docs: add complete README

internal/dynamicrouting/manager.go

@@ -630,11 +630,19 @@ func (m *Manager) applyBirdConfig() error {
 		sb.WriteString("}\n\n")
 	}
 
+	// Ensure directory exists with proper permissions
+	dir := filepath.Dir(birdConfigPath)
+	if err := os.MkdirAll(dir, 0775); err == nil {
+		_ = os.Chmod(dir, 0775)
+		_ = exec.Command("chown", "root:bird", dir).Run()
+	}
+
 	// Write candidate configuration to temporary file
 	tmpPath := birdConfigPath + ".new"
-	if err := os.WriteFile(tmpPath, []byte(sb.String()), 0644); err != nil {
+	if err := os.WriteFile(tmpPath, []byte(sb.String()), 0664); err != nil {
 		return fmt.Errorf("failed to write %s: %w", tmpPath, err)
 	}
+	_ = exec.Command("chown", "root:bird", tmpPath).Run()
 
 	// Validate syntax with bird -p
 	out, err := exec.Command("bird", "-p", "-c", tmpPath).CombinedOutput()
@@ -647,6 +655,8 @@ func (m *Manager) applyBirdConfig() error {
 	if err := os.Rename(tmpPath, birdConfigPath); err != nil {
 		return fmt.Errorf("failed to replace %s: %w", birdConfigPath, err)
 	}
+	_ = os.Chmod(birdConfigPath, 0664)
+	_ = exec.Command("chown", "root:bird", birdConfigPath).Run()
 
 	// Ensure BIRD systemd service is active
 	_ = exec.Command("systemctl", "start", "bird").Run()

systemd/proxmox-router.service

@@ -11,9 +11,5 @@ Restart=always
 RestartSec=3s
 LimitNOFILE=65535
 
-# Capabilities needed for netlink network management
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW
-AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW
-
 [Install]
 WantedBy=multi-user.target