chore: add RPM/DEB packaging artifacts — 5.10

3 packages: python3-meshbay-common (dep), meshbay-hub, meshbay-node.
RPM: spec files with pre/post scriptlets (useradd, systemd macros).
DEB: DEBIAN/control + postinst for hub, control for node + common.
Systemd: hub.service (system, security hardening) + node.service
(user template @%i, EnvironmentFile for MESHBAY_UNLOCK_KEY).
packaging/README.md: build + install instructions.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

10 files changed, 404 insertions, 0 deletions

diff --git a/packaging/README.md b/packaging/README.md
new file mode 100644
index 0000000..2e31b7f
--- /dev/null
+++ b/packaging/README.md
@@ -0,0 +1,80 @@
+# MeshBay — Packaging
+
+Three distributable packages:
+
+| Package | RPM spec | DEB control | Description |
+|---|---|---|---|
+| `python3-meshbay-common` | `rpm/python3-meshbay-common.spec` | `deb/python3-meshbay-common/` | Shared crypto + protocol lib |
+| `meshbay-hub` | `rpm/meshbay-hub.spec` | `deb/meshbay-hub/` | Hub server (FastAPI + PostgreSQL) |
+| `meshbay-node` | `rpm/meshbay-node.spec` | `deb/meshbay-node/` | Node daemon + local UI |
+
+## Building RPMs (Fedora/RHEL)
+
+```bash
+# Install build tools
+sudo dnf install -y rpm-build python3-pip
+
+# Build all three packages
+for pkg in python3-meshbay-common meshbay-hub meshbay-node; do
+    rpmbuild -ba packaging/rpm/${pkg}.spec
+done
+```
+
+## Building DEBs (Debian/Ubuntu)
+
+```bash
+# Install build tools
+sudo apt install -y dpkg-dev debhelper python3-pip
+
+# Build common library first (dependency)
+dpkg-deb --build packaging/deb/python3-meshbay-common
+dpkg-deb --build packaging/deb/meshbay-hub
+dpkg-deb --build packaging/deb/meshbay-node
+
+# Install
+sudo dpkg -i python3-meshbay-common_0.1.0_all.deb
+sudo dpkg -i meshbay-hub_0.1.0_all.deb
+sudo dpkg -i meshbay-node_0.1.0_all.deb
+```
+
+## Install order
+
+Always install `python3-meshbay-common` first (dependency of both hub and node).
+
+## Post-install (hub)
+
+```bash
+# Generate hub keypair
+sudo -u meshbay meshbay-hub --generate-keys
+
+# Edit config
+sudo nano /etc/meshbay/hub.toml
+
+# Configure Caddy for HTTPS
+sudo nano /etc/caddy/Caddyfile
+
+# Start
+sudo systemctl enable --now meshbay-hub
+```
+
+## Post-install (node)
+
+```bash
+# Initialize node (writes example config)
+meshbay-node init
+
+# Edit config
+nano ~/.config/meshbay/node.toml
+
+# Start as user service
+systemctl --user enable --now meshbay-node
+```
+
+## Systemd service files
+
+| File | Location |
+|---|---|
+| `systemd/meshbay-hub.service` | `/usr/lib/systemd/system/meshbay-hub.service` |
+| `systemd/meshbay-node.service` | `/usr/lib/systemd/user/meshbay-node.service` |
+
+The node service is a **user service** (runs as the user's own account, with access to their home directory). The hub is a **system service** (runs as the `meshbay` system account).
diff --git a/packaging/deb/meshbay-hub/DEBIAN/control b/packaging/deb/meshbay-hub/DEBIAN/control
new file mode 100644
index 0000000..cd4a2de
--- /dev/null
+++ b/packaging/deb/meshbay-hub/DEBIAN/control
@@ -0,0 +1,19 @@
+Package: meshbay-hub
+Version: 0.1.0
+Section: net
+Priority: optional
+Architecture: all
+Maintainer: MeshBay Team <team@meshbay.org>
+Homepage: https://meshbay.org
+Depends: python3 (>= 3.12),
+         python3-meshbay-common (= 0.1.0),
+         postgresql,
+         python3-fastapi,
+         python3-uvicorn,
+         adduser
+Recommends: caddy
+Description: MeshBay Hub — identity authority and group registry server
+ MeshBay Hub provides user registration, JWT issuance, group management,
+ GEK bundle distribution, revocation, and moderation for MeshBay networks.
+ .
+ Runs as a systemd service behind Caddy for HTTPS (auto Let's Encrypt).
diff --git a/packaging/deb/meshbay-hub/DEBIAN/postinst b/packaging/deb/meshbay-hub/DEBIAN/postinst
new file mode 100644
index 0000000..48921f2
--- /dev/null
+++ b/packaging/deb/meshbay-hub/DEBIAN/postinst
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        # Create service account
+        if ! getent group meshbay >/dev/null 2>&1; then
+            addgroup --system meshbay
+        fi
+        if ! getent passwd meshbay >/dev/null 2>&1; then
+            adduser --system --ingroup meshbay --home /var/lib/meshbay \
+                    --no-create-home --disabled-password \
+                    --gecos "MeshBay service account" meshbay
+        fi
+
+        # Create data directory
+        install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub
+        install -d -o meshbay -g meshbay -m 750 /var/log/meshbay
+
+        # Enable and start service
+        if [ -d /run/systemd/system ]; then
+            systemctl daemon-reload || true
+            systemctl enable meshbay-hub.service || true
+            systemctl start meshbay-hub.service || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#
diff --git a/packaging/deb/meshbay-node/DEBIAN/control b/packaging/deb/meshbay-node/DEBIAN/control
new file mode 100644
index 0000000..7a8e0fa
--- /dev/null
+++ b/packaging/deb/meshbay-node/DEBIAN/control
@@ -0,0 +1,17 @@
+Package: meshbay-node
+Version: 0.1.0
+Section: net
+Priority: optional
+Architecture: all
+Maintainer: MeshBay Team <team@meshbay.org>
+Homepage: https://meshbay.org
+Depends: python3 (>= 3.12),
+         python3-meshbay-common (= 0.1.0),
+         adduser
+Recommends: ffmpeg
+Description: MeshBay Node — local file host and streaming server
+ MeshBay Node indexes local directories and serves encrypted files
+ to authenticated group members over QUIC (MNP v2) or TCP+TLS (MNP v1).
+ .
+ Includes a local management web UI at http://localhost:18000.
+ Designed to run on a home server or NAS.
diff --git a/packaging/deb/python3-meshbay-common/DEBIAN/control b/packaging/deb/python3-meshbay-common/DEBIAN/control
new file mode 100644
index 0000000..ea35603
--- /dev/null
+++ b/packaging/deb/python3-meshbay-common/DEBIAN/control
@@ -0,0 +1,18 @@
+Package: python3-meshbay-common
+Version: 0.1.0
+Section: python
+Priority: optional
+Architecture: all
+Maintainer: MeshBay Team <team@meshbay.org>
+Homepage: https://meshbay.org
+Depends: python3 (>= 3.12),
+         python3-cryptography (>= 43.0),
+         python3-jwt,
+         python3-msgpack,
+         python3-zstandard
+Description: MeshBay shared cryptographic primitives and protocol types
+ Provides Ed25519/X25519 key operations, GEK wrap/unwrap (ECIES-like),
+ per-chunk HKDF key derivation, ChaCha20-Poly1305 encryption,
+ AES-256-GCM keystore encryption, and MNP protocol message types.
+ .
+ Required by both meshbay-hub and meshbay-node.
diff --git a/packaging/rpm/meshbay-hub.spec b/packaging/rpm/meshbay-hub.spec
new file mode 100644
index 0000000..f68c3bf
--- /dev/null
+++ b/packaging/rpm/meshbay-hub.spec
@@ -0,0 +1,78 @@
+Name:           meshbay-hub
+Version:        0.1.0
+Release:        1%{?dist}
+Summary:        MeshBay Hub — identity authority and group registry server
+License:        AGPLv3+
+URL:            https://meshbay.org
+Source0:        %{name}-%{version}.tar.gz
+
+BuildArch:      noarch
+BuildRequires:  python3-devel >= 3.12
+BuildRequires:  python3-pip
+BuildRequires:  python3-hatchling
+
+Requires:       python3 >= 3.12
+Requires:       python3-meshbay-common = %{version}
+Requires:       python3-fastapi
+Requires:       python3-uvicorn
+Requires:       python3-sqlalchemy >= 2.0
+Requires:       python3-alembic
+Requires:       python3-asyncpg
+Requires:       python3-pyjwt
+Requires:       python3-blake3
+Requires:       python3-slowapi
+Requires:       postgresql-server
+
+%description
+MeshBay Hub provides identity management, group registry,
+GEK bundle distribution, and coordination for MeshBay nodes.
+Runs as a systemd service behind Caddy (HTTPS).
+
+%prep
+%autosetup
+
+%build
+%{python3} -m pip wheel --no-deps --wheel-dir dist .
+
+%install
+%{python3} -m pip install --root %{buildroot} --no-index --find-links dist meshbay-hub
+
+# systemd service
+install -Dm644 packaging/systemd/meshbay-hub.service \
+    %{buildroot}%{_unitdir}/meshbay-hub.service
+
+# Config file template
+install -Dm644 packaging/conf/hub.toml.example \
+    %{buildroot}%{_sysconfdir}/meshbay/hub.toml.example
+
+# Data directory
+install -d %{buildroot}%{_sharedstatedir}/meshbay/hub
+
+%pre
+getent group meshbay >/dev/null || groupadd -r meshbay
+getent passwd meshbay >/dev/null || \
+    useradd -r -g meshbay -d %{_sharedstatedir}/meshbay -s /sbin/nologin \
+            -c "MeshBay service account" meshbay
+
+%post
+%systemd_post meshbay-hub.service
+
+%preun
+%systemd_preun meshbay-hub.service
+
+%postun
+%systemd_postun_with_restart meshbay-hub.service
+
+%files
+%license LICENSE
+%doc README.md
+%{python3_sitelib}/meshbay_hub/
+%{python3_sitelib}/meshbay_hub-*.dist-info/
+%{_bindir}/meshbay-hub
+%{_unitdir}/meshbay-hub.service
+%config(noreplace) %{_sysconfdir}/meshbay/hub.toml.example
+%dir %attr(750, meshbay, meshbay) %{_sharedstatedir}/meshbay/hub
+
+%changelog
+* Sat Aug 09 2026 MeshBay Team <team@meshbay.org> - 0.1.0-1
+- Initial package
diff --git a/packaging/rpm/meshbay-node.spec b/packaging/rpm/meshbay-node.spec
new file mode 100644
index 0000000..5604f4a
--- /dev/null
+++ b/packaging/rpm/meshbay-node.spec
@@ -0,0 +1,57 @@
+Name:           meshbay-node
+Version:        0.1.0
+Release:        1%{?dist}
+Summary:        MeshBay Node — local file host, streaming server, and group daemon
+License:        AGPLv3+
+URL:            https://meshbay.org
+Source0:        %{name}-%{version}.tar.gz
+
+BuildArch:      noarch
+BuildRequires:  python3-devel >= 3.12
+BuildRequires:  python3-pip
+BuildRequires:  python3-hatchling
+
+Requires:       python3 >= 3.12
+Requires:       python3-meshbay-common = %{version}
+Requires:       python3-fastapi
+Requires:       python3-uvicorn
+Requires:       python3-httpx
+Requires:       python3-watchdog
+Requires:       python3-aioquic >= 1.0
+Requires:       python3-aioice
+Requires:       python3-pyjwt
+Requires:       python3-blake3
+Requires:       python3-msgpack
+Requires:       python3-zstandard
+# Optional: ffmpeg for HLS streaming
+Recommends:     ffmpeg
+
+%description
+MeshBay Node indexes local directories and serves encrypted files
+to authenticated group members over QUIC (MNP v2) or TCP+TLS (MNP v1).
+Includes a local web UI at http://localhost:18000.
+
+%prep
+%autosetup
+
+%build
+%{python3} -m pip wheel --no-deps --wheel-dir dist .
+
+%install
+%{python3} -m pip install --root %{buildroot} --no-index --find-links dist meshbay-node
+
+# systemd user service (template)
+install -Dm644 packaging/systemd/meshbay-node.service \
+    %{buildroot}%{_userunitdir}/meshbay-node.service
+
+%files
+%license LICENSE
+%doc README.md
+%{python3_sitelib}/meshbay_node/
+%{python3_sitelib}/meshbay_node-*.dist-info/
+%{_bindir}/meshbay-node
+%{_userunitdir}/meshbay-node.service
+
+%changelog
+* Sat Aug 09 2026 MeshBay Team <team@meshbay.org> - 0.1.0-1
+- Initial package
diff --git a/packaging/rpm/python3-meshbay-common.spec b/packaging/rpm/python3-meshbay-common.spec
new file mode 100644
index 0000000..7687e90
--- /dev/null
+++ b/packaging/rpm/python3-meshbay-common.spec
@@ -0,0 +1,42 @@
+Name:           python3-meshbay-common
+Version:        0.1.0
+Release:        1%{?dist}
+Summary:        MeshBay shared cryptographic primitives and protocol types
+License:        AGPLv3+
+URL:            https://meshbay.org
+Source0:        meshbay-common-%{version}.tar.gz
+
+BuildArch:      noarch
+BuildRequires:  python3-devel >= 3.12
+BuildRequires:  python3-pip
+BuildRequires:  python3-hatchling
+
+Requires:       python3 >= 3.12
+Requires:       python3-cryptography >= 43.0
+Requires:       python3-pyjwt >= 2.9
+Requires:       python3-blake3 >= 1.0
+Requires:       python3-msgpack >= 1.1
+Requires:       python3-zstandard >= 0.23
+
+%description
+Shared library for MeshBay hub and node packages.
+Provides: Ed25519/X25519 operations, GEK wrap/unwrap, chunk
+encryption/signing, keystore AES-256-GCM, and MNP protocol types.
+
+%prep
+%autosetup -n meshbay-common-%{version}
+
+%build
+%{python3} -m pip wheel --no-deps --wheel-dir dist .
+
+%install
+%{python3} -m pip install --root %{buildroot} --no-index --find-links dist meshbay-common
+
+%files
+%license LICENSE
+%{python3_sitelib}/meshbay_common/
+%{python3_sitelib}/meshbay_common-*.dist-info/
+
+%changelog
+* Sat Aug 09 2026 MeshBay Team <team@meshbay.org> - 0.1.0-1
+- Initial package
diff --git a/packaging/systemd/meshbay-hub.service b/packaging/systemd/meshbay-hub.service
new file mode 100644
index 0000000..2bea8ea
--- /dev/null
+++ b/packaging/systemd/meshbay-hub.service
@@ -0,0 +1,35 @@
+[Unit]
+Description=MeshBay Hub — identity authority and group registry
+Documentation=https://meshbay.org/docs
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=meshbay
+Group=meshbay
+WorkingDirectory=/var/lib/meshbay/hub
+
+# Environment — override in /etc/meshbay/hub.env
+EnvironmentFile=-/etc/meshbay/hub.env
+Environment=MESHBAY_DATABASE_URL=postgresql+asyncpg://meshbay:CHANGEME@localhost/meshbay_hub
+Environment=MESHBAY_HUB_KEY=/etc/meshbay/hub_private.pem
+
+ExecStartPre=/usr/bin/meshbay-hub-migrate
+ExecStart=/usr/bin/meshbay-hub --config /etc/meshbay/hub.toml
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+
+# Security hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/meshbay/hub /var/log/meshbay
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+[Install]
+WantedBy=multi-user.target
diff --git a/packaging/systemd/meshbay-node.service b/packaging/systemd/meshbay-node.service
new file mode 100644
index 0000000..e64934f
--- /dev/null
+++ b/packaging/systemd/meshbay-node.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=MeshBay Node — local file host and streaming server
+Documentation=https://meshbay.org/docs
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=%i
+Group=%i
+
+# Per-user service: systemctl enable --now meshbay-node@$USER
+WorkingDirectory=%h
+
+# Override unlock mode in ~/.config/meshbay/hub.env
+EnvironmentFile=-%h/.config/meshbay/node.env
+# Alternative: MESHBAY_UNLOCK_KEY=<password> in environment file (chmod 600)
+
+ExecStart=/usr/bin/meshbay-node --config %h/.config/meshbay/node.toml
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30
+
+# Security hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=default.target