iris
f95bc77f7b
The Rust crate and the Android half of one arrangement: a server that binds the tunnel interface and nothing else, certificates it generates and keeps outside any shared checkout, enrolment that carries a token and the CA to a phone, and a client that trusts exactly that certificate and no other. Extracted because ai-app and dev-updater had written all of it twice and the two copies had already drifted -- one of them carried a bug the other did not. History before this point was squashed away; it was a running record of that extraction and of a personal machine's addresses, and neither is worth keeping in a public repository.
31 lines
1.2 KiB
TOML
31 lines
1.2 KiB
TOML
[package]
|
|
name = "wg-app-link"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
description = "The private link between a phone and a machine you run: WireGuard binding, a self-signed CA the app pins, and QR enrollment of a bearer token."
|
|
|
|
[dependencies]
|
|
anyhow = "1"
|
|
# The config format both projects use, and the two house rules they share.
|
|
ron = "0.12.2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
# Enumerating this machine's addresses, and finding the tunnel's.
|
|
if-addrs = "0.15"
|
|
# Token auth: hash for storage, constant-time compare for verification,
|
|
# CSPRNG-backed generation, base64url for the enrollment string.
|
|
sha2 = "0.11"
|
|
subtle = "2"
|
|
rand = "0.10"
|
|
base64 = "0.23"
|
|
# Renders the enrollment QR straight to the terminal; no image output.
|
|
qrcode = { version = "0.14", default-features = false }
|
|
tracing = "0.1"
|
|
# Generates the CA and leaf in process, so one place decides the
|
|
# extensions, the file modes, and which addresses the leaf covers.
|
|
# x509-parser so the issuer is read back from the CA actually on disk
|
|
# rather than reconstructed from parameters that may since have changed.
|
|
rcgen = { version = "0.14", features = ["pem", "x509-parser"] }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|