5 files changed, 8 insertions, 21 deletions
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh
index d8a5af4..9ad4968 100755
--- a/packaging/build/build-node.sh
+++ b/packaging/build/build-node.sh
@@ -75,13 +75,10 @@ cp "$REPO/packaging/systemd/meshbay-node.service" \
 cp "$REPO/packaging/systemd/meshbay-node-user.service" \
    "$ROOT/usr/lib/systemd/user/meshbay-node.service"
 
-# --- Firewall profiles ----------------------------------------------------
-# firewalld (Fedora)
-mkdir -p "$ROOT/usr/lib/firewalld/services"
-cp "$REPO/packaging/firewall/firewalld/meshbay-node.xml" \
-   "$ROOT/usr/lib/firewalld/services/"
-
-# UFW (Ubuntu/Debian)
+# --- Firewall profile ---------------------------------------------------------
+# UFW (Ubuntu/Debian) — carries the "MeshBay Cast" LAN-casting profile only.
+# The node's own admin surface is a loopback API (127.0.0.1, token-gated) and
+# is never firewall-exposed, so it ships no profile.
 mkdir -p "$ROOT/etc/ufw/applications.d"
 cp "$REPO/packaging/firewall/ufw/meshbay" \
    "$ROOT/etc/ufw/applications.d/"
diff --git a/packaging/deb/meshbay-node/DEBIAN/control b/packaging/deb/meshbay-node/DEBIAN/control
index 0c9d73d..76b2005 100644
--- a/packaging/deb/meshbay-node/DEBIAN/control
+++ b/packaging/deb/meshbay-node/DEBIAN/control
@@ -10,7 +10,8 @@ Recommends: ffmpeg
 Description: MeshBay Node — local file host, streaming server, and group daemon
  MeshBay Node indexes local directories and serves encrypted files to
  authenticated group members over WebRTC. Includes video streaming (fMP4
- remux via ffmpeg), group chat, and a local admin UI on localhost:18000.
+ remux via ffmpeg), group chat, and a token-gated loopback control API
+ on 127.0.0.1:18000 for the CLI and the desktop client.
  .
  Installs node code into the shared venv at /opt/meshbay-common/venv/.
  Ships a default TMDB API token for the Videos app.
diff --git a/packaging/firewall/firewalld/meshbay-node.xml b/packaging/firewall/firewalld/meshbay-node.xml
deleted file mode 100644
index 3443b54..0000000
--- a/packaging/firewall/firewalld/meshbay-node.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<service>
-  <short>MeshBay Node</short>
-  <description>MeshBay Node local administration interface (localhost only by default).</description>
-  <port protocol="tcp" port="18000"/>
-</service>
diff --git a/packaging/firewall/ufw/meshbay b/packaging/firewall/ufw/meshbay
index 5a610a5..732e5d8 100644
--- a/packaging/firewall/ufw/meshbay
+++ b/packaging/firewall/ufw/meshbay
@@ -2,8 +2,3 @@
 title=MeshBay Chromecast relay
 description=HTTP relay for casting decrypted video to LAN devices
 ports=19550:19553/tcp|5353/udp
-
-[MeshBay Node]
-title=MeshBay Node admin UI
-description=Local administration interface (localhost only by default)
-ports=18000/tcp
diff --git a/packaging/rpm/meshbay-node.spec b/packaging/rpm/meshbay-node.spec
index 20d69bc..2bebb26 100644
--- a/packaging/rpm/meshbay-node.spec
+++ b/packaging/rpm/meshbay-node.spec
@@ -14,7 +14,8 @@ Recommends:     ffmpeg
 %description
 MeshBay Node indexes local directories and serves encrypted files to
 authenticated group members over WebRTC. Includes video streaming (fMP4
-remux via ffmpeg), group chat, and a local admin UI on localhost:18000.
+remux via ffmpeg), group chat, and a token-gated loopback control API
+on 127.0.0.1:18000 for the CLI and the desktop client.
 
 Installs node code into the shared venv at /opt/meshbay-common/venv/.
 Ships a default TMDB API token for the Videos app.
@@ -41,7 +42,6 @@ fi
 /usr/bin/meshbay-node
 %{_unitdir}/meshbay-node@.service
 %{_userunitdir}/meshbay-node.service
-/usr/lib/firewalld/services/meshbay-node.xml
 /etc/ufw/applications.d/meshbay
 
 %changelog