docs: add info on local development and security clarifications

Author: pymq

BUILDING.md

@@ -5,16 +5,74 @@
 * Go (1.25)
 * Git
 * gomobile and Android Studio for Android ([see more](https://pkg.go.dev/golang.org/x/mobile/cmd/gomobile))
-* Flutter (3.38)
+* Flutter (3.38) for Web and Android
 
-## Build
+## Release build
 
 The first step is to clone [awl](https://github.com/anywherelan/awl) and [awl-flutter](https://github.com/anywherelan/awl-flutter) in one parent directory.
 
 ```bash
+# Example structure:
+# /workspace
+#   ├── awl
+#   └── awl-flutter
+
+git clone https://github.com/anywherelan/awl.git
+git clone https://github.com/anywherelan/awl-flutter.git
+
 cd awl
 ./build.sh release
 ls build
 ```
 
 See [build.sh](build.sh) for more details.
+
+## Local Development
+
+**Note:** To run the application on desktop (Linux/macOS/Windows), you need **root/administrator** rights. This is required to create virtual network interfaces.
+
+### Web Static Files
+
+The project requires a `static` directory containing the Flutter web UI. If you see an error like `pattern static: no matching files found`, you need to set this up. You have two options:
+
+**Option A: Download pre-built (No Flutter required)**  
+If you don't want to install Flutter or build the frontend, you can download the pre-built static files.
+1. Download the `awl-release-static.zip` artifact from a recent GitHub Action run from [Manual build release workflow](https://github.com/anywherelan/awl/actions/workflows/build-manual.yml).
+2. Unzip the contents into the `static` directory in the root of the awl project:
+   ```bash
+   unzip awl-release-static.zip -d static
+   ```
+
+**Option B: Build locally**  
+If you have [Flutter installed](#dependencies), you can build the web static files yourself:
+```bash
+./build.sh web
+```
+This rebuilds the Flutter web frontend and places it in the `static` directory.
+
+### For Windows
+
+If you are developing on Windows, you must download the `wintun` driver dependencies before building:
+```bash
+./build.sh deps
+```
+
+### For Android
+
+The `./build.sh` script provides commands for Android development:
+
+- **Build Android Library (Go backend)**:
+  ```bash
+  ./build.sh android-lib
+  ```
+  Builds the Go backend as an Android library (`anywherelan.aar`). Use this when you are working on the Go code and want to check for compilation errors without building the full APK.
+
+- **Build Full Android APK**:
+  ```bash
+  ./build.sh android
+  ```
+  Builds the full Android application (requires `android-lib` step implicitly, but this command runs both).
+
+
+
+

README.md

@@ -59,6 +59,13 @@ As a transport awl uses QUIC or TCP with TLS on top. Awl uses [DHT](https://en.w
 
 At first, awl connects to community [bootstrap nodes](https://github.com/anywherelan/awl-bootstrap-node), register itself (send peer id (with public key) and public ip addresses) and later asks for addresses of peers you want to connect (all known peers). If peer does not have public addresses, peer could be reached out through bootstrap nodes.
 
+## Security
+
+For transport and security, awl fully relies on the [libp2p](https://docs.libp2p.io/) library.
+
+- **Encryption**: Traffic between peers is encrypted using TLS 1.3 (or higher). This applies to both QUIC (which uses TLS natively) and TCP transports.
+- **Authentication**: `ed25519` keys are used for peer authentication. A `peer_id` is essentially a public key, ensuring secure identification of devices.
+
 # Installation
 
 For desktop there are two versions: `awl` and `awl-tray`. `awl` is mainly used for servers and other headless purposes and `awl-tray` is for desktop usage: it has nice system tray service (app indicator) to quickly get status of the vpn server, start/stop/restart it or to see which peers are online. Both versions have web-based ui for configuration and monitoring, and terminal interface [cli](#terminal-based-client).
@@ -165,7 +172,7 @@ To configure it on desktop with web UI go to admin page, select a peer, press Se
 How to configure using cli:
 ```bash
 # list all your connected peers and their EXIT NODE status (if they or you allowed to use as a proxy)
-awl cli peers list
+awl cli peers status
 
 # allow peer `peer-name` to use this device as a SOCKS5 proxy
 awl cli peers allow_exit_node --name="peer-name" --allow=true