enricobuehler
54b75c9be4
apple / swift (push) Successful in 55s
windows-host / package (push) Successful in 2m31s
android / android (push) Successful in 4m40s
ci / rust (push) Successful in 4m43s
ci / web (push) Successful in 30s
ci / docs-site (push) Successful in 34s
deb / build-publish (push) Successful in 2m9s
decky / build-publish (push) Successful in 11s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 5s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 14s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 4s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 4s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 21s
ci / bench (push) Successful in 4m44s
docker / deploy-docs (push) Successful in 19s
rpm / build-publish (fedora-44, punktfunk-fedora44-rpm) (push) Successful in 8m6s
rpm / build-publish (bazzite, punktfunk-fedora-rpm) (push) Successful in 8m19s
Follows the security audit (#5/#9): the GameStream-compat plane carries inherent on-path weaknesses that can't be fixed on the wire without breaking stock Moonlight — its pairing runs over plain HTTP (#9, MITM-able during the pairing window) and its legacy control encryption can reuse GCM nonces (#5, a passive eavesdropper can recover/forge input). The native punktfunk/1 plane (SPAKE2 PIN pairing + per-direction AEAD nonces) has neither. So flip the default to secure-by-default: - `serve` → native punktfunk/1 plane + management API ONLY (no GameStream surface). - `serve --gamestream` → ALSO the GameStream/Moonlight-compat planes (nvhttp pairing, RTSP, ENet control, _nvstream mDNS). Opt-in, logged with a trusted-LAN caveat. `--moonlight` is an alias. - The native plane is now ALWAYS on in `serve` (`--native` is a kept-for-compat no-op); the unified GameStream+native host is `serve --gamestream`. `gamestream::serve` gates the GameStream spawns (nvhttp/rtsp/control/mdns) on the flag; the native plane + mgmt + native-pairing handle always run. To avoid silently regressing validated Moonlight deployments, the explicit deployment configs PRESERVE Moonlight via `--gamestream` (each documents dropping it for a secure native-only host): the Linux systemd unit, the Steam Deck installer, and the Windows service default (DEFAULT_HOST_CMD). The bare `serve` default (new/manual use) is secure. Docs swept to match (host-cli, moonlight, quickstart, install, packaging READMEs, CLAUDE.md, README, …): Moonlight setup now instructs `--gamestream`; native/console refs use bare `serve`. OpenAPI regenerated (a stale "run `serve --native`" string). fmt + clippy clean; 94 host tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
80 lines
3.5 KiB
Markdown
80 lines
3.5 KiB
Markdown
---
|
||
title: Troubleshooting
|
||
description: Common problems setting up or using a punktfunk host, and how to fix them.
|
||
---
|
||
|
||
## The host isn't found on the network
|
||
|
||
- Make sure the host is actually running (`systemctl --user status punktfunk-host`, or you see it
|
||
listening in the terminal).
|
||
- Host and client must be on the **same network/subnet**. Discovery uses mDNS, which doesn't cross
|
||
routed subnets or most VPNs-without-multicast. As a fallback, add the host by **IP address** in your
|
||
client.
|
||
- A firewall on the host can block it. The native protocol's control plane uses UDP port **9777**. The
|
||
per-session **data plane** uses an *ephemeral* UDP port negotiated at connect time (currently
|
||
random) — for a strict firewall, open a UDP range or move the data port. GameStream/Moonlight uses
|
||
TCP **47984/47989/48010** + UDP **47998–48010** + ENet UDP **47999**. Allow them on the host's
|
||
firewall.
|
||
|
||
## `nvidia-smi` says it can't communicate with the driver
|
||
|
||
- The NVIDIA kernel module didn't load. With **Secure Boot** enabled, enrol the module's signing key:
|
||
`sudo mokutil --import /var/lib/shim-signed/mok/MOK.der`, reboot, **Enrol MOK** at the blue screen
|
||
(or disable Secure Boot). On Fedora, follow RPM Fusion's Secure Boot steps.
|
||
- After a kernel update the module may need a rebuild — reinstall the driver package.
|
||
|
||
## The desktop won't start, or "GPU … not supported by EGL"
|
||
|
||
The NVIDIA **GL/EGL userspace** is missing — the base driver package doesn't always include it.
|
||
|
||
- **Ubuntu:** `sudo apt install libnvidia-gl-<version>` (matching your driver).
|
||
- Confirm `/usr/share/glvnd/egl_vendor.d/10_nvidia.json` exists and `nvidia-drm modeset` is `Y`.
|
||
|
||
## Black screen / no picture, but the client connects
|
||
|
||
- You must be on a **Wayland** session, not X11 (check the login-screen session picker).
|
||
- KWin must be **≥ 6.5.6** (`kwin_wayland --version`); GNOME **≥ 48**; gamescope **≥ 3.16.22**.
|
||
- Confirm `PUNKTFUNK_COMPOSITOR` in [`host.env`](/docs/configuration) matches your desktop.
|
||
|
||
## Capture fails: "Session creation inhibited" (GNOME)
|
||
|
||
A **locked** GNOME session blocks screen capture. On an always-on/headless host, disable the lock:
|
||
|
||
```sh
|
||
gsettings set org.gnome.desktop.screensaver lock-enabled false
|
||
gsettings set org.gnome.desktop.session idle-delay 0
|
||
```
|
||
|
||
See [Running as a Service](/docs/running-as-a-service).
|
||
|
||
## A controller is detected but does nothing (Bazzite)
|
||
|
||
The host user needs to be in the `input` group. On Bazzite:
|
||
|
||
```sh
|
||
ujust add-user-to-input-group
|
||
```
|
||
|
||
Then log out and back in. On other distros this is `sudo usermod -aG input $USER` + re-login.
|
||
|
||
## Pairing is rejected / the client can't connect
|
||
|
||
- The host **requires pairing** by default. Arm pairing from the web console, then enter the PIN on
|
||
the client. See [Pairing & Trust](/docs/pairing).
|
||
- If you re-installed the host, its identity changed — re-pair the client.
|
||
|
||
## Stutter, drops, or high latency
|
||
|
||
- Lower the **bitrate**. On a busy or Wi-Fi link, the requested bitrate may be too high — the native
|
||
clients' [speed test](/docs/configuration#bitrate) picks a safe value; with Moonlight, set it
|
||
manually.
|
||
- Prefer a **wired** connection or 5 GHz Wi-Fi between host and client.
|
||
- Streaming to **many devices at once** shares the GPU encoder. The production host
|
||
(`serve`) handles one native session at a time, with extra clients queued; heavy load is
|
||
usually bitrate-bound, so lower the bitrate first.
|
||
|
||
## Still stuck?
|
||
|
||
Run the host with `RUST_LOG=info` (or `debug`) and check `journalctl --user -u punktfunk-host` for the
|
||
error around the failed connect or capture.
|