enricobuehler
1dc8dc7f0d
apple / swift (push) Successful in 1m11s
rpm / build-publish (43, bazzite, punktfunk-fedora-rpm) (push) Has been cancelled
rpm / build-publish (44, fedora-44, punktfunk-fedora44-rpm) (push) Has been cancelled
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Has been cancelled
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Has been cancelled
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Has been cancelled
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Has been cancelled
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Has been cancelled
docker / deploy-docs (push) Has been cancelled
decky / build-publish (push) Has been cancelled
deb / build-publish (push) Has been cancelled
ci / rust (push) Has been cancelled
ci / web (push) Has been cancelled
ci / docs-site (push) Has been cancelled
ci / bench (push) Has been cancelled
android / android (push) Successful in 3m49s
apple / screenshots (push) Has been cancelled
arch / build-publish (push) Has been cancelled
The mgmt REST API has bound 0.0.0.0:47990 by default since ae51276 so paired
clients can browse the game library over mTLS, but every packaged firewall
opener still excluded 47990 and the docs still claimed it was loopback-only.
On any host with an active firewall (ufw/firewalld) the LAN game-library
feature was silently broken.
Add 47990/tcp to the native firewall profiles (punktfunk.ufw [punktfunk-native]
+ punktfunk-native.xml) and correct the stale "loopback-only by default" text
across the debian/arch/bazzite READMEs and the docs site (incl. the factually
wrong --mgmt-bind default in host-cli.md, 127.0.0.1 -> 0.0.0.0). Opening the
port adds no admin exposure: off-loopback mgmt::require_auth serves only the
read-only status/library allowlist to a paired client cert; the bearer-token
admin surface stays loopback-only regardless of the bind.
Windows was already sound (shared parse_serve binds 0.0.0.0; service.rs already
firewall-opens 47990) — add a clarifying comment so the rule isn't mistaken for
accidental over-exposure.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
44 lines
2.5 KiB
Plaintext
44 lines
2.5 KiB
Plaintext
# ufw application profile for the punktfunk host — installed to
|
|
# /etc/ufw/applications.d/punktfunk by the .deb and the Arch/CachyOS package.
|
|
#
|
|
# This is the ufw analogue of the firewalld service definitions
|
|
# (punktfunk-native.xml / punktfunk-gamestream.xml): it turns opening the host's
|
|
# ports into a one-liner on the distros that use ufw instead of firewalld
|
|
# (CachyOS ships ufw enabled; Debian/Ubuntu ship it installed-but-inactive). ufw
|
|
# reads this directory on every command, so no reload is needed after the
|
|
# package drops the file — just:
|
|
#
|
|
# sudo ufw allow punktfunk-native # the secure native punktfunk/1 host (the default)
|
|
# sudo ufw allow punktfunk-gamestream # add GameStream/Moonlight compat (opt-in)
|
|
# sudo ufw allow punktfunk-web # reach the web console from the LAN (if punktfunk-web is installed)
|
|
# sudo ufw app info punktfunk-native # show what a profile opens
|
|
#
|
|
# Same port map as the firewalld services. The punktfunk/1 DATA plane is an
|
|
# ephemeral UDP port chosen per session and is NOT listed here: the host
|
|
# hole-punches, so a deny-inbound firewall still works (it just adds ~2.5 s at
|
|
# session start). To open a fixed one instead, run the host with
|
|
# `serve --data-port 9778` and `sudo ufw allow 9778/udp`.
|
|
|
|
[punktfunk-native]
|
|
title=punktfunk host (native punktfunk/1)
|
|
description=punktfunk/1 native streaming: QUIC control plane + mDNS auto-discovery + mgmt/library API (HTTPS + mTLS)
|
|
ports=9777/udp|5353/udp|47990/tcp
|
|
|
|
[punktfunk-gamestream]
|
|
title=punktfunk host (GameStream/Moonlight)
|
|
description=GameStream/Moonlight compatibility ports (opt-in, trusted LAN only)
|
|
ports=47984,47989,48010/tcp|47998:48010/udp|5353/udp
|
|
|
|
# The mgmt REST API (TCP 47990, in the punktfunk-native profile above) binds all interfaces by
|
|
# default so paired clients can browse the game library over mTLS. Off-loopback it exposes ONLY the
|
|
# read-only status + library endpoints, and only to a paired client certificate; every admin action
|
|
# (arming pairing, removing devices, session control, library edits) is honored over loopback only.
|
|
# Run the host with `--mgmt-bind 127.0.0.1:47990` to keep 47990 loopback-only (then don't open it).
|
|
#
|
|
# The optional web console (the separate punktfunk-web package). Open only if you installed it and
|
|
# want to reach it from another device — it binds all interfaces on TCP 47992 (HTTPS, login-gated).
|
|
[punktfunk-web]
|
|
title=punktfunk web console
|
|
description=The optional punktfunk management web console (HTTPS, login-gated) reachable from the LAN
|
|
ports=47992/tcp
|