2 Commits

Author	SHA1	Message	Date
enricobuehler	c2bc72a8e9	fix(packaging): correct CachyOS firewall to ufw + ship ufw openers + web-console opener ... CachyOS ships ufw enabled by default (firewalld is not installed) — verified live on the .21 box — but the docs and shipped firewall openers claimed "CachyOS enables firewalld by default". Correct that everywhere and ship a ufw application profile (the one-liner analogue of the firewalld service files): - packaging/linux/punktfunk.ufw (new): [punktfunk-native], [punktfunk-gamestream], [punktfunk-web] profiles, installed to /etc/ufw/applications.d/punktfunk by the Arch (CachyOS) and .deb host packages. `sudo ufw allow punktfunk-native`. - packaging/linux/punktfunk-web.xml (new): firewalld service for the optional web console (TCP 47992), installed by the host package on arch/deb/rpm. Neither the native nor gamestream opener covered 47992, so a firewalld/ufw host that enabled punktfunk-web could not reach the console over the LAN. - Fix the "CachyOS enables firewalld" claim in arch.md, arch/README.md, debian/README.md, both firewalld service .xml comments, and the pacman scriptlet; firewalld now attributed to the spins that use it (EndeavourOS, Fedora/RHEL). - Docs present both one-liners (ufw + firewalld) whichever firewall you run, plus a console-opener step; postinst/scriptlet hints detect ufw as well as firewalld. The native data plane stays hole-punched (ephemeral UDP, no fixed port) — its openers correctly open only 9777/udp + mDNS; the stale "open a UDP range" note is replaced with the accurate outbound-UDP explanation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 16:52:35 +00:00
enricobuehler	e27718b406	packaging: ship firewalld services on rpm + deb too, share from packaging/linux ... Mirror the Arch firewalld service definitions into the RPM spec and the Debian host package so every Linux packager installs them, and move the two XML files to the shared packaging/linux/ home (alongside the .desktop files both the PKGBUILD and deb scripts already source there) so there's one source of truth instead of three drifting copies. - rpm: install punktfunk-{gamestream,native}.xml to /usr/lib/firewalld/services/, list them in %files host, and print the firewalld enable command in %post (gated on firewall-cmd). Fedora/RHEL run firewalld by default, so this is where it matters most; Bazzite inherits it via the sysext built from the package /usr. - deb: install both XMLs in build-deb.sh and add the same firewalld-gated hint to the postinst. Debian/Ubuntu ship no active firewall, so it's a no-op unless the admin runs firewalld. - PKGBUILD + arch README updated to the packaging/linux/ path. - Firewall docs (bazzite README now leads with --add-service; debian README gains a firewalld block) point at the shipped services; XML comments made distro-neutral. Never auto-enabled — packages don't touch the admin's firewall. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 22:37:45 +00:00