enricobuehler
1dc8dc7f0d
apple / swift (push) Successful in 1m11s
rpm / build-publish (43, bazzite, punktfunk-fedora-rpm) (push) Has been cancelled
rpm / build-publish (44, fedora-44, punktfunk-fedora44-rpm) (push) Has been cancelled
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Has been cancelled
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Has been cancelled
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Has been cancelled
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Has been cancelled
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Has been cancelled
docker / deploy-docs (push) Has been cancelled
decky / build-publish (push) Has been cancelled
deb / build-publish (push) Has been cancelled
ci / rust (push) Has been cancelled
ci / web (push) Has been cancelled
ci / docs-site (push) Has been cancelled
ci / bench (push) Has been cancelled
android / android (push) Successful in 3m49s
apple / screenshots (push) Has been cancelled
arch / build-publish (push) Has been cancelled
The mgmt REST API has bound 0.0.0.0:47990 by default since ae51276 so paired
clients can browse the game library over mTLS, but every packaged firewall
opener still excluded 47990 and the docs still claimed it was loopback-only.
On any host with an active firewall (ufw/firewalld) the LAN game-library
feature was silently broken.
Add 47990/tcp to the native firewall profiles (punktfunk.ufw [punktfunk-native]
+ punktfunk-native.xml) and correct the stale "loopback-only by default" text
across the debian/arch/bazzite READMEs and the docs site (incl. the factually
wrong --mgmt-bind default in host-cli.md, 127.0.0.1 -> 0.0.0.0). Opening the
port adds no admin exposure: off-loopback mgmt::require_auth serves only the
read-only status/library allowlist to a paired client cert; the bearer-token
admin surface stays loopback-only regardless of the bind.
Windows was already sound (shared parse_serve binds 0.0.0.0; service.rs already
firewall-opens 47990) — add a clarifying comment so the rule isn't mistaken for
accidental over-exposure.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
31 lines
2.2 KiB
XML
31 lines
2.2 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
firewalld service definition for the native punktfunk/1 host (the secure default 'serve', or the
|
|
punktfunk1-host subcommand).
|
|
|
|
Installed to /usr/lib/firewalld/services/ by the punktfunk-host package. NOT enabled automatically
|
|
(packages never touch the admin's firewall). Stock Arch/Debian ship no active firewall; Fedora/RHEL
|
|
and some Arch spins (EndeavourOS) enable firewalld by default, so enable it once with firewall-cmd
|
|
(add-service=punktfunk-native, then reload). CachyOS and Ubuntu use ufw instead — the package also
|
|
ships a ufw application profile (punktfunk.ufw). Exact commands: your distro's install guide, or the
|
|
per-distro packaging README (Firewall section).
|
|
|
|
The media DATA plane binds an EPHEMERAL UDP port (0.0.0.0:0) chosen per session and reported to the
|
|
client, so there is no fixed data port to open. On a restrictive firewall you must also allow the
|
|
ephemeral UDP range (the project does not pin one).
|
|
|
|
The mgmt REST API (TCP 47990, HTTPS + mTLS) is opened here because `serve` binds it to all interfaces
|
|
by default so paired clients can browse the game library over the LAN. Off-loopback it exposes ONLY
|
|
the read-only status + library endpoints, and only to a paired client certificate; every admin /
|
|
state-changing action (arming pairing, removing devices, session control, library edits) is honored
|
|
over loopback only. To keep 47990 loopback-only, bind the mgmt API to 127.0.0.1:47990 (the host's
|
|
`mgmt-bind` option).
|
|
-->
|
|
<service>
|
|
<short>Punktfunk (native punktfunk/1)</short>
|
|
<description>Low-latency game-streaming host over the native punktfunk/1 protocol (QUIC control plane). Opens the default QUIC control port plus mDNS for auto-discovery, and the mgmt/library REST API (HTTPS + mTLS; off-loopback it serves only read-only status/library to paired clients). The media data plane uses an ephemeral UDP port negotiated per session, not opened here.</description>
|
|
<port protocol="udp" port="9777"/> <!-- QUIC control plane (default 9777) -->
|
|
<port protocol="udp" port="5353"/> <!-- mDNS auto-discovery (_punktfunk._udp.local) -->
|
|
<port protocol="tcp" port="47990"/> <!-- mgmt/library REST API (HTTPS + mTLS; LAN = read-only, paired) -->
|
|
</service>
|