-packages/linux/openziti-controller/postinstall.bash

@@ -98,7 +98,7 @@ promptPwd() {
     # prompt for password token if interactive, unless already answered
     else
         if ! [[ "${ZITI_BOOTSTRAP_DATABASE:-}" == true ]]; then
-            echo "INFO: ZITI_BOOTSTRAP_DATABASE is not true in ${ZITI_CTRL_SVC_FILE}" >&2
+            echo "INFO: ZITI_BOOTSTRAP_DATABASE is not true in ${ZITI_CTRL_SVC_ENV_FILE}" >&2
         # do nothing if enrollment token is already defined in env file
         elif [[ -n "${ZITI_PWD:-}" ]]; then
             echo "INFO: ZITI_PWD is defined in ${ZITI_CTRL_BOOT_ENV_FILE} and will be used to init db during"\
@@ -173,7 +173,7 @@ DEFAULT_ADDR=localhost
 ZITI_PWD_FILE=/opt/openziti/etc/controller/.pwd
 ZITI_CTRL_SVC_ENV_FILE=/opt/openziti/etc/controller/service.env
 ZITI_CTRL_BOOT_ENV_FILE=/opt/openziti/etc/controller/bootstrap.env
-ZITI_CTRL_SVC_FILE=/lib/systemd/system/ziti-controller.service
+ZITI_CTRL_SVC_FILE=/etc/systemd/system/ziti-controller.service.d/override.conf
 
 # initialize a file descriptor for debug output
 : "${DEBUG:=0}"

dist/dist-packages/linux/openziti-controller/ziti-controller.service

@@ -4,13 +4,6 @@ After=network-online.target
 
 [Service]
 
-# you must set the admin password to bootstrap the database; the bootstrapping script will initialize the default admin
-# username and password by loading the password from a file or env var; for security, set permissions to allow read only
-# by root only and remove the file after the bootstrapping that occurs on the first run or set ZITI_PWD in
-# /opt/openziti/etc/controller/bootstrap.env
-#
-LoadCredential=ZITI_PWD:/opt/openziti/etc/controller/.pwd
-
 #
 ## Optional Permissions
 #

dist/dist-packages/linux/openziti-controller/ziti-controller.service.override.conf

@@ -0,0 +1,17 @@
+[Service]
+
+# you must set the admin password to bootstrap the database; the bootstrapping script will initialize the default admin
+# username and password by loading the password from a file or env var; for security, set permissions to allow read only
+# by root only and remove the file after the bootstrapping that occurs on the first run or set ZITI_PWD in
+# /opt/openziti/etc/controller/bootstrap.env
+#
+LoadCredential=ZITI_PWD:/opt/openziti/etc/controller/.pwd
+
+#
+## Optional Permissions
+#
+
+# allow binding low ports, e.g., 443/tcp; NOTE: use TLS passthrough if fronting with a reverse proxy, i.e., "raw" TCP
+# proxy
+# AmbientCapabilities=CAP_NET_BIND_SERVICE
+

dist/dist-packages/linux/openziti-router/postinstall.bash

@@ -222,7 +222,7 @@ DEFAULT_ADDR=localhost
 ZITI_ENROLL_TOKEN_FILE=/opt/openziti/etc/router/.token
 ZITI_ROUTER_BOOT_ENV_FILE=/opt/openziti/etc/router/bootstrap.env
 ZITI_ROUTER_SVC_ENV_FILE=/opt/openziti/etc/router/service.env
-ZITI_ROUTER_SVC_FILE=/lib/systemd/system/ziti-router.service
+ZITI_ROUTER_SVC_FILE=/etc/systemd/system/ziti-router.service.d/override.conf
 
 # initialize a file descriptor for debug output
 : "${DEBUG:=0}"

dist/dist-packages/linux/openziti-router/ziti-router.service

@@ -4,18 +4,6 @@ After=network-online.target
 
 [Service]
 
-# you must provide an enrollment token to enroll the router at first startup
-LoadCredential=ZITI_ENROLL_TOKEN:/opt/openziti/etc/router/.token
-
-#
-## extra permissions
-#
-
-# allow binding low ports, e.g., 443/tcp; required when ZITI_ROUTER_MODE=tproxy or ZITI_ROUTER_PORT <= 1024
-# AmbientCapabilities=CAP_NET_BIND_SERVICE
-# allow adding IP routes and iptables rules; required when ZITI_ROUTER_MODE=tproxy
-# AmbientCapabilities=CAP_NET_ADMIN
-
 #
 ## options
 #

dist/dist-packages/linux/openziti-router/ziti-router.service.override.conf

@@ -0,0 +1,14 @@
+[Service]
+
+# you must provide an enrollment token to enroll the router at first startup
+LoadCredential=ZITI_ENROLL_TOKEN:/opt/openziti/etc/router/.token
+
+#
+## extra permissions
+#
+
+# allow binding low ports, e.g., 443/tcp; required when ZITI_ROUTER_MODE=tproxy or ZITI_ROUTER_PORT <= 1024
+# AmbientCapabilities=CAP_NET_BIND_SERVICE
+# allow adding IP routes and iptables rules; required when ZITI_ROUTER_MODE=tproxy
+# AmbientCapabilities=CAP_NET_ADMIN
+