initial

VPN_DEMO_GAPS_20260613.md

@@ -0,0 +1,76 @@
+# VPN / Remote Access demo — gap report (2026-06-13)
+
+<!-- doc-meta:start -->
+| Field | Value |
+|---|---|
+| Author | Anton Afanasyeu |
+| Revision | R1 |
+| Creation date | 2026-06-13 |
+| Last modification date | 2026-06-13 |
+| Co-authored |  |
+| Severity | medium |
+| State | blocked by DEV |
+| Document type | internal |
+<!-- doc-meta:end -->
+
+\newpage
+\newpage
+
+---
+
+
+See also [REMOTE_ACCESS_VALIDATION.md](../REMOTE_ACCESS_VALIDATION.md), [REMOTE_ACCESS_IMPL.md](../REMOTE_ACCESS_IMPL.md).
+
+
+---
+
+---
+
+
+---
+
+## Table of contents
+
+<!-- toc -->
+- [Fixed today (prod BE)](#fixed-today-prod-be)
+- [Fixed in repo (awaiting BE sync)](#fixed-in-repo-awaiting-be-sync)
+- [Verified OK](#verified-ok)
+- [Open (PO / device)](#open-po-device)
+<!-- /toc -->
+
+**Documentation index:** [README.md](README.md)
+
+---
+
+## Fixed today (prod BE)
+
+- `config.php` **`remote_access` block** was missing — blocked real WireGuard connect credentials
+- Installed via `examples/wireguard/install_be_remote_access.sh`
+- **VPN traffic counters** in admin expanded device row (`WireGuardTrafficStats.php`)
+- sudoers: `wg show wg0 dump` for nginx FPM user
+
+## Fixed in repo (awaiting BE sync)
+
+- **MariaDB `NULLS LAST`** — `listDevices()` ORDER BY broke dashboard on prod (HTTP 500); fixed to `(last_seen_at IS NULL), last_seen_at DESC`
+- **Dashboard perf** — issue counts use indexed `reports.device_id` via `devices.external_id` instead of `payload_json LIKE`
+- **Operational docs** — `REMOTE_ACCESS_IMPL.md` / `REMOTE_ACCESS_VALIDATION.md` now use prod **45340** and **172.200.2.0/16** (proposal doc still uses example 51820)
+- **Orphan wg peer cleanup** — `WireGuardPeerProvisioner::pruneOrphanPeers()`, hourly via `purge_remote_access.php`; manual `scripts/sync_wg_peers.php --dry-run|--apply`
+- **CLI defaults** — `ra_udp_debug.sh` / `ra_lib.sh` help and fallbacks match prod subnet
+
+## Verified OK
+
+- `wg0` on BE, endpoint `ra.apps.f0xx.org:45340`
+- UDP 45340 open on public IP
+- Heartbeat disable/enable API
+- Mobile boot restores RA mode (`RemoteAccessCoordinator.onBootIfNeeded`)
+- App wait-state + diagnostics (idle vs fail-reason); 30s heartbeat timeout
+
+## Open (PO / device)
+
+1. Full `ra_e2e_cli.sh` — needs admin login on laptop
+2. UDP handshake + ping — needs phone or `ra_udp_debug.sh --apply`
+3. SSH passthrough — RSSH track, not WG v1
+4. Persistent traffic history — live stats only today
+5. Whitelist + device E2E — human validation in progress
+
+Journal: `/shared/journal/cluster0.journal.tsv` (tag `vpn-demo`).