fixes

docs/FIRST_RUN.md

@@ -87,6 +87,8 @@ file dist/docker-build/rust-proxy
 zstd -dc dist/os-rustproxy-latest.pkg | tar -tf - | head -50
 ```
 
+The package payload should contain files such as `/usr/local/sbin/rust-proxy` and must not contain directory entries such as `/usr/` or `/usr/local/`. The build fails automatically when payload paths differ from `+MANIFEST`.
+
 The binary should identify as an x86-64 FreeBSD ELF executable, not a Linux executable.
 
 ## 7. Install on a test OPNsense
@@ -136,3 +138,19 @@ AUTO_DEPLOY_SSH_KEY=/root/.ssh/opnsense_test
 ```
 
 Leave both empty for manual deployment.
+
+## OPNsense runtime settings
+
+After installation open **Services -> RustProxy**. Defaults are:
+
+- HTTP listen: `0.0.0.0:8080`
+- HTTPS/TLS enabled: yes
+- HTTPS/TLS listen: `0.0.0.0:8181`
+- Admin listen: `127.0.0.1:9090`
+- Allow remote admin: no
+
+If you want the RustProxy administration UI reachable from another host, set the admin listener to an address such as `0.0.0.0:9090` and enable **Allow remote admin**. Apply restarts/reloads the service with the corresponding RustProxy CLI flags.
+
+Direct `pkg add` is supported: the package post-install script restarts OPNsense `configd`, flushes the plugin cache and renders `/usr/local/etc/rustproxy/opnsense.conf` so `configctl rustproxy status/start/stop` is available immediately.
+
+RustProxy requires its data directory to be private. The plugin enforces owner `rustproxy:rustproxy` and mode `0700` on `/var/db/rustproxy` before every start.