Persistent HEADLESS-1 + SSH-tunnel-friendly cert SANs + web UI lockdown
Two streams of fixes shipped together. Headless persistence (root cause of "Fatal: Unable to find display or encoder during startup") - bin/sunshine-stream-undo.sh: stop removing HEADLESS-1 on disconnect. Create-on-connect / destroy-on-disconnect raced with Sunshine's startup encoder probe and made every restart fail with a fatal-but-misleading warning. The output now lives across stream sessions; sunshine-stream- do.sh just resizes it per client. - files/headless-prestart.conf: systemd-user drop-in that runs 'hyprctl output create headless' (non-fatal) before Sunshine starts, so HEADLESS-1 exists before the encoder probe. - lib/headless.sh: install_headless_prestart_dropin resolves the actual unit name (sunshine.service or app-dev.lizardbyte.app.Sunshine.service) and lands the drop-in under ~/.config/systemd/user/<unit>.d/. - lib/service.sh: enable_sunshine_service calls install_headless_prestart_ dropin when STREAM_MODE=headless. Placed after ensure_sunshine_unit_ present so the unit name is settled when the drop-in is written. - install.sh: comment noting the drop-in install is deferred to the service-enable step. Web UI lockdown + tunnel-friendly certs - lib/config.sh: emits origin_web_ui_allowed = pc. Sunshine rejects web UI requests from anywhere other than localhost regardless of bind address. Streaming/pairing (47989) stays LAN-accessible. Inline comment documents the SSH tunnel recipe. - lib/certs.sh: add DNS:localhost and IP:127.0.0.1 to host cert SANs so the tunneled https://localhost:47990 URL doesn't trigger a hostname mismatch. Idempotency check now requires those SANs too. Misc. - files/sunshine.service: fallback unit also gains the prestart ExecStartPre. - lib/service.sh: ensure_sunshine_unit_present aliases the reverse-DNS Sunshine unit as sunshine.service when sunshine-bin's short-name unit isn't installed.
This commit is contained in:
@@ -102,7 +102,9 @@ subjectAltName = @alt_names
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = ${host_lc}.lan
|
||||
DNS.2 = localhost
|
||||
IP.1 = ${lan_ip}
|
||||
IP.2 = 127.0.0.1
|
||||
EOF
|
||||
|
||||
openssl genrsa -out "$tmpdir/host-key.pem" 2048 2>/dev/null
|
||||
@@ -176,7 +178,9 @@ fetch_and_install_certs() {
|
||||
&& cert_is_current \
|
||||
&& cert_signed_by_ca "$tmpdir/ca-cert.pem" \
|
||||
&& cert_has_san_for "${host_lc}.lan" \
|
||||
&& cert_has_san_for "${lan_ip}"; then
|
||||
&& cert_has_san_for "${lan_ip}" \
|
||||
&& cert_has_san_for "localhost" \
|
||||
&& cert_has_san_for "127.0.0.1"; then
|
||||
ok "Sunshine cert is current, signed by CA, and matches expected SANs — skipping mint"
|
||||
return 0
|
||||
fi
|
||||
|
||||
@@ -74,6 +74,13 @@ audio_sink = pulse
|
||||
|
||||
# Keyboard / mouse / gamepad pass-through via /dev/uinput.
|
||||
# (Requires user to be in the 'input' group; install.sh handles this.)
|
||||
|
||||
# Lock the web UI to localhost-only regardless of what the socket binds to.
|
||||
# Reach the admin panel from another machine via an SSH tunnel:
|
||||
# ssh -L 47990:127.0.0.1:47990 <user>@<host>
|
||||
# then open https://localhost:47990 in a browser. The streaming/pairing port
|
||||
# (47989) stays LAN-accessible — only the admin UI is locked down.
|
||||
origin_web_ui_allowed = pc
|
||||
EOF
|
||||
ok "Wrote sunshine.conf"
|
||||
}
|
||||
|
||||
@@ -18,3 +18,36 @@ install_headless_hooks() {
|
||||
install -m 0755 "$SCRIPT_DIR/bin/sunshine-stream-undo.sh" "$UNDO_SCRIPT"
|
||||
ok "Installed prep-cmd hooks to $HEADLESS_BIN_DIR"
|
||||
}
|
||||
|
||||
# Install a systemd-user drop-in that pre-creates HEADLESS-1 before Sunshine
|
||||
# starts, so the encoder probe at startup sees a valid Wayland output. Without
|
||||
# this, Sunshine reports a fatal "Unable to find display or encoder during
|
||||
# startup" on every restart, even though streaming works once a client connects.
|
||||
install_headless_prestart_dropin() {
|
||||
local dropin_src="$SCRIPT_DIR/files/headless-prestart.conf"
|
||||
if [[ ! -f "$dropin_src" ]]; then
|
||||
err "Drop-in source missing: $dropin_src"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Resolve the actual unit name. Prefer sunshine.service when present (alias
|
||||
# or sunshine-bin); fall back to the AUR source pkg's reverse-DNS name.
|
||||
local unit=""
|
||||
for u in sunshine.service app-dev.lizardbyte.app.Sunshine.service; do
|
||||
if systemctl --user list-unit-files "$u" >/dev/null 2>&1 \
|
||||
&& systemctl --user cat "$u" >/dev/null 2>&1; then
|
||||
unit="$u"
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [[ -z "$unit" ]]; then
|
||||
warn "Could not resolve a sunshine unit to attach the drop-in to; skipping."
|
||||
return 0
|
||||
fi
|
||||
|
||||
local dropin_dir="$HOME/.config/systemd/user/${unit}.d"
|
||||
mkdir -p "$dropin_dir"
|
||||
install -m 0644 "$dropin_src" "$dropin_dir/headless-prestart.conf"
|
||||
systemctl --user daemon-reload
|
||||
ok "Installed headless prestart drop-in at $dropin_dir/headless-prestart.conf"
|
||||
}
|
||||
|
||||
@@ -2,9 +2,64 @@
|
||||
# Enable Sunshine as a systemd --user service and turn on lingering so it
|
||||
# runs at boot without a graphical login.
|
||||
|
||||
ensure_sunshine_unit_present() {
|
||||
# Case 1: a sunshine.service unit already exists in any path systemd-user
|
||||
# scans. sunshine-bin ships /usr/lib/systemd/user/sunshine.service directly.
|
||||
for p in \
|
||||
/usr/lib/systemd/user/sunshine.service \
|
||||
/etc/systemd/user/sunshine.service \
|
||||
"$HOME/.config/systemd/user/sunshine.service" \
|
||||
"$HOME/.local/share/systemd/user/sunshine.service"
|
||||
do
|
||||
[[ -e "$p" ]] && return 0
|
||||
done
|
||||
|
||||
# Case 2: the AUR source 'sunshine' package ships the unit under a
|
||||
# Flatpak-style reverse-DNS name. Symlink it as sunshine.service so the rest
|
||||
# of our tooling can keep using the short name.
|
||||
local fqdn_unit=""
|
||||
for p in \
|
||||
/usr/lib/systemd/user/app-dev.lizardbyte.app.Sunshine.service \
|
||||
/etc/systemd/user/app-dev.lizardbyte.app.Sunshine.service
|
||||
do
|
||||
[[ -f "$p" ]] && { fqdn_unit="$p"; break; }
|
||||
done
|
||||
if [[ -n "$fqdn_unit" ]]; then
|
||||
info "Found packaged unit at $fqdn_unit"
|
||||
info "Aliasing it as sunshine.service in $HOME/.config/systemd/user/"
|
||||
mkdir -p "$HOME/.config/systemd/user"
|
||||
ln -sf "$fqdn_unit" "$HOME/.config/systemd/user/sunshine.service"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Case 3: no unit shipped at all — drop our own.
|
||||
local fallback="$SCRIPT_DIR/files/sunshine.service"
|
||||
if [[ ! -f "$fallback" ]]; then
|
||||
err "No sunshine.service shipped by the package, and no fallback found at $fallback"
|
||||
return 1
|
||||
fi
|
||||
info "No packaged sunshine.service found; installing repo fallback unit"
|
||||
mkdir -p "$HOME/.config/systemd/user"
|
||||
install -m 0644 "$fallback" "$HOME/.config/systemd/user/sunshine.service"
|
||||
ok "Installed $HOME/.config/systemd/user/sunshine.service"
|
||||
}
|
||||
|
||||
enable_sunshine_service() {
|
||||
# The AUR 'sunshine' (source) package doesn't always ship a systemd user unit
|
||||
# at the standard /usr/lib/systemd/user/sunshine.service path. If systemd
|
||||
# can't find one, drop our own copy into ~/.config/systemd/user/.
|
||||
ensure_sunshine_unit_present
|
||||
systemctl --user daemon-reload
|
||||
|
||||
# In headless mode, install a drop-in that pre-creates HEADLESS-1 before
|
||||
# Sunshine starts. Done here because the drop-in target name depends on
|
||||
# which unit ensure_sunshine_unit_present resolved.
|
||||
if [[ "${STREAM_MODE:-}" == "headless" ]] && declare -F install_headless_prestart_dropin >/dev/null; then
|
||||
install_headless_prestart_dropin
|
||||
fi
|
||||
|
||||
if ! systemctl --user list-unit-files sunshine.service >/dev/null 2>&1; then
|
||||
err "sunshine.service not found in user systemd units. Did the package install correctly?"
|
||||
err "sunshine.service still not found after fallback. Inspect: find /usr ~/.config -name sunshine.service"
|
||||
return 1
|
||||
fi
|
||||
|
||||
|
||||
Reference in New Issue
Block a user