V1.0: Class 1 fax — real-world 4-page send to external number confirmed

Core features: - Class 1 T.30 protocol: full send/receive implementation - HDLC: DLE-stuffing, FCS strip, USR5637 bit-reversal handling - T.4 MH encoder/decoder (1728px A4 standard) - Document pipeline: PDF (Ghostscript), PNG, TIFF input - Width clamping: US Letter 1734px → 1728px fax standard - Cover page: CJK rasterization (TW/CN/JP/EN), TIFF + HTML output - OCR verification: Tesseract 5 with eng+chi_tra, CJK space-tolerant - API server (axum): health, send, jobs, cover, retry, cancel - Background worker: auto-poll queue, speed fallback, retry policy - Modem detection, pool management Real-world test results (2026-07-23): - V90 → 25153038: 4 pages, V.17 12000 bps, 2:33 ✅ - USR5637 → 25153038: 4 pages, V.17 12000 bps, 2:26 ✅ - Both faxes confirmed received on remote machine Tested: loopback (100% pixel match), multi-page, all input formats, cover pages, OCR verify, API endpoints, worker processing. 13 unit tests pass, 0 new clippy warnings.
2026-07-24 18:47:15 +08:00
parent d1e92b32fb
commit 55bca92691
155 changed files with 25024 additions and 916 deletions
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.telfax.server</string>
+    
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/local/bin/telfax</string>
+        <string>serve</string>
+        <string>--config</string>
+        <string>/usr/local/etc/telfax/config.toml</string>
+    </array>
+    
+    <key>RunAtLoad</key>
+    <true/>
+    
+    <key>KeepAlive</key>
+    <true/>
+    
+    <key>StandardOutPath</key>
+    <string>/usr/local/var/log/telfax/telfax.log</string>
+    
+    <key>StandardErrorPath</key>
+    <string>/usr/local/var/log/telfax/telfax-error.log</string>
+    
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>RUST_LOG</key>
+        <string>info</string>
+        <key>TELFAX_CONFIG_PATH</key>
+        <string>/usr/local/etc/telfax/config.toml</string>
+    </dict>
+    
+    <key>WorkingDirectory</key>
+    <string>/usr/local/var/lib/telfax</string>
+    
+    <key>UserName</key>
+    <string>root</string>
+    
+    <key>GroupName</key>
+    <string>wheel</string>
+    
+    <key>SoftResourceLimits</key>
+    <dict>
+        <key>NumberOfFiles</key>
+        <integer>65536</integer>
+    </dict>
+    
+    <key>HardResourceLimits</key>
+    <dict>
+        <key>NumberOfFiles</key>
+        <integer>65536</integer>
+    </dict>
+</dict>
+</plist>
@@ -0,0 +1,99 @@
+# Telfax Enterprise Configuration - Complete Example
+# 
+# Copy this file to /usr/local/etc/telfax/config.toml or use --config option
+
+[server]
+listen = "0.0.0.0:3000"
+log_level = "info"
+
+# Authentication tokens
+[auth]
+rate_limit_per_ip = 100
+rate_limit_per_token = 500
+
+[[auth.tokens]]
+token = "admin-token-change-me-in-production"
+permissions = "admin"
+description = "Full administrative access"
+
+[[auth.tokens]]
+token = "write-token-change-me-in-production"
+permissions = "write"
+description = "Send faxes and manage jobs"
+
+[[auth.tokens]]
+token = "read-token-change-me-in-production"
+permissions = "read"
+description = "View status and history"
+
+# Modem configuration
+[[modems]]
+device = "/dev/cu.usbmodem123456781"
+name = "V90-Primary"
+class = 2
+priority = 1
+enabled = true
+
+[[modems]]
+device = "/dev/cu.usbmodem00000021"
+name = "USR5637-Backup"
+class = 1
+priority = 2
+enabled = false  # Class 1 is experimental
+
+# Job queue
+[queue]
+database = "/usr/local/var/lib/telfax/queue.db"
+max_retries = 3
+retry_intervals = [60, 300, 900]  # 1min, 5min, 15min
+
+# Fax settings
+[fax]
+station_id = "+886-2-25289852"
+header = "Telfax Enterprise Fax Server"
+resolution = "fine"
+speed_fallback = true
+default_class = 2
+
+# Cover page
+[cover]
+font_path = "/System/Library/AssetsV2/com_apple_MobileAsset_Font8/86ba2c91f017a3749571a82f2c6d890ac7ffb2fb.asset/AssetData/PingFang.ttc"
+font_index = 10  # TC-Semibold
+default_from = "Telfax Enterprise"
+
+# Address book
+[address_book]
+database = "/usr/local/var/lib/telfax/address_book.db"
+
+# Email configuration (optional)
+# Uncomment and configure for Email-to-Fax and notifications
+# 
+# [email]
+# smtp_host = "smtp.gmail.com"
+# smtp_port = 587
+# smtp_username = "your-email@gmail.com"
+# smtp_password = "your-app-password"
+# from_address = "telfax@yourdomain.com"
+# from_name = "Telfax Fax Server"
+# use_tls = true
+#
+# [notification]
+# email = "admin@yourdomain.com"
+# notify_on_success = true
+# notify_on_failure = true
+# notify_on_received = true
+
+# Monitoring
+[monitoring]
+metrics_port = 9090
+enable_prometheus = true
+health_check_interval = 60
+
+# Logging
+[logging]
+# Log file path (optional, defaults to stdout)
+# file = "/usr/local/var/log/telfax/telfax.log"
+# Maximum log file size in MB
+# max_size = 100
+# Number of rotated log files to keep
+# max_files = 10
@@ -0,0 +1,74 @@
+# Telfax Production Configuration - V90 Class 2 Primary
+# 
+# This config is optimized for production use with V90 modem in Class 2 mode
+
+[server]
+listen = "0.0.0.0:3000"
+log_level = "info"
+
+# Production authentication tokens
+# IMPORTANT: Change these tokens before deployment!
+[auth]
+rate_limit_per_ip = 100
+rate_limit_per_token = 500
+
+[[auth.tokens]]
+token = "prod-admin-token-change-me-abc123xyz"
+permissions = "admin"
+description = "Production admin token"
+
+[[auth.tokens]]
+token = "prod-write-token-change-me-def456uvw"
+permissions = "write"
+description = "Production write token for sending faxes"
+
+[[auth.tokens]]
+token = "prod-read-token-change-me-ghi789rst"
+permissions = "read"
+description = "Production read token for status monitoring"
+
+# Primary Modem: V90 (Class 2 only - proven stable)
+[[modems]]
+device = "/dev/cu.usbmodem123456781"
+name = "V90-Primary"
+class = 2
+priority = 1
+enabled = true
+phone_number = "25289852"
+description = "V90 modem for Class 2 operations (production)"
+
+# Backup Modem: USR5637 (Class 1 - experimental)
+[[modems]]
+device = "/dev/cu.usbmodem00000021"
+name = "USR5637-Backup"
+class = 1
+priority = 2
+enabled = false  # Disabled until Class 1 is stable
+phone_number = "27486656"
+description = "USR5637 modem for Class 1 operations (experimental)"
+
+# Job queue configuration
+[queue]
+database = "/usr/local/var/lib/telfax/queue.db"
+max_retries = 3
+retry_intervals = [60, 300, 900]  # 1min, 5min, 15min
+
+# Fax settings
+[fax]
+station_id = "+886-2-25289852"
+header = "Telfax Fax Server"
+resolution = "fine"
+speed_fallback = true
+default_class = 2  # Use Class 2 for production
+
+# Cover page settings (Chinese support)
+[cover]
+font_path = "/System/Library/AssetsV2/com_apple_MobileAsset_Font8/86ba2c91f017a3749571a82f2c6d890ac7ffb2fb.asset/AssetData/PingFang.ttc"
+font_index = 10
+default_from = "Telfax Enterprise"
+
+# Monitoring settings
+[monitoring]
+metrics_port = 9090
+enable_prometheus = true
+health_check_interval = 60  # seconds
@@ -0,0 +1,65 @@
+# Telfax Enterprise Fax Server Configuration
+# 
+# Copy this file to /opt/telfax/config.toml and customize as needed
+
+[server]
+listen = "0.0.0.0:3000"
+log_level = "info"
+
+# Authentication tokens
+# Each token has a permission level: "admin", "write", "read"
+[auth]
+rate_limit_per_ip = 100
+rate_limit_per_token = 500
+
+[[auth.tokens]]
+token = "your-secret-admin-token-here"
+permissions = "admin"
+description = "Admin token for full access"
+
+[[auth.tokens]]
+token = "your-secret-write-token-here"
+permissions = "write"
+description = "Token for sending faxes"
+
+[[auth.tokens]]
+token = "your-secret-read-token-here"
+permissions = "read"
+description = "Token for viewing status"
+
+# Modem configuration
+# V90 modem - Primary (Class 2)
+[[modems]]
+device = "/dev/cu.usbmodem123456781"
+name = "V90"
+class = 2
+priority = 1
+enabled = true
+
+# USR5637 modem - Fallback (Class 1)
+[[modems]]
+device = "/dev/cu.usbmodem00000021"
+name = "USR5637"
+class = 1
+priority = 2
+enabled = true
+
+# Job queue configuration
+[queue]
+database = "/var/lib/telfax/queue.db"
+max_retries = 3
+retry_intervals = [60, 300, 900]  # 1min, 5min, 15min
+
+# Fax settings
+[fax]
+station_id = "+886-2-1234-5678"
+header = "Your Company Name"
+resolution = "fine"
+speed_fallback = true
+default_class = 2  # Prefer Class 2 for reliability
+
+# Cover page settings
+[cover]
+font_path = "/System/Library/AssetsV2/com_apple_MobileAsset_Font8/86ba2c91f017a3749571a82f2c6d890ac7ffb2fb.asset/AssetData/PingFang.ttc"
+font_index = 10
+default_from = "Your Company Name"
@@ -0,0 +1,275 @@
+#!/bin/bash
+# Telfax Enterprise - Complete Production Deployment Script
+#
+# This script deploys Telfax as a production-ready fax server
+# Supports: macOS (launchd) and Linux (systemd)
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+echo -e "${GREEN}=== Telfax Enterprise Fax Server Deployment ===${NC}"
+echo ""
+
+# Detect OS
+OS=$(uname -s)
+case "$OS" in
+    Darwin)
+        echo "Detected: macOS"
+        INSTALL_DIR="/usr/local"
+        CONFIG_DIR="$INSTALL_DIR/etc/telfax"
+        DATA_DIR="$INSTALL_DIR/var/lib/telfax"
+        LOG_DIR="$INSTALL_DIR/var/log/telfax"
+        ;;
+    Linux)
+        echo "Detected: Linux"
+        INSTALL_DIR="/opt/telfax"
+        CONFIG_DIR="/etc/telfax"
+        DATA_DIR="/var/lib/telfax"
+        LOG_DIR="/var/log/telfax"
+        ;;
+    *)
+        echo -e "${RED}Unsupported OS: $OS${NC}"
+        exit 1
+        ;;
+esac
+
+# Check for root privileges
+if [ "$EUID" -ne 0 ]; then
+    echo -e "${RED}Please run as root (sudo ./deploy.sh)${NC}"
+    exit 1
+fi
+
+# Create directories
+echo -e "${YELLOW}Creating directories...${NC}"
+mkdir -p "$INSTALL_DIR/bin"
+mkdir -p "$CONFIG_DIR"
+mkdir -p "$DATA_DIR"
+mkdir -p "$LOG_DIR"
+
+# Build binary
+echo -e "${YELLOW}Building Telfax binary...${NC}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+
+cd "$PROJECT_DIR"
+cargo build --release --features server
+
+if [ ! -f "target/release/telfax" ]; then
+    echo -e "${RED}Build failed! Binary not found.${NC}"
+    exit 1
+fi
+
+# Install binary
+echo -e "${YELLOW}Installing binary...${NC}"
+cp target/release/telfax "$INSTALL_DIR/bin/"
+chmod +x "$INSTALL_DIR/bin/telfax"
+
+# Install configuration
+if [ ! -f "$CONFIG_DIR/config.toml" ]; then
+    echo -e "${YELLOW}Installing configuration...${NC}"
+    cp deployment/config.enterprise.toml "$CONFIG_DIR/config.toml"
+    echo -e "${GREEN}Configuration installed to: $CONFIG_DIR/config.toml${NC}"
+else
+    echo -e "${YELLOW}Configuration already exists, skipping...${NC}"
+fi
+
+# Create database directory
+echo -e "${YELLOW}Initializing databases...${NC}"
+mkdir -p "$(dirname "$DATA_DIR/queue.db")"
+mkdir -p "$(dirname "$DATA_DIR/address_book.db")"
+
+# Install service
+echo -e "${YELLOW}Installing system service...${NC}"
+case "$OS" in
+    Darwin)
+        # macOS launchd
+        cat > /Library/LaunchDaemons/com.telfax.server.plist <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.telfax.server</string>
+    
+    <key>ProgramArguments</key>
+    <array>
+        <string>$INSTALL_DIR/bin/telfax</string>
+        <string>serve</string>
+        <string>--config</string>
+        <string>$CONFIG_DIR/config.toml</string>
+    </array>
+    
+    <key>RunAtLoad</key>
+    <true/>
+    
+    <key>KeepAlive</key>
+    <true/>
+    
+    <key>StandardOutPath</key>
+    <string>$LOG_DIR/telfax.log</string>
+    
+    <key>StandardErrorPath</key>
+    <string>$LOG_DIR/telfax-error.log</string>
+    
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>RUST_LOG</key>
+        <string>info</string>
+    </dict>
+    
+    <key>WorkingDirectory</key>
+    <string>$DATA_DIR</string>
+</dict>
+</plist>
+EOF
+        chmod 644 /Library/LaunchDaemons/com.telfax.server.plist
+        ;;
+        
+    Linux)
+        # Linux systemd
+        cat > /etc/systemd/system/telfax.service <<EOF
+[Unit]
+Description=Telfax Enterprise Fax Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=$DATA_DIR
+ExecStart=$INSTALL_DIR/bin/telfax serve --config $CONFIG_DIR/config.toml
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=30
+TimeoutStopSec=30
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=telfax
+
+Environment=RUST_LOG=info
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+
+ReadWritePaths=$DATA_DIR $LOG_DIR /dev
+
+LimitNOFILE=65536
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target
+EOF
+        chmod 644 /etc/systemd/system/telfax.service
+        systemctl daemon-reload
+        ;;
+esac
+
+# Set permissions
+echo -e "${YELLOW}Setting permissions...${NC}"
+case "$OS" in
+    Darwin)
+        chown -R root:wheel "$CONFIG_DIR"
+        chown -R root:wheel "$DATA_DIR"
+        chown -R root:wheel "$LOG_DIR"
+        ;;
+    Linux)
+        chown -R root:root "$CONFIG_DIR"
+        chown -R root:root "$DATA_DIR"
+        chown -R root:root "$LOG_DIR"
+        ;;
+esac
+
+chmod 600 "$CONFIG_DIR/config.toml"
+
+# Create environment file
+echo -e "${YELLOW}Creating environment file...${NC}"
+cat > "$CONFIG_DIR/telfax.env" <<EOF
+# Telfax Environment Variables
+# Source this file for quick access: source /etc/telfax/telfax.env
+
+export TELFAX_BIN="$INSTALL_DIR/bin/telfax"
+export TELFAX_CONFIG="$CONFIG_DIR/config.toml"
+export TELFAX_DATA="$DATA_DIR"
+export TELFAX_LOG="$LOG_DIR"
+
+# Quick commands
+alias telfax='$TELFAX_BIN --config $TELFAX_CONFIG'
+alias telfax-log='tail -f $TELFAX_LOG/telfax.log'
+alias telfax-status='$TELFAX_BIN status'
+EOF
+
+echo ""
+echo -e "${GREEN}=== Installation Complete ===${NC}"
+echo ""
+echo "Binary:          $INSTALL_DIR/bin/telfax"
+echo "Configuration:   $CONFIG_DIR/config.toml"
+echo "Data directory:  $DATA_DIR"
+echo "Log directory:   $LOG_DIR"
+echo ""
+echo -e "${YELLOW}Next Steps:${NC}"
+echo ""
+echo "1. Edit configuration:"
+echo "   nano $CONFIG_DIR/config.toml"
+echo ""
+echo "2. Configure authentication tokens (IMPORTANT!)"
+echo "   - Change all default tokens in [auth.tokens]"
+echo "   - Configure email settings if needed"
+echo ""
+echo "3. Configure modems:"
+echo "   - Set correct device paths in [[modems]]"
+echo "   - Adjust class and priority as needed"
+echo ""
+echo "4. Start the service:"
+case "$OS" in
+    Darwin)
+        echo "   sudo launchctl load -w /Library/LaunchDaemons/com.telfax.server.plist"
+        echo ""
+        echo "5. Check service status:"
+        echo "   sudo launchctl list | grep telfax"
+        ;;
+    Linux)
+        echo "   sudo systemctl enable telfax"
+        echo "   sudo systemctl start telfax"
+        echo ""
+        echo "5. Check service status:"
+        echo "   sudo systemctl status telfax"
+        ;;
+esac
+echo ""
+echo "6. View logs:"
+echo "   tail -f $LOG_DIR/telfax.log"
+echo ""
+echo "7. Test API:"
+echo "   curl http://localhost:3000/api/v1/status"
+echo ""
+echo "8. Open Web UI:"
+echo "   http://localhost:3000"
+echo ""
+echo -e "${GREEN}Deployment successful!${NC}"
+echo ""
+
+# Optional: Start service automatically
+read -p "Start Telfax service now? (y/n) " -n 1 -r
+echo
+if [[ $REPLY =~ ^[Yy]$ ]]; then
+    case "$OS" in
+        Darwin)
+            launchctl load -w /Library/LaunchDaemons/com.telfax.server.plist
+            echo -e "${GREEN}Service started!${NC}"
+            ;;
+        Linux)
+            systemctl enable telfax
+            systemctl start telfax
+            echo -e "${GREEN}Service started!${NC}"
+            ;;
+    esac
+else
+    echo -e "${YELLOW}Service not started. Start manually when ready.${NC}"
+fi
@@ -0,0 +1,103 @@
+#!/bin/bash
+# Telfax Enterprise Fax Server Installation Script for macOS
+#
+# Usage: sudo ./install-macos.sh
+
+set -e
+
+INSTALL_DIR="/usr/local"
+BIN_DIR="$INSTALL_DIR/bin"
+CONFIG_DIR="$INSTALL_DIR/etc/telfax"
+DATA_DIR="$INSTALL_DIR/var/lib/telfax"
+LOG_DIR="$INSTALL_DIR/var/log/telfax"
+PLIST_NAME="com.telfax.server.plist"
+PLIST_DEST="/Library/LaunchDaemons/$PLIST_NAME"
+
+echo "=== Telfax Enterprise Fax Server Installation (macOS) ==="
+echo ""
+
+# Check if running as root
+if [ "$EUID" -ne 0 ]; then
+    echo "Error: Please run as root (sudo ./install-macos.sh)"
+    exit 1
+fi
+
+# Create directories
+echo "Creating directories..."
+mkdir -p "$BIN_DIR"
+mkdir -p "$CONFIG_DIR"
+mkdir -p "$DATA_DIR"
+mkdir -p "$LOG_DIR"
+
+# Build the binary if needed
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+
+if [ ! -f "$PROJECT_DIR/target/release/telfax" ]; then
+    echo "Building telfax (release mode)..."
+    cd "$PROJECT_DIR"
+    cargo build --release
+fi
+
+# Install binary
+echo "Installing binary..."
+cp "$PROJECT_DIR/target/release/telfax" "$BIN_DIR/"
+chmod +x "$BIN_DIR/telfax"
+
+# Install configuration
+if [ ! -f "$CONFIG_DIR/config.toml" ]; then
+    echo "Installing production configuration..."
+    cp "$PROJECT_DIR/deployment/config.production.toml" "$CONFIG_DIR/config.toml"
+    echo ""
+    echo "⚠️  IMPORTANT: Edit $CONFIG_DIR/config.toml"
+    echo "   - Change all authentication tokens"
+    echo "   - Verify modem device paths"
+    echo "   - Set your station_id and header"
+    echo ""
+else
+    echo "Configuration file already exists, skipping..."
+fi
+
+# Install launchd plist
+echo "Installing launchd service..."
+cp "$PROJECT_DIR/deployment/$PLIST_NAME" "$PLIST_DEST"
+chmod 644 "$PLIST_DEST"
+
+# Set permissions
+echo "Setting permissions..."
+chown -R root:wheel "$CONFIG_DIR"
+chown -R root:wheel "$DATA_DIR"
+chown -R root:wheel "$LOG_DIR"
+chmod 600 "$CONFIG_DIR/config.toml"
+
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Binary:          $BIN_DIR/telfax"
+echo "Configuration:   $CONFIG_DIR/config.toml"
+echo "Data directory:  $DATA_DIR"
+echo "Log directory:   $LOG_DIR"
+echo "Service plist:   $PLIST_DEST"
+echo ""
+echo "Next steps:"
+echo "  1. Edit $CONFIG_DIR/config.toml and configure:"
+echo "     - Authentication tokens (IMPORTANT!)"
+echo "     - Modem device paths"
+echo "     - Station ID and header"
+echo ""
+echo "  2. Load and start the service:"
+echo "     sudo launchctl load -w $PLIST_DEST"
+echo ""
+echo "  3. Check service status:"
+echo "     sudo launchctl list | grep telfax"
+echo ""
+echo "  4. View logs:"
+echo "     tail -f $LOG_DIR/telfax.log"
+echo "     tail -f $LOG_DIR/telfax-error.log"
+echo ""
+echo "  5. Test API:"
+echo "     curl -H 'Authorization: Bearer YOUR_TOKEN' http://localhost:3000/api/v1/status"
+echo ""
+echo "To stop the service:"
+echo "  sudo launchctl unload $PLIST_DEST"
+echo ""
@@ -0,0 +1,64 @@
+#!/bin/bash
+# Telfax Enterprise Fax Server Installation Script
+#
+# Usage: sudo ./install.sh
+
+set -e
+
+INSTALL_DIR="/opt/telfax"
+DATA_DIR="/var/lib/telfax"
+LOG_DIR="/var/log/telfax"
+CONFIG_FILE="$INSTALL_DIR/config.toml"
+
+echo "=== Telfax Enterprise Fax Server Installation ==="
+
+# Create user and group
+echo "Creating telfax user..."
+if ! id -u telfax &>/dev/null; then
+    useradd -r -s /bin/false telfax
+fi
+
+# Create directories
+echo "Creating directories..."
+mkdir -p "$INSTALL_DIR/bin"
+mkdir -p "$DATA_DIR"
+mkdir -p "$LOG_DIR"
+
+# Build the binary
+echo "Building telfax..."
+cd "$(dirname "$0")/.."
+cargo build --release
+cp target/release/telfax "$INSTALL_DIR/bin/"
+
+# Copy default config if not exists
+if [ ! -f "$CONFIG_FILE" ]; then
+    echo "Copying default configuration..."
+    cp deployment/config.toml "$CONFIG_FILE"
+    echo "IMPORTANT: Edit $CONFIG_FILE and set your authentication tokens!"
+fi
+
+# Install systemd service
+echo "Installing systemd service..."
+cp deployment/telfax.service /etc/systemd/system/
+systemctl daemon-reload
+
+# Set permissions
+echo "Setting permissions..."
+chown -R telfax:telfax "$INSTALL_DIR"
+chown -R telfax:telfax "$DATA_DIR"
+chown -R telfax:telfax "$LOG_DIR"
+chmod 600 "$CONFIG_FILE"
+
+echo ""
+echo "=== Installation Complete ==="
+echo ""
+echo "Configuration file: $CONFIG_FILE"
+echo "Data directory:     $DATA_DIR"
+echo "Log directory:      $LOG_DIR"
+echo ""
+echo "Next steps:"
+echo "  1. Edit $CONFIG_FILE and configure your modems and auth tokens"
+echo "  2. systemctl enable telfax"
+echo "  3. systemctl start telfax"
+echo "  4. journalctl -u telfax -f  # View logs"
+echo ""
@@ -0,0 +1,45 @@
+[Unit]
+Description=Telfax Enterprise Fax Server
+After=network.target
+Documentation=https://github.com/yourorg/telfax
+
+[Service]
+Type=simple
+User=telfax
+Group=telfax
+WorkingDirectory=/opt/telfax
+ExecStart=/opt/telfax/bin/telfax serve --config /opt/telfax/config.toml
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=30
+TimeoutStopSec=30
+
+# Logging to systemd journal
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=telfax
+
+# Environment
+Environment=RUST_LOG=info
+Environment=TELFAX_CONFIG_PATH=/opt/telfax/config.toml
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+PrivateTmp=true
+
+# Allow write access to necessary directories
+ReadWritePaths=/opt/telfax
+ReadWritePaths=/var/lib/telfax
+ReadWritePaths=/var/log/telfax
+ReadWritePaths=/dev
+
+# Resource limits
+LimitNOFILE=65536
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target