# Remote access — implementation notes (v1 WireGuard)

See the full proposal: [20260602_REVERSE_SSH_proposals_summary.md](20260602_REVERSE_SSH_proposals_summary.md).

## Table of contents

<!-- toc -->
- [App (developer settings)](#app-developer-settings)
- [BE](#be)
- [WireGuard third-party](#wireguard-third-party)
- [Tests](#tests)
<!-- /toc -->

**Documentation index:** [README.md](README.md)

---

## App (developer settings)

- Dropdown: **Disabled** | **WireGuard** | **RSSH (greyed — not selectable)**
- Pref key: `dev_remote_access_mode` (`AppPreferences`)
- **Disabled:** stops `RemoteAccessService`, tears down VPN, POST `type:ra` + `status:disable`
- **WireGuard:** foreground poll 1–7 min → `RemoteAccessService` → BE `heartbeat.php`

## BE

- Migration: `sql/migrations/007_remote_access.sql`
- Repository: `src/RemoteAccessRepository.php`
- Device API: `public/api/heartbeat.php` (`type: ra`)
- Admin API: `public/api/remote_access.php`
- UI: `?view=remote_access` (nav + hub card)
- RBAC: `remote_access_view`, `remote_access_operate`, `remote_access_admin`

## WireGuard third-party

```bash
bash scripts/init-wireguard-submodule.sh
```

Optional `:tunnel` module from `third-party/wireguard-android`. Without it, `WireGuardTunnelBridge` uses `RemoteAccessVpnService` (TUN fallback).

## Tests

```bash
./gradlew :app:testDebugUnitTest
bash examples/crash_reporter/backend/scripts/test_remote_access_api.sh
```