enricobuehler
54b75c9be4
apple / swift (push) Successful in 55s
windows-host / package (push) Successful in 2m31s
android / android (push) Successful in 4m40s
ci / rust (push) Successful in 4m43s
ci / web (push) Successful in 30s
ci / docs-site (push) Successful in 34s
deb / build-publish (push) Successful in 2m9s
decky / build-publish (push) Successful in 11s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 5s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 14s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 4s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 4s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 21s
ci / bench (push) Successful in 4m44s
docker / deploy-docs (push) Successful in 19s
rpm / build-publish (fedora-44, punktfunk-fedora44-rpm) (push) Successful in 8m6s
rpm / build-publish (bazzite, punktfunk-fedora-rpm) (push) Successful in 8m19s
Follows the security audit (#5/#9): the GameStream-compat plane carries inherent on-path weaknesses that can't be fixed on the wire without breaking stock Moonlight — its pairing runs over plain HTTP (#9, MITM-able during the pairing window) and its legacy control encryption can reuse GCM nonces (#5, a passive eavesdropper can recover/forge input). The native punktfunk/1 plane (SPAKE2 PIN pairing + per-direction AEAD nonces) has neither. So flip the default to secure-by-default: - `serve` → native punktfunk/1 plane + management API ONLY (no GameStream surface). - `serve --gamestream` → ALSO the GameStream/Moonlight-compat planes (nvhttp pairing, RTSP, ENet control, _nvstream mDNS). Opt-in, logged with a trusted-LAN caveat. `--moonlight` is an alias. - The native plane is now ALWAYS on in `serve` (`--native` is a kept-for-compat no-op); the unified GameStream+native host is `serve --gamestream`. `gamestream::serve` gates the GameStream spawns (nvhttp/rtsp/control/mdns) on the flag; the native plane + mgmt + native-pairing handle always run. To avoid silently regressing validated Moonlight deployments, the explicit deployment configs PRESERVE Moonlight via `--gamestream` (each documents dropping it for a secure native-only host): the Linux systemd unit, the Steam Deck installer, and the Windows service default (DEFAULT_HOST_CMD). The bare `serve` default (new/manual use) is secure. Docs swept to match (host-cli, moonlight, quickstart, install, packaging READMEs, CLAUDE.md, README, …): Moonlight setup now instructs `--gamestream`; native/console refs use bare `serve`. OpenAPI regenerated (a stale "run `serve --native`" string). fmt + clippy clean; 94 host tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
40 lines
2.3 KiB
Desktop File
40 lines
2.3 KiB
Desktop File
# punktfunk streaming host — systemd USER unit (`serve --gamestream` = native punktfunk/1 + the
|
|
# GameStream/Moonlight-compat planes). For a SECURE native-only host (no plain-HTTP pairing / legacy
|
|
# GCM nonce reuse — security-review #5/#9; native clients only), drop `--gamestream` from ExecStart.
|
|
#
|
|
# Install (against an already-running compositor session):
|
|
# mkdir -p ~/.config/systemd/user && cp scripts/punktfunk-host.service ~/.config/systemd/user/
|
|
# cp scripts/host.env.example ~/.config/punktfunk/host.env # then edit for your backend
|
|
# systemctl --user daemon-reload && systemctl --user enable --now punktfunk-host
|
|
#
|
|
# Self-contained boot appliance (no login, no manual steps after boot):
|
|
# - kwin backend (stream the Plasma desktop): also install + enable
|
|
# punktfunk-kde-session.service (it brings up the headless KWin session this After=s), and set
|
|
# PUNKTFUNK_COMPOSITOR=kwin + WAYLAND_DISPLAY=wayland-kde in host.env.
|
|
# - gamescope backend (stream a nested app, no desktop): set PUNKTFUNK_COMPOSITOR=gamescope in
|
|
# host.env — the host spawns gamescope per session, so no kde-session unit is needed.
|
|
# Then `sudo loginctl enable-linger "$USER"` so user units start at boot, and reboot.
|
|
#
|
|
# The host LISTENS as soon as it starts and only touches the compositor per session (on a client
|
|
# connect), so the After= below is a soft ordering, not a hard readiness gate — the kde-session
|
|
# unit (when present) just needs to be up by the time a client streams (seconds later, user-driven).
|
|
# A missing After= unit (e.g. gamescope backend, no kde-session installed) is simply ignored.
|
|
[Unit]
|
|
Description=punktfunk GameStream + punktfunk/1 host
|
|
After=pipewire.service punktfunk-kde-session.service
|
|
# PartOf the kwin session (when present): the host's libei input uses the RemoteDesktop portal,
|
|
# whose D-Bus connection goes stale if the compositor session restarts the portal under it — the
|
|
# in-process reopen loop can't recover that, but a full restart re-establishes it. So restart the
|
|
# host whenever the kde-session restarts. Ignored when punktfunk-kde-session isn't installed
|
|
# (gamescope / other backends).
|
|
PartOf=punktfunk-kde-session.service
|
|
|
|
[Service]
|
|
EnvironmentFile=%h/.config/punktfunk/host.env
|
|
ExecStart=%h/punktfunk/target/release/punktfunk-host serve --gamestream
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
|
|
[Install]
|
|
WantedBy=default.target
|