build: Refactor CMake back to in-tree CMakeListsbe

This moves the build definitions back to src/ subdirectories
(CMakeLists.txt per component). Configuration and dependencies are
kept out of tree. Configuration options are bundled into cmake/config/
modules. Dependencies are grouped by component (system/, crypt/, eth/,
coverage/, etc.). It now consistently uses target-based commands
(target_include_directories, target_link_libraries) instead of global
include_directories(). Proper PRIVATE/PUBLIC visibility for executable
link libraries. CONFIG_OUROBOROS_DEBUG now properly set based on being
a valid debug config (not just checking the string name).

It also adds OuroborosTargets export for find_package() support and
CMake package config files (OuroborosConfig.cmake) for easier
integration with CMake projects.

The build logic now follows more idiomatic CMake practices with
configuration separated from target definitions.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

22 files changed, 263 insertions, 165 deletions

diff --git a/cmake/dependencies/coverage/gcov.cmake b/cmake/dependencies/coverage/gcov.cmake
new file mode 100644
index 00000000..1b593155
--- /dev/null
+++ b/cmake/dependencies/coverage/gcov.cmake
@@ -0,0 +1,21 @@
+include(utils/CompilerUtils)
+
+find_program(GCOV_PATH gcov)
+
+if(GCOV_PATH)
+  set(HAVE_GCOV TRUE CACHE INTERNAL "gcov coverage tool available")
+  set(DISABLE_COVERAGE ON CACHE BOOL "Disable code coverage analysis")
+  if(DISABLE_COVERAGE)
+    message(STATUS "gcov found - coverage analysis available (disabled by user)")
+  else()
+    message(STATUS "Code coverage analysis enabled")
+    test_and_set_c_compiler_flag_global(-g)
+    test_and_set_c_compiler_flag_global(--coverage)
+    add_link_options(--coverage)
+  endif()
+else()
+  set(HAVE_GCOV FALSE CACHE INTERNAL "gcov coverage tool available")
+  message(STATUS "gcov not found - coverage analysis not available")
+endif()
+
+mark_as_advanced(GCOV_PATH)
diff --git a/cmake/dependencies/lcov.cmake b/cmake/dependencies/coverage/lcov.cmake
index db559332..65ed316e 100644
--- a/cmake/dependencies/lcov.cmake
+++ b/cmake/dependencies/coverage/lcov.cmake
@@ -1,17 +1,17 @@
 find_program(LCOV_PATH lcov)
 find_program(GENHTML_PATH genhtml)
 
-if (LCOV_PATH AND GENHTML_PATH)
-  set(HAVE_LCOV TRUE CACHE INTERNAL "")
+if(LCOV_PATH AND GENHTML_PATH)
+  set(HAVE_LCOV TRUE CACHE INTERNAL "lcov HTML coverage reports available")
   message(STATUS "lcov and genhtml found - HTML coverage reports available")
-else ()
-  set(HAVE_LCOV FALSE CACHE INTERNAL "")
-  if (NOT LCOV_PATH)
+else()
+  set(HAVE_LCOV FALSE CACHE INTERNAL "lcov HTML coverage reports available")
+  if(NOT LCOV_PATH)
     message(STATUS "lcov not found - HTML coverage reports not available")
-  endif ()
-  if (NOT GENHTML_PATH)
+  endif()
+  if(NOT GENHTML_PATH)
     message(STATUS "genhtml not found - HTML coverage reports not available")
-  endif ()
-endif ()
+  endif()
+endif()
 
 mark_as_advanced(LCOV_PATH GENHTML_PATH)
diff --git a/cmake/dependencies/crypt/libgcrypt.cmake b/cmake/dependencies/crypt/libgcrypt.cmake
new file mode 100644
index 00000000..4f8a4cfe
--- /dev/null
+++ b/cmake/dependencies/crypt/libgcrypt.cmake
@@ -0,0 +1,55 @@
+# Try pkg-config first, fall back to find_library
+if(PkgConfig_FOUND)
+  pkg_check_modules(LIBGCRYPT QUIET IMPORTED_TARGET libgcrypt>=1.7.0)
+  if(LIBGCRYPT_FOUND AND NOT TARGET Gcrypt::Gcrypt)
+    add_library(Gcrypt::Gcrypt ALIAS PkgConfig::LIBGCRYPT)
+  endif()
+endif()
+
+if(NOT LIBGCRYPT_FOUND)
+  find_library(LIBGCRYPT_LIBRARIES gcrypt QUIET)
+  if(LIBGCRYPT_LIBRARIES)
+    find_path(LIBGCRYPT_INCLUDE_DIR gcrypt.h
+              HINTS /usr/include /usr/local/include)
+    if(LIBGCRYPT_INCLUDE_DIR)
+      file(STRINGS ${LIBGCRYPT_INCLUDE_DIR}/gcrypt.h GCSTR
+        REGEX "^#define GCRYPT_VERSION ")
+      string(REGEX REPLACE "^#define GCRYPT_VERSION \"(.*)\".*$" "\\1"
+        LIBGCRYPT_VERSION "${GCSTR}")
+      if(NOT LIBGCRYPT_VERSION VERSION_LESS "1.7.0")
+        set(LIBGCRYPT_FOUND TRUE)
+        if(NOT TARGET Gcrypt::Gcrypt)
+          add_library(Gcrypt::Gcrypt UNKNOWN IMPORTED)
+          set_target_properties(Gcrypt::Gcrypt PROPERTIES
+            IMPORTED_LOCATION "${LIBGCRYPT_LIBRARIES}"
+            INTERFACE_INCLUDE_DIRECTORIES "${LIBGCRYPT_INCLUDE_DIR}")
+        endif()
+      endif()
+    endif()
+  endif()
+endif()
+
+if(LIBGCRYPT_FOUND)
+  set(DISABLE_LIBGCRYPT FALSE CACHE BOOL "Disable libgcrypt support")
+  if(NOT DISABLE_LIBGCRYPT)
+    if(LIBGCRYPT_VERSION)
+      message(STATUS "libgcrypt support enabled (version ${LIBGCRYPT_VERSION})")
+    else()
+      message(STATUS "libgcrypt support enabled")
+    endif()
+    set(HAVE_LIBGCRYPT TRUE CACHE INTERNAL "libgcrypt cryptography support available")
+  else()
+    message(STATUS "libgcrypt support disabled by user")
+    unset(HAVE_LIBGCRYPT CACHE)
+  endif()
+else()
+  message(STATUS "Install libgcrypt >= 1.7.0 to enable libgcrypt support")
+  unset(HAVE_LIBGCRYPT CACHE)
+endif()
+
+if(NOT HAVE_LIBGCRYPT)
+  set(LIBGCRYPT_LIBRARIES "")
+  set(LIBGCRYPT_INCLUDE_DIR "")
+endif()
+
+mark_as_advanced(LIBGCRYPT_LIBRARIES LIBGCRYPT_INCLUDE_DIR)
diff --git a/cmake/dependencies/openssl.cmake b/cmake/dependencies/crypt/openssl.cmake
index b02d64b4..ed07cc9d 100644
--- a/cmake/dependencies/openssl.cmake
+++ b/cmake/dependencies/crypt/openssl.cmake
@@ -1,18 +1,18 @@
 find_package(OpenSSL QUIET)
-if (OPENSSL_FOUND)
+if(OPENSSL_FOUND)
   set(HAVE_OPENSSL_RNG TRUE)
-  if (OPENSSL_VERSION VERSION_LESS "3.0.0")
+  if(OPENSSL_VERSION VERSION_LESS "3.0.0")
     message(STATUS "Install version >= 3.0.0 to enable OpenSSL support "
                    "(found version \"${OPENSSL_VERSION}\")")
-  else ()
+  else()
     set(DISABLE_OPENSSL FALSE CACHE BOOL "Disable OpenSSL support")
-    if (NOT DISABLE_OPENSSL)
+    if(NOT DISABLE_OPENSSL)
       message(STATUS "OpenSSL support enabled, found version ${OPENSSL_VERSION}")
-      set(HAVE_OPENSSL TRUE CACHE INTERNAL "")
+      set(HAVE_OPENSSL TRUE CACHE INTERNAL "OpenSSL cryptography support available")
       set(DISABLE_PQC FALSE CACHE BOOL "Disable post-quantum cryptography support")
-      if (OPENSSL_VERSION VERSION_GREATER_EQUAL "3.4.0")
-        if (NOT DISABLE_PQC)
-          set(HAVE_OPENSSL_PQC TRUE CACHE INTERNAL "")
+      if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.4.0")
+        if(NOT DISABLE_PQC)
+          set(HAVE_OPENSSL_PQC TRUE CACHE INTERNAL "OpenSSL post-quantum cryptography available")
           message(STATUS "OpenSSL PQC support enabled")
         else()
           message(STATUS "OpenSSL PQC support disabled by user")
@@ -25,18 +25,11 @@ if (OPENSSL_FOUND)
       message(STATUS "OpenSSL support disabled")
       unset(HAVE_OPENSSL CACHE)
     endif()
-  endif ()
+  endif()
 else()
   message(STATUS "Install OpenSSL version >= 3.0.0 to enable OpenSSL support")
   unset(HAVE_OPENSSL_RNG)
   unset(HAVE_OPENSSL CACHE)
-  set(OPENSSL_INCLUDE_DIR "")
-  set(OPENSSL_LIBRARIES "")
-  set(OPENSSL_CRYPTO_LIBRARY "")
-endif ()
+endif()
 
-set(IRMD_SECMEM_MAX 1048576 CACHE STRING "IRMd secure heap size")
-set(PROC_SECMEM_MAX 1048576 CACHE STRING "Process secure heap size")
-set(SECMEM_GUARD 32 CACHE STRING "Secure heap min size")
-
-mark_as_advanced(OPENSSL_LIBRARIES OPENSSL_CRYPTO_LIBRARY)
+# Secure memory options are in cmake/config/global.cmake
diff --git a/cmake/dependencies/bpf.cmake b/cmake/dependencies/eth/bpf.cmake
index 8c04937f..c2f69e79 100644
--- a/cmake/dependencies/bpf.cmake
+++ b/cmake/dependencies/eth/bpf.cmake
@@ -1,20 +1,20 @@
 # Berkeley Packet Filter support (BSD/macOS only)
-if (NOT CMAKE_SYSTEM_NAME STREQUAL "Linux")
+if(NOT CMAKE_SYSTEM_NAME STREQUAL "Linux")
   find_path(BPF_C_INCLUDE_DIR
     net/bpf.h
     HINTS /usr/include /usr/local/include)
 
   mark_as_advanced(BPF_C_INCLUDE_DIR)
 
-  if (BPF_C_INCLUDE_DIR)
+  if(BPF_C_INCLUDE_DIR)
     set(DISABLE_BPF FALSE CACHE BOOL
       "Disable Berkeley Packet Filter support for Ethernet IPCPs")
-    if (NOT DISABLE_BPF)
+    if(NOT DISABLE_BPF)
       message(STATUS "Berkeley Packet Filter support for Ethernet IPCPs enabled")
       set(HAVE_BPF TRUE)
-    else ()
+    else()
       message(STATUS "Berkeley Packet Filter support for Ethernet IPCPs disabled by user")
       unset(HAVE_BPF)
-    endif ()
-  endif ()
-endif ()
+    endif()
+  endif()
+endif()
diff --git a/cmake/dependencies/netmap.cmake b/cmake/dependencies/eth/netmap.cmake
index d8d3781b..94ecd634 100644
--- a/cmake/dependencies/netmap.cmake
+++ b/cmake/dependencies/eth/netmap.cmake
@@ -5,14 +5,14 @@ find_path(NETMAP_C_INCLUDE_DIR
 
 mark_as_advanced(NETMAP_C_INCLUDE_DIR)
 
-if (NOT HAVE_RAW_SOCKETS AND NOT HAVE_BPF AND NETMAP_C_INCLUDE_DIR)
+if(NOT HAVE_RAW_SOCKETS AND NOT HAVE_BPF AND NETMAP_C_INCLUDE_DIR)
   set(DISABLE_NETMAP FALSE CACHE BOOL
     "Disable netmap support for ETH IPCPs")
-  if (NOT DISABLE_NETMAP)
+  if(NOT DISABLE_NETMAP)
     message(STATUS "Netmap support for Ethernet IPCPs enabled")
     set(HAVE_NETMAP TRUE)
-  else ()
+  else()
     message(STATUS "Netmap support for Ethernet IPCPs disabled by user")
     unset(HAVE_NETMAP)
-  endif ()
-endif ()
+  endif()
+endif()
diff --git a/cmake/dependencies/rawsockets.cmake b/cmake/dependencies/eth/rawsockets.cmake
index 92f7b8b7..395d9efb 100644
--- a/cmake/dependencies/rawsockets.cmake
+++ b/cmake/dependencies/eth/rawsockets.cmake
@@ -1,12 +1,12 @@
 # Raw sockets support (Linux only)
-if (CMAKE_SYSTEM_NAME STREQUAL "Linux")
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
   set(DISABLE_RAW_SOCKETS FALSE CACHE BOOL
     "Disable raw socket support for Ethernet IPCPs")
-  if (NOT DISABLE_RAW_SOCKETS)
+  if(NOT DISABLE_RAW_SOCKETS)
     message(STATUS "Raw socket support for Ethernet IPCPs enabled")
     set(HAVE_RAW_SOCKETS TRUE)
-  else ()
+  else()
     message(STATUS "Raw socket support for Ethernet IPCPs disabled by user")
     unset(HAVE_RAW_SOCKETS)
-  endif ()
-endif ()
+  endif()
+endif()
diff --git a/cmake/dependencies/explicit_bzero.cmake b/cmake/dependencies/explicit_bzero.cmake
deleted file mode 100644
index 54a11d21..00000000
--- a/cmake/dependencies/explicit_bzero.cmake
+++ /dev/null
@@ -1 +0,0 @@
-check_symbol_exists(explicit_bzero "string.h" HAVE_EXPLICIT_BZERO)
\ No newline at end of file
diff --git a/cmake/dependencies/fuse.cmake b/cmake/dependencies/fuse.cmake
deleted file mode 100644
index 8ef60292..00000000
--- a/cmake/dependencies/fuse.cmake
+++ /dev/null
@@ -1,23 +0,0 @@
-find_library(FUSE_LIBRARIES fuse QUIET)
-if (FUSE_LIBRARIES)
-  #FIXME: Check for version >= 2.6
-  set(DISABLE_FUSE FALSE CACHE BOOL "Disable FUSE support")
-  if (NOT DISABLE_FUSE)
-    message(STATUS "FUSE support enabled")
-    set(FUSE_PREFIX "/tmp/ouroboros" CACHE STRING
-    "Mountpoint for RIB filesystem")
-    set(HAVE_FUSE TRUE CACHE INTERNAL "")
-  else ()
-    message(STATUS "FUSE support disabled by user")
-    unset(HAVE_FUSE CACHE)
-  endif ()
-else ()
-  message(STATUS "Install FUSE version > 2.6 to enable RIB access")
-endif ()
-
-if (NOT HAVE_FUSE)
-  set(FUSE_LIBRARIES "")
-  set(FUSE_INCLUDE_DIR "")
-endif ()
-
-mark_as_advanced(FUSE_LIBRARIES)
diff --git a/cmake/dependencies/gcov.cmake b/cmake/dependencies/gcov.cmake
deleted file mode 100644
index c4d1caf0..00000000
--- a/cmake/dependencies/gcov.cmake
+++ /dev/null
@@ -1,11 +0,0 @@
-find_program(GCOV_PATH gcov)
-
-if (GCOV_PATH)
-  set(HAVE_GCOV TRUE CACHE INTERNAL "")
-  message(STATUS "gcov found - coverage analysis available")
-else ()
-  set(HAVE_GCOV FALSE CACHE INTERNAL "")
-  message(STATUS "gcov not found - coverage analysis not available")
-endif ()
-
-mark_as_advanced(GCOV_PATH)
diff --git a/cmake/dependencies/irmd/libtoml.cmake b/cmake/dependencies/irmd/libtoml.cmake
new file mode 100644
index 00000000..dcbc17e4
--- /dev/null
+++ b/cmake/dependencies/irmd/libtoml.cmake
@@ -0,0 +1,29 @@
+find_library(LIBTOML_LIBRARY toml QUIET)
+if(LIBTOML_LIBRARY)
+  find_path(LIBTOML_INCLUDE_DIR toml.h)
+  set(DISABLE_CONFIGFILE FALSE CACHE BOOL
+    "Disable configuration file support")
+  if(NOT DISABLE_CONFIGFILE)
+    set(OUROBOROS_CONFIG_FILE irmd.conf CACHE STRING
+      "Name of the IRMd configuration file")
+    set(HAVE_TOML TRUE CACHE INTERNAL "TOML configuration file support available")
+    message(STATUS "Configuration file support enabled")
+    message(STATUS "Configuration directory: ${OUROBOROS_CONFIG_DIR}")
+    # Create imported target for consistency with other dependencies
+    if(NOT TARGET toml::toml)
+      add_library(toml::toml UNKNOWN IMPORTED)
+      set_target_properties(toml::toml PROPERTIES
+        IMPORTED_LOCATION "${LIBTOML_LIBRARY}"
+        INTERFACE_INCLUDE_DIRECTORIES "${LIBTOML_INCLUDE_DIR}")
+    endif()
+  else()
+    message(STATUS "Configuration file support disabled by user")
+    unset(OUROBOROS_CONFIG_FILE CACHE)
+    unset(HAVE_TOML CACHE)
+  endif()
+  mark_as_advanced(LIBTOML_LIBRARY LIBTOML_INCLUDE_DIR)
+else()
+  message(STATUS "Install tomlc99 for config file support")
+  message(STATUS "     https://github.com/cktan/tomlc99")
+  unset(HAVE_TOML CACHE)
+endif()
diff --git a/cmake/dependencies/libgcrypt.cmake b/cmake/dependencies/libgcrypt.cmake
deleted file mode 100644
index 90a25f36..00000000
--- a/cmake/dependencies/libgcrypt.cmake
+++ /dev/null
@@ -1,31 +0,0 @@
-find_library(LIBGCRYPT_LIBRARIES gcrypt QUIET)
-if (LIBGCRYPT_LIBRARIES)
-  find_path(LIBGCRYPT_INCLUDE_DIR gcrypt.h
-            HINTS /usr/include /usr/local/include)
-  if (LIBGCRYPT_INCLUDE_DIR)
-    file(STRINGS ${LIBGCRYPT_INCLUDE_DIR}/gcrypt.h GCSTR
-      REGEX "^#define GCRYPT_VERSION ")
-    string(REGEX REPLACE "^#define GCRYPT_VERSION \"(.*)\".*$" "\\1"
-      GCVER "${GCSTR}")
-    if (NOT GCVER VERSION_LESS "1.7.0")
-      set(DISABLE_LIBGCRYPT FALSE CACHE BOOL "Disable libgcrypt support")
-      if (NOT DISABLE_LIBGCRYPT)
-        message(STATUS "libgcrypt support enabled")
-        set(HAVE_LIBGCRYPT TRUE CACHE INTERNAL "")
-      else ()
-        message(STATUS "libgcrypt support disabled by user")
-        unset(HAVE_LIBGCRYPT CACHE)
-      endif()
-    else ()
-      message(STATUS "Install version >= \"1.7.0\" to enable libgcrypt support "
-                     "(found version \"${GCVER}\")")
-    endif()
-  endif ()
-endif ()
-
-if (NOT HAVE_LIBGCRYPT)
-  set(LIBGCRYPT_LIBRARIES "")
-  set(LIBGCRYPT_INCLUDE_DIR "")
-endif ()
-
-mark_as_advanced(LIBGCRYPT_LIBRARIES LIBGCRYPT_INCLUDE_DIR)
diff --git a/cmake/dependencies/libtoml.cmake b/cmake/dependencies/libtoml.cmake
deleted file mode 100644
index 3974a1dd..00000000
--- a/cmake/dependencies/libtoml.cmake
+++ /dev/null
@@ -1,5 +0,0 @@
-find_library(LIBTOML_LIBRARIES toml QUIET)
-if (LIBTOML_LIBRARIES)
-  find_path(LIBTOML_INCLUDE toml.h)
-  mark_as_advanced(LIBTOML_LIBRARIES LIBTOML_INCLUDE)
-endif ()
diff --git a/cmake/dependencies/sysrandom.cmake b/cmake/dependencies/sysrandom.cmake
deleted file mode 100644
index 972db801..00000000
--- a/cmake/dependencies/sysrandom.cmake
+++ /dev/null
@@ -1,21 +0,0 @@
-if (APPLE OR CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
-  set(SYS_RND_HDR "")
-else ()
-  find_path(SYS_RND_HDR sys/random.h PATH /usr/include/ /usr/local/include/)
-  if (SYS_RND_HDR)
-    message(STATUS "Found sys/random.h in ${SYS_RND_HDR}")
-    set(HAVE_SYS_RANDOM TRUE)
-  else ()
-    set(SYS_RND_HDR "")
-    unset(HAVE_SYS_RANDOM)
-  endif ()
-endif()
-
-# Validate that at least one secure random generator is available
-if (NOT ((CMAKE_SYSTEM_NAME STREQUAL "FreeBSD") OR APPLE OR
-  HAVE_SYS_RANDOM OR HAVE_OPENSSL_RNG OR HAVE_LIBGCRYPT))
-  message(FATAL_ERROR "No secure random generator found, "
-                      "please install libgcrypt (> 1.7.0) or OpenSSL")
-endif ()
-
-mark_as_advanced(SYS_RND_HDR)
diff --git a/cmake/dependencies/system/explicit_bzero.cmake b/cmake/dependencies/system/explicit_bzero.cmake
new file mode 100644
index 00000000..89ab3abc
--- /dev/null
+++ b/cmake/dependencies/system/explicit_bzero.cmake
@@ -0,0 +1,4 @@
+# Check for explicit_bzero in string.h
+# glibc requires _DEFAULT_SOURCE to expose it; harmless on other platforms
+list(APPEND CMAKE_REQUIRED_DEFINITIONS -D_DEFAULT_SOURCE)
+check_symbol_exists(explicit_bzero "string.h" HAVE_EXPLICIT_BZERO)
diff --git a/cmake/dependencies/system/fuse.cmake b/cmake/dependencies/system/fuse.cmake
new file mode 100644
index 00000000..7de12b31
--- /dev/null
+++ b/cmake/dependencies/system/fuse.cmake
@@ -0,0 +1,44 @@
+# Try pkg-config first, fall back to find_library
+if(PkgConfig_FOUND)
+  pkg_check_modules(FUSE QUIET IMPORTED_TARGET fuse>=2.6)
+  if(FUSE_FOUND AND NOT TARGET Fuse::Fuse)
+    add_library(Fuse::Fuse ALIAS PkgConfig::FUSE)
+  endif()
+endif()
+
+if(NOT FUSE_FOUND)
+  find_library(FUSE_LIBRARIES fuse QUIET)
+  if(FUSE_LIBRARIES)
+    set(FUSE_FOUND TRUE)
+    if(NOT TARGET Fuse::Fuse)
+      add_library(Fuse::Fuse UNKNOWN IMPORTED)
+      set_target_properties(Fuse::Fuse PROPERTIES
+        IMPORTED_LOCATION "${FUSE_LIBRARIES}")
+    endif()
+  endif()
+endif()
+
+if(FUSE_FOUND)
+  set(DISABLE_FUSE FALSE CACHE BOOL "Disable FUSE support")
+  if(NOT DISABLE_FUSE)
+    if(FUSE_VERSION)
+      message(STATUS "FUSE support enabled (version ${FUSE_VERSION})")
+    else()
+      message(STATUS "FUSE support enabled")
+    endif()
+    # FUSE_PREFIX is set in cmake/config/global.cmake
+    set(HAVE_FUSE TRUE CACHE INTERNAL "FUSE filesystem support available")
+  else()
+    message(STATUS "FUSE support disabled by user")
+    unset(HAVE_FUSE CACHE)
+  endif()
+else()
+  message(STATUS "Install FUSE version >= 2.6 to enable RIB access")
+  unset(HAVE_FUSE CACHE)
+endif()
+
+if(NOT HAVE_FUSE)
+  set(FUSE_LIBRARIES "")
+endif()
+
+mark_as_advanced(FUSE_LIBRARIES)
diff --git a/cmake/dependencies/system/libraries.cmake b/cmake/dependencies/system/libraries.cmake
new file mode 100644
index 00000000..55c22d6a
--- /dev/null
+++ b/cmake/dependencies/system/libraries.cmake
@@ -0,0 +1,17 @@
+if(NOT APPLE)
+  find_library(LIBRT_LIBRARIES rt)
+  mark_as_advanced(LIBRT_LIBRARIES)
+  if(NOT LIBRT_LIBRARIES)
+    message(FATAL_ERROR "Could not find librt")
+  endif()
+else()
+  set(LIBRT_LIBRARIES "")
+endif()
+
+find_package(Threads REQUIRED)
+
+find_library(LIBM_LIBRARIES m)
+mark_as_advanced(LIBM_LIBRARIES)
+if(NOT LIBM_LIBRARIES)
+  message(FATAL_ERROR "Could not find libm")
+endif()
diff --git a/cmake/dependencies/protobufc.cmake b/cmake/dependencies/system/protobufc.cmake
index f1fab59d..b7e0062a 100644
--- a/cmake/dependencies/protobufc.cmake
+++ b/cmake/dependencies/system/protobufc.cmake
@@ -1,11 +1,13 @@
 list(APPEND CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake/utils")
 
 find_package(ProtobufC QUIET)
-if (NOT (PROTOBUF_C_INCLUDE_DIRS AND PROTOBUF_C_LIBRARY
+if(NOT (PROTOBUF_C_INCLUDE_DIRS AND PROTOBUF_C_LIBRARY
          AND PROTOBUF_PROTOC_C_EXECUTABLE))
   message(FATAL_ERROR "Protobuf C compiler required but not found. "
                       "Please install Google Protocol Buffers.")
-else ()
+else()
   message(STATUS "Found protobuf C compiler in ${PROTOBUF_PROTOC_C_EXECUTABLE}")
-endif ()
-include_directories(${PROTOBUF_C_INCLUDE_DIRS})
+endif()
+
+# Note: Include dirs are added per-target via target_include_directories
+# using ${PROTOBUF_C_INCLUDE_DIRS}
diff --git a/cmake/dependencies/robustmutex.cmake b/cmake/dependencies/system/robustmutex.cmake
index 94aec8f0..89b7325b 100644
--- a/cmake/dependencies/robustmutex.cmake
+++ b/cmake/dependencies/system/robustmutex.cmake
@@ -3,16 +3,16 @@ list(APPEND CMAKE_REQUIRED_DEFINITIONS -D__XSI_VISIBLE=500)
 list(APPEND CMAKE_REQUIRED_LIBRARIES pthread)
 check_symbol_exists(pthread_mutexattr_setrobust pthread.h HAVE_ROBUST_MUTEX)
 
-if (HAVE_ROBUST_MUTEX)
+if(HAVE_ROBUST_MUTEX)
   set(DISABLE_ROBUST_MUTEXES FALSE CACHE BOOL "Disable robust mutex support")
-  if (NOT DISABLE_ROBUST_MUTEXES)
+  if(NOT DISABLE_ROBUST_MUTEXES)
     message(STATUS "Robust mutex support enabled")
     set(HAVE_ROBUST_MUTEX TRUE)
-  else ()
+  else()
     message(STATUS "Robust mutex support disabled by user")
     unset(HAVE_ROBUST_MUTEX)
-  endif ()
+  endif()
 else()
   message(STATUS "Robust mutex support not available")
   unset(HAVE_ROBUST_MUTEX)
-endif ()
+endif()
diff --git a/cmake/dependencies/system/sysrandom.cmake b/cmake/dependencies/system/sysrandom.cmake
new file mode 100644
index 00000000..dc8443a1
--- /dev/null
+++ b/cmake/dependencies/system/sysrandom.cmake
@@ -0,0 +1,14 @@
+if(APPLE OR CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
+  set(SYS_RND_HDR "")
+else()
+  find_path(SYS_RND_HDR sys/random.h PATH /usr/include/ /usr/local/include/)
+  if(SYS_RND_HDR)
+    message(STATUS "Found sys/random.h in ${SYS_RND_HDR}")
+    set(HAVE_SYS_RANDOM TRUE)
+  else()
+    set(SYS_RND_HDR "")
+    unset(HAVE_SYS_RANDOM)
+  endif()
+endif()
+
+mark_as_advanced(SYS_RND_HDR)
diff --git a/cmake/dependencies/systemlibraries.cmake b/cmake/dependencies/systemlibraries.cmake
deleted file mode 100644
index e00266d6..00000000
--- a/cmake/dependencies/systemlibraries.cmake
+++ /dev/null
@@ -1,20 +0,0 @@
-if (NOT APPLE)
-  find_library(LIBRT_LIBRARIES rt)
-  if (NOT LIBRT_LIBRARIES)
-    message(FATAL_ERROR "Could not find librt")
-  endif ()
-else ()
-  set(LIBRT_LIBRARIES "")
-endif ()
-
-find_library(LIBPTHREAD_LIBRARIES pthread)
-if (NOT LIBPTHREAD_LIBRARIES)
-  message(FATAL_ERROR "Could not find libpthread")
-endif ()
-
-find_library(LIBM_LIBRARIES m)
-if (NOT LIBM_LIBRARIES)
-  message(FATAL_ERROR "Could not find libm")
-endif ()
-
-mark_as_advanced(LIBRT_LIBRARIES LIBPTHREAD_LIBRARIES LIBM_LIBRARIES)
diff --git a/cmake/dependencies/udp/ddns.cmake b/cmake/dependencies/udp/ddns.cmake
new file mode 100644
index 00000000..e8208e47
--- /dev/null
+++ b/cmake/dependencies/udp/ddns.cmake
@@ -0,0 +1,31 @@
+# DDNS (Dynamic DNS) support detection
+# Requires nsupdate and nslookup tools
+
+find_program(NSUPDATE_EXECUTABLE
+  NAMES nsupdate
+  DOC "The nsupdate tool that enables DDNS")
+
+find_program(NSLOOKUP_EXECUTABLE
+  NAMES nslookup
+  DOC "The nslookup tool that resolves DNS names")
+
+mark_as_advanced(NSLOOKUP_EXECUTABLE NSUPDATE_EXECUTABLE)
+
+if(NSLOOKUP_EXECUTABLE AND NSUPDATE_EXECUTABLE)
+  set(DISABLE_DDNS FALSE CACHE BOOL "Disable DDNS support")
+  if(NOT DISABLE_DDNS)
+    message(STATUS "DDNS support enabled")
+    set(HAVE_DDNS TRUE CACHE INTERNAL "Dynamic DNS support available")
+  else()
+    message(STATUS "DDNS support disabled by user")
+    unset(HAVE_DDNS CACHE)
+  endif()
+else()
+  if(NSLOOKUP_EXECUTABLE)
+    message(STATUS "Install nsupdate to enable DDNS support")
+  elseif(NSUPDATE_EXECUTABLE)
+    message(STATUS "Install nslookup to enable DDNS support")
+  else()
+    message(STATUS "Install nslookup and nsupdate to enable DDNS support")
+  endif()
+endif()