A community pkg repo for 2.8.x "outside" packages (+ one-page manager GUI)

[TMiland]

Hi all — I maintain a small community project that answers a question that comes up regularly here: tmiland-lab/pfsense-community-packages (https://github.com/tmiland-lab/pfsense-community-packages), a unified signed pkg(8) repository for pfSense CE 2.8.x that keeps the packages Netgate dropped (or never hosted) installable — and, importantly, resolvable at boot.

The motivation: when a package disappears from the official repo, pfSense's boot package resync silently removes it from firewalls ("Package X does not exist in current pfSense version..."). That's what bit RESTAPI and DNSCrypt users on 2.8. With this repo enabled, those installs survive resyncs.

Currently offered (14): RESTAPI, saml2-auth, dnscrypt-proxy, WireGuard Easy, WireGuard peer export, Mullvad server picker, plus first-party packages (AdGuard Home manager, AbuseIPDB watcher, config backup, OpenVPN TOTP, AirVPN remotes, VPN providers, light/dark theme) and a one-page manager: pfSense-pkg-community (System → Community Packages) that lists community and official add-ons with inline install/upgrade/delete.

On the "custom repos are risky" concern — fair, so the design is conservative:

• repo metadata is signed; the firewall verifies against a published pubkey (same PUBKEY mechanism as the official repos)
• every mirrored package is a pinned upstream release asset, sha256-verified at every build — provenance (URL, version, license, hash) in packages/mirrors.json (https://github.com/tmiland-lab/pfsense-community-packages/blob/main/packages/mirrors.json), builds fail hard on mismatch
• builds run an ABI guard and an osreldate guard — e.g. I had to exclude a well-known security package recently because its pkgs were built on a newer FreeBSD userland than 2.8.1's, which would make pkg reject the repo outright
• upstream licenses are respected, and all mirrored authors have been notified and can opt out

Image:

Install:

cat > /usr/local/etc/pkg/repos/community.conf <<'EOF'
community: {
    url: "https://tmiland-lab.github.io/pfsense-community-packages/repo",
    mirror_type: "NONE",
    signature_type: "PUBKEY",
    pubkey: "/usr/local/etc/pkg/community.pub",
    enabled: yes
}
EOF

fetch -o /usr/local/etc/pkg/community.pub \
  https://tmiland-lab.github.io/pfsense-community-packages/community.pub
pkg update -r community
pkg install -y -r community pfSense-pkg-community

It's third-party software — review before you use it, standard disclaimer applies. Feedback (and candidates worth mirroring) very welcome: issue tracker (https://github.com/tmiland-lab/pfsense-community-packages/issues).

(Drafted with the opencode AI agent; maintained by tmiland-lab.)