sync on be, vpn

docs/VPN_DEMO_GAPS_20260613.md

@@ -0,0 +1,28 @@
+# VPN / Remote Access demo — gap report (2026-06-13)
+
+See also [REMOTE_ACCESS_VALIDATION.md](../REMOTE_ACCESS_VALIDATION.md), [REMOTE_ACCESS_IMPL.md](../REMOTE_ACCESS_IMPL.md).
+
+## Fixed today (prod BE)
+
+- `config.php` **`remote_access` block** was missing — blocked real WireGuard connect credentials
+- Installed via `examples/wireguard/install_be_remote_access.sh`
+- **VPN traffic counters** in admin expanded device row (`WireGuardTrafficStats.php`)
+- sudoers: `wg show wg0 dump` for nginx FPM user
+
+## Verified OK
+
+- `wg0` on BE, endpoint `ra.apps.f0xx.org:45340`
+- UDP 45340 open on public IP
+- Heartbeat disable/enable API
+- Mobile boot restores RA mode (`RemoteAccessCoordinator.onBootIfNeeded`)
+
+## Open (PO / device)
+
+1. Full `ra_e2e_cli.sh` — needs admin login on laptop
+2. UDP handshake + ping — needs phone or `ra_udp_debug.sh --apply`
+3. SSH passthrough — RSSH track, not WG v1
+4. Doc port references still say 51820 in places; prod uses **45340**
+5. Stale wg peer with `allowed ips: (none)` — manual cleanup
+6. Persistent traffic history — live stats only today
+
+Journal: `/shared/journal/cluster0.journal.tsv` (tag `vpn-demo`).