enricobuehler
54b75c9be4
apple / swift (push) Successful in 55s
windows-host / package (push) Successful in 2m31s
android / android (push) Successful in 4m40s
ci / rust (push) Successful in 4m43s
ci / web (push) Successful in 30s
ci / docs-site (push) Successful in 34s
deb / build-publish (push) Successful in 2m9s
decky / build-publish (push) Successful in 11s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 5s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 14s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 4s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 4s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 21s
ci / bench (push) Successful in 4m44s
docker / deploy-docs (push) Successful in 19s
rpm / build-publish (fedora-44, punktfunk-fedora44-rpm) (push) Successful in 8m6s
rpm / build-publish (bazzite, punktfunk-fedora-rpm) (push) Successful in 8m19s
Follows the security audit (#5/#9): the GameStream-compat plane carries inherent on-path weaknesses that can't be fixed on the wire without breaking stock Moonlight — its pairing runs over plain HTTP (#9, MITM-able during the pairing window) and its legacy control encryption can reuse GCM nonces (#5, a passive eavesdropper can recover/forge input). The native punktfunk/1 plane (SPAKE2 PIN pairing + per-direction AEAD nonces) has neither. So flip the default to secure-by-default: - `serve` → native punktfunk/1 plane + management API ONLY (no GameStream surface). - `serve --gamestream` → ALSO the GameStream/Moonlight-compat planes (nvhttp pairing, RTSP, ENet control, _nvstream mDNS). Opt-in, logged with a trusted-LAN caveat. `--moonlight` is an alias. - The native plane is now ALWAYS on in `serve` (`--native` is a kept-for-compat no-op); the unified GameStream+native host is `serve --gamestream`. `gamestream::serve` gates the GameStream spawns (nvhttp/rtsp/control/mdns) on the flag; the native plane + mgmt + native-pairing handle always run. To avoid silently regressing validated Moonlight deployments, the explicit deployment configs PRESERVE Moonlight via `--gamestream` (each documents dropping it for a secure native-only host): the Linux systemd unit, the Steam Deck installer, and the Windows service default (DEFAULT_HOST_CMD). The bare `serve` default (new/manual use) is secure. Docs swept to match (host-cli, moonlight, quickstart, install, packaging READMEs, CLAUDE.md, README, …): Moonlight setup now instructs `--gamestream`; native/console refs use bare `serve`. OpenAPI regenerated (a stale "run `serve --native`" string). fmt + clippy clean; 94 host tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
38 lines
1.8 KiB
Bash
38 lines
1.8 KiB
Bash
# punktfunk host configuration (Windows) — read by the `PunktfunkHost` service.
|
|
#
|
|
# `punktfunk-host service install` writes a default copy of this to
|
|
# %ProgramData%\punktfunk\host.env
|
|
# Edit that file (not this one) and restart the service to apply:
|
|
# punktfunk-host service stop
|
|
# punktfunk-host service start
|
|
#
|
|
# Format: KEY=VALUE per line; '#' starts a comment. The service loads these into its environment
|
|
# and passes PUNKTFUNK_* and RUST_LOG through to the host it launches into the active session.
|
|
|
|
# Hardware encode via NVENC (NVIDIA). The host must be the `--features nvenc` build. Falls back to
|
|
# the software encoder automatically if NVENC is unavailable.
|
|
PUNKTFUNK_ENCODER=nvenc
|
|
|
|
# Video source: `virtual` creates a per-client virtual display (SudoVDA) at the client's exact
|
|
# resolution + refresh — the flagship mode. Requires the SudoVDA indirect display driver installed.
|
|
PUNKTFUNK_VIDEO_SOURCE=virtual
|
|
|
|
# Capture the secure desktop (UAC / lock / login) so the stream survives those transitions.
|
|
PUNKTFUNK_SECURE_DDA=1
|
|
|
|
# Log level (info | debug | trace). Logs land in %ProgramData%\punktfunk\logs\.
|
|
RUST_LOG=info
|
|
|
|
# The host subcommand the service launches. Default: `serve --gamestream` (native punktfunk/1 host
|
|
# ALWAYS on + the GameStream/Moonlight-compat planes). Use `serve` for a SECURE native-only host
|
|
# (no plain-HTTP pairing / legacy GCM nonce reuse — security-review #5/#9). Uncomment to override.
|
|
#PUNKTFUNK_HOST_CMD=serve --gamestream
|
|
|
|
# Multi-GPU boxes only: force the NVENC/Desktop-Duplication GPU by Description substring. Leave
|
|
# unset on single-GPU machines (the default auto-picks the discrete adapter).
|
|
#PUNKTFUNK_RENDER_ADAPTER=4090
|
|
|
|
# Keep a per-client virtual display alive briefly after disconnect so a quick reconnect reuses it
|
|
# (no display connect/disconnect chime). Default 10000 ms.
|
|
#PUNKTFUNK_MONITOR_LINGER_MS=10000
|