fixes

scripts/check.sh

@@ -51,9 +51,33 @@ grep -q 'PACKAGING_WORKDIR=/opt/opn-rustproxy/packaging' "$ROOT/builder.env.exam
 [[ -f "$ROOT/builder/freebsd/patches/0.20.0/0001-opnsense-build.patch" ]]
 grep -q 'APPLY_FREEBSD_PATCHES=1' "$ROOT/builder.env.example"
 grep -q 'builder/freebsd/apply-patches.sh' "$ROOT/builder/debian/build-docker-release.sh"
-grep -q 'rustproxy_run_dir:="/var/run/rustproxy"' "$ROOT/opnsense-plugin/www/rustproxy/src/etc/rc.d/rustproxy"
-grep -q 'pidfile="${rustproxy_run_dir}/daemon.pid"' "$ROOT/opnsense-plugin/www/rustproxy/src/etc/rc.d/rustproxy"
-grep -q 'child_pidfile="${rustproxy_run_dir}/rustproxy.pid"' "$ROOT/opnsense-plugin/www/rustproxy/src/etc/rc.d/rustproxy"
-grep -q '/var/run/rustproxy' "$ROOT/opnsense-plugin/www/rustproxy/+POST_INSTALL.pre"
+
+rc_script="$ROOT/opnsense-plugin/www/rustproxy/src/etc/rc.d/rustproxy"
+model="$ROOT/opnsense-plugin/www/rustproxy/src/opnsense/mvc/app/models/OPNsense/RustProxy/RustProxy.xml"
+template="$ROOT/opnsense-plugin/www/rustproxy/src/opnsense/service/templates/OPNsense/RustProxy/rustproxy.conf"
+post_install="$ROOT/opnsense-plugin/www/rustproxy/+POST_INSTALL.pre"
+
+grep -q 'rustproxy_run_dir:="/var/run/rustproxy"' "$rc_script"
+grep -q 'rustproxy_user:="root"' "$rc_script"
+grep -q 'rustproxy_group:="wheel"' "$rc_script"
+grep -q 'rustproxy_resolve_listener' "$rc_script"
+grep -q 'rustproxy_valid_port' "$rc_script"
+grep -q 'pidfile="${rustproxy_run_dir}/daemon.pid"' "$rc_script"
+grep -q 'child_pidfile="${rustproxy_run_dir}/rustproxy.pid"' "$rc_script"
+grep -q '<proxyPort type="PortField">' "$model"
+grep -q '<tlsPort type="PortField">' "$model"
+grep -q '<adminPort type="PortField">' "$model"
+grep -q 'rustproxy_tls_port=' "$template"
+grep -q 'rustproxy_tls_listen_legacy=' "$template"
+grep -q 'root -g wheel' "$post_install"
+grep -q '/var/run/rustproxy' "$post_install"
+
+# The generated command must never contain a literal listener ending in a colon
+# from model defaults/templates.  rc.d rejects/falls back from malformed legacy
+# values before assembling runtime_args.
+if grep -R --exclude='*.md' --exclude='check.sh' -nE 'tls_listen.*0\.0\.0\.0:"|--tls-listen 0\.0\.0\.0:' "$ROOT/opnsense-plugin"; then
+    echo "Malformed empty-port TLS listener found in plugin source" >&2
+    exit 1
+fi
 
 echo "Repository checks passed."