# PufferPanel rules

These rules apply to PufferPanel deployment and related files outside this directory.

- Run one combined panel/daemon under dedicated rootless `pufferpanel` user.
- Do not reuse Fedora's existing system `games` account or another service user's Podman socket/storage.
- Use `registry.bugabinga.net/pufferpanel:latest` with Quadlet registry auto-update and the service user's native update timer.
- Socket access grants full control of the dedicated user's runtime; it is not a per-container sandbox.
- Keep panel HTTP bound to host loopback, behind existing Caddy HTTPS ingress.
- Keep public self-registration enabled with login-only accounts, secure cookies enabled, and SFTP unexposed.
- Preserve persistent config, database, server files, and backups across deployments and updates.
- Game port exposure, reviewed templates, friend accounts, and encrypted R2 backups require separate configuration; do not claim them complete.
- Never apply infrastructure without approval of the reviewed saved plan.
- Validate shell scripts, rendered Quadlet, Caddy route, and OpenTofu plan before deployment.
- Verify live health, HTTPS, rootless socket ownership, and update timer after deployment.