enricobuehler
54b75c9be4
apple / swift (push) Successful in 55s
windows-host / package (push) Successful in 2m31s
android / android (push) Successful in 4m40s
ci / rust (push) Successful in 4m43s
ci / web (push) Successful in 30s
ci / docs-site (push) Successful in 34s
deb / build-publish (push) Successful in 2m9s
decky / build-publish (push) Successful in 11s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 5s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 14s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 4s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 4s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 21s
ci / bench (push) Successful in 4m44s
docker / deploy-docs (push) Successful in 19s
rpm / build-publish (fedora-44, punktfunk-fedora44-rpm) (push) Successful in 8m6s
rpm / build-publish (bazzite, punktfunk-fedora-rpm) (push) Successful in 8m19s
Follows the security audit (#5/#9): the GameStream-compat plane carries inherent on-path weaknesses that can't be fixed on the wire without breaking stock Moonlight — its pairing runs over plain HTTP (#9, MITM-able during the pairing window) and its legacy control encryption can reuse GCM nonces (#5, a passive eavesdropper can recover/forge input). The native punktfunk/1 plane (SPAKE2 PIN pairing + per-direction AEAD nonces) has neither. So flip the default to secure-by-default: - `serve` → native punktfunk/1 plane + management API ONLY (no GameStream surface). - `serve --gamestream` → ALSO the GameStream/Moonlight-compat planes (nvhttp pairing, RTSP, ENet control, _nvstream mDNS). Opt-in, logged with a trusted-LAN caveat. `--moonlight` is an alias. - The native plane is now ALWAYS on in `serve` (`--native` is a kept-for-compat no-op); the unified GameStream+native host is `serve --gamestream`. `gamestream::serve` gates the GameStream spawns (nvhttp/rtsp/control/mdns) on the flag; the native plane + mgmt + native-pairing handle always run. To avoid silently regressing validated Moonlight deployments, the explicit deployment configs PRESERVE Moonlight via `--gamestream` (each documents dropping it for a secure native-only host): the Linux systemd unit, the Steam Deck installer, and the Windows service default (DEFAULT_HOST_CMD). The bare `serve` default (new/manual use) is secure. Docs swept to match (host-cli, moonlight, quickstart, install, packaging READMEs, CLAUDE.md, README, …): Moonlight setup now instructs `--gamestream`; native/console refs use bare `serve`. OpenAPI regenerated (a stale "run `serve --native`" string). fmt + clippy clean; 94 host tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
85 lines
4.6 KiB
Markdown
85 lines
4.6 KiB
Markdown
---
|
|
title: Install the Host
|
|
description: Install the punktfunk host — on Linux from its package registry, or on Windows from a signed installer.
|
|
---
|
|
|
|
On Linux, the package registries are the real distribution channel. Pick your distro, add the repo, and
|
|
install with your native package manager. Each row links to the full per-distro guide (add the repo,
|
|
first-run steps, the web console) — those are the source of truth, so this page doesn't duplicate them.
|
|
On **Windows** (NVIDIA), the host ships as a signed installer instead — see [Windows](#windows-nvidia).
|
|
|
|
## Pick your distro
|
|
|
|
| Distro | Package manager | One-command happy path | Guide |
|
|
|--------|-----------------|------------------------|-------|
|
|
| **Ubuntu / Debian** | apt | `sudo apt install punktfunk-host` | [Ubuntu — GNOME](/docs/ubuntu-gnome) · [Ubuntu — KDE](/docs/ubuntu-kde) · [packaging/debian](https://git.unom.io/unom/punktfunk/src/branch/main/packaging/debian/README.md) |
|
|
| **Fedora / Bazzite** | rpm-ostree | `rpm-ostree install punktfunk punktfunk-web` | [Fedora — KDE](/docs/fedora-kde) · [Bazzite](/docs/bazzite) · [packaging/rpm](https://git.unom.io/unom/punktfunk/src/branch/main/packaging/rpm/README.md) |
|
|
| **Arch** | PKGBUILD | `makepkg -si` | [packaging/arch](https://git.unom.io/unom/punktfunk/src/branch/main/packaging/arch/README.md) |
|
|
| **SteamOS (host)** | on-device script | `bash scripts/steamdeck/install.sh` | [SteamOS (Host)](/docs/steamos-host) |
|
|
|
|
Each registry is public — no auth, you just trust the repo's signing key. Adding the repo is a
|
|
one-time step covered in the linked guide; after that, normal `apt upgrade` / `rpm-ostree upgrade`
|
|
tracks new builds automatically.
|
|
|
|
## Windows (NVIDIA)
|
|
|
|
punktfunk also runs as a native host on **Windows 10/11 (x64) with an NVIDIA GPU**, shipped as a
|
|
signed installer — see [Windows Host](/docs/windows-host) for what it includes and its limitations.
|
|
|
|
1. From the [packages page](https://git.unom.io/unom/-/packages) (generic group), download the newest
|
|
**`punktfunk-host-setup-<ver>.exe`** and its matching **`.cer`**.
|
|
2. **Trust the publisher certificate once.** The installer is signed with a self-signed certificate
|
|
whose public `.cer` is published next to it — the **same certificate for every release**, so this is
|
|
genuinely one-time and later updates need nothing. In an **admin** PowerShell:
|
|
|
|
```powershell
|
|
Import-Certificate -FilePath .\punktfunk-host-setup.cer `
|
|
-CertStoreLocation Cert:\LocalMachine\TrustedPublisher
|
|
```
|
|
|
|
3. Run `punktfunk-host-setup-<ver>.exe` (elevated). It installs to `C:\Program Files\punktfunk`,
|
|
optionally installs the bundled **SudoVDA** virtual-display driver, and registers + starts the
|
|
`LocalSystem` service (`/VERYSILENT` for an unattended install). Upgrades and uninstall go through
|
|
Add/Remove Programs.
|
|
|
|
You need an NVIDIA GPU + driver (the host is NVENC-only on Windows). More detail — including the CLI
|
|
`punktfunk-host service install` path — is in
|
|
[Running as a Service → Windows](/docs/running-as-a-service#windows).
|
|
|
|
## What the packages are
|
|
|
|
- **`punktfunk-host`** — the streaming host. Install this on your Linux + NVIDIA gaming machine.
|
|
- **`punktfunk-web`** — the browser management console (pairing + status). Recommended alongside the
|
|
host; on RPM list it explicitly (`rpm-ostree install punktfunk punktfunk-web`).
|
|
- **`punktfunk-client`** — the GTK4 desktop client, for streaming *to* a Linux box (also shipped via
|
|
apt / RPM / Arch / Flatpak). On a Steam Deck, this is the package you want.
|
|
|
|
## After installing
|
|
|
|
1. Add yourself to the `input` group (virtual gamepads need `/dev/uinput`), then re-login. The exact
|
|
command differs per distro — see your guide (`usermod -aG input "$USER"`, or `ujust
|
|
add-user-to-input-group` on Bazzite).
|
|
2. Start the host inside your desktop session:
|
|
|
|
```sh
|
|
punktfunk-host serve
|
|
```
|
|
|
|
Bare `serve` is the secure native-only default (native `punktfunk/1` + the web console). On a
|
|
trusted LAN, add `--gamestream` to also serve stock [Moonlight](/docs/moonlight) clients.
|
|
|
|
3. Enable the web console and read its login password, then open `http://<host-ip>:3000`:
|
|
|
|
```sh
|
|
systemctl --user enable --now punktfunk-web
|
|
journalctl --user -u punktfunk-web-init | sed -n 's/.*password generated: //p'
|
|
```
|
|
|
|
From there, follow the [Quick Start](/docs/quickstart) to pair your first client. To run the host
|
|
automatically at boot, see [Running as a Service](/docs/running-as-a-service).
|
|
|
|
## Building from source
|
|
|
|
If no package exists for your platform, you can build from source — see the repository README. Source
|
|
builds are a fallback; the registries are the supported path.
|