enricobuehler
23d0452157
The user direction after WP0: ENet exists only for Moonlight, so the native
plane must be provably safe and the compat planes a deliberate choice.
Opt-in, everywhere. Windows already was (unchecked installer task). The three
opt-out surfaces are flipped: the shipped systemd user unit (deb/RPM/Arch/
sysext) no longer bakes --gamestream into ExecStart — a new
PUNKTFUNK_GAMESTREAM=1 host.env knob (pf-host-config, OR-ed with the CLI
flag) is the packaged opt-in; the NixOS module default goes true→false, with
a module-check assertion that unset = native-only; the Deck installer takes
--gamestream to opt in (--no-gamestream kept as explicit-off). Docs
(quickstart, running-as-a-service, moonlight, ubuntu/fedora/arch firewall
sections, gnome/sway, how-it-works) rewritten to the opt-in shape; the
CHANGELOG carries the upgrade note.
Enforced-safe. punktfunk-core is #![deny(unsafe_code)] crate-wide — every
module that parses network bytes is safe Rust as a compile error, not a
census result. Carve-outs are exactly two documented classes, neither of
which interprets attacker bytes: the client surface (abi, client) and the
transport syscall-batching shims (udp/{apple,linux,windows}, qos_windows).
In punktfunk-host, the modules a secure-default host exposes — native
(cfg-not-test: its tests exercise the client C ABI on purpose),
native_pairing, mgmt, mgmt_token, discovery, wol — are #[forbid(unsafe_code)].
Gates: Linux amd64 container clippy --all-targets -D warnings clean over
core+host-config+host; core 204 tests green under the deny; mgmt 46/46,
control 6/6. .133 Windows clippy (shipped features, clean-first,
sentinel-checked) clean — covers the qos_windows/udp-windows carve-outs.
macOS + iOS cargo check green (the apple.rs carve-out compiles for real).
35 lines
2.3 KiB
Bash
35 lines
2.3 KiB
Bash
# punktfunk host config for a Fedora/Ubuntu KDE Plasma appliance (kwin backend).
|
|
#
|
|
# APPLIANCE-ONLY: this file deliberately PINS the backend (PUNKTFUNK_COMPOSITOR) and the session
|
|
# env (WAYLAND_DISPLAY/XDG_CURRENT_DESKTOP) at the dedicated headless KWin session — which also
|
|
# turns OFF the host's live-session auto-detection and Desktop<->Game following. On a normal
|
|
# desktop (or any box that switches to Steam Game Mode) do NOT use this file; start from
|
|
# host.env.example instead, whose defaults auto-detect and follow the live session.
|
|
#
|
|
# Copy to ~/.config/punktfunk/host.env. Pairs with punktfunk-kde-session.service, which brings
|
|
# up a headless `kwin --virtual` on wayland-kde (with KWIN_WAYLAND_NO_PERMISSION_CHECKS=1 so the
|
|
# host can bind KWin's privileged zkde_screencast protocol — an interactive Plasma session will
|
|
# NOT hand that protocol to an external client). The host streams a per-client virtual output
|
|
# from that session, captured zero-copy (dmabuf -> CUDA -> NVENC) on NVIDIA.
|
|
WAYLAND_DISPLAY=wayland-kde
|
|
XDG_CURRENT_DESKTOP=KDE
|
|
PUNKTFUNK_COMPOSITOR=kwin
|
|
PUNKTFUNK_VIDEO_SOURCE=virtual
|
|
# Stock-Moonlight (GameStream) compat is OPT-IN (the host is native-only by default). Uncomment
|
|
# on a TRUSTED LAN if this appliance should serve Moonlight clients too (plain-HTTP pairing +
|
|
# legacy GCM caveats — security-review #5/#9 — and the punktfunk-gamestream firewall ports).
|
|
#PUNKTFUNK_GAMESTREAM=1
|
|
# GPU zero-copy (dmabuf → CUDA → NVENC) is ON by default; auto-falls back to CPU. Set =0 to force CPU.
|
|
PUNKTFUNK_INPUT_BACKEND=libei
|
|
# UDP Generic Segmentation Offload on the send path: coalesce a frame's equal-size packets into
|
|
# kernel super-buffers (one sendmsg per ~64 packets instead of one per packet) — the dominant
|
|
# lever above ~1 Gbps, where per-packet send syscalls/pps become the host bottleneck. Safe: it
|
|
# auto-falls back to sendmmsg on any kernel/path that rejects UDP_SEGMENT. Set PUNKTFUNK_GSO=0 to
|
|
# force it off if a NIC/middlebox mishandles GSO segments.
|
|
PUNKTFUNK_GSO=1
|
|
# Make the per-session streamed output the SOLE desktop, so plasmashell + windows render on it
|
|
# rather than on the headless session's `kwin --virtual` bootstrap output (without this the client
|
|
# sees only the wallpaper of an empty extended output). KWin re-homes the desktop; the bootstrap is
|
|
# re-enabled on teardown.
|
|
PUNKTFUNK_KWIN_VIRTUAL_PRIMARY=1
|