fixes

README.md

@@ -93,3 +93,19 @@ The OPNsense page **Services -> RustProxy** exposes the runtime listeners used b
 - Allow remote admin: on by default so the RustProxy panel can be reached from other hosts; OPNsense firewall rules still decide which networks can connect
 
 The service runs as the unprivileged `rustproxy` user and keeps `/var/db/rustproxy` mode `0700`, as required by RustProxy. Package installation restarts `configd` so `configctl rustproxy ...` actions are immediately available even after direct `pkg add`.
+
+## FreeBSD/OPNsense-only RustProxy patches
+
+Version-specific application patches live under `builder/freebsd/patches/<RustProxy-version>/`.
+They are **not** applied to `/opt/opn-rustproxy/source/RustProxy` and are never pushed back to the RustProxy repository.
+`builder/debian/build-docker-release.sh` creates an isolated source copy under `dist/.build-source/`, runs `builder/freebsd/apply-patches.sh` there, and mounts only that patched copy into the Docker build container.
+
+For RustProxy `0.20.0` the patch set is:
+
+`builder/freebsd/patches/0.20.0/0001-opnsense-build.patch`
+
+Set `APPLY_FREEBSD_PATCHES=0` in `/etc/rustproxy-opnsense-builder.env` only when you explicitly want to test the unpatched upstream source.
+
+### Runtime PID directory
+
+The OPNsense rc.d service creates `/var/run/rustproxy` as `rustproxy:rustproxy` (0750) on every start. Both supervisor and child PID files live there so `daemon -u rustproxy` can run without root-owned PID-file errors.