refactor: adopt baby-nas Makefile style with inline packaging targets

- Simplify build targets: frontend, build, build-go, build-all, run, package
- Remove scripts/ for packaging (inline in Makefile)
- Add etc/syncserver/config.yaml and lib/systemd/system/ at project root
- build-all produces both amd64 and arm64 binaries
- package target builds .deb inline without external scripts
- VERSION from git tags, commit hash injected via ldflags

Makefile

@@ -1,36 +1,48 @@
-.PHONY: build dev clean deb run test lint
+BINARY=syncserver
+VERSION?=1.0.0
+GO?=go
+LDFLAGS=-s -w -X main.version=$(VERSION) -X main.commit=$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
+BUILD_FLAGS=CGO_ENABLED=0
 
-VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+.PHONY: build build-all build-go frontend run package clean tidy test
-GOARCH := amd64
 
-build:
+frontend:
-	GOARCH=$(GOARCH) ./scripts/build.sh
+	cd web && npm install && npm run build
 
-deb:
+build: frontend
-	./scripts/package-deb.sh
+	cp -R web/dist internal/webui/dist
+	$(BUILD_FLAGS) $(GO) build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/server
 
-clean:
+# build-go builds the binary without rebuilding the frontend (dist must exist).
-	rm -rf dist/
+build-go:
-	rm -rf internal/webui/dist/
+	$(BUILD_FLAGS) $(GO) build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/server
-	go clean
+
+build-all: frontend
+	$(BUILD_FLAGS) GOOS=linux GOARCH=amd64 $(GO) build -ldflags "$(LDFLAGS)" -o bin/$(BINARY)-linux-amd64 ./cmd/server
+	$(BUILD_FLAGS) GOOS=linux GOARCH=arm64 $(GO) build -ldflags "$(LDFLAGS)" -o bin/$(BINARY)-linux-arm64 ./cmd/server
 
 run: build
-	./syncserver --data-dir ./data --addr :8080
+	SYNCSERVER_ADMIN_USER=admin SYNCSERVER_ADMIN_PASSWORD=secret \
+	SYNCSERVER_DATA_DIR=.data \
+	./bin/$(BINARY) --addr :8080
 
-dev:
+package: build-all
-	cd web && npm run dev &
+	@mkdir -p dist/deb/usr/bin dist/deb/etc/syncserver dist/deb/lib/systemd/system dist/deb/DEBIAN
+	cp bin/$(BINARY)-linux-amd64 dist/deb/usr/bin/$(BINARY)
+	cp etc/syncserver/config.yaml dist/deb/etc/syncserver/config.yaml
+	cp lib/systemd/system/$(BINARY).service dist/deb/lib/systemd/system/$(BINARY).service
+	printf 'Package: $(BINARY)\nVersion: $(VERSION)\nSection: net\nPriority: optional\nArchitecture: amd64\nDepends: rsync, openssh-client, ca-certificates\nMaintainer: SyncServer\nDescription: File sync orchestrator with Wake-on-LAN and web UI\n' > dist/deb/DEBIAN/control
+	printf '#!/bin/sh\nset -e\nid $(BINARY) >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin $(BINARY)\ninstall -d -o $(BINARY) -g $(BINARY) -m 0750 /var/lib/$(BINARY)/data\ninstall -d -o $(BINARY) -g $(BINARY) -m 0750 /var/lib/$(BINARY)/ssh\ninstall -d -o $(BINARY) -g $(BINARY) -m 0750 /var/lib/$(BINARY)/logs\ninstall -d -o root -g root -m 0755 /etc/$(BINARY)\n[ ! -f /etc/$(BINARY)/config.yaml ] && cp /etc/$(BINARY)/config.yaml /etc/$(BINARY)/config.yaml.new || true\nsystemctl daemon-reload 2>/dev/null || true\nsystemctl enable --now $(BINARY).service 2>/dev/null || true\n' > dist/deb/DEBIAN/postinst
+	chmod 0755 dist/deb/DEBIAN/postinst
+	printf '#!/bin/sh\nset -e\nsystemctl stop $(BINARY).service 2>/dev/null || true\nsystemctl disable $(BINARY).service 2>/dev/null || true\n' > dist/deb/DEBIAN/prerm
+	chmod 0755 dist/deb/DEBIAN/prerm
+	dpkg-deb --build dist/deb dist/$(BINARY)_$(VERSION)_amd64.deb
+
+clean:
+	rm -rf bin dist .data web/node_modules web/dist internal/webui/dist
+
+tidy:
+	$(GO) mod tidy
 
 test:
-	go test ./...
+	$(GO) test ./...
-
-lint:
-	go vet ./...
-
-fmt:
-	go fmt ./...
-
-# Build for local macOS (not for production)
-build-local:
-	rm -rf web/dist && cd web && npm run build && cd ..
-	cp -R web/dist internal/webui/dist/
-	go build -ldflags="-X main.version=$(VERSION)" -o syncserver ./cmd/server

etc/syncserver/config.yaml

@@ -0,0 +1,9 @@
+data_dir: /var/lib/syncserver
+addr: :8080
+
+auth:
+  jwt_secret: ""
+  jwt_expiry_hours: 24
+
+scheduler:
+  timezone: UTC

lib/systemd/system/syncserver.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=SyncServer - File sync orchestrator with Wake-on-LAN and web UI
+Documentation=https://github.com/syncserver/syncserver
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=syncserver
+Group=syncserver
+ExecStart=/usr/bin/syncserver --config /etc/syncserver/config.yaml --data-dir /var/lib/syncserver
+Restart=on-failure
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=syncserver
+
+# Hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/syncserver /run
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target