Files
Omarchy-Stream/lib/service.sh
Levi Woodard 4d2f050e33 Persistent HEADLESS-1 + SSH-tunnel-friendly cert SANs + web UI lockdown
Two streams of fixes shipped together.

Headless persistence (root cause of "Fatal: Unable to find display or
encoder during startup")
- bin/sunshine-stream-undo.sh: stop removing HEADLESS-1 on disconnect.
  Create-on-connect / destroy-on-disconnect raced with Sunshine's startup
  encoder probe and made every restart fail with a fatal-but-misleading
  warning. The output now lives across stream sessions; sunshine-stream-
  do.sh just resizes it per client.
- files/headless-prestart.conf: systemd-user drop-in that runs
  'hyprctl output create headless' (non-fatal) before Sunshine starts, so
  HEADLESS-1 exists before the encoder probe.
- lib/headless.sh: install_headless_prestart_dropin resolves the actual
  unit name (sunshine.service or app-dev.lizardbyte.app.Sunshine.service)
  and lands the drop-in under ~/.config/systemd/user/<unit>.d/.
- lib/service.sh: enable_sunshine_service calls install_headless_prestart_
  dropin when STREAM_MODE=headless. Placed after ensure_sunshine_unit_
  present so the unit name is settled when the drop-in is written.
- install.sh: comment noting the drop-in install is deferred to the
  service-enable step.

Web UI lockdown + tunnel-friendly certs
- lib/config.sh: emits origin_web_ui_allowed = pc. Sunshine rejects web UI
  requests from anywhere other than localhost regardless of bind address.
  Streaming/pairing (47989) stays LAN-accessible. Inline comment documents
  the SSH tunnel recipe.
- lib/certs.sh: add DNS:localhost and IP:127.0.0.1 to host cert SANs so
  the tunneled https://localhost:47990 URL doesn't trigger a hostname
  mismatch. Idempotency check now requires those SANs too.

Misc.
- files/sunshine.service: fallback unit also gains the prestart ExecStartPre.
- lib/service.sh: ensure_sunshine_unit_present aliases the reverse-DNS
  Sunshine unit as sunshine.service when sunshine-bin's short-name unit
  isn't installed.
2026-05-18 11:53:18 -06:00

94 lines
3.7 KiB
Bash

#!/usr/bin/env bash
# Enable Sunshine as a systemd --user service and turn on lingering so it
# runs at boot without a graphical login.
ensure_sunshine_unit_present() {
# Case 1: a sunshine.service unit already exists in any path systemd-user
# scans. sunshine-bin ships /usr/lib/systemd/user/sunshine.service directly.
for p in \
/usr/lib/systemd/user/sunshine.service \
/etc/systemd/user/sunshine.service \
"$HOME/.config/systemd/user/sunshine.service" \
"$HOME/.local/share/systemd/user/sunshine.service"
do
[[ -e "$p" ]] && return 0
done
# Case 2: the AUR source 'sunshine' package ships the unit under a
# Flatpak-style reverse-DNS name. Symlink it as sunshine.service so the rest
# of our tooling can keep using the short name.
local fqdn_unit=""
for p in \
/usr/lib/systemd/user/app-dev.lizardbyte.app.Sunshine.service \
/etc/systemd/user/app-dev.lizardbyte.app.Sunshine.service
do
[[ -f "$p" ]] && { fqdn_unit="$p"; break; }
done
if [[ -n "$fqdn_unit" ]]; then
info "Found packaged unit at $fqdn_unit"
info "Aliasing it as sunshine.service in $HOME/.config/systemd/user/"
mkdir -p "$HOME/.config/systemd/user"
ln -sf "$fqdn_unit" "$HOME/.config/systemd/user/sunshine.service"
return 0
fi
# Case 3: no unit shipped at all — drop our own.
local fallback="$SCRIPT_DIR/files/sunshine.service"
if [[ ! -f "$fallback" ]]; then
err "No sunshine.service shipped by the package, and no fallback found at $fallback"
return 1
fi
info "No packaged sunshine.service found; installing repo fallback unit"
mkdir -p "$HOME/.config/systemd/user"
install -m 0644 "$fallback" "$HOME/.config/systemd/user/sunshine.service"
ok "Installed $HOME/.config/systemd/user/sunshine.service"
}
enable_sunshine_service() {
# The AUR 'sunshine' (source) package doesn't always ship a systemd user unit
# at the standard /usr/lib/systemd/user/sunshine.service path. If systemd
# can't find one, drop our own copy into ~/.config/systemd/user/.
ensure_sunshine_unit_present
systemctl --user daemon-reload
# In headless mode, install a drop-in that pre-creates HEADLESS-1 before
# Sunshine starts. Done here because the drop-in target name depends on
# which unit ensure_sunshine_unit_present resolved.
if [[ "${STREAM_MODE:-}" == "headless" ]] && declare -F install_headless_prestart_dropin >/dev/null; then
install_headless_prestart_dropin
fi
if ! systemctl --user list-unit-files sunshine.service >/dev/null 2>&1; then
err "sunshine.service still not found after fallback. Inspect: find /usr ~/.config -name sunshine.service"
return 1
fi
if ! loginctl show-user "$USER" -p Linger --value 2>/dev/null | grep -qx yes; then
info "Enabling user lingering (loginctl enable-linger $USER)"
as_root loginctl enable-linger "$USER"
else
ok "User lingering already enabled"
fi
info "Enabling sunshine.service (user)"
systemctl --user enable sunshine.service >/dev/null
# Clear any prior start-limit state from a failed run so this attempt isn't
# immediately rejected with "Start request repeated too quickly."
systemctl --user reset-failed sunshine.service 2>/dev/null || true
info "Starting sunshine.service (user)"
# Restart so a re-run picks up new config / new caps. Tolerate first-launch races.
systemctl --user restart sunshine.service || systemctl --user start sunshine.service || {
err "Failed to start sunshine.service. Check: journalctl --user -u sunshine"
return 1
}
sleep 1
if systemctl --user is-active --quiet sunshine.service; then
ok "sunshine.service is active"
else
warn "sunshine.service did not stay active. Inspect: journalctl --user -u sunshine -n 50"
fi
}