Keep public self-registration enabled with login-only accounts, secure cookies enabled, and SFTP unexposed.
Preserve persistent config, database, server files, and backups across deployments and updates.
Game port exposure, reviewed templates, friend accounts, and encrypted R2 backups require separate configuration; do not claim them complete.
Never apply infrastructure without approval of the reviewed saved plan.
Validate shell scripts, rendered Quadlet, Caddy route, and OpenTofu plan before deployment.
Verify live health, HTTPS, rootless socket ownership, and update timer after deployment.
# PufferPanel rules
These rules apply to PufferPanel deployment and related files outside this directory.
- Run one combined panel/daemon under dedicated rootless `pufferpanel` user.
- Do not reuse Fedora's existing system `games` account or another service user's Podman socket/storage.
- Use `registry.bugabinga.net/pufferpanel:latest` with Quadlet registry auto-update and the service user's native update timer.
- Socket access grants full control of the dedicated user's runtime; it is not a per-container sandbox.
- Keep panel HTTP bound to host loopback, behind existing Caddy HTTPS ingress.
- Keep public self-registration enabled with login-only accounts, secure cookies enabled, and SFTP unexposed.
- Preserve persistent config, database, server files, and backups across deployments and updates.
- Game port exposure, reviewed templates, friend accounts, and encrypted R2 backups require separate configuration; do not claim them complete.
- Never apply infrastructure without approval of the reviewed saved plan.
- Validate shell scripts, rendered Quadlet, Caddy route, and OpenTofu plan before deployment.
- Verify live health, HTTPS, rootless socket ownership, and update timer after deployment.