From b486a43985a96eba20fc31589310b391317d9e5d Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Fri, 15 May 2026 16:24:19 +0200
Subject: [PATCH] Add sunshine service installation

---
 bin/omarchy-install-service-sunshine | 61 ++++++++++++++++++++++++++++
 bin/omarchy-menu                     |  3 +-
 bin/omarchy-remove-service-sunshine  | 58 ++++++++++++++++++++++++++
 3 files changed, 121 insertions(+), 1 deletion(-)
 create mode 100755 bin/omarchy-install-service-sunshine
 create mode 100755 bin/omarchy-remove-service-sunshine

diff --git a/bin/omarchy-install-service-sunshine b/bin/omarchy-install-service-sunshine
new file mode 100755
index 00000000..3ffa9b96
--- /dev/null
+++ b/bin/omarchy-install-service-sunshine
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+# omarchy:summary=Install Sunshine and open Moonlight streaming ports for LAN and Tailscale.
+# omarchy:requires-sudo=true
+
+set -e
+
+TCP_PORTS=(47984 47989 48010)
+UDP_PORTS=(5353 47998 47999 48000 48002 48010)
+PRIVATE_CIDRS=(10.0.0.0/8 172.16.0.0/12 192.168.0.0/16)
+UFW_COMMENT="omarchy-sunshine"
+
+open_ufw_port_for_private_lans() {
+  local proto="$1"
+  local port="$2"
+  local cidr
+
+  for cidr in "${PRIVATE_CIDRS[@]}"; do
+    sudo ufw allow in proto "$proto" from "$cidr" to any port "$port" comment "$UFW_COMMENT"
+  done
+}
+
+open_ufw_port_for_tailscale() {
+  local proto="$1"
+  local port="$2"
+
+  if ip link show tailscale0 >/dev/null 2>&1; then
+    sudo ufw allow in on tailscale0 to any port "$port" proto "$proto" comment "$UFW_COMMENT"
+  fi
+}
+
+open_ufw_ports() {
+  local port
+
+  if omarchy-cmd-missing ufw; then
+    echo "UFW is not installed; skipping Sunshine firewall rules."
+    return
+  fi
+
+  for port in "${TCP_PORTS[@]}"; do
+    open_ufw_port_for_private_lans tcp "$port"
+    open_ufw_port_for_tailscale tcp "$port"
+  done
+
+  for port in "${UDP_PORTS[@]}"; do
+    open_ufw_port_for_private_lans udp "$port"
+    open_ufw_port_for_tailscale udp "$port"
+  done
+
+  sudo ufw reload
+}
+
+echo "Installing Sunshine..."
+omarchy-pkg-add sunshine
+systemctl --user enable --now sunshine
+
+echo "Opening Sunshine firewall ports..."
+open_ufw_ports
+
+echo ""
+echo "Sunshine has been installed and its Moonlight streaming ports are open for private LANs and Tailscale."
diff --git a/bin/omarchy-menu b/bin/omarchy-menu
index 6f372be2..8627ab13 100755
--- a/bin/omarchy-menu
+++ b/bin/omarchy-menu
@@ -557,11 +557,12 @@ show_install_browser_menu() {
 }
 
 show_install_service_menu() {
-  case $(menu "Install" "  Dropbox\n  Tailscale\n󱇱  NordVPN [AUR]\n󰏖  ONCE\n󰟵  Bitwarden\n  Chromium Account") in
+  case $(menu "Install" "  Dropbox\n  Tailscale\n󱇱  NordVPN [AUR]\n󰏖  ONCE\n☀  Sunshine\n󰟵  Bitwarden\n  Chromium Account") in
   *Dropbox*) present_terminal omarchy-install-dropbox ;;
   *Tailscale*) present_terminal omarchy-install-tailscale ;;
   *NordVPN*) present_terminal omarchy-install-nordvpn ;;
   *ONCE*) present_terminal omarchy-install-once ;;
+  *Sunshine*) present_terminal omarchy-install-service-sunshine ;;
   *Bitwarden*) install_and_launch "Bitwarden" "bitwarden bitwarden-cli" "bitwarden" ;;
   *Chromium*) present_terminal omarchy-install-chromium-google-account ;;
   *) show_install_menu ;;
diff --git a/bin/omarchy-remove-service-sunshine b/bin/omarchy-remove-service-sunshine
new file mode 100755
index 00000000..d98d49c3
--- /dev/null
+++ b/bin/omarchy-remove-service-sunshine
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# omarchy:summary=Remove Sunshine and close Omarchy-managed Moonlight streaming ports.
+# omarchy:requires-sudo=true
+
+set -e
+
+TCP_PORTS=(47984 47989 48010)
+UDP_PORTS=(5353 47998 47999 48000 48002 48010)
+PRIVATE_CIDRS=(10.0.0.0/8 172.16.0.0/12 192.168.0.0/16)
+
+delete_ufw_rule() {
+  sudo ufw --force delete "$@" 2>/dev/null || true
+}
+
+close_ufw_port_for_private_lans() {
+  local proto="$1"
+  local port="$2"
+  local cidr
+
+  for cidr in "${PRIVATE_CIDRS[@]}"; do
+    delete_ufw_rule allow in proto "$proto" from "$cidr" to any port "$port"
+  done
+}
+
+close_ufw_port_for_tailscale() {
+  local proto="$1"
+  local port="$2"
+
+  delete_ufw_rule allow in on tailscale0 to any port "$port" proto "$proto"
+}
+
+close_ufw_ports() {
+  local port
+
+  if omarchy-cmd-missing ufw; then
+    return
+  fi
+
+  for port in "${TCP_PORTS[@]}"; do
+    close_ufw_port_for_private_lans tcp "$port"
+    close_ufw_port_for_tailscale tcp "$port"
+  done
+
+  for port in "${UDP_PORTS[@]}"; do
+    close_ufw_port_for_private_lans udp "$port"
+    close_ufw_port_for_tailscale udp "$port"
+  done
+
+  sudo ufw reload
+}
+
+systemctl --user disable --now sunshine 2>/dev/null || true
+omarchy-pkg-drop sunshine
+close_ufw_ports
+
+echo ""
+echo "Sunshine has been removed and its Omarchy-managed Moonlight streaming ports have been closed."