@push.rocks/smartvpn 1.0.3

package/ts/smartvpn.classes.vpnconfig.ts

@@ -0,0 +1,104 @@
+import * as plugins from './smartvpn.plugins.js';
+import type {
+  IVpnClientConfig,
+  IVpnServerConfig,
+} from './smartvpn.interfaces.js';
+
+/**
+ * VPN configuration loader, saver, and validator.
+ */
+export class VpnConfig {
+  /**
+   * Validate a client config object. Throws on invalid config.
+   */
+  public static validateClientConfig(config: IVpnClientConfig): void {
+    if (!config.serverUrl) {
+      throw new Error('VpnConfig: serverUrl is required');
+    }
+    if (!config.serverUrl.startsWith('wss://') && !config.serverUrl.startsWith('ws://')) {
+      throw new Error('VpnConfig: serverUrl must start with wss:// or ws://');
+    }
+    if (!config.serverPublicKey) {
+      throw new Error('VpnConfig: serverPublicKey is required');
+    }
+    if (config.mtu !== undefined && (config.mtu < 576 || config.mtu > 65535)) {
+      throw new Error('VpnConfig: mtu must be between 576 and 65535');
+    }
+    if (config.keepaliveIntervalSecs !== undefined && config.keepaliveIntervalSecs < 1) {
+      throw new Error('VpnConfig: keepaliveIntervalSecs must be >= 1');
+    }
+    if (config.dns) {
+      for (const dns of config.dns) {
+        if (!VpnConfig.isValidIp(dns)) {
+          throw new Error(`VpnConfig: invalid DNS address: ${dns}`);
+        }
+      }
+    }
+  }
+
+  /**
+   * Validate a server config object. Throws on invalid config.
+   */
+  public static validateServerConfig(config: IVpnServerConfig): void {
+    if (!config.listenAddr) {
+      throw new Error('VpnConfig: listenAddr is required');
+    }
+    if (!config.privateKey) {
+      throw new Error('VpnConfig: privateKey is required');
+    }
+    if (!config.publicKey) {
+      throw new Error('VpnConfig: publicKey is required');
+    }
+    if (!config.subnet) {
+      throw new Error('VpnConfig: subnet is required');
+    }
+    if (!VpnConfig.isValidSubnet(config.subnet)) {
+      throw new Error(`VpnConfig: invalid subnet: ${config.subnet}`);
+    }
+    if (config.mtu !== undefined && (config.mtu < 576 || config.mtu > 65535)) {
+      throw new Error('VpnConfig: mtu must be between 576 and 65535');
+    }
+    if (config.keepaliveIntervalSecs !== undefined && config.keepaliveIntervalSecs < 1) {
+      throw new Error('VpnConfig: keepaliveIntervalSecs must be >= 1');
+    }
+  }
+
+  /**
+   * Load a config from a JSON file.
+   */
+  public static async loadFromFile<T>(filePath: string): Promise<T> {
+    const content = await plugins.fs.promises.readFile(filePath, 'utf-8');
+    return JSON.parse(content) as T;
+  }
+
+  /**
+   * Save a config to a JSON file.
+   */
+  public static async saveToFile<T>(filePath: string, config: T): Promise<void> {
+    const content = JSON.stringify(config, null, 2);
+    await plugins.fs.promises.writeFile(filePath, content, 'utf-8');
+  }
+
+  /**
+   * Basic IP address validation.
+   */
+  private static isValidIp(ip: string): boolean {
+    const parts = ip.split('.');
+    if (parts.length !== 4) return false;
+    return parts.every((part) => {
+      const num = parseInt(part, 10);
+      return !isNaN(num) && num >= 0 && num <= 255 && String(num) === part;
+    });
+  }
+
+  /**
+   * Basic subnet validation (CIDR notation).
+   */
+  private static isValidSubnet(subnet: string): boolean {
+    const [ip, prefix] = subnet.split('/');
+    if (!ip || !prefix) return false;
+    if (!VpnConfig.isValidIp(ip)) return false;
+    const prefixNum = parseInt(prefix, 10);
+    return !isNaN(prefixNum) && prefixNum >= 0 && prefixNum <= 32;
+  }
+}

package/ts/smartvpn.classes.vpninstaller.ts

@@ -0,0 +1,126 @@
+import * as plugins from './smartvpn.plugins.js';
+import type { TVpnPlatform, IVpnServiceUnit } from './smartvpn.interfaces.js';
+
+/**
+ * Install the smartvpn daemon as a system service.
+ */
+export class VpnInstaller {
+  /**
+   * Detect the current platform.
+   */
+  public static detectPlatform(): TVpnPlatform {
+    switch (process.platform) {
+      case 'linux':
+        return 'linux';
+      case 'darwin':
+        return 'macos';
+      case 'win32':
+        return 'windows';
+      default:
+        return 'unknown';
+    }
+  }
+
+  /**
+   * Generate a systemd unit file for Linux.
+   */
+  public static generateSystemdUnit(options: {
+    binaryPath: string;
+    socketPath: string;
+    mode: 'client' | 'server';
+    configPath?: string;
+    description?: string;
+  }): IVpnServiceUnit {
+    const desc = options.description || `SmartVPN ${options.mode} daemon`;
+    const content = `[Unit]
+Description=${desc}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${options.binaryPath} --management-socket ${options.socketPath} --mode ${options.mode}
+Restart=always
+RestartSec=5
+LimitNOFILE=65535
+
+# Security hardening
+NoNewPrivileges=no
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/run /dev/net/tun
+PrivateTmp=yes
+
+[Install]
+WantedBy=multi-user.target
+`;
+
+    return {
+      platform: 'linux',
+      content,
+      installPath: `/etc/systemd/system/smartvpn-${options.mode}.service`,
+    };
+  }
+
+  /**
+   * Generate a launchd plist for macOS.
+   */
+  public static generateLaunchdPlist(options: {
+    binaryPath: string;
+    socketPath: string;
+    mode: 'client' | 'server';
+    description?: string;
+  }): IVpnServiceUnit {
+    const label = `rocks.push.smartvpn.${options.mode}`;
+    const content = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${label}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${options.binaryPath}</string>
+    <string>--management-socket</string>
+    <string>${options.socketPath}</string>
+    <string>--mode</string>
+    <string>${options.mode}</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardErrorPath</key>
+  <string>/var/log/smartvpn-${options.mode}.err.log</string>
+  <key>StandardOutPath</key>
+  <string>/var/log/smartvpn-${options.mode}.out.log</string>
+</dict>
+</plist>
+`;
+
+    return {
+      platform: 'macos',
+      content,
+      installPath: `/Library/LaunchDaemons/${label}.plist`,
+    };
+  }
+
+  /**
+   * Generate the appropriate service unit for the current platform.
+   */
+  public static generateServiceUnit(options: {
+    binaryPath: string;
+    socketPath: string;
+    mode: 'client' | 'server';
+  }): IVpnServiceUnit {
+    const platform = VpnInstaller.detectPlatform();
+    switch (platform) {
+      case 'linux':
+        return VpnInstaller.generateSystemdUnit(options);
+      case 'macos':
+        return VpnInstaller.generateLaunchdPlist(options);
+      default:
+        throw new Error(`VpnInstaller: unsupported platform: ${platform}`);
+    }
+  }
+}

package/ts/smartvpn.classes.vpnserver.ts

@@ -0,0 +1,107 @@
+import * as plugins from './smartvpn.plugins.js';
+import { VpnBridge } from './smartvpn.classes.vpnbridge.js';
+import type {
+  IVpnServerOptions,
+  IVpnServerConfig,
+  IVpnStatus,
+  IVpnServerStatistics,
+  IVpnClientInfo,
+  IVpnKeypair,
+  TVpnServerCommands,
+} from './smartvpn.interfaces.js';
+
+/**
+ * VPN Server — manages a smartvpn daemon in server mode.
+ */
+export class VpnServer extends plugins.events.EventEmitter {
+  private bridge: VpnBridge<TVpnServerCommands>;
+  private options: IVpnServerOptions;
+
+  constructor(options: IVpnServerOptions) {
+    super();
+    this.options = options;
+    this.bridge = new VpnBridge<TVpnServerCommands>({
+      transport: options.transport,
+      mode: 'server',
+    });
+
+    // Forward bridge events
+    this.bridge.on('exit', (code: number | null, signal: string | null) => {
+      this.emit('exit', { code, signal });
+    });
+    this.bridge.on('reconnected', () => {
+      this.emit('reconnected');
+    });
+  }
+
+  /**
+   * Start the daemon bridge (spawn or connect).
+   */
+  public async start(config?: IVpnServerConfig): Promise<void> {
+    const started = await this.bridge.start();
+    if (!started) {
+      throw new Error('VpnServer: failed to start daemon bridge');
+    }
+    const cfg = config || this.options.config;
+    if (cfg) {
+      await this.bridge.sendCommand('start', { config: cfg });
+    }
+  }
+
+  /**
+   * Stop the VPN server.
+   */
+  public async stopServer(): Promise<void> {
+    await this.bridge.sendCommand('stop', {} as Record<string, never>);
+  }
+
+  /**
+   * Get server status.
+   */
+  public async getStatus(): Promise<IVpnStatus> {
+    return this.bridge.sendCommand('getStatus', {} as Record<string, never>);
+  }
+
+  /**
+   * Get server statistics.
+   */
+  public async getStatistics(): Promise<IVpnServerStatistics> {
+    return this.bridge.sendCommand('getStatistics', {} as Record<string, never>);
+  }
+
+  /**
+   * List connected clients.
+   */
+  public async listClients(): Promise<IVpnClientInfo[]> {
+    const result = await this.bridge.sendCommand('listClients', {} as Record<string, never>);
+    return result.clients;
+  }
+
+  /**
+   * Disconnect a specific client.
+   */
+  public async disconnectClient(clientId: string): Promise<void> {
+    await this.bridge.sendCommand('disconnectClient', { clientId });
+  }
+
+  /**
+   * Generate a new Noise keypair.
+   */
+  public async generateKeypair(): Promise<IVpnKeypair> {
+    return this.bridge.sendCommand('generateKeypair', {} as Record<string, never>);
+  }
+
+  /**
+   * Stop the daemon bridge.
+   */
+  public stop(): void {
+    this.bridge.stop();
+  }
+
+  /**
+   * Whether the bridge is running.
+   */
+  public get running(): boolean {
+    return this.bridge.running;
+  }
+}

package/ts/smartvpn.interfaces.ts

@@ -0,0 +1,166 @@
+// ============================================================================
+// Transport options
+// ============================================================================
+
+export interface IVpnTransportStdio {
+  transport: 'stdio';
+}
+
+export interface IVpnTransportSocket {
+  transport: 'socket';
+  socketPath: string;
+  autoReconnect?: boolean;
+  reconnectBaseDelayMs?: number;
+  reconnectMaxDelayMs?: number;
+  maxReconnectAttempts?: number;
+}
+
+export type TVpnTransportOptions = IVpnTransportStdio | IVpnTransportSocket;
+
+// ============================================================================
+// Client configuration
+// ============================================================================
+
+export interface IVpnClientConfig {
+  /** Server WebSocket URL, e.g. wss://vpn.example.com/tunnel */
+  serverUrl: string;
+  /** Server's static public key (base64) for Noise NK handshake */
+  serverPublicKey: string;
+  /** Optional DNS servers to use while connected */
+  dns?: string[];
+  /** Optional MTU for the TUN device */
+  mtu?: number;
+  /** Keepalive interval in seconds (default: 30) */
+  keepaliveIntervalSecs?: number;
+}
+
+export interface IVpnClientOptions {
+  transport: TVpnTransportOptions;
+  config?: IVpnClientConfig;
+}
+
+// ============================================================================
+// Server configuration
+// ============================================================================
+
+export interface IVpnServerConfig {
+  /** Listen address for WebSocket, e.g. 0.0.0.0:443 */
+  listenAddr: string;
+  /** TLS certificate PEM (optional — can be behind reverse proxy) */
+  tlsCert?: string;
+  /** TLS private key PEM */
+  tlsKey?: string;
+  /** Server's Noise static private key (base64) */
+  privateKey: string;
+  /** Server's Noise static public key (base64) */
+  publicKey: string;
+  /** IP subnet for VPN clients, e.g. 10.8.0.0/24 */
+  subnet: string;
+  /** DNS servers pushed to clients */
+  dns?: string[];
+  /** MTU for TUN device */
+  mtu?: number;
+  /** Keepalive interval in seconds (default: 30) */
+  keepaliveIntervalSecs?: number;
+  /** Enable NAT/masquerade for client traffic */
+  enableNat?: boolean;
+}
+
+export interface IVpnServerOptions {
+  transport: TVpnTransportOptions;
+  config?: IVpnServerConfig;
+}
+
+// ============================================================================
+// Status and statistics
+// ============================================================================
+
+export type TVpnConnectionState =
+  | 'disconnected'
+  | 'connecting'
+  | 'handshaking'
+  | 'connected'
+  | 'reconnecting'
+  | 'error';
+
+export interface IVpnStatus {
+  state: TVpnConnectionState;
+  assignedIp?: string;
+  serverAddr?: string;
+  connectedSince?: string;
+  lastError?: string;
+}
+
+export interface IVpnStatistics {
+  bytesSent: number;
+  bytesReceived: number;
+  packetsSent: number;
+  packetsReceived: number;
+  keepalivesSent: number;
+  keepalivesReceived: number;
+  uptimeSeconds: number;
+}
+
+export interface IVpnClientInfo {
+  clientId: string;
+  assignedIp: string;
+  connectedSince: string;
+  bytesSent: number;
+  bytesReceived: number;
+}
+
+export interface IVpnServerStatistics extends IVpnStatistics {
+  activeClients: number;
+  totalConnections: number;
+}
+
+export interface IVpnKeypair {
+  publicKey: string;
+  privateKey: string;
+}
+
+// ============================================================================
+// IPC Command maps (used by smartrust RustBridge<TCommands>)
+// ============================================================================
+
+export type TVpnClientCommands = {
+  connect: { params: { config: IVpnClientConfig }; result: { assignedIp: string } };
+  disconnect: { params: Record<string, never>; result: void };
+  getStatus: { params: Record<string, never>; result: IVpnStatus };
+  getStatistics: { params: Record<string, never>; result: IVpnStatistics };
+};
+
+export type TVpnServerCommands = {
+  start: { params: { config: IVpnServerConfig }; result: void };
+  stop: { params: Record<string, never>; result: void };
+  getStatus: { params: Record<string, never>; result: IVpnStatus };
+  getStatistics: { params: Record<string, never>; result: IVpnServerStatistics };
+  listClients: { params: Record<string, never>; result: { clients: IVpnClientInfo[] } };
+  disconnectClient: { params: { clientId: string }; result: void };
+  generateKeypair: { params: Record<string, never>; result: IVpnKeypair };
+};
+
+// ============================================================================
+// Installer
+// ============================================================================
+
+export type TVpnPlatform = 'linux' | 'macos' | 'windows' | 'unknown';
+
+export interface IVpnServiceUnit {
+  platform: TVpnPlatform;
+  content: string;
+  installPath: string;
+}
+
+// ============================================================================
+// Events emitted by VpnClient / VpnServer
+// ============================================================================
+
+export interface IVpnEventMap {
+  'status': IVpnStatus;
+  'error': { message: string; code?: string };
+  'client-connected': IVpnClientInfo;
+  'client-disconnected': { clientId: string; reason?: string };
+  'exit': { code: number | null; signal: string | null };
+  'reconnected': void;
+}

package/ts/smartvpn.paths.ts

@@ -0,0 +1,6 @@
+import * as plugins from './smartvpn.plugins.js';
+
+export const packageDir = plugins.path.join(
+  plugins.smartpath.get.dirnameFromImportMetaUrl(import.meta.url),
+  '../',
+);

package/ts/smartvpn.plugins.ts

@@ -0,0 +1,14 @@
+// node native
+import * as path from 'path';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as url from 'url';
+import * as events from 'events';
+
+export { path, fs, os, url, events };
+
+// @push.rocks
+import * as smartpath from '@push.rocks/smartpath';
+import * as smartrust from '@push.rocks/smartrust';
+
+export { smartpath, smartrust };