Skip to content

ROADMAP.md

Latest commit

 

History

History
139 lines (100 loc) · 5.47 KB

ROADMAP.md

File metadata and controls

139 lines (100 loc) · 5.47 KB
Raw

Roadmap

Epic 1 – Core AWG Integration ✅ complete

  • Execute awg show all dump via std::process::Command
  • Parse output into AwgInterface / AwgPeer structs
  • Handle missing binary gracefully (warn + skip cycle)
  • allowed_ips saved in peers table on every poll

Epic 2 – Config Discovery ✅ complete

  • Scan config directory for *.conf files (non-recursive)
  • Extract [Peer] PublicKey + [Interface] Address
  • Schema columns config_name, config_path added to peers
  • Poller runs config scan after each AWG poll cycle
  • Idempotent mapping: clear-then-apply on every cycle
  • Warn+skip on unreadable files; skip-on-missing-dir
  • unlinked status correctly driven by has_config

Epic 3 – Database & Migrations ✅ complete

  • SQLite via sqlx; peers, snapshots, events, interfaces, users tables
  • Migrations 0001 (schema) + 0002 (config_name, config_path)
  • update_peer_metadata for rename/comment support

Epic 4 – Poller & Snapshots ✅ complete

  • Background Tokio task, configurable interval
  • Snapshot insertion per poll; peer upsert (including allowed_ips)
  • Config mapping step after AWG step; logged per cycle

Epic 5 – Traffic History & Basic UI ✅ complete

  • GET /api/peers/:id/history?range=24h|7d|30d
  • Per-snapshot deltas with counter-reset handling
  • GET / – server-rendered HTML peer list
  • GET /peers/:id – server-rendered HTML peer detail + edit form

Epic 6 – Peer Rename & Comment ✅ complete

  • normalize_display_name() / normalize_comment() in domain layer
  • update_peer_metadata(pool, id, name, comment) DB function
  • PATCH /api/peers/:id – JSON API endpoint (partial update)
  • POST /peers/:id – HTML form endpoint (PRG redirect)

Epic 7 – Authentication ✅ complete

  • AuthConfig struct with enabled, username, password_hash, api_token, secure_cookie
  • Argon2id password verification (constant-time)
  • In-memory session store with lazy expiry cleanup
  • 32-byte OsRng session IDs
  • GET /login + POST /login + POST /logout
  • Auth middleware protecting all HTML + API routes
  • HTML → redirect to /login; API → 401 JSON
  • Optional bearer token via AUTH_API_TOKEN
  • Logout button in nav bar on all pages
  • AUTH_ENABLED, AUTH_USERNAME, AUTH_PASSWORD_HASH, AUTH_API_TOKEN, AUTH_SECURE_COOKIE env vars
  • Health endpoint stays public
  • 29 new auth-specific tests

Epic 8 – Deployment Hardening ✅ complete

  • CSRF tokens on all HTML write forms (POST /login, POST /logout, POST /peers/:id)
  • Login rate limiting: 5 attempts per 5-minute window per IP; 429 on excess
  • Configurable session TTL via AUTH_SESSION_TTL_SECS (default 24 h)
  • Systemd service unit file (packaging/amneziawg-web.service)
  • Reverse-proxy config examples in docs/DEPLOYMENT.md (nginx, Caddy)
  • Constant-time CSRF token comparison (csrf_eq())
  • Pre-login CSRF token store (short-lived, single-use)
  • Tests for CSRF, rate limiting, session expiry, valid/invalid CSRF flows

Epic 9 – Audit Logging ✅ complete

  • events table (existed from initial migration); added peer_id INTEGER FK column via migration 0003
  • src/db/events.rs – EventRow, EVT_* constants, log_event(), list_events()
  • GET /api/events – filterable by peer_id, event_type, limit
  • peer_updated event logged from PATCH /api/peers/:id and POST /peers/:id
  • login_success, login_failed, logout events logged from auth handlers
  • Recent activity shown on /peers/:id HTML page (last 20 events)
  • Logging is fire-and-forget – never breaks main operation
  • 17 new audit-related tests (155 total)

Epic 10 – Admin Write Actions ✅ complete

  • Enable / disable peer (PATCH /api/peers/:id with "disabled": true/false)
  • Download client config (GET /api/peers/:id/config)
  • HTML form disabled checkbox on peer detail page
  • Audit event peer_disabled logged on state change
  • Admin module helper execute_set_peer_enabled
  • 12 new Epic 10 tests (167 total)

Recommended next step

Choose one of:

  1. Persistent session store – DB-backed sessions that survive restarts.
  2. Export / backup and restore – SQLite dump endpoint or file download.
  3. Release packaging – .deb/.rpm package or Docker image with the binary + systemd unit.

Epic 11 – Release Preparation ✅ complete

  • README overhaul: screenshot placeholders, architecture diagram, feature comparison table, "vs status script" section
  • docs/INSTALL.md: full installation guide (prerequisites, build, systemd, Docker, reverse proxy)
  • .env.example: all variables documented with comments and safe defaults
  • Dockerfile + .dockerignore: multi-stage build, slim Debian runtime, non-root user
  • CONTRIBUTING.md: bug reporting, PR guidelines, security note
  • docs/RELEASE.md: v0.1.0 release checklist and release notes template
  • docs/ROADMAP.md updated with all complete epics
  • Terminology and cross-links consistent across all docs

Recommended next steps after v0.1.0

  1. Publish v0.1.0 – tag the release, optional binary upload to GitHub Releases
  2. Persistent session store – DB-backed sessions that survive restarts
  3. Export / backup – SQLite dump or JSON export endpoint