From 5163d7a893d130d0d9cb7fde8b92c4f2aeed2a63 Mon Sep 17 00:00:00 2001 From: kadinho Date: Wed, 7 Oct 2026 17:26:32 +0100 Subject: [PATCH] Document live DNS deployment --- README.md | 41 +++++++++++++++++++++++++++++++++++++++-- docs/HANDOFF.md | 8 +++++++- 2 files changed, 46 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 79d2ece..810e352 100644 --- a/README.md +++ b/README.md @@ -5,8 +5,9 @@ The upstream project is pinned as a Git submodule, and the image build verifies SHA-256 digest of every executable payload before including it. The Compose stack also includes a local PS5 User Guide gateway: authoritative DNS -for `manuals.playstation.net`, HTTP/HTTPS redirect to the local exploit, and NXDOMAIN -for every other domain so the console cannot resolve PSN or update services. +for `manuals.playstation.net`, HTTP/HTTPS redirect to the local exploit, allowlisted +DNS forwarding for the homebrew store, and NXDOMAIN for every other domain so the +console cannot resolve PSN or update services. Use this only on consoles you own or are authorized to test. The exploit can panic the console, corrupt kernel state, expose administrative services, and execute @@ -20,6 +21,42 @@ Documentation: - [External payload candidate evidence](docs/payload-evidence/README.md) - [Repository instructions for coding agents](AGENTS.md) +## Current deployment + +The maintained LAN deployment runs on `net-utils01` from +`/opt/relapse-exploit-docker`: + +| Service | LAN endpoint | Purpose | +| --- | --- | --- | +| Relapse page | `http://192.168.20.30:8000/` | Exploit page and payload assets | +| Restricted DNS | `192.168.20.30:53` UDP/TCP | User Guide override and store allowlist | +| User Guide gateway | `192.168.20.30:80` and `:443` TCP | Redirect to the local Relapse page | + +Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`. +The DNS gateway resolves `manuals.playstation.net` locally, forwards only +`homebrew.page`, `github.com`, and `release-assets.githubusercontent.com` to its +configured upstream resolver, and returns NXDOMAIN for other names. + +The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on +`192.168.20.30`. For the homebrew store it also needs WAN egress on TCP 443 to the +three allowlisted domains; no WAN ingress rule is required. The server needs DNS +egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default). + +To deploy a reviewed commit: + +```sh +ssh net-utils01 +cd /opt/relapse-exploit-docker +git pull --ff-only +git submodule update --init --recursive +docker compose up -d --build +docker compose ps +curl -I http://127.0.0.1:8000/ +``` + +Both Compose services must report `healthy`. Runtime changes require the rebuild +above; documentation-only changes need only the fast-forward pull. + ## Clone and build ```sh diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index f39b2e2..e2cf215 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -1,6 +1,6 @@ # Maintainer and agent handoff -Last updated: 2026-10-02 +Last updated: 2026-10-07 This file is the durable handoff for future sessions. Start work from this repository rather than from the upstream Relapse Exploit checkout. @@ -80,6 +80,12 @@ this service there. At the last verification, the Relapse container was healthy, ran as `65532:65532`, used a read-only root filesystem, and returned HTTP 200 over the LAN. `/.git/config` returned 404. +On 2026-10-07, commit `fd5685c` was deployed with `docker compose up -d --build`. +Both services reported healthy after recreation. Live checks confirmed HTTP 200, +the expected JavaScript MIME type and security headers, HTTP/HTTPS redirects, UID/GID +`65532:65532`, read-only root filesystems, DNS forwarding for all three store names +over UDP and TCP, and NXDOMAIN for an unrelated PlayStation name. + No firewall management tool was detected on `net-utils01` during setup. ## Deployment authentication detail