ac/android_cast
1
0
Fork 0
mirror of git://f0xx.org/android_cast synced 2026-07-29 06:58:51 +03:00
Code Issues Packages Projects Releases Wiki Activity

sync

Browse Source
This commit is contained in:
Anton Afanasyeu
2026-06-13 16:49:40 +02:00
parent 86055bf509
commit 2fd6d421a3
11 changed files with 198 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/REMOTE_ACCESS_IMPL.md
View File

@@ -49,7 +49,7 @@ WireGuard on Android **must** use `VpnService` (see `DeveloperSettingsActivity`
| One-time system dialog | Yes — “Allow VPN?” | No VPN permission |
| Status-bar key icon | Yes while tunnel up | No |
| Full-device routing | TUN interface (split routes in config, still a VPN) | No L3 tunnel |
| Outbound from phone | UDP to BE `:51820` | HTTPS poll + outbound SSH to bastion |
| Outbound from phone | UDP to BE `:45340` | HTTPS poll + outbound SSH to bastion |
There is no supported “hidden VPN” on non-root Android: any TUN creator is classified as a VPN app. **RSSH** (foreground service + existing HTTPS poll + outbound SSH reverse tunnel) is the **alpha deliverable** agreed by project owners — device initiates, operator reaches a forwarded port on the bastion, without VPN consent or status-bar key. See [Rev. 3 Q&A](20260602_REVERSE_SSH_proposals_summary.md#rev-3--wg-vs-ssh-qa--bastion-deep-dive) and [ROADMAP.md § Remote access](ROADMAP.md#remote-access-alpha--rssh).
@@ -105,7 +105,7 @@ Migration **007** (already applied on prod per deploy notes). Tables auto-create
```php
'remote_access' => [
'wg_endpoint' => 'ra.apps.f0xx.org:51820', // public UDP hostname:port (FE DNAT → BE)
'wg_endpoint' => 'ra.apps.f0xx.org:45340', // public UDP hostname:port (FE DNAT → BE)
'wg_server_public_key' => '…', // wg show wg0 public-key on BE — REQUIRED
'wg_interface' => 'wg0',
'provision_peers' => true, // wg set on connect/close
@@ -121,7 +121,7 @@ Migration **007** (already applied on prod per deploy notes). Tables auto-create
```sh
apk add wireguard-tools wireguard-tools-wg
# wg0 configured separately (Address 10.66.66.1/24, ListenPort 51820, etc.)
# wg0 configured separately (Address 172.200.2.1/16, ListenPort 45340, etc.)
# PHP-FPM user must run wg when provision_peers=true (same as CLI test):
sudo -u www-data wg show wg0
@@ -131,6 +131,7 @@ sudo -u www-data wg show wg0
```cron
0 * * * * cd /var/www/.../backend && php81 scripts/purge_remote_access.php --hours=24
# Orphan wg peers are pruned each run; skip with --no-prune-wg. Manual: php81 scripts/sync_wg_peers.php --dry-run
```
Use `php81` when Alpine default `php` is 8.5+ without the session module; FPM is `php-fpm81`.
@@ -156,7 +157,7 @@ Hard-refresh after deploying `public/assets/js/remote_access.js`.
HTTP control plane stays on FE→BE `:80`. **WireGuard traffic is UDP** — configure at the **FE firewall/DNAT**, not in nginx:
```text
Internet UDP :51820 → FE DNAT → BE wg0 :51820
Internet UDP :45340 → FE DNAT → BE wg0 :45340
```
Hostname `ra.apps.f0xx.org` (or similar) should resolve to the FE public IP. Devices use `wg_endpoint` from config/connect payload.