enricobuehler
cef2f6780c
CachyOS ships ufw enabled by default (firewalld is not installed) — verified live on the .21 box — but the docs and shipped firewall openers claimed "CachyOS enables firewalld by default". Correct that everywhere and ship a ufw application profile (the one-liner analogue of the firewalld service files): - packaging/linux/punktfunk.ufw (new): [punktfunk-native], [punktfunk-gamestream], [punktfunk-web] profiles, installed to /etc/ufw/applications.d/punktfunk by the Arch (CachyOS) and .deb host packages. `sudo ufw allow punktfunk-native`. - packaging/linux/punktfunk-web.xml (new): firewalld service for the optional web console (TCP 47992), installed by the host package on arch/deb/rpm. Neither the native nor gamestream opener covered 47992, so a firewalld/ufw host that enabled punktfunk-web could not reach the console over the LAN. - Fix the "CachyOS enables firewalld" claim in arch.md, arch/README.md, debian/README.md, both firewalld service .xml comments, and the pacman scriptlet; firewalld now attributed to the spins that use it (EndeavourOS, Fedora/RHEL). - Docs present both one-liners (ufw + firewalld) whichever firewall you run, plus a console-opener step; postinst/scriptlet hints detect ufw as well as firewalld. The native data plane stays hole-punched (ephemeral UDP, no fixed port) — its openers correctly open only 9777/udp + mDNS; the stale "open a UDP range" note is replaced with the accurate outbound-UDP explanation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
23 lines
1.5 KiB
XML
23 lines
1.5 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
firewalld service definition for the native punktfunk/1 host (the secure default 'serve', or the
|
|
punktfunk1-host subcommand).
|
|
|
|
Installed to /usr/lib/firewalld/services/ by the punktfunk-host package. NOT enabled automatically
|
|
(packages never touch the admin's firewall). Stock Arch/Debian ship no active firewall; Fedora/RHEL
|
|
and some Arch spins (EndeavourOS) enable firewalld by default, so enable it once with firewall-cmd
|
|
(add-service=punktfunk-native, then reload). CachyOS and Ubuntu use ufw instead — the package also
|
|
ships a ufw application profile (punktfunk.ufw). Exact commands: your distro's install guide, or the
|
|
per-distro packaging README (Firewall section).
|
|
|
|
The media DATA plane binds an EPHEMERAL UDP port (0.0.0.0:0) chosen per session and reported to the
|
|
client, so there is no fixed data port to open. On a restrictive firewall you must also allow the
|
|
ephemeral UDP range (the project does not pin one).
|
|
-->
|
|
<service>
|
|
<short>Punktfunk (native punktfunk/1)</short>
|
|
<description>Low-latency game-streaming host over the native punktfunk/1 protocol (QUIC control plane). Opens the default QUIC control port plus mDNS for auto-discovery. The media data plane uses an ephemeral UDP port negotiated per session, not opened here.</description>
|
|
<port protocol="udp" port="9777"/> <!-- QUIC control plane (default 9777) -->
|
|
<port protocol="udp" port="5353"/> <!-- mDNS auto-discovery (_punktfunk._udp.local) -->
|
|
</service>
|