From 7df4a40c7851f92ed4309d58df1eab227533e735 Mon Sep 17 00:00:00 2001 From: kadinho Date: Wed, 7 Oct 2026 21:27:27 +0100 Subject: [PATCH] Allow PS5 Payload Manager catalog DNS --- README.md | 19 +++++++++++++------ compose.yaml | 2 +- docker/guide_gateway.py | 2 +- docs/HANDOFF.md | 27 ++++++++++++++++++--------- docs/PS5_SETUP.md | 14 +++++++++++--- 5 files changed, 44 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 810e352..85c9594 100644 --- a/README.md +++ b/README.md @@ -33,14 +33,21 @@ The maintained LAN deployment runs on `net-utils01` from | User Guide gateway | `192.168.20.30:80` and `:443` TCP | Redirect to the local Relapse page | Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`. -The DNS gateway resolves `manuals.playstation.net` locally, forwards only -`homebrew.page`, `github.com`, and `release-assets.githubusercontent.com` to its -configured upstream resolver, and returns NXDOMAIN for other names. +The DNS gateway resolves `manuals.playstation.net` locally and forwards only +`homebrew.page`, `itsplk.github.io`, `github.com`, and +`release-assets.githubusercontent.com` to its configured upstream resolver. These +names cover the homebrew store and the official PS5 Payload Manager catalog and +downloads; every other name receives NXDOMAIN. The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on -`192.168.20.30`. For the homebrew store it also needs WAN egress on TCP 443 to the -three allowlisted domains; no WAN ingress rule is required. The server needs DNS -egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default). +`192.168.20.30`. For the homebrew store and Payload Manager it also needs WAN egress +on TCP 443 to the four allowlisted domains; no WAN ingress rule is required. The +server needs DNS egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by +default). + +The Payload Manager supports arbitrary custom repository URLs. Those hosts are not +allowed automatically: review the repository JSON, payload URLs, checksums, and +redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`. To deploy a reviewed commit: diff --git a/compose.yaml b/compose.yaml index b326bfd..2fefd69 100644 --- a/compose.yaml +++ b/compose.yaml @@ -20,7 +20,7 @@ services: environment: GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}" REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}" - FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,github.com,release-assets.githubusercontent.com}" + FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com}" UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}" ports: - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp" diff --git a/docker/guide_gateway.py b/docker/guide_gateway.py index 07a0882..9b74fbb 100644 --- a/docker/guide_gateway.py +++ b/docker/guide_gateway.py @@ -20,7 +20,7 @@ FORWARDED_DOMAINS = frozenset( name.strip().lower() for name in os.environ.get( "FORWARDED_DOMAINS", - "homebrew.page,github.com,release-assets.githubusercontent.com", + "homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com", ).split(",") if name.strip() ) diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index e2cf215..5c055c3 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -70,10 +70,11 @@ kadinho The same Compose project also runs `ps5-guide-gateway`, bound specifically to `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves -`manuals.playstation.net` locally and forwards only `homebrew.page`, `github.com` -and `release-assets.githubusercontent.com` to the configured upstream resolver -(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway -redirects the User Guide to `http://192.168.20.30:8000/`. +`manuals.playstation.net` locally and forwards only `homebrew.page`, +`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com` to the +configured upstream resolver (`1.1.1.1` by default). Every other name receives +NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to +`http://192.168.20.30:8000/`. Port `8080` on the host is already used by `unifi-network-application`; do not move this service there. At the last verification, the Relapse container was healthy, @@ -178,11 +179,19 @@ primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the consol accept the self-signed certificate warning in the User Guide. The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`, -`github.com` and `release-assets.githubusercontent.com`. Only those names and -`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits -the homebrew store catalog and HTTPS release downloads while continuing to block -PSN and update resolution. The PS5 sends DNS only to `net-utils01`; that host must -be allowed to reach the configured upstream resolver on UDP/TCP 53. +`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com`. Only +those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN. +This permits the homebrew store and the official PS5 Payload Manager catalog and +HTTPS release downloads while continuing to block PSN and update resolution. The +PS5 sends DNS only to `net-utils01`; that host must be allowed to reach the +configured upstream resolver on UDP/TCP 53. + +The Payload Manager review used upstream commit +`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on +2026-10-07. Its fixed catalog URL uses `itsplk.github.io`; all 25 catalog download +URLs used `github.com`, with observed redirects only to +`release-assets.githubusercontent.com`. Custom repositories are intentionally not +covered because their catalog and payload URLs are user-controlled. The PS5 was previously identified as `192.168.10.26`; requests from `192.168.10.6` seen at that time were from a different client. Those addresses are historical and must not be used as the current payload destination. diff --git a/docs/PS5_SETUP.md b/docs/PS5_SETUP.md index 8b75307..74fb41d 100644 --- a/docs/PS5_SETUP.md +++ b/docs/PS5_SETUP.md @@ -137,9 +137,10 @@ O Compose inclui um DNS controlado no `net-utils01` que: - bloqueie domínios PlayStation/PSN e servidores de atualização; - responda `manuals.playstation.net` com `192.168.20.30`; -- encaminhe apenas `homebrew.page`, `github.com` e +- encaminhe apenas `homebrew.page`, `itsplk.github.io`, `github.com` e `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo - o catálogo, ícones e downloads HTTPS do homebrew store; + o catálogo, ícones e downloads HTTPS do homebrew store e o catálogo oficial do + PS5 Payload Manager; - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e telemetria bloqueados por DNS; - registe as consultas nos logs do container; @@ -169,11 +170,18 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para `192.168.20.30`; não deve consultar diretamente um DNS público. -O acesso WAN da consola pode ficar limitado a TCP `443` para os três domínios +O acesso WAN da consola pode ficar limitado a TCP `443` para os quatro domínios permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será bloqueado até esse destino ser revisto e acrescentado explicitamente. +O catálogo oficial do PS5 Payload Manager está em +`https://itsplk.github.io/ps5-payloads-mirror/payloads.json`. No snapshot revisto em +2026-10-07, todos os URLs de payload começavam em `github.com` e redirecionavam para +`release-assets.githubusercontent.com`. Repositórios personalizados podem apontar +para qualquer host e permanecem bloqueados até os seus JSON, payloads, hashes e +redirects serem revistos e o hostname exato ser acrescentado conscientemente. + ## Abrir pelo Guia do Utilizador Com um DNS que redirecione o manual: