<?xml version="1.0" encoding="utf-8"?>
<!--
  firewalld service definition for the native punktfunk/1 host (the secure default 'serve', or the
  punktfunk1-host subcommand).

  Installed to /usr/lib/firewalld/services/ by the punktfunk-host package. NOT enabled automatically
  (packages never touch the admin's firewall). Stock Arch/Debian ship no active firewall; Fedora/RHEL
  and some Arch spins (EndeavourOS) enable firewalld by default, so enable it once with firewall-cmd
  (add-service=punktfunk-native, then reload). CachyOS and Ubuntu use ufw instead — the package also
  ships a ufw application profile (punktfunk.ufw). Exact commands: your distro's install guide, or the
  per-distro packaging README (Firewall section).

  The media DATA plane binds an EPHEMERAL UDP port (0.0.0.0:0) chosen per session and reported to the
  client, so there is no fixed data port to open. On a restrictive firewall you must also allow the
  ephemeral UDP range (the project does not pin one).

  The mgmt REST API (TCP 47990, HTTPS + mTLS) is opened here because `serve` binds it to all interfaces
  by default so paired clients can browse the game library over the LAN. Off-loopback it exposes ONLY
  the read-only status + library endpoints, and only to a paired client certificate; every admin /
  state-changing action (arming pairing, removing devices, session control, library edits) is honored
  over loopback only. To keep 47990 loopback-only, bind the mgmt API to 127.0.0.1:47990 (the host's
  `mgmt-bind` option).
-->
<service>
  <short>Punktfunk (native punktfunk/1)</short>
  <description>Low-latency game-streaming host over the native punktfunk/1 protocol (QUIC control plane). Opens the default QUIC control port plus mDNS for auto-discovery, and the mgmt/library REST API (HTTPS + mTLS; off-loopback it serves only read-only status/library to paired clients). The media data plane uses an ephemeral UDP port negotiated per session, not opened here.</description>
  <port protocol="udp" port="9777"/>  <!-- QUIC control plane (default 9777)            -->
  <port protocol="udp" port="5353"/>  <!-- mDNS auto-discovery (_punktfunk._udp.local) -->
  <port protocol="tcp" port="47990"/> <!-- mgmt/library REST API (HTTPS + mTLS; LAN = read-only, paired) -->
</service>
