diff options
Diffstat (limited to 'packaging')
| -rw-r--r-- | packaging/README.md | 34 |
1 files changed, 25 insertions, 9 deletions
diff --git a/packaging/README.md b/packaging/README.md index 45e1a41..ff65488 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -22,7 +22,9 @@ bash packaging/build/build-packages.sh rpm bash packaging/build/build-packages.sh deb --arm64 ``` -Output: `meshbay-{common,hub,node,client}_0.9.0_{arch}.{deb,rpm}` in `/tmp/meshbay-build/out/`. +Output: `meshbay-{common,hub,node,client}_<version>_{arch}.{deb,rpm}` in +`/tmp/meshbay-build/out/` (override with `MESHBAY_BUILD_DIR`). The version comes +from each package's `pyproject.toml`. ## Install order @@ -51,12 +53,15 @@ No pip runs at install time — everything is pre-built. ## Post-install (hub) ```bash -meshbay-hub --generate-keys -sudo cp /opt/meshbay-hub/share/hub.toml.example /etc/meshbay/hub.toml +sudo cp /etc/meshbay/hub.toml.example /etc/meshbay/hub.toml sudo nano /etc/meshbay/hub.toml sudo systemctl enable --now meshbay-hub ``` +The hub generates its own Ed25519 keypair on first start if +`identity.private_key_path` does not exist yet (`app.py`, lifespan), so there is +no key-generation step to run by hand. + ## Post-install (node) ```bash @@ -65,11 +70,20 @@ nano ~/.config/meshbay/node.toml systemctl --user enable --now meshbay-node ``` -## Firewall (LAN casting) +## Firewall + +Two passive profiles: packaged, not activated. + +**LAN casting (client)** — the Electron client runs an HTTP relay on +**TCP 19550-19553** to stream decrypted video to Chromecast / Smart TV devices +on the local network. Discovery uses **mDNS (UDP 5353)**. -The Electron client runs an HTTP relay on **TCP 19550-19553** to stream -decrypted video to Chromecast / Smart TV devices on the local network. -Chromecast discovery uses **mDNS (UDP 5353)**. +**Peer connections (node)** — WebRTC binds an ephemeral UDP port per +connection, so there is no fixed port: the node profile opens **UDP +1024-65535** and must be scoped to the LAN. A node that refuses unsolicited +inbound UDP is unreachable from every browser it cannot itself call back, +because browsers publish an mDNS `.local` candidate the node cannot resolve. +See `docs/PACKAGING-GUIDE.md` for the reasoning. ### Fedora / RHEL (firewalld) @@ -77,6 +91,7 @@ Pre-installed service files at `/usr/lib/firewalld/services/`: ```bash sudo firewall-cmd --permanent --add-service=meshbay-cast +sudo firewall-cmd --permanent --zone=<your LAN zone> --add-service=meshbay-node sudo firewall-cmd --reload ``` @@ -86,6 +101,7 @@ Pre-installed application profile at `/etc/ufw/applications.d/meshbay`: ```bash sudo ufw allow "MeshBay Cast" +sudo ufw allow from 192.168.0.0/16 app "MeshBay Node" # your LAN, not "anywhere" ``` ## Systemd units @@ -93,8 +109,8 @@ sudo ufw allow "MeshBay Cast" | File | Location | |---|---| | `systemd/meshbay-hub.service` | `/usr/lib/systemd/system/meshbay-hub.service` | -| `systemd/meshbay-node@.service` | `/usr/lib/systemd/system/meshbay-node@.service` | -| `systemd/meshbay-node.service` (user) | `/usr/lib/systemd/user/meshbay-node.service` | +| `systemd/meshbay-node.service` | `/usr/lib/systemd/system/meshbay-node@.service` | +| `systemd/meshbay-node-user.service` | `/usr/lib/systemd/user/meshbay-node.service` | The node user service is enabled by the person themselves: |