diff -up ./contrib/systemd/cjdns-loadmodules.service.sbin ./contrib/systemd/cjdns-loadmodules.service

--- ./contrib/systemd/cjdns-loadmodules.service.sbin	2017-01-13 21:43:05.413731242 -0500

+++ ./contrib/systemd/cjdns-loadmodules.service	2017-01-13 21:43:05.413731242 -0500

@@ -0,0 +1,13 @@

+[Unit]

+Description=Load cjdns kernel modules

+# Load kernel modules needed by cjdns so that it doesn't need the privilege

+Before=cjdns.service

+# Do not try to load modules in containers like openvz

+ConditionVirtualization=!container

+

+[Service]

+Type=oneshot

+ExecStart=/usr/sbin/modprobe tun

+

+[Install]

+WantedBy=multi-user.target

diff -up ./contrib/systemd/cjdns-online.sh.sbin ./contrib/systemd/cjdns-online.sh

--- ./contrib/systemd/cjdns-online.sh.sbin	2017-01-13 21:43:05.414731254 -0500

+++ ./contrib/systemd/cjdns-online.sh	2017-01-13 21:43:05.414731254 -0500

@@ -0,0 +1,90 @@

+#!/bin/sh

+#   Check whether cjdns IPs are available

+#   Copyright (C) 2016  Stuart D. Gathman <stuart@gathman.org>

+#

+#   This program is free software: you can redistribute it and/or modify

+#   it under the terms of the GNU General Public License as published by

+#   the Free Software Foundation, either version 3 of the License, or

+#   (at your option) any later version.

+#

+#   This program is distributed in the hope that it will be useful,

+#   but WITHOUT ANY WARRANTY; without even the implied warranty of

+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+#   GNU General Public License for more details.

+#

+#   You should have received a copy of the GNU General Public License

+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.

+

+cjdns_ips() {

+  ip -6 -o addr | while read i dev fam ip rem; do

+    case "$ip" in

+    fc*:*/8) echo "${ip%/8}";;

+    esac

+  done

+}

+

+cjdns_dev() {

+  ip -6 -o addr | while read i dev fam ip rem; do

+    case "$ip" in

+    fc*:*/8) echo "${dev}";;

+    esac

+  done

+}

+

+die() {

+  echo "$1" >&2

+  exit 1

+}

+

+PROGRAM_NAME="/usr/bin/cjdns-online"

+

+ARGS=$(getopt -n $PROGRAM_NAME -o t:xiqsh \

+	--long timeout:,exit,interface,quiet,wait-for-startup,help -- "$@")

+

+# Die if they fat finger arguments, this program may be run as root

+[ $? = 0 ] || die "Error parsing arguments. Try $PROGRAM_NAME --help"

+

+help() {

+        cat <

+Usage: $PROGRAM_NAME [options]

+        -t, --timeout <timeout_value>	time to wait in seconds, default 30

+        -i, --interface 	output interface name instead of ip

+        -x, --exit		exit immediately if cjdns is not online

+        -q, --quiet		don't print anything

+        -s, --wait-for-startup	wait for full startup instead of just tun dev

+EOH

+        exit 2

+}

+

+let timeout="30"

+let nowait="0"

+let quiet="0"

+let startup="0"

+let interface="0"

+

+eval set -- "$ARGS"

+while true; do

+  case "$1" in

+    -t|--timeout)	   let timeout="$2" || help; shift 2; continue;;

+    -i|--interface)	   let interface="1"; shift;;

+    -x|--exit)		   let nowait="1"; shift;;

+    -q|--quiet)		   let quiet="1"; shift;;

+    -s|--wait-for-startup) let startup="1"; shift;;

+    --) shift; break;;

+    *)	help;;

+  esac

+done

+

+let started="$(date +%s)"

+while test -z "$(cjdns_ips)"; do

+  let elapsed="$(date +%s) - $started"

+  [ $elapsed -gt $timeout ] && exit 1

+  sleep 2

+done

+if [ "$quiet" -eq 0 ]; then

+  if [ "$interface" -eq 0 ]; then

+    cjdns_ips

+  else

+    cjdns_dev

+  fi

+fi

diff -up ./contrib/systemd/cjdns.service.sbin ./contrib/systemd/cjdns.service

--- ./contrib/systemd/cjdns.service.sbin	2016-10-11 17:39:44.000000000 -0400

+++ ./contrib/systemd/cjdns.service	2017-01-13 22:07:35.128118775 -0500

@@ -1,18 +1,21 @@

 [Unit]

 Description=cjdns: routing engine designed for security, scalability, speed and ease of use

 Wants=network.target

-After=network.target

+After=network.target cjdns-loadmodules.service

+Requires=cjdns-loadmodules.service

 [Service]

 ProtectHome=true

 ProtectSystem=true

 SyslogIdentifier=cjdroute

+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SYS_CHROOT CAP_AUDIT_CONTROL

 ExecStartPre=/bin/sh -ec "if ! test -s /etc/cjdroute.conf; \

                 then umask 077; \

-                /usr/bin/cjdroute --genconf > /etc/cjdroute.conf; \

+                /usr/sbin/cjdroute --genconf | cat > /etc/cjdroute.conf; \

                 echo 'WARNING: A new /etc/cjdroute.conf file has been generated.'; \

             fi"

-ExecStart=/bin/sh -c "exec cjdroute --nobg < /etc/cjdroute.conf"

+ExecStart=/bin/sh -c "exec /usr/sbin/cjdroute --nobg < /etc/cjdroute.conf"

+ExecStartPost=/bin/sh /usr/libexec/cjdns/cjdns-up

 Restart=always

 [Install]

diff -up ./contrib/systemd/cjdns-wait-online.service.sbin ./contrib/systemd/cjdns-wait-online.service

--- ./contrib/systemd/cjdns-wait-online.service.sbin	2017-01-13 21:43:05.414731254 -0500

+++ ./contrib/systemd/cjdns-wait-online.service	2017-01-13 21:43:05.414731254 -0500

@@ -0,0 +1,13 @@

+[Unit]

+Description=CJDNS Wait Online

+Requisite=cjdns.service

+After=cjdns.service

+Wants=network.target

+Before=network-online.target

+

+[Service]

+Type=oneshot

+ExecStart=/usr/bin/cjdns-online -s -q --timeout=30

+

+[Install]

+WantedBy=multi-user.target

diff -up ./contrib/upstart/cjdns.conf.sbin ./contrib/upstart/cjdns.conf

--- ./contrib/upstart/cjdns.conf.sbin	2016-10-11 17:39:44.000000000 -0400

+++ ./contrib/upstart/cjdns.conf	2017-01-13 21:45:35.268491363 -0500

@@ -13,10 +13,16 @@ pre-start script

     if ! [ -s /etc/cjdroute.conf ]; then

         ( # start a subshell to avoid side effects of umask later on

             umask 077 # to create the file with 600 permissions without races

-            /usr/bin/cjdroute --genconf > /etc/cjdroute.conf

+	    # use cat because cjdroute can't write directly to /etc

+            /usr/sbin/cjdroute --genconf | cat > /etc/cjdroute.conf

         ) # exit subshell; umask no longer applies

         echo 'WARNING: A new cjdns cjdroute.conf file has been generated.'

     fi

+    # preload tun driver, since we prevent module_request

+    case $(wc -c /proc/modules) in

+    0*) ;;

+    *) /sbin/modprobe tun;;

+    esac

     # If you need a non-standard setup, as described in

     # https://github.com/cjdelisle/cjdns#non-standard-setups,

@@ -25,4 +31,10 @@ pre-start script

     # see http://upstart.ubuntu.com/cookbook/#setuid

 end script

-exec /usr/bin/cjdroute --nobg < /etc/cjdroute.conf

+script

+  exec /usr/sbin/cjdroute --nobg < /etc/cjdroute.conf

+end script

+

+post-start script

+  . /usr/libexec/cjdns/cjdns-up

+end script