diff --git a/docs-site/content/docs/install.md b/docs-site/content/docs/install.md index c0c1c6f5..6b0a9eb9 100644 --- a/docs-site/content/docs/install.md +++ b/docs-site/content/docs/install.md @@ -85,7 +85,7 @@ fallback without one. More detail — including the CLI `punktfunk-host service systemctl --user enable --now punktfunk-web ``` - Then open `http://:47992`. Reading its [login password](/docs/web-console#login-password) + Then open `https://:47992`. Reading its [login password](/docs/web-console#login-password) and [arming PIN pairing](/docs/web-console#arm-pairing) are covered in [The Web Console](/docs/web-console). diff --git a/docs-site/content/docs/steamos-host.md b/docs-site/content/docs/steamos-host.md index 293aa0cb..21dcae33 100644 --- a/docs-site/content/docs/steamos-host.md +++ b/docs-site/content/docs/steamos-host.md @@ -86,7 +86,8 @@ When it finishes it prints the web-console URL and how to pair. By default the host **requires PIN pairing** (secure). Two ways to pair: -- **Web console** (printed at the end of step 2): open `http://:47992`, +- **Web console** (printed at the end of step 2): open `https://:47992` (self-signed host + cert — your browser warns once; trust it and continue), [arm pairing](/docs/web-console#arm-pairing), and enter the PIN on your client. - **From the client directly**: pick this host (it advertises over mDNS as `_punktfunk._udp`) and enter the PIN the host shows. diff --git a/docs-site/content/docs/web-console.md b/docs-site/content/docs/web-console.md index ed85da83..a14692a0 100644 --- a/docs-site/content/docs/web-console.md +++ b/docs-site/content/docs/web-console.md @@ -5,7 +5,8 @@ description: Enable the punktfunk browser console, read or change its login pass The web console is the browser UI for a punktfunk host — live status, paired devices, and the PIN pairing flow. It ships as the **`punktfunk-web`** systemd user unit on Linux and the **`PunktfunkWeb`** -task on Windows, and serves on **`http://:47992`**. It's the surface you expose on the LAN to +task on Windows, and serves on **`https://:47992`** (HTTPS with the host's own self-signed +identity cert — your browser warns once; trust it and continue). It's the surface you expose on the LAN to administer the host; the host's own management API (47990) keeps every admin action loopback-only and off-loopback serves only read-only status + game-library browsing to paired clients. @@ -19,11 +20,11 @@ off-loopback serves only read-only status + game-library browsing to paired clie ```sh systemctl --user enable --now punktfunk-web - # then browse to http://:47992 + # then browse to https://:47992 ``` - **Windows host:** the installer sets up the console, its runtime, and the `PunktfunkWeb` task and - starts it at boot. There is nothing to enable — open `http://:47992`. + starts it at boot. There is nothing to enable — open `https://:47992`. - **SteamOS host:** the install script builds and starts the console as a user service for you. It prints the URL when it finishes. diff --git a/docs-site/content/docs/windows-host.md b/docs-site/content/docs/windows-host.md index 0006e3a3..92cbe390 100644 --- a/docs-site/content/docs/windows-host.md +++ b/docs-site/content/docs/windows-host.md @@ -64,7 +64,7 @@ the Windows specifics follow. The installer also sets up the **web management console** (status, paired devices, the PIN pairing flow): it bundles the console plus its own runtime and runs it as the **`PunktfunkWeb`** task on -**`http://:47992`**, starting at boot. +**`https://:47992`**, starting at boot. #### Console login password diff --git a/packaging/rpm/README.md b/packaging/rpm/README.md index 6b70713a..2a5bf3e3 100644 --- a/packaging/rpm/README.md +++ b/packaging/rpm/README.md @@ -85,7 +85,7 @@ ujust add-user-to-input-group # virtual gamepads need /dev/uinput (re- mkdir -p ~/.config/punktfunk cp /usr/share/punktfunk/host.env.bazzite ~/.config/punktfunk/host.env # gamescope defaults systemctl --user enable --now punktfunk-host -# Web console — enable it and read the auto-generated login password (then open http://:47992): +# Web console — enable it and read the auto-generated login password (then open https://:47992): systemctl --user enable --now punktfunk-web journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p' ``` diff --git a/packaging/rpm/punktfunk.spec b/packaging/rpm/punktfunk.spec index 40a46a27..3676602e 100644 --- a/packaging/rpm/punktfunk.spec +++ b/packaging/rpm/punktfunk.spec @@ -383,7 +383,7 @@ echo "punktfunk-web installed. Enable the console for your user:" echo " systemctl --user enable --now punktfunk-web" echo "A login password is generated on first start — read it with:" echo " journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'" -echo "Then open http://:3000" +echo "Then open https://:47992" %endif %changelog diff --git a/scripts/web-init.sh b/scripts/web-init.sh index 4bfd1246..8348b2a4 100755 --- a/scripts/web-init.sh +++ b/scripts/web-init.sh @@ -15,5 +15,5 @@ if [ ! -s "$PWFILE" ]; then (umask 077; printf 'PUNKTFUNK_UI_PASSWORD=%s\n' "$PW" > "$PWFILE") chmod 600 "$PWFILE" 2>/dev/null || true echo "punktfunk web console login password generated: $PW" - echo "(stored in $PWFILE — open http://:47992 and log in)" + echo "(stored in $PWFILE — open https://:47992 and log in)" fi diff --git a/scripts/windows/README.md b/scripts/windows/README.md index c76b54a6..a7c20574 100644 --- a/scripts/windows/README.md +++ b/scripts/windows/README.md @@ -40,7 +40,7 @@ bun and runs `punktfunk-host.exe web setup`, which registers the **`PunktfunkWeb (at boot, as SYSTEM, restart-on-failure) running `{app}\web\web-run.cmd` → `bun …\.output\server\index.mjs` on `:47992`, opens inbound TCP 47992, and writes the login password to `%ProgramData%\punktfunk\web-password` (ACL'd to Administrators + SYSTEM). The mgmt bearer token it -proxies with is the host's own `%ProgramData%\punktfunk\mgmt-token`. Browse `http://:47992` +proxies with is the host's own `%ProgramData%\punktfunk\mgmt-token`. Browse `https://:47992` and log in with the password the installer shows on its final page. To change it, edit `web-password` and re-run the task: `schtasks /run /tn PunktfunkWeb`.