Files
Omarchy-Stream/bin/sunshine-stream-undo.sh
Levi Woodard 4d2f050e33 Persistent HEADLESS-1 + SSH-tunnel-friendly cert SANs + web UI lockdown
Two streams of fixes shipped together.

Headless persistence (root cause of "Fatal: Unable to find display or
encoder during startup")
- bin/sunshine-stream-undo.sh: stop removing HEADLESS-1 on disconnect.
  Create-on-connect / destroy-on-disconnect raced with Sunshine's startup
  encoder probe and made every restart fail with a fatal-but-misleading
  warning. The output now lives across stream sessions; sunshine-stream-
  do.sh just resizes it per client.
- files/headless-prestart.conf: systemd-user drop-in that runs
  'hyprctl output create headless' (non-fatal) before Sunshine starts, so
  HEADLESS-1 exists before the encoder probe.
- lib/headless.sh: install_headless_prestart_dropin resolves the actual
  unit name (sunshine.service or app-dev.lizardbyte.app.Sunshine.service)
  and lands the drop-in under ~/.config/systemd/user/<unit>.d/.
- lib/service.sh: enable_sunshine_service calls install_headless_prestart_
  dropin when STREAM_MODE=headless. Placed after ensure_sunshine_unit_
  present so the unit name is settled when the drop-in is written.
- install.sh: comment noting the drop-in install is deferred to the
  service-enable step.

Web UI lockdown + tunnel-friendly certs
- lib/config.sh: emits origin_web_ui_allowed = pc. Sunshine rejects web UI
  requests from anywhere other than localhost regardless of bind address.
  Streaming/pairing (47989) stays LAN-accessible. Inline comment documents
  the SSH tunnel recipe.
- lib/certs.sh: add DNS:localhost and IP:127.0.0.1 to host cert SANs so
  the tunneled https://localhost:47990 URL doesn't trigger a hostname
  mismatch. Idempotency check now requires those SANs too.

Misc.
- files/sunshine.service: fallback unit also gains the prestart ExecStartPre.
- lib/service.sh: ensure_sunshine_unit_present aliases the reverse-DNS
  Sunshine unit as sunshine.service when sunshine-bin's short-name unit
  isn't installed.
2026-05-18 11:53:18 -06:00

52 lines
2.0 KiB
Bash

#!/usr/bin/env bash
# Invoked by Sunshine as a stream-stop hook (global_prep_cmd `undo`).
# Moves the previously-active workspace back to a real monitor (if any
# exist) and tears down the headless output created by sunshine-stream-do.sh.
set -euo pipefail
log() { printf '[sunshine-undo] %s\n' "$*" >&2; }
MON="HEADLESS-1"
STATE_DIR="${XDG_RUNTIME_DIR:-/tmp}/sunshine-headless"
if ! command -v hyprctl >/dev/null 2>&1; then
log "hyprctl not found; nothing to undo."
exit 0
fi
if [[ -z "${HYPRLAND_INSTANCE_SIGNATURE:-}" ]]; then
for sig_dir in "${XDG_RUNTIME_DIR:-/tmp}"/hypr/*/; do
[[ -d "$sig_dir" ]] || continue
export HYPRLAND_INSTANCE_SIGNATURE="$(basename "$sig_dir")"
break
done
if [[ -z "${HYPRLAND_INSTANCE_SIGNATURE:-}" ]]; then
log "Hyprland not running; nothing to undo."
exit 0
fi
fi
PREV_WS="$(cat "$STATE_DIR/prev-workspace-id" 2>/dev/null || echo 1)"
# Find a non-headless monitor to move the workspace back to. If there isn't one
# (truly headless host with KVM detached), the workspace just lives on whatever
# Hyprland reassigns it to when we remove the output.
REAL_MON="$(hyprctl monitors -j 2>/dev/null | jq -r '.[] | select(.name | test("^HEADLESS") | not) | .name' | head -n1)"
if [[ -n "$REAL_MON" ]]; then
log "Returning workspace $PREV_WS$REAL_MON"
hyprctl dispatch moveworkspacetomonitor "$PREV_WS $REAL_MON" >/dev/null || true
hyprctl dispatch focusmonitor "$REAL_MON" >/dev/null || true
else
log "No real monitor connected; leaving workspace assignment to Hyprland defaults."
fi
# Leave HEADLESS-1 in place. It needs to exist persistently for Sunshine's
# encoder probe to succeed at startup; removing-and-recreating per session
# raced with the probe and caused fatal startup errors. Resizing on each
# new client (in sunshine-stream-do.sh) is enough — the output itself stays.
# Clean state files but keep the directory for the next run.
rm -f "$STATE_DIR/prev-monitors.json" "$STATE_DIR/prev-workspace-id"
log "Stream teardown complete (HEADLESS-1 kept for next connect)"