n/essentialsoftware.md: note systemd socket.BindIPv6Only behaviour and firewalld configuration

n/essentialsoftware.md

@@ -52,6 +52,7 @@ _{{ page.excerpt }}_
   - [`/etc/xdg/autostart`](#etcxdgautostart)
   - [`aminda-*.{service,socket}`](#aminda-servicesocket)
   - [systemd sockets](#systemd-sockets)
+    - [firewalld for systemd sockets](#firewalld-for-systemd-sockets)
 - [Remember!](#remember)
   - [Accessing UEFI setup without key smashing](#accessing-uefi-setup-without-key-smashing)
   - [Recovering selinux policy issues](#recovering-selinux-policy-issues)
@@ -190,7 +191,7 @@ bit...
 # Ensure third party Fedora repos are available, this is part of KDE Prompt?
 sudo fedora-third-party enable
 # Layer packages I need on top of the base image.
-sudo rpm-ostree install android-tools cronie cronie-anacron darkman duperemove foot foot-terminfo gamescope git-lfs haveged iwd mangohud mosh mpv rng-tools setroubleshoot snapd sshguard steam-devices syncthing terminus-fonts-console tmux tor torsocks unbound zsh
+sudo rpm-ostree install android-tools cronie cronie-anacron darkman duperemove foot foot-terminfo gamescope git-lfs haveged iwd mangohud mosh mpv oidentd rng-tools setroubleshoot snapd sshguard steam-devices syncthing terminus-fonts-console tmux tor torsocks unbound zsh
 # Remove packages I don't need from the base image. (Challenge to remove
 # nothing failed by using rpmfusion codecs anyway)
 sudo rpm-ostree override remove firefox firefox-langpacks
@@ -565,6 +566,25 @@ sudo systemctl --global enable foot-server.socket
 sudo systemctl enable --now ssh.socket sshd.socket avahi-daemon.socket systemd-oomd.socket oidentd.socket
 ```
 
+Remember that systemd sockets are silly and listen only to `::` by default and
+since system administrators not-so-uncommonly set that to only mean IPv6 in
+order to avoid dotted-decimals, it may be desirable to have a
+`/etc/systemd/system/socket.d/dualstack-bind.conf` with
+
+```ini
+[Socket]
+BindIPv6Only=both
+```
+
+#### firewalld for systemd sockets
+
+```bash
+sudo firewall-cmd --add-service=ssh --permanent && sudo firewall-cmd --add-service=ssh --permanent --zone=home
+sudo firewall-cmd --add-service=ident --permanent && sudo firewall-cmd --add-service=ident --permanent --zone=home
+sudo firewall-cmd --add-service=mdns --permanent && sudo firewall-cmd --add-service=mdns --permanent --zone=home
+sudo firewall-cmd --reload
+```
+
 ## Remember!
 
 Not quite configuration, but I am not going to start inventing a new place for