ac/android_cast
1
0
Fork 0
mirror of git://f0xx.org/android_cast synced 2026-07-29 05:17:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

bastion RSSH + other changes

Browse Source
This commit is contained in:
Anton Afanasyeu
2026-06-15 11:56:23 +02:00
parent 22cc1c6a6a
commit 2421c4007b
19 changed files with 549 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
docs/OPEN_TASKS_GRAPH.md
View File

@@ -1,29 +1,8 @@
# Open tasks — dependency graph
_Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off graph** (postponed)._
_Last synced: 2026-06-04 (RSSH full stack on `feature/rssh-alpha`, RA control HTTP, cluster acl0 DNS). **DNS 2.x off graph** (postponed)._
**Documentation index:** [README.md](README.md) · **Service map:** [20260608_BE_SERVICES_and_infra.md](20260608_BE_SERVICES_and_infra.md)
---
---
---
---
## Table of contents
<!-- toc -->
- [Removed from graph (done)](#removed-from-graph-done)
- [Postponed / off graph (DNS + mail)](#postponed-off-graph-dns-mail)
- [Priority tiers (open only)](#priority-tiers-open-only)
- [Dependency graph](#dependency-graph)
- [Task index (open)](#task-index-open)
- [Critical path](#critical-path)
<!-- /toc -->
**Documentation index:** [README.md](README.md)
**Standing rules:** [../bottomline_reminder.txt](../bottomline_reminder.txt) · **Documentation index:** [README.md](README.md) · **Service map:** [20260608_BE_SERVICES_and_infra.md](20260608_BE_SERVICES_and_infra.md)
---
@@ -33,13 +12,22 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g
|----|------|
| **0.1** | Stream dump |
| **3.x** | Auth register + verify + TOTP + migration `008` |
| **4.x** | RSSH alpha — BE + Android + JSch |
| **4.wg** | WG lab — BE `wg0`, FE + **router** DNAT persist |
| **4.wg** | WG lab — BE `wg0`, FE + router DNAT persist |
| **RBAC** (core) | Admin panel + lockout clear |
| **Browser** | JS syntax validated; `validate_be_services.sh` |
| **1.1 / 1.2** | Graphs drill-down, columns, full-width (`shell--graphs-full`) |
| **5.3** | RSSH API validate — `test_rssh_api.sh` OK on BE |
| **1.1 / 1.2** | Graphs drill-down, columns, full-width |
| **5.3** | RSSH API smoke — `test_rssh_api.sh` |
| **Infra doc** | `20260608_BE_SERVICES_and_infra.md` + PDF |
| **RA control** | `:ra_control` HTTP + WebSocket shell + adb JSON `ra_control` block |
---
## In progress (feature/rssh-alpha)
| ID | Owner | Blocker | Status |
|----|-------|---------|--------|
| **4.rssh** | Agent | BE `provision_users` + FE stream deploy on PO | **In progress** — mobile MINA :8022, bastion provisioner, linux-sim, docs/tests in repo |
| **cluster0** | Agent | cast01–03 reachable | **Ongoing** — lab VMs; DNS `c1–c3.acl0.f0xx.org` noted in `cluster.env` |
---
@@ -47,7 +35,7 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g
| ID | Owner | Note |
|----|-------|------|
| **2.1–2.4** | Developer | DNS / forwards — **postponed** |
| **2.1–2.4** | Developer | DNS / forwards — **postponed** (acl0 CNAMEs added for cluster lab only) |
| **2.5** | Agent | SMTP — frozen |
| **5.4** (mail) | Agent | Auth mail E2E — frozen |
@@ -58,9 +46,10 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g
| Tier | IDs | Alpha blocker |
|------|-----|---------------|
| **P4** | **5.1 OTA**, **5.2 URLs**, **5.5** RBAC UI soak | **Yes** |
| **P4b** | **4.rssh** deploy soak | **Yes** (alpha essential) |
| **P5** | **6.1–6.6** app LAN | LAN alpha |
| **P9** | **9.x** landing (excl. globe FR) | No |
| **Post-alpha** | **SFU** relay (`feature/sfu-relay`) | No |
| **Post-alpha** | **SFU** relay | No |
---
@@ -72,6 +61,7 @@ flowchart TB
OTA["5.1 OTA channel<br/>SVC-OTA · HTTP 400"]
URL["5.2 device URLs<br/>SVC-URL · legacy host"]
RBACV["5.5 RBAC UI soak<br/>API ✓"]
RSSH["4.rssh full stack<br/>feature/rssh-alpha<br/>Agent"]
end
subgraph P5["P5 — app LAN · dev"]
@@ -83,12 +73,16 @@ flowchart TB
A66["6.6 stream analysis"]
end
subgraph P9["P9 — landing"]
L9["9.x hub cards<br/>no globe FR"]
subgraph LAB["Lab · cluster0"]
C0["cast01–03<br/>c1–c3.acl0.f0xx.org"]
end
subgraph POST["Post-alpha · hidden"]
SFU["SFU / Janus relay<br/>feature/sfu-relay"]
subgraph P9["P9 — landing"]
L9["9.x hub cards"]
end
subgraph POST["Post-alpha"]
SFU["SFU / Janus relay"]
end
FULL["FULL_ALPHA<br/>no DNS/mail"]
@@ -96,7 +90,9 @@ flowchart TB
OTA --> FULL
URL --> FULL
RBACV --> FULL
RSSH --> FULL
A62 --> FULL
C0 -.-> RSSH
A63 <--> A64
A65 --> A66
@@ -106,6 +102,7 @@ flowchart TB
style FULL fill:#1e3a5f,color:#fff
style OTA fill:#991b1b,color:#fff
style URL fill:#b45309,color:#fff
style RSSH fill:#7c3aed,color:#fff
style SFU fill:#e5e7eb,color:#374151
```
@@ -115,12 +112,14 @@ flowchart TB
| ID | Owner | Depends on | Status |
|----|-------|------------|--------|
| **5.1** | 50/50 | nginx OTA path | **Open** — `SVC-OTA` ticket |
| **5.2** | 50/50 | — | **Open** — `SVC-URL` / `settings.json` base |
| **5.5** | Agent | RBAC API ✓ | Light UI soak (optional) |
| **4.rssh** | Agent | FE stream + BE sshd Match User | **In progress** — repo complete pending deploy soak |
| **5.1** | 50/50 | nginx OTA path | **Open** |
| **5.2** | 50/50 | — | **Open** |
| **5.5** | Agent | RBAC API ✓ | Light UI soak |
| **6.1–6.6** | Developer (~99%) | 0.1 ✓ | Open |
| **9.x** | Agent (low) | — | Open (globe out of scope) |
| **SFU** | Agent | owner spec | Hidden preview on `feature/sfu-relay` |
| **9.x** | Agent (low) | — | Open |
| **cluster0** | Agent | NFS/DNS | cast01–03 lab |
| **SFU** | Agent | owner spec | Hidden |
---
@@ -129,9 +128,23 @@ flowchart TB
```text
BLOCKER: 5.1 OTA nginx (/v0/ota/ on apps.f0xx.org) ──┐
SHARED: 5.2 production URLs (apps not f0xx.org) ─────┼──► FULL_ALPHA
OPTIONAL: 5.5 RBAC UI click-through ──────────────────┤
DEV: 6.2 LAN soak ───────────────────────────────┘
ALPHA: 4.rssh deploy (FE stream + BE sshd + app) ───┤
OPTIONAL: 5.5 RBAC UI click-through ────────────────────┤
DEV: 6.2 LAN soak ────────────────────────────────┘
Off graph: 2.x DNS/mail (postponed)
Parallel: 6.1/6.3–6.6, 9.x (no globe), SFU post-alpha
Parallel: cluster0 lab (c1–c3.acl0.f0xx.org), 6.1/6.3–6.6, 9.x, SFU
Off graph: 2.x DNS/mail (postponed)
```
---
## Numbered priority legend (PO overrides AI)
1. **5.1 OTA** — nginx path (PO/dev)
2. **5.2 URLs** — production base URLs
3. **4.rssh** — alpha remote access (Agent, `feature/rssh-alpha`)
4. **5.5 RBAC UI soak** — optional click-through
5. **6.2 LAN soak** — developer device validation
6. **cluster0** — cast01–03 integration tests
7. **6.1 / 6.3–6.6** — app LAN quality
8. **9.x** — landing polish

19
docs/REMOTE_ACCESS_IMPL.md
View File

@@ -186,11 +186,28 @@ bash scripts/init-third-party-submodules.sh # or ./rebuild.sh (includes init +
Gradle fails fast if the submodule is missing. VPN runs in `:vpn` (`AndroidCastVpnService` + AIDL); `WireGuardVpnEngine` uses `GoBackend` with TUN fallback in the same process.
## RSSH alpha (reverse SSH)
| Layer | Component | Notes |
|-------|-----------|--------|
| **App** | `ReverseSshTunnelBridge` | JSch outbound `-R 127.0.0.1:<port>:127.0.0.1:8022` |
| **App** | `RsshLocalSshServer` | Apache MINA SSHD on `127.0.0.1:8022` |
| **BE** | `RsshSessionProvisioner` / `RsshBastionProvisioner` | DB creds; optional Linux user via `rssh_bastion_user.sh` |
| **FE** | nginx `stream` | `nginx/rssh-bastion-stream.conf.example` |
| **Sim** | `examples/rssh/linux-sim/` | Laptop heartbeat + `ssh -R` |
Developer settings → **RSSH** (no VPN dialog). Operator command shown in admin active sessions.
## RA control HTTP (`:ra_control`)
Isolated process: template web UI + sandbox shell when RA session is up. Port/token in `adb.json` `ra_control` block.
## Tests
```bash
./gradlew :app:testDebugUnitTest --tests 'com.foxx.androidcast.remoteaccess.*'
bash examples/crash_reporter/backend/scripts/test_rbac_api.sh
bash examples/crash_reporter/backend/scripts/test_rssh_unit.sh
bash examples/crash_reporter/backend/scripts/test_rssh_api.sh
bash examples/crash_reporter/backend/scripts/test_remote_access_api.sh
BASE=https://apps.f0xx.org/app/androidcast_project/crashes bash examples/crash_reporter/backend/scripts/test_remote_access_api.sh
BASE=https://apps.f0xx.org/app/androidcast_project/crashes bash examples/crash_reporter/backend/scripts/ra_e2e_cli.sh