ac-docs/VPN_DEMO_GAPS_20260613.md

VPN / Remote Access demo — gap report (2026-06-13)

Field	Value
Author	Anton Afanasyeu
Revision	R1
Creation date	2026-06-13
Last modification date	2026-06-13
Co-authored
Severity	medium
State	blocked by DEV
Document type	internal

\newpage \newpage

---

See also REMOTE_ACCESS_VALIDATION.md, REMOTE_ACCESS_IMPL.md.

---

---

---

Table of contents

• Fixed today (prod BE)
• Fixed in repo (awaiting BE sync)
• Verified OK
• Open (PO / device)

Documentation index: README.md

---

Fixed today (prod BE)

• config.php remote_access block was missing — blocked real WireGuard connect credentials
• Installed via examples/wireguard/install_be_remote_access.sh
• VPN traffic counters in admin expanded device row (WireGuardTrafficStats.php)
• sudoers: wg show wg0 dump for nginx FPM user

Fixed in repo (awaiting BE sync)

• MariaDB NULLS LAST — listDevices() ORDER BY broke dashboard on prod (HTTP 500); fixed to (last_seen_at IS NULL), last_seen_at DESC
• Dashboard perf — issue counts use indexed reports.device_id via devices.external_id instead of payload_json LIKE
• Operational docs — REMOTE_ACCESS_IMPL.md / REMOTE_ACCESS_VALIDATION.md now use prod 45340 and 172.200.2.0/16 (proposal doc still uses example 51820)
• Orphan wg peer cleanup — WireGuardPeerProvisioner::pruneOrphanPeers(), hourly via purge_remote_access.php; manual scripts/sync_wg_peers.php --dry-run|--apply
• CLI defaults — ra_udp_debug.sh / ra_lib.sh help and fallbacks match prod subnet

Verified OK

• wg0 on BE, endpoint ra.apps.f0xx.org:45340
• UDP 45340 open on public IP
• Heartbeat disable/enable API
• Mobile boot restores RA mode (RemoteAccessCoordinator.onBootIfNeeded)
• App wait-state + diagnostics (idle vs fail-reason); 30s heartbeat timeout

Open (PO / device)

1. Full ra_e2e_cli.sh — needs admin login on laptop
2. UDP handshake + ping — needs phone or ra_udp_debug.sh --apply
3. SSH passthrough — RSSH track, not WG v1
4. Persistent traffic history — live stats only today
5. Whitelist + device E2E — human validation in progress

Journal: /shared/journal/cluster0.journal.tsv (tag vpn-demo).