mirror of
git://f0xx.org/android_cast
synced 2026-07-29 02:59:00 +03:00
sync
This commit is contained in:
Anton Afanasyeu
@@ -49,7 +49,7 @@ WireGuard on Android **must** use `VpnService` (see `DeveloperSettingsActivity`
|
||||
| One-time system dialog | Yes — “Allow VPN?” | No VPN permission |
|
||||
| Status-bar key icon | Yes while tunnel up | No |
|
||||
| Full-device routing | TUN interface (split routes in config, still a VPN) | No L3 tunnel |
|
||||
| Outbound from phone | UDP to BE `:51820` | HTTPS poll + outbound SSH to bastion |
|
||||
| Outbound from phone | UDP to BE `:45340` | HTTPS poll + outbound SSH to bastion |
|
||||
|
||||
There is no supported “hidden VPN” on non-root Android: any TUN creator is classified as a VPN app. **RSSH** (foreground service + existing HTTPS poll + outbound SSH reverse tunnel) is the **alpha deliverable** agreed by project owners — device initiates, operator reaches a forwarded port on the bastion, without VPN consent or status-bar key. See [Rev. 3 Q&A](20260602_REVERSE_SSH_proposals_summary.md#rev-3--wg-vs-ssh-qa--bastion-deep-dive) and [ROADMAP.md § Remote access](ROADMAP.md#remote-access-alpha--rssh).
|
||||
|
||||
@@ -105,7 +105,7 @@ Migration **007** (already applied on prod per deploy notes). Tables auto-create
|
||||
|
||||
```php
|
||||
'remote_access' => [
|
||||
'wg_endpoint' => 'ra.apps.f0xx.org:51820', // public UDP hostname:port (FE DNAT → BE)
|
||||
'wg_endpoint' => 'ra.apps.f0xx.org:45340', // public UDP hostname:port (FE DNAT → BE)
|
||||
'wg_server_public_key' => '…', // wg show wg0 public-key on BE — REQUIRED
|
||||
'wg_interface' => 'wg0',
|
||||
'provision_peers' => true, // wg set on connect/close
|
||||
@@ -121,7 +121,7 @@ Migration **007** (already applied on prod per deploy notes). Tables auto-create
|
||||
|
||||
```sh
|
||||
apk add wireguard-tools wireguard-tools-wg
|
||||
# wg0 configured separately (Address 10.66.66.1/24, ListenPort 51820, etc.)
|
||||
# wg0 configured separately (Address 172.200.2.1/16, ListenPort 45340, etc.)
|
||||
|
||||
# PHP-FPM user must run wg when provision_peers=true (same as CLI test):
|
||||
sudo -u www-data wg show wg0
|
||||
@@ -131,6 +131,7 @@ sudo -u www-data wg show wg0
|
||||
|
||||
```cron
|
||||
0 * * * * cd /var/www/.../backend && php81 scripts/purge_remote_access.php --hours=24
|
||||
# Orphan wg peers are pruned each run; skip with --no-prune-wg. Manual: php81 scripts/sync_wg_peers.php --dry-run
|
||||
```
|
||||
|
||||
Use `php81` when Alpine default `php` is 8.5+ without the session module; FPM is `php-fpm81`.
|
||||
@@ -156,7 +157,7 @@ Hard-refresh after deploying `public/assets/js/remote_access.js`.
|
||||
HTTP control plane stays on FE→BE `:80`. **WireGuard traffic is UDP** — configure at the **FE firewall/DNAT**, not in nginx:
|
||||
|
||||
```text
|
||||
Internet UDP :51820 → FE DNAT → BE wg0 :51820
|
||||
Internet UDP :45340 → FE DNAT → BE wg0 :45340
|
||||
```
|
||||
|
||||
Hostname `ra.apps.f0xx.org` (or similar) should resolve to the FE public IP. Devices use `wg_endpoint` from config/connect payload.
|
||||
|
||||
@@ -55,8 +55,9 @@ All under `examples/crash_reporter/backend/scripts/`:
|
||||
| `ra_device_sim.sh` | Device-only: disable / enable / poll / optional WG |
|
||||
| `ra_e2e_cli.sh` | Full flow: disable → wait → whitelist → open → connect → close → disable |
|
||||
| `test_remote_access_api.sh` | Minimal API smoke (grep, no jq) |
|
||||
| `verify_remote_access_prod.sh` | BE preflight: config, wg tools, DB tables, optional smoke |
|
||||
| `ra_udp_debug.sh` | DNS + UDP port + HTTP smoke + connect + `wg-quick` + ping BE (`10.66.66.1`) |
|
||||
| `verify_remote_access_prod.sh` | BE preflight: config, wg tools, DB tables, wg peer sync, optional smoke |
|
||||
| `sync_wg_peers.php` | Reconcile wg0 peers with pending/active sessions (`--dry-run` / `--apply`) |
|
||||
| `ra_udp_debug.sh` | DNS + UDP port + HTTP smoke + connect + `wg-quick` + ping BE (`172.200.2.1`) |
|
||||
|
||||
```bash
|
||||
cd examples/crash_reporter/backend
|
||||
@@ -91,7 +92,7 @@ export RA_DEVICE_ID=my-lab-phone
|
||||
|
||||
## Production / staging BE
|
||||
|
||||
**Verified 2026-06-04** on `https://apps.f0xx.org/app/androidcast_project/crashes`: `ra_e2e_cli.sh` passed (connect returned real `peer_public_key`, endpoint `ra.apps.f0xx.org:51820`). Poll step may take up to ~45s per `min_poll_interval_s`. UDP handshake still needs a device or `ra_device_sim.sh --apply-wg` from a reachable host.
|
||||
**Verified 2026-06-04** on `https://apps.f0xx.org/app/androidcast_project/crashes`: `ra_e2e_cli.sh` passed (connect returned real `peer_public_key`, endpoint `ra.apps.f0xx.org:45340`). Poll step may take up to ~45s per `min_poll_interval_s`. UDP handshake still needs a device or `ra_device_sim.sh --apply-wg` from a reachable host.
|
||||
|
||||
```bash
|
||||
ssh alpine-be # or your BE host
|
||||
@@ -130,10 +131,10 @@ export CRASHES_BASE=https://apps.f0xx.org/app/androidcast_project/crashes
|
||||
export ADMIN_USER=admin ADMIN_PASS='…'
|
||||
|
||||
./scripts/ra_udp_debug.sh # DNS, UDP nc, HTTP smoke, connect, wg conf
|
||||
./scripts/ra_udp_debug.sh --apply # also wg-quick up + ping 10.66.66.1 + teardown
|
||||
./scripts/ra_udp_debug.sh --apply # also wg-quick up + ping 172.200.2.1 + teardown
|
||||
```
|
||||
|
||||
Steps: CNAME check (`ra.apps.f0xx.org` → same A as `apps.f0xx.org`) → UDP `51820` → `test_remote_access_api.sh` → whitelist + open + poll connect → write `/tmp/ra-udp-<id>.conf`. With `--apply`, brings tunnel up and pings the BE WG address.
|
||||
Steps: CNAME check (`ra.apps.f0xx.org` → same A as `apps.f0xx.org`) → UDP `45340` → `test_remote_access_api.sh` → whitelist + open + poll connect → write `/tmp/ra-udp-<id>.conf`. With `--apply`, brings tunnel up and pings the BE WG address.
|
||||
|
||||
Skip HTTP re-check when control plane was just verified: `./scripts/ra_udp_debug.sh --skip-http --apply`.
|
||||
|
||||
@@ -157,7 +158,7 @@ RESP="$(curl -sf …)" # connect response
|
||||
source scripts/ra_lib.sh
|
||||
ra_wg_quick_from_connect "$RESP" | sudo tee /tmp/ra-test.conf
|
||||
sudo wg-quick up /tmp/ra-test.conf
|
||||
ping -c1 10.66.66.1 # BE wg0 address if routed
|
||||
ping -c1 172.200.2.1 # BE wg0 address if routed
|
||||
sudo wg-quick down /tmp/ra-test.conf
|
||||
```
|
||||
|
||||
|
||||
@@ -9,20 +9,26 @@ See also [REMOTE_ACCESS_VALIDATION.md](../REMOTE_ACCESS_VALIDATION.md), [REMOTE_
|
||||
- **VPN traffic counters** in admin expanded device row (`WireGuardTrafficStats.php`)
|
||||
- sudoers: `wg show wg0 dump` for nginx FPM user
|
||||
|
||||
## Fixed in repo (awaiting BE sync)
|
||||
|
||||
- **Operational docs** — `REMOTE_ACCESS_IMPL.md` / `REMOTE_ACCESS_VALIDATION.md` now use prod **45340** and **172.200.2.0/16** (proposal doc still uses example 51820)
|
||||
- **Orphan wg peer cleanup** — `WireGuardPeerProvisioner::pruneOrphanPeers()`, hourly via `purge_remote_access.php`; manual `scripts/sync_wg_peers.php --dry-run|--apply`
|
||||
- **CLI defaults** — `ra_udp_debug.sh` / `ra_lib.sh` help and fallbacks match prod subnet
|
||||
|
||||
## Verified OK
|
||||
|
||||
- `wg0` on BE, endpoint `ra.apps.f0xx.org:45340`
|
||||
- UDP 45340 open on public IP
|
||||
- Heartbeat disable/enable API
|
||||
- Mobile boot restores RA mode (`RemoteAccessCoordinator.onBootIfNeeded`)
|
||||
- App wait-state + diagnostics (idle vs fail-reason); 30s heartbeat timeout
|
||||
|
||||
## Open (PO / device)
|
||||
|
||||
1. Full `ra_e2e_cli.sh` — needs admin login on laptop
|
||||
2. UDP handshake + ping — needs phone or `ra_udp_debug.sh --apply`
|
||||
3. SSH passthrough — RSSH track, not WG v1
|
||||
4. Doc port references still say 51820 in places; prod uses **45340**
|
||||
5. Stale wg peer with `allowed ips: (none)` — manual cleanup
|
||||
6. Persistent traffic history — live stats only today
|
||||
4. Persistent traffic history — live stats only today
|
||||
5. Whitelist + device E2E — human validation in progress
|
||||
|
||||
Journal: `/shared/journal/cluster0.journal.tsv` (tag `vpn-demo`).
|
||||
|
||||
Reference in New Issue
Block a user