The zrok agent (https://docs.zrok.io/docs/guides/agent/) service is a "user service," meaning it doesn't have the elevated permissions required to do system admin stuff like forming a VPN, needed by VPN backend mode to share or access a zrok VPN.
To the existing Linux package, zrok-agent, add a privileged "system service" that, when enabled, is granted the Linux kernel capability NET_ADMIN, so it can provision a tun device for the zrok VPN.
Required functionality for the first run: The new system service doesn't run as the login user, but a service account named like "zrok-agent," so it needs a managed homedir that is automatically created and enabled with a zrok account token (probably re-using the "enable unless enabled" logic in zrok-enable.bash), and it needs new logic expressing "enroll unless enrolled" for the system-wide, privileged zrok agent, so that it can be remotely controlled.
The zrok agent (https://docs.zrok.io/docs/guides/agent/) service is a "user service," meaning it doesn't have the elevated permissions required to do system admin stuff like forming a VPN, needed by VPN backend mode to share or access a zrok VPN.
To the existing Linux package,
zrok-agent, add a privileged "system service" that, when enabled, is granted the Linux kernel capabilityNET_ADMIN, so it can provision a tun device for the zrok VPN.Required functionality for the first run: The new system service doesn't run as the login user, but a service account named like "zrok-agent," so it needs a managed homedir that is automatically created and enabled with a zrok account token (probably re-using the "enable unless enabled" logic in
zrok-enable.bash), and it needs new logic expressing "enroll unless enrolled" for the system-wide, privileged zrok agent, so that it can be remotely controlled.