chore: initial skeleton

- docs/architecture.md: native rewrite plan (5 services + control plane,
  Active-Active cluster like nmg, Floating-IP for HTTP ingress)
- cmd/edgeguard-{api,scheduler,ctl}: minimal Gin + CLI stubs
- packaging/debian/edgeguard-{api,ui,meta}: control + maintainer scripts
- deploy/systemd/edgeguard-api.service + edgeguard-scheduler.service
  with hardening defaults
- Makefile: build / cross-compile (amd64+arm64) / deb / publish targets
- scripts/install.sh + scripts/apt-repo/build-package.sh stubs

packaging/debian/edgeguard-api/DEBIAN/conffiles

@@ -0,0 +1 @@
+/etc/edgeguard/edgeguard.yaml

packaging/debian/edgeguard-api/DEBIAN/control

@@ -0,0 +1,18 @@
+Package: edgeguard-api
+Version: __VERSION__
+Architecture: __ARCH__
+Maintainer: NetCell IT <support@netcell-it.de>
+Homepage: https://edgeguard.netcell-it.de
+Description: EdgeGuard — native Reverse-Proxy / LB / Forward-Proxy / VPN / Firewall
+ EdgeGuard is a native Debian/Ubuntu edge gateway combining HAProxy,
+ Angie (nginx-fork), Squid, WireGuard and nftables, configured from
+ a PostgreSQL single-source-of-truth via a Go management API.
+ Deployable as a cluster of symmetric peers (KeyDB Active-Active +
+ PG Streaming Replication + provider Floating-IP for HTTP ingress).
+ .
+ This package ships the management API, scheduler and CLI.
+Depends: postgresql-16 | postgresql-17, edgeguard-keydb (>= 6.3.4-edgeguard1), angie, haproxy (>= 2.8), squid, wireguard-tools, nftables, certbot, sudo, adduser, systemd, ca-certificates
+Recommends: apparmor, fail2ban
+Section: admin
+Priority: optional
+Installed-Size: 0

packaging/debian/edgeguard-api/DEBIAN/postinst

@@ -0,0 +1,46 @@
+#!/bin/bash
+# postinst for edgeguard-api — creates system user, filesystem layout,
+# enables systemd units. DB init + migrations run lazily on first start
+# of edgeguard-api.
+set -e
+
+export LC_ALL=C
+export LANG=C
+
+EG_USER="edgeguard"
+EG_HOME="/var/lib/edgeguard"
+
+case "$1" in
+    configure)
+        # ── System user ──────────────────────────────────────────────
+        if ! getent passwd "$EG_USER" >/dev/null; then
+            adduser --system --group --home "$EG_HOME" \
+                    --shell /usr/sbin/nologin --no-create-home \
+                    --gecos "EdgeGuard daemon" "$EG_USER"
+        fi
+
+        # ── Directories ──────────────────────────────────────────────
+        for d in /etc/edgeguard /var/lib/edgeguard /var/log/edgeguard \
+                 /etc/edgeguard/haproxy /etc/edgeguard/angie \
+                 /etc/edgeguard/squid /etc/edgeguard/wireguard \
+                 /etc/edgeguard/nftables.d /etc/edgeguard/tls; do
+            install -d -m 0750 -o "$EG_USER" -g "$EG_USER" "$d"
+        done
+
+        # ── systemd ──────────────────────────────────────────────────
+        systemctl daemon-reload
+        systemctl enable --now edgeguard-api.service edgeguard-scheduler.service || true
+        ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+        ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0

packaging/debian/edgeguard-api/DEBIAN/postrm

@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+case "$1" in
+    purge)
+        # Only on purge: remove user, configs, state.
+        if getent passwd edgeguard >/dev/null; then
+            deluser --quiet edgeguard >/dev/null 2>&1 || true
+        fi
+        rm -rf /etc/edgeguard /var/lib/edgeguard /var/log/edgeguard
+        ;;
+
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+        ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0

packaging/debian/edgeguard-api/DEBIAN/prerm

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -e
+
+case "$1" in
+    remove|upgrade|deconfigure)
+        systemctl stop edgeguard-api.service edgeguard-scheduler.service || true
+        systemctl disable edgeguard-api.service edgeguard-scheduler.service || true
+        ;;
+
+    failed-upgrade)
+        ;;
+
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0

packaging/debian/edgeguard-meta/DEBIAN/control

@@ -0,0 +1,14 @@
+Package: edgeguard
+Version: __VERSION__
+Architecture: all
+Maintainer: NetCell IT <support@netcell-it.de>
+Homepage: https://edgeguard.netcell-it.de
+Description: EdgeGuard — meta package
+ Pulls the full EdgeGuard stack: management API, UI, configured
+ third-party services (HAProxy, Angie, Squid, WireGuard, nftables).
+ .
+ Install this package to get a complete EdgeGuard node.
+Depends: edgeguard-api (= ${binary:Version}), edgeguard-ui (= ${binary:Version})
+Section: admin
+Priority: optional
+Installed-Size: 0

packaging/debian/edgeguard-ui/DEBIAN/control

@@ -0,0 +1,12 @@
+Package: edgeguard-ui
+Version: __VERSION__
+Architecture: all
+Maintainer: NetCell IT <support@netcell-it.de>
+Homepage: https://edgeguard.netcell-it.de
+Description: EdgeGuard — management UI (static React build)
+ React 19 + Ant Design 6 single-page admin UI for EdgeGuard.
+ Served by the Angie reverse proxy bundled in edgeguard-api.
+Depends: edgeguard-api (= ${binary:Version}), angie
+Section: admin
+Priority: optional
+Installed-Size: 0