docs(arch): fish-safe repo setup, firewalld services, fix client label

The pacman-repo setup step used a bash heredoc (`<<'EOF'`), which fish — the default shell on CachyOS — cannot parse ("expected a string, but found a redirection"). Replace it with a cross-shell `printf | sudo tee -a` form in both the Arch guide and packaging/arch/README.md; `$repo`/`$arch` stay literal for pacman and the output is byte-identical to the old heredoc. Firewall: stock Arch ships none (ports already open), but CachyOS enables firewalld by default and an Arch package must never touch the running firewall. Ship firewalld service definitions the host package installs to /usr/lib/firewalld/services/ (punktfunk-gamestream, punktfunk-native), not auto-enabled; the install scriptlet prints the enable command only when firewall-cmd is present. Document it in the Arch guide (new section) and README. The mgmt API (loopback) and web console ports are deliberately not opened. Also fix the "GTK4 couch/Deck client" mislabel — it's the native GTK4/libadwaita Linux client (desktop/laptop/Deck are targets; the controller-optimized launcher is one view, not its identity) — across the Arch PKGBUILD/README, Arch guide, and the Debian README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-04 22:31:53 +00:00
parent f0d015fc45
commit 6bc893e394
7 changed files with 136 additions and 22 deletions
@@ -17,6 +17,18 @@ punktfunk-host installed.
 NOTE: encode is NVENC-only. Install 'nvidia-utils' on an NVIDIA host. An AMD Steam Deck is NOT
      yet supported — it needs a VAAPI (hevc_vaapi) encoder backend (see packaging/arch/README.md).
 MSG
+  # Firewall: stock Arch ships none (ports already open), but CachyOS et al. enable firewalld. We
+  # install firewalld service definitions but never touch the running firewall — just point the way.
+  if command -v firewall-cmd >/dev/null 2>&1; then
+    cat <<'MSG'
+
+  4. firewalld is active — open the streaming ports once (GameStream/Moonlight shown; use
+     'punktfunk-native' instead for the native-only host):
+       sudo firewall-cmd --reload                                        # load the new service def
+       sudo firewall-cmd --permanent --add-service=punktfunk-gamestream
+       sudo firewall-cmd --reload
+MSG
+  fi
 }

 post_upgrade() {