unom/punktfunk
1
0
Fork 0
Code Issues Pull Requests Actions 12 Packages Projects Releases 16 Wiki Activity

fix(packaging): correct CachyOS firewall to ufw + ship ufw openers + web-console opener

Browse Source 
CachyOS ships ufw enabled by default (firewalld is not installed) — verified live
on the .21 box — but the docs and shipped firewall openers claimed "CachyOS enables
firewalld by default". Correct that everywhere and ship a ufw application profile
(the one-liner analogue of the firewalld service files):

- packaging/linux/punktfunk.ufw (new): [punktfunk-native], [punktfunk-gamestream],
  [punktfunk-web] profiles, installed to /etc/ufw/applications.d/punktfunk by the
  Arch (CachyOS) and .deb host packages. `sudo ufw allow punktfunk-native`.
- packaging/linux/punktfunk-web.xml (new): firewalld service for the optional web
  console (TCP 47992), installed by the host package on arch/deb/rpm. Neither the
  native nor gamestream opener covered 47992, so a firewalld/ufw host that enabled
  punktfunk-web could not reach the console over the LAN.
- Fix the "CachyOS enables firewalld" claim in arch.md, arch/README.md,
  debian/README.md, both firewalld service .xml comments, and the pacman scriptlet;
  firewalld now attributed to the spins that use it (EndeavourOS, Fedora/RHEL).
- Docs present both one-liners (ufw + firewalld) whichever firewall you run, plus a
  console-opener step; postinst/scriptlet hints detect ufw as well as firewalld.

The native data plane stays hole-punched (ephemeral UDP, no fixed port) — its
openers correctly open only 9777/udp + mDNS; the stale "open a UDP range" note is
replaced with the accurate outbound-UDP explanation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Enrico Bühler
2026-07-05 16:52:35 +00:00
parent f818f1ec3d
commit cef2f6780c
11 changed files with 197 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/linux/punktfunk-native.xml
+3 -2
View File
@@ -5,8 +5,9 @@
Installed to /usr/lib/firewalld/services/ by the punktfunk-host package. NOT enabled automatically
(packages never touch the admin's firewall). Stock Arch/Debian ship no active firewall; Fedora/RHEL
and CachyOS enable firewalld by default, so enable it once with firewall-cmd
(add-service=punktfunk-native, then reload). Exact commands: your distro's install guide, or the
and some Arch spins (EndeavourOS) enable firewalld by default, so enable it once with firewall-cmd
(add-service=punktfunk-native, then reload). CachyOS and Ubuntu use ufw instead — the package also
ships a ufw application profile (punktfunk.ufw). Exact commands: your distro's install guide, or the
per-distro packaging README (Firewall section).
The media DATA plane binds an EPHEMERAL UDP port (0.0.0.0:0) chosen per session and reported to the