Allow PS5 Payload Manager catalog DNS

README.md

@@ -33,14 +33,21 @@ The maintained LAN deployment runs on `net-utils01` from
 | User Guide gateway | `192.168.20.30:80` and `:443` TCP | Redirect to the local Relapse page |
 
 Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`.
-The DNS gateway resolves `manuals.playstation.net` locally, forwards only
-`homebrew.page`, `github.com`, and `release-assets.githubusercontent.com` to its
-configured upstream resolver, and returns NXDOMAIN for other names.
+The DNS gateway resolves `manuals.playstation.net` locally and forwards only
+`homebrew.page`, `itsplk.github.io`, `github.com`, and
+`release-assets.githubusercontent.com` to its configured upstream resolver. These
+names cover the homebrew store and the official PS5 Payload Manager catalog and
+downloads; every other name receives NXDOMAIN.
 
 The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on
-`192.168.20.30`. For the homebrew store it also needs WAN egress on TCP 443 to the
-three allowlisted domains; no WAN ingress rule is required. The server needs DNS
-egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default).
+`192.168.20.30`. For the homebrew store and Payload Manager it also needs WAN egress
+on TCP 443 to the four allowlisted domains; no WAN ingress rule is required. The
+server needs DNS egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by
+default).
+
+The Payload Manager supports arbitrary custom repository URLs. Those hosts are not
+allowed automatically: review the repository JSON, payload URLs, checksums, and
+redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`.
 
 To deploy a reviewed commit:
 

compose.yaml

@@ -20,7 +20,7 @@ services:
     environment:
       GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}"
       REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}"
-      FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,github.com,release-assets.githubusercontent.com}"
+      FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com}"
       UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}"
     ports:
       - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp"

docker/guide_gateway.py

@@ -20,7 +20,7 @@ FORWARDED_DOMAINS = frozenset(
     name.strip().lower()
     for name in os.environ.get(
         "FORWARDED_DOMAINS",
-        "homebrew.page,github.com,release-assets.githubusercontent.com",
+        "homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com",
     ).split(",")
     if name.strip()
 )

docs/HANDOFF.md

@@ -70,10 +70,11 @@ kadinho <[email protected]>
 
 The same Compose project also runs `ps5-guide-gateway`, bound specifically to
 `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
-`manuals.playstation.net` locally and forwards only `homebrew.page`, `github.com`
-and `release-assets.githubusercontent.com` to the configured upstream resolver
-(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway
-redirects the User Guide to `http://192.168.20.30:8000/`.
+`manuals.playstation.net` locally and forwards only `homebrew.page`,
+`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com` to the
+configured upstream resolver (`1.1.1.1` by default). Every other name receives
+NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
+`http://192.168.20.30:8000/`.
 
 Port `8080` on the host is already used by `unifi-network-application`; do not move
 this service there. At the last verification, the Relapse container was healthy,
@@ -178,11 +179,19 @@ primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the consol
 accept the self-signed certificate warning in the User Guide.
 
 The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
-`github.com` and `release-assets.githubusercontent.com`. Only those names and
-`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
-the homebrew store catalog and HTTPS release downloads while continuing to block
-PSN and update resolution. The PS5 sends DNS only to `net-utils01`; that host must
-be allowed to reach the configured upstream resolver on UDP/TCP 53.
+`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com`. Only
+those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN.
+This permits the homebrew store and the official PS5 Payload Manager catalog and
+HTTPS release downloads while continuing to block PSN and update resolution. The
+PS5 sends DNS only to `net-utils01`; that host must be allowed to reach the
+configured upstream resolver on UDP/TCP 53.
+
+The Payload Manager review used upstream commit
+`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
+2026-10-07. Its fixed catalog URL uses `itsplk.github.io`; all 25 catalog download
+URLs used `github.com`, with observed redirects only to
+`release-assets.githubusercontent.com`. Custom repositories are intentionally not
+covered because their catalog and payload URLs are user-controlled.
 The PS5 was previously identified as `192.168.10.26`; requests from
 `192.168.10.6` seen at that time were from a different client. Those addresses
 are historical and must not be used as the current payload destination.

docs/PS5_SETUP.md

@@ -137,9 +137,10 @@ O Compose inclui um DNS controlado no `net-utils01` que:
 
 - bloqueie domínios PlayStation/PSN e servidores de atualização;
 - responda `manuals.playstation.net` com `192.168.20.30`;
-- encaminhe apenas `homebrew.page`, `github.com` e
+- encaminhe apenas `homebrew.page`, `itsplk.github.io`, `github.com` e
   `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo
-  o catálogo, ícones e downloads HTTPS do homebrew store;
+  o catálogo, ícones e downloads HTTPS do homebrew store e o catálogo oficial do
+  PS5 Payload Manager;
 - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
   telemetria bloqueados por DNS;
 - registe as consultas nos logs do container;
@@ -169,11 +170,18 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
 resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
 `192.168.20.30`; não deve consultar diretamente um DNS público.
 
-O acesso WAN da consola pode ficar limitado a TCP `443` para os três domínios
+O acesso WAN da consola pode ficar limitado a TCP `443` para os quatro domínios
 permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar
 os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será
 bloqueado até esse destino ser revisto e acrescentado explicitamente.
 
+O catálogo oficial do PS5 Payload Manager está em
+`https://itsplk.github.io/ps5-payloads-mirror/payloads.json`. No snapshot revisto em
+2026-10-07, todos os URLs de payload começavam em `github.com` e redirecionavam para
+`release-assets.githubusercontent.com`. Repositórios personalizados podem apontar
+para qualquer host e permanecem bloqueados até os seus JSON, payloads, hashes e
+redirects serem revistos e o hostname exato ser acrescentado conscientemente.
+
 ## Abrir pelo Guia do Utilizador
 
 Com um DNS que redirecione o manual: