enricobuehlerandClaude Opus 5
5c7a9407ff
arch / build-publish (push) Successful in 17m1s
ci / web (push) Successful in 53s
ci / docs-site (push) Successful in 58s
apple / swift (push) Successful in 1m19s
decky / build-publish (push) Successful in 24s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 9s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 35s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 10s
docker / build-push (ci, ci/rust-ci-noble.Dockerfile, punktfunk-rust-ci-noble) (push) Successful in 8s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 10s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 47s
ci / bench (push) Successful in 6m19s
deb / build-publish (push) Successful in 9m35s
docker / deploy-docs (push) Successful in 29s
apple / screenshots (push) Successful in 10m56s
deb / build-publish-host (push) Successful in 13m40s
android / android (push) Successful in 16m19s
windows-host / package (push) Successful in 17m13s
ci / rust (push) Successful in 19m39s
rpm / build-publish (44, fedora-44, punktfunk-fedora44-rpm) (push) Successful in 15m44s
rpm / build-publish (43, bazzite, punktfunk-fedora-rpm) (push) Successful in 20m18s
A fresh install left PunktfunkWeb registered but not running: `web setup` waited only for the mgmt token before firing `schtasks /run`, while `web-run.cmd` also requires the host identity cert — and the host writes the token during argument parsing but `cert.pem` only after the pure-Rust RSA-2048 keygen inside `serve`. The launcher lost that race, exited 1, and since the task carried no trigger but boot (Task Scheduler does not reliably restart on a non-zero exit code) the console stayed down until the next reboot, with the installer still reporting "web console set up + started". - `web setup` gates on cert.pem (written last) as well as the token, 90 s budget. - After `schtasks /run`, poll for the :47992 listener and retry before giving up; warn honestly instead of claiming a start that did not happen. - `web-run.cmd` (installed + dev) waits in-process for the token + cert (~5 min) rather than exiting 1 and hoping restart-on-failure retries. - Register the task with a logon trigger alongside boot, falling back to the boot-only XML if a Task Scheduler build rejects it. - Linux had the same defect: punktfunk-web.service's Restart=on-failure gave up permanently after systemd's default 5-starts-in-10 s limit. StartLimitIntervalSec=0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
43 lines
2.3 KiB
Desktop File
43 lines
2.3 KiB
Desktop File
# punktfunk management web console — systemd USER unit (Nitro SSR on bun, port 47992, HTTPS).
|
|
#
|
|
# Installed by the punktfunk-web .deb to /usr/lib/systemd/user/. AUTO-WIRED — no env editing:
|
|
# it sources the host's mgmt token + the generated login password, serves HTTPS (HTTP/1.1 over TLS)
|
|
# with the host's own identity cert (~/.config/punktfunk/{cert,key}.pem), and points the /api proxy
|
|
# at the host's loopback HTTPS mgmt API. The self-signed cert is accepted only for that loopback hop,
|
|
# scoped inside the proxy code (Bun per-request TLS) — no process-wide NODE_TLS_REJECT_UNAUTHORIZED.
|
|
# Enable per user:
|
|
# systemctl --user enable --now punktfunk-web
|
|
[Unit]
|
|
Description=punktfunk management web console
|
|
# web-init generates the login password; the host writes the mgmt token. Order after both.
|
|
After=punktfunk-web-init.service punktfunk-host.service
|
|
Wants=punktfunk-web-init.service
|
|
# Retry indefinitely while the host is still writing the mgmt token + identity cert. Without this,
|
|
# systemd's default rate limit (5 starts / 10 s) plus RestartSec=2 gives up permanently after ~10 s
|
|
# - so a console enabled before the host's first run stayed dead until someone restarted it by hand
|
|
# (the same defect the Windows PunktfunkWeb task had).
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Both are KEY=VALUE files. mgmt-token is REQUIRED (written by the host's `serve`); if absent the
|
|
# unit fails + Restart retries until the host has created it. web-password is '-' optional (web-init
|
|
# creates it first, but a manual operator may inject PUNKTFUNK_UI_PASSWORD another way).
|
|
EnvironmentFile=%h/.config/punktfunk/mgmt-token
|
|
EnvironmentFile=-%h/.config/punktfunk/web-password
|
|
Environment=PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990
|
|
Environment=PORT=47992
|
|
Environment=HOST=0.0.0.0
|
|
# Serve HTTPS (HTTP/1.1 over TLS) with the host's own identity cert; mark the
|
|
# session cookie Secure. The host's `serve` writes these PEMs; if absent at start the unit fails and
|
|
# Restart retries (same as the mgmt-token wait above) rather than silently serving plain HTTP.
|
|
Environment=PUNKTFUNK_UI_TLS_CERT=%h/.config/punktfunk/cert.pem
|
|
Environment=PUNKTFUNK_UI_TLS_KEY=%h/.config/punktfunk/key.pem
|
|
Environment=PUNKTFUNK_UI_SECURE=1
|
|
ExecStart=/usr/bin/punktfunk-web-server
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
|
|
[Install]
|
|
WantedBy=default.target
|