punktfunk

Version	2026.242.1705
Repo	box/github.com/opencharly/layer-punktfunk:v2026.242.1658

Punktfunk streaming host — the punktfunk/1 QUIC host daemon, its browser console and its plugin runner, installed from unom’s signed pacman repository on Arch and CachyOS. Lands three packages (punktfunk-host, punktfunk-web, punktfunk-scripting), the [punktfunk] repo stanza with its locally-signed release key, and a host.env policy file that pins the wlroots compositor backend, the virtual video source and the software encoder so the host runs on a headless seat with no GPU.

Two service forms ship side by side because punktfunk is a systemd USER service upstream: the packaged punktfunk-host / punktfunk-web / punktfunk-scripting units are enabled on a systemd venue, while a container venue runs the host through a charly-owned wrapper that waits for sway’s IPC socket first — the virtual output is created against sway’s wlroots output management (through the portal, see below), so without SWAYSOCK there is no display to capture.

The capture path — sway is necessary but not sufficient

A compositor alone does not get frames out. A session resolves to capture: Portal, so the host asks xdg-desktop-portal’s ScreenCast interface to create the virtual output and then receives frames over PipeWire; the wlroots backend drives sway underneath. A venue therefore needs layer-xdg-portal and pod-pipewire alongside a compositor, and this candy does not pull them in — compose them in the image.

This is worth stating because the failure is silent in a misleading way. With no portal the host installs, its units reach active, the management API answers, pairing succeeds and a codec is negotiated — every control-plane check passes — and then every session dies at pipeline build:

create virtual output: ScreenCast portal on HEADLESS-2 failed: A portal
frontend implementing `org.freedesktop.portal.ScreenCast` was not found

XDG_CURRENT_DESKTOP is load-bearing for that, and layer-xdg-portal sets it: the portal frontend picks its backend from that variable, and D-Bus activation supplies no environment of its own.

The management REST API answers on 47990 and the web console on 47992, both HTTPS with a self-signed certificate; the native QUIC control plane is UDP 9777. Probing and managing a running host is the punktfunk: check verb (/charly-check:punktfunk), which discovers the bearer token this candy’s install leaves at ~/.config/punktfunk/mgmt-token.

Services

• punktfunk-host
• punktfunk-web
• punktfunk-scripting
• punktfunk-host
• punktfunk-web
• punktfunk-scripting

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	create the user’s local bin directory
run	install the punktfunk-host launcher wrapper for the container venue
run	install the web-console launcher wrapper for the container venue
run	install the plugin-runner launcher wrapper for the container venue
run	create the punktfunk config directory
run	write the host.env policy file pinning the headless capture path
run	enable systemd user lingering so the packaged user units run without a login
run	join the deploying user to the input group for full controller support
check	the punktfunk host daemon binary is installed at /usr/bin/punktfunk-host
check	the punktfunk-host package is recorded in the package database
check	the punktfunk-web console package is recorded in the package database
check	the punktfunk-scripting plugin runner package is recorded in the package database
check	the host daemon reports its version without needing a compositor
check	the punktfunk release key is imported AND locally signed in the pacman keyring
check	the punktfunk repo stanza is present in pacman.conf
check	the host.env policy file pins the software encoder and virtual source
check	the container-venue launcher wrapper is installed and executable where it is the launch path
check	the punktfunk host user unit is enabled on a systemd venue
check	the web console answers inside the venue, so the advertised port is not a promise the venue breaks
check	the management API answers inside the venue, which proves the host actually reached serve