fix(packaging): correct CachyOS firewall to ufw + ship ufw openers + web-console opener

CachyOS ships ufw enabled by default (firewalld is not installed) — verified live
on the .21 box — but the docs and shipped firewall openers claimed "CachyOS enables
firewalld by default". Correct that everywhere and ship a ufw application profile
(the one-liner analogue of the firewalld service files):

- packaging/linux/punktfunk.ufw (new): [punktfunk-native], [punktfunk-gamestream],
  [punktfunk-web] profiles, installed to /etc/ufw/applications.d/punktfunk by the
  Arch (CachyOS) and .deb host packages. `sudo ufw allow punktfunk-native`.
- packaging/linux/punktfunk-web.xml (new): firewalld service for the optional web
  console (TCP 47992), installed by the host package on arch/deb/rpm. Neither the
  native nor gamestream opener covered 47992, so a firewalld/ufw host that enabled
  punktfunk-web could not reach the console over the LAN.
- Fix the "CachyOS enables firewalld" claim in arch.md, arch/README.md,
  debian/README.md, both firewalld service .xml comments, and the pacman scriptlet;
  firewalld now attributed to the spins that use it (EndeavourOS, Fedora/RHEL).
- Docs present both one-liners (ufw + firewalld) whichever firewall you run, plus a
  console-opener step; postinst/scriptlet hints detect ufw as well as firewalld.

The native data plane stays hole-punched (ephemeral UDP, no fixed port) — its
openers correctly open only 9777/udp + mDNS; the stale "open a UDP range" note is
replaced with the accurate outbound-UDP explanation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/debian/README.md

@@ -53,23 +53,31 @@ journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'
 ## Firewall
 
 **Debian ships no firewall and Ubuntu's `ufw` is installed-but-inactive by default**, so out of the
-box there is nothing to open. If you run one, open the ports the host listens on.
-
-If you use **firewalld**, the `punktfunk-host` package installs service definitions to
-`/usr/lib/firewalld/services/` (not auto-enabled), so it's one command:
+box there is nothing to open. If you turn one on, the `punktfunk-host` package ships a one-liner
+opener for both **ufw** and **firewalld** (neither auto-enabled):
 
 ```sh
+# ufw (Ubuntu) — profile at /etc/ufw/applications.d/punktfunk, read at once (no reload):
+sudo ufw allow punktfunk-native        # the default native host
+sudo ufw allow punktfunk-gamestream    # …add for Moonlight compat
+
+# firewalld — service definitions at /usr/lib/firewalld/services/:
 sudo firewall-cmd --reload                                          # load the installed definition
-sudo firewall-cmd --permanent --add-service=punktfunk-native        # the default native host
+sudo firewall-cmd --permanent --add-service=punktfunk-native
 #                              --add-service=punktfunk-gamestream    # …add for Moonlight compat
 sudo firewall-cmd --reload
 ```
 
-Otherwise open the ports directly. The **native `punktfunk/1`** plane:
+If you installed the **web console** (`punktfunk-web`) and want it reachable from another device,
+open its port with the matching one-liner — `sudo ufw allow punktfunk-web` or `sudo firewall-cmd
+--permanent --add-service=punktfunk-web && sudo firewall-cmd --reload` — which opens **TCP 47992**
+(HTTPS, login-gated). The mgmt API (47990) stays loopback-only.
+
+Prefer explicit rules? Open the ports directly. The **native `punktfunk/1`** plane:
 
 - **QUIC control plane: UDP 9777** (`serve --native-port N` to change).
-- **Data plane: an *ephemeral* UDP port** — negotiated per session, so there is no fixed port to
-  open. For a restrictive firewall you'd need to allow a UDP range (the repo does not pin one).
+- **Data plane: an *ephemeral* UDP port** the client hole-punches — nothing to open inbound as long
+  as outbound UDP is allowed (the host streams back out through the client-opened path).
 
 And the **GameStream / Moonlight** ports (fixed) — only needed if you run the host with
 `serve --gamestream` (opt-in, trusted LAN only); bare `serve` is native-only and doesn't open these:
@@ -85,14 +93,14 @@ And the **GameStream / Moonlight** ports (fixed) — only needed if you run the
 The mgmt API (TCP 47990) binds to loopback by default — leave it closed unless you move it off
 loopback with `--mgmt-bind IP:PORT` (which then requires `--mgmt-token`).
 
-With `ufw`:
+With `ufw` (explicit ports, instead of the shipped profile):
 
 ```sh
 sudo ufw allow 9777/udp                                 # punktfunk/1 control plane
 sudo ufw allow 47984/tcp && sudo ufw allow 47989/tcp && sudo ufw allow 48010/tcp
-sudo ufw allow 47998:48010/udp
-sudo ufw allow 5353/udp
-# plus the ephemeral punktfunk/1 data port — open a UDP range you reserve for it.
+sudo ufw allow 47998,47999,48000/udp                    # GameStream video/control/audio
+sudo ufw allow 5353/udp                                 # mDNS discovery
+# The punktfunk/1 data plane is an ephemeral UDP port the host hole-punches — nothing to open here.
 ```
 
 With raw `nftables` (add to your `inet filter input` chain):

packaging/debian/build-deb.sh

@@ -80,13 +80,19 @@ install -Dm0644 scripts/host.env.example           "$SHAREDIR/host.env.example"
 install -Dm0644 packaging/bazzite/host.env         "$SHAREDIR/host.env.bazzite"
 install -Dm0644 packaging/kde/host.env             "$SHAREDIR/host.env.kde"
 install -Dm0644 api/openapi.json              "$SHAREDIR/openapi.json"
-# firewalld service definitions (shared across all Linux packaging). NOT auto-enabled — the postinst
-# only prints the enable command when firewalld is present. Debian/Ubuntu ship no active firewall
-# (Ubuntu's ufw is installed-but-inactive), so these are a no-op unless the admin runs firewalld.
+# Firewall openers (shared across all Linux packaging), NOT auto-enabled — the postinst prints the
+# enable command for whichever firewall is present. Debian ships none and Ubuntu's ufw is
+# installed-but-inactive, so these are a no-op until the admin turns a firewall on.
+install -Dm0644 packaging/linux/punktfunk.ufw \
+                "$STAGE/etc/ufw/applications.d/punktfunk"
 install -Dm0644 packaging/linux/punktfunk-gamestream.xml \
                 "$STAGE/usr/lib/firewalld/services/punktfunk-gamestream.xml"
 install -Dm0644 packaging/linux/punktfunk-native.xml \
                 "$STAGE/usr/lib/firewalld/services/punktfunk-native.xml"
+# Web console opener (TCP 47992) — only meaningful with the optional punktfunk-web package; opened
+# deliberately (see README.md → Firewall). ufw's equivalent is the punktfunk-web profile above.
+install -Dm0644 packaging/linux/punktfunk-web.xml \
+                "$STAGE/usr/lib/firewalld/services/punktfunk-web.xml"
 install -Dm0644 LICENSE-MIT                         "$DOCDIR/LICENSE-MIT"
 install -Dm0644 LICENSE-APACHE                      "$DOCDIR/LICENSE-APACHE"
 install -Dm0644 README.md                           "$DOCDIR/README.md"
@@ -193,11 +199,14 @@ if [ "$1" = "configure" ]; then
     echo "    sudo usermod -aG input \"\$USER\"   # then re-login"
     echo "Config:  mkdir -p ~/.config/punktfunk && cp /usr/share/punktfunk-host/host.env.example ~/.config/punktfunk/host.env"
     echo "Enable:  systemctl --user enable --now punktfunk-host"
-    # Debian/Ubuntu ship no active firewall; only hint firewalld users (ufw users: see README).
+    # Debian ships no active firewall and Ubuntu's ufw is inactive by default; hint whichever is present.
+    if command -v ufw >/dev/null 2>&1; then
+        echo "Firewall (ufw detected): sudo ufw allow punktfunk-native   (or punktfunk-gamestream for Moonlight)"
+    fi
     if command -v firewall-cmd >/dev/null 2>&1; then
         echo "Firewall (firewalld detected): sudo firewall-cmd --reload &&"
-        echo "    sudo firewall-cmd --permanent --add-service=punktfunk-gamestream && sudo firewall-cmd --reload"
-        echo "    (use punktfunk-native for the native-only host)"
+        echo "    sudo firewall-cmd --permanent --add-service=punktfunk-native && sudo firewall-cmd --reload"
+        echo "    (use punktfunk-gamestream for the Moonlight-compat host)"
     fi
 fi
 exit 0