fixes

README.md

@@ -69,9 +69,11 @@ dist/
 
 This version intentionally produces an installable `.pkg`, not a full `pkg repo` catalogue. Installation/update is currently done with `pkg add -f`.
 
+The Linux-side package builder validates the FreeBSD package payload before publishing it: payload paths must be absolute (`/usr/local/...`), no undeclared directory entries are archived, and every payload file must have an identical entry in `+MANIFEST`.
+
 ## OPNsense UI
 
-The first version exposes only **Services -> RustProxy -> Enabled**. RustProxy runs as the unprivileged `rustproxy` user.
+The OPNsense page **Services -> RustProxy** exposes enable/disable plus HTTP, HTTPS/TLS and administration listener settings. RustProxy runs as the unprivileged `rustproxy` user.
 
 ## Validation
 
@@ -80,3 +82,14 @@ The first version exposes only **Services -> RustProxy -> Enabled**. RustProxy r
 ```
 
 See `docs/FIRST_RUN.md` for Debian setup.
+
+## OPNsense listener settings
+
+The OPNsense page **Services -> RustProxy** exposes the runtime listeners used by the rc.d service:
+
+- HTTP listen: `0.0.0.0:8080`
+- HTTPS/TLS listen: `0.0.0.0:8181` (toggleable)
+- Admin listen: `127.0.0.1:9090`
+- Allow remote admin: off by default; enable it when binding admin to a non-loopback address such as `0.0.0.0:9090`
+
+The service runs as the unprivileged `rustproxy` user and keeps `/var/db/rustproxy` mode `0700`, as required by RustProxy. Package installation restarts `configd` so `configctl rustproxy ...` actions are immediately available even after direct `pkg add`.