iris
f95bc77f7b
The Rust crate and the Android half of one arrangement: a server that binds the tunnel interface and nothing else, certificates it generates and keeps outside any shared checkout, enrolment that carries a token and the CA to a phone, and a client that trusts exactly that certificate and no other. Extracted because ai-app and dev-updater had written all of it twice and the two copies had already drifted -- one of them carried a bug the other did not. History before this point was squashed away; it was a running record of that extraction and of a personal machine's addresses, and neither is worth keeping in a public repository.
36 lines
1.5 KiB
Rust
36 lines
1.5 KiB
Rust
//! What dev-updater and ai-app both need in order to be reached from a
|
|
//! phone, and nothing either of them does afterwards.
|
|
//!
|
|
//! Both projects are the same shape underneath: a server on a machine
|
|
//! somebody owns, bound to a WireGuard interface so it is not on the LAN,
|
|
//! presenting a certificate from a CA the app pins, and answering only
|
|
//! requests carrying a bearer token that was enrolled by scanning a QR
|
|
//! code off the terminal. None of that is about serving APKs or running
|
|
//! model sessions -- it is the link, and it was written twice.
|
|
//!
|
|
//! # What belongs here
|
|
//!
|
|
//! Anything that would be *identical* in a third such project. The test
|
|
//! applied to each module below was to diff the two existing copies: if
|
|
//! the only differences were a product name and which state type the code
|
|
//! was generic over, it came here.
|
|
//!
|
|
//! # What deliberately does not
|
|
//!
|
|
//! The API surfaces. dev-updater's routes are about projects and builds,
|
|
//! ai-app's about sessions and providers, and their HTTP clients have
|
|
//! diverged to 14% similarity because they are genuinely different
|
|
//! programs. Sharing a transport is worth doing; sharing an API would mean
|
|
//! inventing a common vocabulary neither project wants.
|
|
//!
|
|
//! Config *schemas*, for the same reason -- though the RON house rules
|
|
//! that both files are written in are shared, since those were identical
|
|
//! to the byte.
|
|
|
|
pub mod certs;
|
|
pub mod enroll;
|
|
pub mod format;
|
|
pub mod netif;
|
|
pub mod private;
|
|
pub mod xdg;
|