feat: packaging — .deb/.rpm via nfpm and Docker image

[Crank-Git]

Summary

• .deb / .rpm packages via nfpm: amd64 + arm64 for both formats, produced in the release workflow on every tag push
• Dockerfile — two-stage build, non-root user, capabilities granted at runtime via --cap-add
• packaging/postinst — creates ja4monitor system user/group, data + log dirs, grants CAP_NET_RAW + CAP_NET_ADMIN via setcap so the daemon runs without root
• Release workflow updated to install nfpm and upload .deb/.rpm packages to GitHub Releases

Capability model

Deployment	How
.deb/.rpm	postinst runs setcap cap_net_raw,cap_net_admin=eip /usr/bin/ja4monitor; daemon runs as ja4monitor system user
Docker (live)	docker run --cap-add NET_RAW --cap-add NET_ADMIN --network host
Docker (PCAP replay)	No special capabilities needed
Kubernetes	Privileged DaemonSet or custom seccomp profile (documented in Dockerfile header)

Quick start after install

# Debian/Ubuntu
sudo apt install ./ja4monitor_0.8.0_linux_amd64.deb
# Edit /etc/ja4monitor/ja4monitor.toml (set interface, db_path, etc.)
sudo systemctl start ja4monitor

# Docker
docker run --rm -it --cap-add NET_RAW --cap-add NET_ADMIN --network host \
  -v /var/lib/ja4monitor:/data \
  ja4monitor:latest \
  --interface eth0 --db /data/ja4monitor.db

Test plan

• Build passes: go build ./... + go test ./... all green
• Shell scripts are +x and use set -e
• postinst is idempotent (uses getent checks before useradd/groupadd)
• postrm purge cleans up user, group, and data dirs; plain remove leaves data intact
• nfpm.yaml paths match what the release workflow produces (../dist/ja4monitor)
• Smoke-test on next tag: verify .deb installs cleanly on Ubuntu 22.04 + 24.04

🤖 Generated with Claude Code