gea-program 0.74.0__tar.gz → 0.75.1__tar.gz

{gea_program-0.74.0/gea_program.egg-info → gea_program-0.75.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gea-program
-Version: 0.74.0
+Version: 0.75.1
 Summary: GEA-Program: downhole gauge monitoring - canonical measurement records, quality rules, drift evaluation with a re-fit change log, well-test validation, alarm management, model cards, store-and-forward, monthly SLA measurement, FAT/SAT protocols and a dashboard, generated from live objects in the client's reporting outline.
 Author: Daniel T. Murphy
 License: MPL-2.0
@@ -463,6 +463,29 @@ keeps them byte for byte and makes the array and electrode stations of
 them. `gea help recorder`; the box's README has the parts, the wiring and
 the clock.
 
+### GEA-VPN: the programs on separate computers, one private network
+
+The control panel, each pad's recorder, the operator's window and the
+client's reader run on separate computers in separate places. GEA-VPN
+(since 0.75.0; the Administration tab's card, `gea help vpn`) joins them
+into one private WireGuard network over the internet: the office reaches
+every box at a fixed private address (`http://10.77.0.3:8780`) as if it
+sat on the pad's cable - the pull, the live monitor - and nothing else on
+the internet can see any of them. One hub is needed, a small Debian or
+Ubuntu server of the site's own with a public address (UDP 51820); every
+member connects out to it and it forwards between the office and each
+member - members never see one another. GEA makes every key and writes
+every configuration: enter the hub's address, **Make the network**, copy
+`gea-vpn-hub.zip` to the hub and run `sudo sh install-hub.sh`; install
+WireGuard on the office PC from wireguard.com and import the office's
+`gea-vpn.conf`; add a member per computer and hand it its zip (a box's
+holds `vpn.sh`, run once on the Pi; a window imports its `gea-vpn.conf`),
+then run the hub installer again. The keys stay in
+`keys\vpn\network.json`, owner-only, in the backup and never in the
+dossier. From a terminal: `gea vpn --workspace C:\site --create
+vpn.pad3site.com`, `gea vpn --workspace C:\site --add "Pad 3 box" --kind
+box`, `gea vpn --workspace C:\site`.
+
 ### The image: drill-bit seismic from the ground
 
 While a well is drilled the program knows where the bit is - the survey and
@@ -757,7 +780,7 @@ unsigned, the key hand-overs - and shows the reports as they were signed. A
 reader made from the workspace knows the site's key fingerprints, so it
 says whether a dossier is the site's; it allows no network request, and it
 leaves the trusted time-stamp to `verify_dossier.py`. For a client who wants
-it installed, every release also carries `GEA-Reader-Setup-0.74.0.exe`: GEA
+it installed, every release also carries `GEA-Reader-Setup-0.75.1.exe`: GEA
 Reader as a Windows program of its own - its own icon and taskbar button,
 Check with GEA Reader on a dossier's right-click menu, fingerprints the client
 saves kept on that computer, nothing of GEA-Program. `gea help reader`.
@@ -1522,7 +1545,7 @@ attaches the zips to the GitHub release of that tag.
 
 ### The Windows installer
 
-Every release also carries `GEA-Program-Setup-0.74.0.exe` (for 0.74.0): the
+Every release also carries `GEA-Program-Setup-0.75.1.exe` (for 0.75.1): the
 same Windows kit installed like any Windows program, for the signed-in user
 alone and with no administrator rights (`%LOCALAPPDATA%\Programs\GEA-Program`).
 It asks for the site workspace (an existing one such as `C:\site` is used as
@@ -1541,7 +1564,7 @@ it, removes the program and leaves the workspace. Silent, for a site's
 software deployment:
 
 ```
-GEA-Program-Setup-0.74.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
+GEA-Program-Setup-0.75.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
 ```
 
 The setup is built by Inno Setup 6 from `tools/installer.iss` in the same

{gea_program-0.74.0 → gea_program-0.75.1}/README.md

@@ -424,6 +424,29 @@ keeps them byte for byte and makes the array and electrode stations of
 them. `gea help recorder`; the box's README has the parts, the wiring and
 the clock.
 
+### GEA-VPN: the programs on separate computers, one private network
+
+The control panel, each pad's recorder, the operator's window and the
+client's reader run on separate computers in separate places. GEA-VPN
+(since 0.75.0; the Administration tab's card, `gea help vpn`) joins them
+into one private WireGuard network over the internet: the office reaches
+every box at a fixed private address (`http://10.77.0.3:8780`) as if it
+sat on the pad's cable - the pull, the live monitor - and nothing else on
+the internet can see any of them. One hub is needed, a small Debian or
+Ubuntu server of the site's own with a public address (UDP 51820); every
+member connects out to it and it forwards between the office and each
+member - members never see one another. GEA makes every key and writes
+every configuration: enter the hub's address, **Make the network**, copy
+`gea-vpn-hub.zip` to the hub and run `sudo sh install-hub.sh`; install
+WireGuard on the office PC from wireguard.com and import the office's
+`gea-vpn.conf`; add a member per computer and hand it its zip (a box's
+holds `vpn.sh`, run once on the Pi; a window imports its `gea-vpn.conf`),
+then run the hub installer again. The keys stay in
+`keys\vpn\network.json`, owner-only, in the backup and never in the
+dossier. From a terminal: `gea vpn --workspace C:\site --create
+vpn.pad3site.com`, `gea vpn --workspace C:\site --add "Pad 3 box" --kind
+box`, `gea vpn --workspace C:\site`.
+
 ### The image: drill-bit seismic from the ground
 
 While a well is drilled the program knows where the bit is - the survey and
@@ -718,7 +741,7 @@ unsigned, the key hand-overs - and shows the reports as they were signed. A
 reader made from the workspace knows the site's key fingerprints, so it
 says whether a dossier is the site's; it allows no network request, and it
 leaves the trusted time-stamp to `verify_dossier.py`. For a client who wants
-it installed, every release also carries `GEA-Reader-Setup-0.74.0.exe`: GEA
+it installed, every release also carries `GEA-Reader-Setup-0.75.1.exe`: GEA
 Reader as a Windows program of its own - its own icon and taskbar button,
 Check with GEA Reader on a dossier's right-click menu, fingerprints the client
 saves kept on that computer, nothing of GEA-Program. `gea help reader`.
@@ -1483,7 +1506,7 @@ attaches the zips to the GitHub release of that tag.
 
 ### The Windows installer
 
-Every release also carries `GEA-Program-Setup-0.74.0.exe` (for 0.74.0): the
+Every release also carries `GEA-Program-Setup-0.75.1.exe` (for 0.75.1): the
 same Windows kit installed like any Windows program, for the signed-in user
 alone and with no administrator rights (`%LOCALAPPDATA%\Programs\GEA-Program`).
 It asks for the site workspace (an existing one such as `C:\site` is used as
@@ -1502,7 +1525,7 @@ it, removes the program and leaves the workspace. Silent, for a site's
 software deployment:
 
 ```
-GEA-Program-Setup-0.74.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
+GEA-Program-Setup-0.75.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
 ```
 
 The setup is built by Inno Setup 6 from `tools/installer.iss` in the same

{gea_program-0.74.0 → gea_program-0.75.1}/gea/__init__.py

@@ -123,7 +123,7 @@ from .profile_catalog import (
     read_pangaea_txt,
 )
 
-__version__ = "0.74.0"
+__version__ = "0.75.1"
 __all__ = [
     "aging_rate", "rate_psi_yr", "accuracy_psi",
     "Sensor", "SimulatorConfig", "DownholeEngine",

{gea_program-0.74.0 → gea_program-0.75.1}/gea/__main__.py

@@ -1023,6 +1023,19 @@ def main(argv=None) -> int:
     p_up.add_argument("--install", type=str, default=None, help="run the fetched GEA-Program-Setup of this version (Windows): the control panel stops and comes back")
     p_up.add_argument("--actor", type=str, default="cli")
 
+    p_vp = sub.add_parser("vpn", help="GEA-VPN: the private WireGuard network the programs talk over - make it, add and remove members, write the hub installer and every member's configuration (the Administration card does the same by clicking)")
+    p_vp.add_argument("--workspace", type=str, default=None, help="the workspace (C:\\site); keys in keys\\vpn\\network.json, files under exports\\vpn")
+    p_vp.add_argument("--create", type=str, default=None, metavar="HOST", help="make the network with the hub at this public name or address (vpn.pad3site.com or 203.0.113.10); the office member is made with it")
+    p_vp.add_argument("--port", type=int, default=None, help="with --create or --hub: the hub's UDP port (default 51820)")
+    p_vp.add_argument("--subnet", type=str, default=None, help="with --create: the private subnet (default 10.77.0.0/24)")
+    p_vp.add_argument("--hub", type=str, default=None, metavar="HOST", help="change the hub's public name or address; every configuration is written again")
+    p_vp.add_argument("--add", type=str, default=None, metavar="NAME", help="add a member of this name (Pad 3 box) of the --kind")
+    p_vp.add_argument("--kind", type=str, default="box", help="with --add: office, box, operator, reader or other (default box)")
+    p_vp.add_argument("--remove", type=str, default=None, metavar="ID", help="remove the member of this id (pad-3-box); run the hub installer again after")
+    p_vp.add_argument("--bundles", action="store_true", help="write the hub installer and every member's configuration again")
+    p_vp.add_argument("--json", action="store_true")
+    p_vp.add_argument("--actor", type=str, default="cli")
+
     p_nt = sub.add_parser("notify", help="notification rules: validate the configuration, send a test message, show the delivery log")
     p_nt.add_argument("--workspace", type=str, default=None)
     p_nt.add_argument("--test", type=str, default=None, help="send a test message through this channel name")
@@ -2358,6 +2371,40 @@ def main(argv=None) -> int:
             return 0
         from .doctor import update as _update
         return _update(check_only=a.check, extras=a.extras, as_json=a.json)
+    elif a.cmd == "vpn":
+        import json as _json
+        from . import vpn as VP
+        from .workspace import Workspace
+        wsp = a.workspace or os.environ.get("GEA_WORKSPACE")
+        if not wsp:
+            raise SystemExit("vpn needs --workspace C:\\site")
+        ws = Workspace(wsp)
+        try:
+            if a.create:
+                VP.create(ws, a.actor, a.create, hub_port=a.port or VP.DEFAULT_PORT, subnet=a.subnet or VP.DEFAULT_SUBNET)
+                print(f"the network is made; hub {a.create}:{a.port or VP.DEFAULT_PORT}")
+            if a.hub:
+                VP.set_hub(ws, a.actor, a.hub, a.port)
+                print(f"the hub is now {a.hub}")
+            if a.add:
+                m = VP.add_member(ws, a.actor, a.add, a.kind)
+                print(f"added {m['name']} ({m['kind']}) at {m['address']}: gea-vpn-{m['id']}.zip; run the hub installer again")
+            if a.remove:
+                m = VP.remove_member(ws, a.actor, a.remove)
+                print(f"removed {m['name']} ({m['address']}); run the hub installer again")
+            if a.bundles:
+                b = VP.write_bundles(ws, a.actor)
+                print("written: " + ", ".join(sorted(b)))
+        except VP.VpnError as e:
+            raise SystemExit(f"vpn: {e}")
+        if a.json:
+            print(_json.dumps(VP.status(ws, probes=False), indent=1))
+        else:
+            print(VP.text(ws))
+            st = VP.status(ws, probes=False)
+            if st["network"]:
+                print(f"  files: {st['exports_dir']}")
+        return 0
     elif a.cmd == "checklist":
         import json as _json
         from . import setup_checklist as _SC

{gea_program-0.74.0 → gea_program-0.75.1}/gea/acceptance_tests.py

@@ -15913,7 +15913,8 @@ def section_dr_field_recorder(tmp: str) -> None:
             "started": st["running"] is True and st["pid"] and st["already_running"] is False and st["health"]["station"] == "SIM" and st["health"]["site"] == "Pad 3 sim",
             "live": live is not None and live["recording"] is True and len(live["channels"]) == 6,
             "stopped": sp["stopped"] is True and sp["running"] is False and RL.health(port, timeout=0.5) is None,
-            "closed": len(man3["files"]) == 6 and all(Path(RL.sim_dir(ws3), "data", e["file"]).is_file() for e in man3["files"]),
+            # six channels, a file each - two each when the run crossed a minute (the simulated box splits its files every minute)
+            "closed": len({e["sensor_id"] for e in man3["files"]}) == 6 and len(man3["files"]) in (6, 12) and all(Path(RL.sim_dir(ws3), "data", e["file"]).is_file() for e in man3["files"]),
             "pulled": [s_["kind"] for s_ in r4["stations"]] == ["array", "electrodes"] and len(r4["stations"][0]["sensors"]) == 4,
             "monitor_url": RL.monitor_url("192.168.1.50") == "http://192.168.1.50:8780/live" and RL.monitor_url("http://192.168.1.50:8780/") == "http://192.168.1.50:8780/live",
             "audit": "field.sim_start" in acts3 and "field.sim_stop" in acts3,
@@ -16065,6 +16066,224 @@ def section_ds_updates(tmp: str) -> None:
        "--install, and the help page carry it" + (f" [failed: {', '.join(failed3)}]" if failed3 else ""))
 
 
+def section_dt_vpn(tmp: str) -> None:
+    """Section DT - GEA-VPN: the programs on separate computers in separate places joined by a WireGuard network GEA
+    manages. The key agreement against RFC 7748's test vectors (and against `wg pubkey` where the tools are here);
+    a network made, members added and removed with the refusals (a second office, a name twice, a public subnet,
+    a bad host); every configuration's contents (what each kind may reach, the pre-shared key, the keepalive, the
+    hub's forwarding rules); the installer and member bundles, read back by wg-quick where it is installed and by
+    sh -n; the private keys in one owner-only file that the backup carries; the routes, the card, the command and
+    the help."""
+    import base64
+    import http.cookiejar
+    import io
+    import shutil
+    import stat
+    import subprocess
+    import urllib.error
+    import urllib.request
+    import zipfile
+    from . import backup as BK
+    from . import helplib as H
+    from . import vpn as VP
+    from . import x25519 as X
+    from .service import Service, Users
+    from .workspace import Workspace
+    pkg = Path(__file__).parent
+    d = Path(tmp, "dt"); d.mkdir()
+    # -- DT1 the key agreement -----------------------------------------------------------------------------------------------
+    k1 = bytes.fromhex("a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4")
+    u1 = bytes.fromhex("e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c")
+    r1 = "c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552"
+    a_priv = bytes.fromhex("77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a")
+    b_priv = bytes.fromhex("5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb")
+    a_pub = "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a"
+    b_pub = "de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f"
+    shared = "4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742"
+    pub_a = X.public_key(a_priv); pub_b = X.public_key(b_priv)
+    wg = shutil.which("wg") if os.name != "nt" else None
+    wg_same = None
+    if wg:
+        try:
+            wg_same = all(subprocess.run([wg, "pubkey"], input=pv, capture_output=True, text=True, timeout=5).stdout.strip() == pb
+                          for pv, pb in [X.keypair_b64() for _ in range(3)])
+        except Exception:
+            wg_same = False
+    kp = X.keypair_b64()
+    c1 = {
+        "rfc_vector": X.x25519(k1, u1).hex() == r1,
+        "rfc_alice_bob": pub_a.hex() == a_pub and pub_b.hex() == b_pub and X.x25519(a_priv, pub_b).hex() == shared and X.x25519(b_priv, pub_a).hex() == shared,
+        "keys_32": len(base64.b64decode(kp[0])) == 32 and len(base64.b64decode(kp[1])) == 32 and X.public_from_b64(kp[0]) == kp[1],
+        "clamped": (base64.b64decode(kp[0])[0] & 7) == 0 and (base64.b64decode(kp[0])[31] & 0xC0) == 0x40,
+        "wg_agrees": wg_same in (None, True),
+        "two_differ": X.keypair_b64()[0] != X.keypair_b64()[0] and len(X.preshared_b64()) == 44,
+    }
+    failed1 = [k for k, v in c1.items() if not v]
+    ok(not failed1,
+       "DT1 the program's own X25519 reproduces RFC 7748's test vector and its Alice/Bob exchange, makes clamped 32-byte key pairs whose public key "
+       + ("the WireGuard tool here agrees with" if wg else "the RFC's ladder gives") + (f" [failed: {', '.join(failed1)}]" if failed1 else ""))
+    # -- DT2 the network: made, members, refusals, the files ---------------------------------------------------------------
+    ws = Workspace.create(str(d / "ws"), "Pad 3 vpn", actor="tester")
+    refusals = {}
+    for nm, fn in (("host", lambda: VP.create(ws, "tester", "not a host!")), ("subnet", lambda: VP.create(ws, "tester", "vpn.example.com", subnet="8.8.8.0/24")),
+                   ("member_before", lambda: VP.add_member(ws, "tester", "Box", "box"))):
+        try:
+            fn(); refusals[nm] = False
+        except VP.VpnError:
+            refusals[nm] = True
+    net = VP.create(ws, "tester", "vpn.example.com")
+    box = VP.add_member(ws, "tester", "Pad 3 box", "box")
+    rd = VP.add_member(ws, "tester", "Client reader", "reader")
+    for nm, fn in (("twice", lambda: VP.create(ws, "tester", "vpn.example.com")), ("name_twice", lambda: VP.add_member(ws, "tester", "pad 3 BOX", "box")),
+                   ("second_office", lambda: VP.add_member(ws, "tester", "Office 2", "office")), ("kind", lambda: VP.add_member(ws, "tester", "X", "laptop")),
+                   ("remove_office", lambda: VP.remove_member(ws, "tester", "office")), ("remove_none", lambda: VP.remove_member(ws, "tester", "nobody"))):
+        try:
+            fn(); refusals[nm] = False
+        except VP.VpnError:
+            refusals[nm] = True
+    raw = json.loads(Path(ws.path, VP.FILE).read_text(encoding="utf-8"))
+    office = next(m for m in raw["members"] if m["kind"] == "office")
+    bm = next(m for m in raw["members"] if m["id"] == box["id"])
+    mc_box = VP.member_conf(raw, bm); mc_off = VP.member_conf(raw, office); hc = VP.hub_conf(raw)
+    mode_ok = True
+    if os.name != "nt":
+        mode_ok = stat.S_IMODE(os.stat(Path(ws.path, VP.FILE)).st_mode) == 0o600
+    st = VP.status(ws, probes=False)
+    pub_json = json.dumps(st)
+    c2 = {
+        "refusals": all(refusals.values()) and len(refusals) == 9,
+        "addresses": office["address"] == "10.77.0.2" and box["address"] == "10.77.0.3" and rd["address"] == "10.77.0.4" and raw["hub"]["address"] == "10.77.0.1",
+        "keys_private": mode_ok and all(m.get("private_key") and m.get("preshared_key") for m in raw["members"]) and raw["hub"]["private_key"]
+                        and all(X.public_from_b64(m["private_key"]) == m["public_key"] for m in raw["members"]) and X.public_from_b64(raw["hub"]["private_key"]) == raw["hub"]["public_key"],
+        "status_no_keys": "private_key" not in pub_json and "preshared_key" not in pub_json and len(st["network"]["members"]) == 3,
+        "box_conf": f"PrivateKey = {bm['private_key']}" in mc_box and f"PresharedKey = {bm['preshared_key']}" in mc_box and "AllowedIPs = 10.77.0.1/32, 10.77.0.2/32" in mc_box
+                    and "Endpoint = vpn.example.com:51820" in mc_box and "PersistentKeepalive = 25" in mc_box and f"PublicKey = {raw['hub']['public_key']}" in mc_box,
+        "office_conf": "AllowedIPs = 10.77.0.0/24" in mc_off and "Address = 10.77.0.2/32" in mc_off,
+        "hub_conf": "ListenPort = 51820" in hc and hc.count("[Peer]") == 3 and all(f"PublicKey = {m['public_key']}" in hc and f"AllowedIPs = {m['address']}/32" in hc for m in raw["members"])
+                    and "-s 10.77.0.2/32 -j ACCEPT" in hc and "-d 10.77.0.2/32 -j ACCEPT" in hc and "-o gea-vpn -j DROP" in hc and "PostDown" in hc and raw["hub"]["private_key"] in hc,
+        "audit": {"vpn.create", "vpn.member.add"} <= {a["action"] for a in ws.audit_log()},
+    }
+    failed2 = [k for k, v in c2.items() if not v]
+    ok(not failed2,
+       "DT2 a network made with its office; a box and a reader added at the next addresses; nine refusals (a bad host, a public subnet, a member before "
+       "a network, a second network, a name twice, a second office, an unknown kind, removing the office, removing nobody); every private key in one "
+       "owner-only file and nowhere in the status; a box reaches the hub and the office only, the office the whole subnet, every member with a "
+       "pre-shared key and a keepalive; the hub lists every member and forwards office<->member only" + (f" [failed: {', '.join(failed2)}]" if failed2 else ""))
+    # -- DT3 the bundles -----------------------------------------------------------------------------------------------------
+    written = VP.write_bundles(ws, "tester")
+    root = Path(ws.path, "exports", "vpn")
+    hub_zip = root / "gea-vpn-hub.zip"; box_zip = root / f"gea-vpn-{box['id']}.zip"; rd_zip = root / f"gea-vpn-{rd['id']}.zip"
+    with zipfile.ZipFile(hub_zip) as z:
+        hub_names = sorted(n.split("/", 1)[1] for n in z.namelist()); install_sh = z.read("gea-vpn-hub/install-hub.sh").decode()
+    with zipfile.ZipFile(box_zip) as z:
+        box_names = sorted(n.split("/", 1)[1] for n in z.namelist()); box_conf_z = z.read(f"gea-vpn-{box['id']}/gea-vpn.conf").decode(); vpn_sh = z.read(f"gea-vpn-{box['id']}/vpn.sh").decode()
+    with zipfile.ZipFile(rd_zip) as z:
+        rd_names = sorted(n.split("/", 1)[1] for n in z.namelist())
+    sh = shutil.which("sh") if os.name != "nt" else None          # the scripts run on Linux hosts; Git's sh.exe on a Windows machine is not that
+    sh_ok = None
+    if sh:
+        try:
+            sh_ok = all(subprocess.run([sh, "-n", str(root / f)], capture_output=True, timeout=10).returncode == 0 for f in ("hub/install-hub.sh", f"{box['id']}/vpn.sh"))
+        except (OSError, subprocess.SubprocessError):
+            sh_ok = None
+    wgq = shutil.which("wg-quick") if os.name != "nt" else None
+    strip_ok = None
+    if wgq:
+        try:
+            strip_ok = all(subprocess.run([wgq, "strip", str(root / f)], capture_output=True, timeout=10).returncode == 0 for f in ("hub/gea-vpn.conf", f"{box['id']}/gea-vpn.conf", "office/gea-vpn.conf"))
+        except (OSError, subprocess.SubprocessError):
+            strip_ok = None
+    removed = VP.remove_member(ws, "tester", rd["id"])
+    rd_gone_at_once = not rd_zip.exists() and not (root / rd["id"]).exists()
+    VP.write_bundles(ws, "tester")
+    after = VP.status(ws, probes=False)
+    hc2 = (root / "hub" / "gea-vpn.conf").read_text(encoding="utf-8")
+    c3 = {
+        "written": set(written) == {"hub", "office", box["id"], rd["id"]},
+        "hub_zip": hub_names == ["README.txt", "gea-vpn.conf", "install-hub.sh"] and "wg syncconf" in install_sh and "PORT=51820" in install_sh and "$PORT/udp" in install_sh and "ip_forward" in install_sh and "IFACE=gea-vpn" in install_sh and "wg-quick@$IFACE" in install_sh,
+        "box_zip": box_names == ["gea-vpn.conf", "vpn.sh"] and box_conf_z == (root / box["id"] / "gea-vpn.conf").read_text(encoding="utf-8") and "IFACE=gea-vpn" in vpn_sh and "wg-quick@$IFACE" in vpn_sh and "wireguard" in vpn_sh,
+        "reader_zip": rd_names == ["README.txt", "gea-vpn.conf"],
+        "sh_n": sh_ok in (None, True),
+        "wg_quick_strip": strip_ok in (None, True),
+        "removed": removed["id"] == rd["id"] and rd_gone_at_once and f"gea-vpn-{rd['id']}.zip" not in after["bundles"] and not rd_zip.exists() and rd["public_key"] not in hc2
+                   and len(after["network"]["members"]) == 2 and box["public_key"] in hc2,
+    }
+    failed3 = [k for k, v in c3.items() if not v]
+    ok(not failed3,
+       "DT3 the hub bundle (the configuration, an idempotent installer that opens 51820/udp, turns forwarding on and syncs a running tunnel, a README) "
+       "and a bundle per member (a box's with vpn.sh, a window's with a README)" + (", read back by wg-quick strip" if wgq else "") + (", sh -n clean" if sh else "")
+       + "; a member removed leaves the hub's configuration and the files without it" + (f" [failed: {', '.join(failed3)}]" if failed3 else ""))
+    # -- DT4 the backup carries the keys; the routes; the card; the command; the help --------------------------------------
+    bk = BK.make(ws.path, str(d / "bk"), actor="tester")
+    with zipfile.ZipFile(bk["path"]) as z:
+        bk_names = z.namelist()
+    Users(str(Path(ws.path, "users.json"))).add("adm", "admin-pass-123", "admin")
+    Users(str(Path(ws.path, "users.json"))).add("op", "op-pass-123", "operator")
+    svc = Service(ws.path, port=0, scheduler=False).start()
+    base = svc.url.rstrip("/")
+
+    def opener_():
+        return urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()))
+
+    def call(op, method, path, body=None, raw_=False):
+        rq = urllib.request.Request(base + path, method=method, data=(json.dumps(body).encode() if body is not None else None))
+        rq.add_header("Content-Type", "application/json"); rq.add_header("X-GEA-Action", "1")
+        try:
+            with op.open(rq, timeout=60) as rr_:
+                data = rr_.read()
+                return rr_.status, (data if raw_ else json.loads(data)), rr_.headers
+        except urllib.error.HTTPError as e:
+            return e.code, (e.read() if raw_ else json.loads(e.read() or b"{}")), e.headers
+    try:
+        anon = opener_()
+        s_anon, _, _ = call(anon, "GET", "/api/vpn")
+        op_ = opener_(); call(op_, "POST", "/api/login", {"name": "op", "password": "op-pass-123"})
+        s_op, _, _ = call(op_, "GET", "/api/vpn")
+        s_opz, _, _ = call(op_, "GET", "/api/vpn/bundle/gea-vpn-hub.zip", raw_=True)
+        adm = opener_(); call(adm, "POST", "/api/login", {"name": "adm", "password": "admin-pass-123"})
+        s_st, st_, _ = call(adm, "GET", "/api/vpn?probe=0")
+        s_add, added, _ = call(adm, "POST", "/api/vpn/members", {"name": "Operator window", "kind": "operator"})
+        s_dup, _, _ = call(adm, "POST", "/api/vpn/members", {"name": "Operator window", "kind": "operator"})
+        s_bad, _, _ = call(adm, "POST", "/api/vpn/create", {"hub_host": "x"})
+        s_z, zbytes, zh = call(adm, "GET", "/api/vpn/bundle/gea-vpn-operator-window.zip", raw_=True)
+        s_trav, _, _ = call(adm, "GET", "/api/vpn/bundle/..%2fnetwork.json", raw_=True)
+        s_other, _, _ = call(adm, "GET", "/api/vpn/bundle/gea-vpn-nobody.zip", raw_=True)
+        s_rm, _, _ = call(adm, "POST", f"/api/vpn/members/{added.get('id', 'operator-window')}/remove")
+        s_hub, hub_, _ = call(adm, "POST", "/api/vpn/hub", {"host": "203.0.113.10", "port": 51821})
+        s_b, _, _ = call(adm, "POST", "/api/vpn/bundles")
+    finally:
+        svc.stop()
+    zip_ok = False
+    try:
+        with zipfile.ZipFile(io.BytesIO(zbytes)) as z:
+            zip_ok = "gea-vpn-operator-window/gea-vpn.conf" in z.namelist()
+    except Exception:
+        pass
+    app_src = (pkg / "web" / "app.html").read_text(encoding="utf-8")
+    main_src = (pkg / "__main__.py").read_text(encoding="utf-8")
+    sec_doc = (pkg / "help" / "IT_SECURITY.md").read_text(encoding="utf-8")
+    final = VP.status(ws, probes=False)
+    c4 = {
+        "backup_keys": "keys/vpn/network.json" in bk_names,
+        "anon_op": s_anon in (401, 403) and s_op == 403 and s_opz == 403,
+        "status": s_st == 200 and st_["network"]["hub"]["host"] == "vpn.example.com" and "private_key" not in json.dumps(st_) and "gea-vpn-hub.zip" in st_["bundles"],
+        "add": s_add == 200 and s_dup == 400 and s_bad == 400,
+        "download": s_z == 200 and zip_ok and "attachment" in str(zh.get("Content-Disposition", "")) and s_trav in (400, 404) and s_other == 404,
+        "remove_hub": s_rm == 200 and s_hub == 200 and s_b == 200 and final["network"]["hub"]["host"] == "203.0.113.10" and final["network"]["hub"]["port"] == 51821
+                      and len(final["network"]["members"]) == 2 and "203.0.113.10:51821" in (root / "office" / "gea-vpn.conf").read_text(encoding="utf-8"),
+        "audit_download": {"vpn.bundle.download", "vpn.bundles", "vpn.member.remove", "vpn.hub"} <= {a["action"] for a in ws.audit_log()},
+        "card": all(t_ in app_src for t_ in ("vpnCardLoad", "/api/vpn/create", "/api/vpn/members", "/api/vpn/bundle/", "Make the network", "Add the member", "Make the files again", "gea-vpn-hub.zip")),
+        "cli": all(t_ in main_src for t_ in ('add_parser("vpn"', '"--create"', '"--add"', '"--remove"', '"--bundles"', "VP.add_member")),
+        "help": not H.check("vpn") and any(t_ == "vpn" for t_, _, _ in H.INDEX) and "GEA-VPN" in sec_doc and "51820" in sec_doc and "keys\\vpn\\network.json" in sec_doc,
+    }
+    failed4 = [k for k, v in c4.items() if not v]
+    ok(not failed4,
+       "DT4 the backup carries keys/vpn/network.json; the routes are admin-only (anonymous and operator refused, a bundle too), the status never "
+       "carries a private key, a name twice and a bad host are 400, a bundle downloads as an attachment and is audited, a path outside the folder "
+       "and an unknown bundle are refused, a member removed and the hub changed rewrite every file; the Administration card, the vpn command "
+       "and the help page carry it" + (f" [failed: {', '.join(failed4)}]" if failed4 else ""))
+
+
 def main() -> int:
     print("GEA-Program - ACCEPTANCE SUITE (the product gate)")
     # a handle a job subprocess still holds at the end must not turn a finished gate into a traceback on Windows:
@@ -16191,6 +16410,7 @@ def main() -> int:
         section_dq_bit_image(tmp)
         section_dr_field_recorder(tmp)
         section_ds_updates(tmp)
+        section_dt_vpn(tmp)
     if _FAILS:
         print(f"[ACCEPTANCE] {len(_FAILS)} FAILURES ({_PASS} passed):")
         for f in _FAILS:

{gea_program-0.74.0 → gea_program-0.75.1}/gea/help/IT_SECURITY.md

@@ -148,6 +148,25 @@ declared extras.
   every response carries a Content-Security-Policy (`default-src 'self'`,
   `frame-ancestors 'none'`), `X-Frame-Options: DENY`, `nosniff` and a
   same-origin referrer policy. The page loads nothing from the internet.
+- **GEA-VPN** (since 0.75.0, `gea help vpn`): the programs run on separate
+  computers in separate places and talk over a WireGuard network GEA
+  manages. One hub, a Debian or Ubuntu server of the site's own with a
+  public address, listens on UDP 51820 and forwards between the office and
+  each member (`iptables` FORWARD rule: office to any member and back
+  ACCEPT, everything else DROP, so members never reach one another);
+  members only connect out (a box behind a cellular modem opens no inbound
+  port; a keepalive every 25 s holds the tunnel). Every key pair is made by
+  GEA (X25519 by `wg genkey` where it is installed, else the program's own
+  RFC 7748 implementation checked against the RFC's vectors in the gate) and
+  every member has a pre-shared key besides. The private keys are in
+  `keys\vpn\network.json`, owner-only (0600), carried by the backup and
+  never by the dossier; a member's configuration file holds that member's
+  private key and is handed over by a channel of its own. The hub installer
+  and the member files are under `exports\vpn\`; the card's downloads are
+  admin-only and audited (`vpn.bundle.download`). The tunnel encrypts and
+  addresses; the programs' own sign-in, roles and hashes apply through it
+  unchanged, and the box's page is still bound to the pad network and the
+  tunnel address only.
 
 ## What it records
 

{gea_program-0.74.0 → gea_program-0.75.1}/gea/help/install.md

@@ -2,7 +2,7 @@
 
 > GEA-Program-Setup: the program installed for you like any Windows program - a window of its own, an icon in the notification area, Start-menu and desktop shortcuts, an Add/Remove Programs entry, upgrades in place - with no administrator rights and the site's data left where it is.
 
-**The command**: download the setup from the release on GitHub (`GEA-Program-Setup-0.74.0.exe` for this version) and run it. It installs for you alone, under `%LOCALAPPDATA%\Programs\GEA-Program`, and asks for the site workspace - the folder that holds the wells, reports, records, accounts and keys. An existing one such as `C:\site` is used exactly as it is, its name included; for a new one (by default `%LOCALAPPDATA%\GEA-Program\site`) it also asks the site's name, which heads every report, and makes the workspace with it (left empty, the workspace is named after its folder; an administrator renames the site in Administration's site settings). Then the Start menu's **GEA-Program** (and the desktop shortcut) starts the control panel when it is not running and opens it in a window of its own. A newer setup installs over the older one: it stops the control panel, replaces the program, keeps the workspace and the choices made before. For a site's software deployment: `GEA-Program-Setup-0.74.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"` (`/SITENAME` names a workspace the setup makes; one that exists keeps its own name). From a terminal: `gea launch` does what the shortcut does, `gea launch --selftest` says what it would do, `gea tray --selftest` checks the icon.
+**The command**: download the setup from the release on GitHub (`GEA-Program-Setup-0.75.1.exe` for this version) and run it. It installs for you alone, under `%LOCALAPPDATA%\Programs\GEA-Program`, and asks for the site workspace - the folder that holds the wells, reports, records, accounts and keys. An existing one such as `C:\site` is used exactly as it is, its name included; for a new one (by default `%LOCALAPPDATA%\GEA-Program\site`) it also asks the site's name, which heads every report, and makes the workspace with it (left empty, the workspace is named after its folder; an administrator renames the site in Administration's site settings). Then the Start menu's **GEA-Program** (and the desktop shortcut) starts the control panel when it is not running and opens it in a window of its own. A newer setup installs over the older one: it stops the control panel, replaces the program, keeps the workspace and the choices made before. For a site's software deployment: `GEA-Program-Setup-0.75.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"` (`/SITENAME` names a workspace the setup makes; one that exists keeps its own name). From a terminal: `gea launch` does what the shortcut does, `gea launch --selftest` says what it would do, `gea tray --selftest` checks the icon.
 
 **The window**: Microsoft Edge's app window (`msedge --app=`: the control panel with no tabs and no address bar, its own button on the taskbar, which shows the program's derrick and pins as GEA-Program, not as Edge), with a browser profile of its own (`%LOCALAPPDATA%\GEA-Program\window`, no extensions; the first time, Edge may say it signed that profile in to your Microsoft account - Got it), else Google Chrome's, else a tab in the default browser. Where the browser keeps no cookies (its settings or a policy block them), the sign-in page says so and the control panel holds the sign-in itself, in the window's address, until the window is closed. The control panel itself runs with no window of its own: `gea supervise` keeps it running in the background, starts it again when it asks for a restart, and writes everything it would have shown in a console - the start, the sign-ins, the jobs, a stop and why - to `records\console.log` in the workspace. No PowerShell or console window opens. The kit's `start-dashboard.cmd` still runs it in a console window, for a site that wants to watch it there.
 
@@ -18,7 +18,7 @@
 
 **The number to check**: Add/Remove Programs lists GEA-Program with the version you installed; `gea doctor --workspace C:\site` ends with `nothing blocks serving`; the Start menu's **Verify GEA-Program** runs the acceptance gate from the installation and ends with `[ACCEPTANCE] OK - N checks passed`. The release's build installs, upgrades and uninstalls the setup silently before it is published, with the control panel running, and checks the workspace untouched afterwards.
 
-**Signed**: when the publisher's code-signing certificate is configured for the build, the setup is signed with it (Authenticode, timestamped) and Windows names the publisher; until then it ships unsigned and Windows SmartScreen says "unknown publisher" (More info, then Run anyway). The build's provenance holds either way: `gh attestation verify GEA-Program-Setup-0.74.0.exe -R Daniel8Murphy0007/GEA-Program`. The uninstaller the setup leaves behind is Inno Setup's own and is not signed separately.
+**Signed**: when the publisher's code-signing certificate is configured for the build, the setup is signed with it (Authenticode, timestamped) and Windows names the publisher; until then it ships unsigned and Windows SmartScreen says "unknown publisher" (More info, then Run anyway). The build's provenance holds either way: `gh attestation verify GEA-Program-Setup-0.75.1.exe -R Daniel8Murphy0007/GEA-Program`. The uninstaller the setup leaves behind is Inno Setup's own and is not signed separately.
 
 **What this page will not call a measurement**: the icon's running or stopped is whether the control panel's port answers on this computer, read every three seconds - not whether every patch, job or report behind it is healthy (Home and the Verification page say that).
 

{gea_program-0.74.0 → gea_program-0.75.1}/gea/help/reader.md

@@ -4,7 +4,7 @@
 
 **The command**: Reports tab -> Signed dossiers -> **Download GEA Reader for your clients**, or `gea reader --workspace C:\site --out C:\site\GEA-Reader.html`. Send the file once, by any channel (email, a USB stick, the client's portal); send the site's key fingerprint separately - by phone, email or in the contract - as for any dossier. The client opens GEA-Reader.html, drops a dossier on it (or chooses it), and reads the verdict: **Valid** (signed with the site's key, or with a newer key the site's key handed over to), **Valid, but signed by a key you were not given**, or **Not valid** with the reason. Below the verdict: each check, the signer's fingerprint, the key hand-overs, and every file the dossier holds - a report opens in the page as it was signed, a PDF in the browser's own viewer, a table or a log as text, and any file can be saved. A dossier that lists source records by hash without carrying them lets the client choose their copies and checks each against its hash.
 
-**The program**: for a client who wants it installed, **GEA-Reader-Setup-0.74.0.exe** on the release page installs GEA Reader as a Windows program of its own, for the signed-in user, with no administrator rights and nothing of GEA-Program: GEA Reader in the Start menu and on the desktop with its own icon (a white page with a green seal, on blue) and its own taskbar button, and **Check with GEA Reader** on the right-click menu of .zip files (on Windows 11, under Show more options), which opens the dossier at once. It opens the same page in Microsoft Edge's app window with a browser profile of its own (`%LOCALAPPDATA%\GEA-Reader\window`), so a fingerprint the client saves - **Remember this fingerprint**, with whose it is - stays on that computer, and every later dossier signed with that key reads **Valid** with the name the client gave it. `GEA-Reader-portable-0.74.0.zip` is the same program to unzip and run (`GEA-Reader.cmd`). `python\python.exe -m gea_reader --selftest`, in the installed folder, checks the page, the icon, the taskbar identity and the hand-over of a dossier without opening a window.
+**The program**: for a client who wants it installed, **GEA-Reader-Setup-0.75.1.exe** on the release page installs GEA Reader as a Windows program of its own, for the signed-in user, with no administrator rights and nothing of GEA-Program: GEA Reader in the Start menu and on the desktop with its own icon (a white page with a green seal, on blue) and its own taskbar button, and **Check with GEA Reader** on the right-click menu of .zip files (on Windows 11, under Show more options), which opens the dossier at once. It opens the same page in Microsoft Edge's app window with a browser profile of its own (`%LOCALAPPDATA%\GEA-Reader\window`), so a fingerprint the client saves - **Remember this fingerprint**, with whose it is - stays on that computer, and every later dossier signed with that key reads **Valid** with the name the client gave it. `GEA-Reader-portable-0.75.1.zip` is the same program to unzip and run (`GEA-Reader.cmd`). `python\python.exe -m gea_reader --selftest`, in the installed folder, checks the page, the icon, the taskbar identity and the hand-over of a dossier without opening a window.
 
 **What it writes**: the one file, GEA-Reader.html (about 40 KB): the checks, written in the page's own script - Ed25519 (RFC 8032) in its own arithmetic, SHA-256 from the browser - and, when made from a workspace, the site's name and the fingerprints of every key it has signed with (the current one and each retired one from the key history: public halves only; the signing key never leaves `keys\`). The audit log records each download (`reader.download`) and each `gea reader` (`reader.write`) with the fingerprints the reader carried. The reader page writes nothing on the client's computer but the fingerprints a client saves (in the browser's storage for the page): it reads the zip it is given, in memory, and a saved copy goes where the client's browser saves downloads. The installed program also writes the page it opens to `%LOCALAPPDATA%\GEA-Reader\page` (with the dossier inside it when one was right-clicked; removed ten minutes later) and its right-click entry under the user's own registry keys, removed with the program.
 

{gea_program-0.74.0 → gea_program-0.75.1}/gea/help/recorder.md

@@ -2,9 +2,9 @@
 
 > GEA Recorder is the program on the pad: a Raspberry Pi in a sealed box that records the ground channels (geophones, accelerometers, electrode dipoles) through a 24-bit ADC and the rig's WITS0 feed, every sample on one GPS-disciplined clock, into hourly miniSEED files with a SHA-256 beside each and a manifest, and serves one status page on the pad network. Nothing to type: power it and it records. GEA pulls its files in and makes stations of them.
 
-**The command**: the **Seismic** tab, the card **Field recorder**: the box's address on the pad network (`http://192.168.1.50:8780` - the status page shows the address) or the folder of the USB mirror carried to the office, a station name if the site's is not wanted, then **Pull** (a job). GEA fetches the manifest, downloads every file it does not have, checks each against its SHA-256, and makes or updates two stations: the array of the ground-motion sensors (band 8-80 Hz, the sensors' positions from the box's config) and the electrode station (0.01-5 Hz); each sensor's hours are joined in order into one record, nothing re-sampled or filtered. Pull again later: only the new hours come across, and the stations are updated in place. From a terminal: `gea workspace --path C:\site --action field-pull --box http://192.168.1.50:8780`. On the box: `gea-recorder status`, `gea-recorder selftest`; `sudo sh kiosk.sh` once puts the live view full-screen on a monitor on the box's HDMI port from boot - RECORDING in green or what is wrong in red, the clock, the rig's depth, every channel's last minute and the ground sensors' spectrogram, nothing to press - and the same view is at `/live` on the box's page from any browser on the pad network; `sudo sh install.sh` once, from the release's `GEA-Recorder-0.74.0.tar.gz`; the box's README has the parts list, the wiring and the three chrony lines for the GPS clock.
+**The command**: the **Seismic** tab, the card **Field recorder**: the box's address on the pad network (`http://192.168.1.50:8780` - the status page shows the address) or the folder of the USB mirror carried to the office, a station name if the site's is not wanted, then **Pull** (a job). GEA fetches the manifest, downloads every file it does not have, checks each against its SHA-256, and makes or updates two stations: the array of the ground-motion sensors (band 8-80 Hz, the sensors' positions from the box's config) and the electrode station (0.01-5 Hz); each sensor's hours are joined in order into one record, nothing re-sampled or filtered. Pull again later: only the new hours come across, and the stations are updated in place. From a terminal: `gea workspace --path C:\site --action field-pull --box http://192.168.1.50:8780`. On the box: `gea-recorder status`, `gea-recorder selftest`; `sudo sh kiosk.sh` once puts the live view full-screen on a monitor on the box's HDMI port from boot - RECORDING in green or what is wrong in red, the clock, the rig's depth, every channel's last minute and the ground sensors' spectrogram, nothing to press - and the same view is at `/live` on the box's page from any browser on the pad network; `sudo sh install.sh` once, from the release's `GEA-Recorder-0.75.1.tar.gz`; the box's README has the parts list, the wiring and the three chrony lines for the GPS clock.
 
-**Before there is a Pi**: on the same card, **Start the simulated box**: the recorder's own program runs on this computer with its test signal in place of the ADC (a process of its own, its files under `field\sim-box\` in the workspace, its page on port 8781), **Open its monitor** shows the live screen the attendant will see, **Pull from it** brings its files in as stations, **Stop it** closes every file and lists them. **Open the box's monitor** opens any real box's live screen from its address. The kit and the setup install the recorder's program beside GEA for this; a pip install adds it with `pip install gea-recorder`.
+**Before there is a Pi**: on the same card, **Start the simulated box**: the recorder's own program runs on this computer with its test signal in place of the ADC (a process of its own, its files under `field\sim-box\` in the workspace, its page on port 8781), **Open its monitor** shows the live screen the attendant will see, **Pull from it** brings its files in as stations, **Stop it** closes every file and lists them. **Open the box's monitor** opens any real box's live screen from its address. The kit and the setup install the recorder's program beside GEA for this; a pip install adds it with `pip install gea-recorder`. **From the office, over the internet**: GEA-VPN (`gea help vpn`, Administration) gives every box a private address the office pulls from (`http://10.77.0.3:8780`) through a tunnel from the pad's cellular modem; the box's zip from that card holds `vpn.sh`, run once on the Pi.
 
 **What it needs**: the box's kit on a Raspberry Pi 4 or 5 with the ADS1256 HAT (Waveshare High-Precision AD/DA), a GPS receiver with a pulse-per-second line on GPIO 18, buried geophones and electrode pairs wired to the ADC's inputs, and the box's config: the site, the wellhead's position, each channel's input, id, kind and place in feet from the wellhead, the ADC driver, the rig feed's port. The rig feed is optional and read-only; the EDR's WITS0 over a serial line or TCP, when the operator gives it.
 

gea_program-0.75.1/gea/help/vpn.md

@@ -0,0 +1,13 @@
+# GEA-VPN - the private network between the programs
+
+> The control panel, each pad's recorder, the operator's window and the client's reader run on separate computers in separate places; GEA-VPN joins them into one private network over the internet, so the office reaches every box at a fixed private address and nothing else on the internet can see any of them.
+
+**The command**: the Administration tab's **GEA-VPN** card (admin). It is WireGuard - the VPN built into every Linux kernel and installed on Windows from wireguard.com - and GEA writes every key, address and configuration, so nothing is typed on a pad. One **hub** is needed: a small cloud server of the site's own, any Debian or Ubuntu machine with a public address (a rented virtual server of the smallest size is enough), reachable on UDP port 51820; every member connects out to it and it forwards between the office and each member - members never see one another. Make the network once: enter the hub's public name or address (`vpn.pad3site.com` or `203.0.113.10`) and click **Make the network** - the office member (this control panel, `10.77.0.2`) is made with it. Download `gea-vpn-hub.zip`, copy it to the hub and run there, once, `sudo sh install-hub.sh` (it installs WireGuard, opens the port, turns forwarding on and starts the tunnel at boot). Install WireGuard on this computer from wireguard.com (admin, once), click **Import tunnel(s) from file**, choose `gea-vpn.conf` from `gea-vpn-office.zip`, click **Activate**; the card's pill turns to `tunnel up`. Add a member per computer: its name (`Pad 3 box`) and its kind - `box` for a recorder (its page on 8780, reaches the office only), `operator` or `reader` for a window (reaches the office's control panel only), `office` for a second control panel - then **Add the member**; its address and `gea-vpn-pad-3-box.zip` appear in the table, and the hub installer must be run again (the hub's folder is written anew with every member). A box's zip holds `vpn.sh`: on the Pi, `sudo sh vpn.sh` once. A Windows member imports its `gea-vpn.conf` into WireGuard once. In the Field tab, pull from the box at its private address: `http://10.77.0.3:8780`. **Remove** takes a member out (its key is dropped from the hub when the installer runs again); **Make the files again** rewrites every folder and zip. From a terminal: `gea vpn --workspace C:\site --create vpn.pad3site.com`, `gea vpn --workspace C:\site --add "Pad 3 box" --kind box`, `gea vpn --workspace C:\site --remove pad-3-box`, `gea vpn --workspace C:\site --bundles`, `gea vpn --workspace C:\site` (the table).
+
+**What it writes**: `keys\vpn\network.json` (owner-only; every member's private key, the hub's, and the pre-shared key per member) - the backup carries it, the dossier never does; under `exports\vpn\`: `hub\` (`gea-vpn.conf`, `install-hub.sh`, `README.txt`, zipped as `gea-vpn-hub.zip`) and one folder per member (`gea-vpn.conf` with the member's own private key, plus `vpn.sh` for a box or `README.txt` for a window, zipped as `gea-vpn-pad-3-box.zip` for `Pad 3 box`); the audit lines `vpn.create`, `vpn.hub`, `vpn.member.add`, `vpn.member.remove`, `vpn.bundles`, `vpn.bundle.download`. A member's zip holds its key: hand it over in person, or by a channel of its own, never by the same e-mail as anything else; a lost file is replaced by removing the member, adding it again and running the hub installer again.
+
+**The number to check**: the card's pill - `tunnel up` means WireGuard on this computer has the `gea-vpn` tunnel active; `tunnel not up here` means it is not installed or not activated, and nothing private is reachable. In the table, **Last handshake** within the last two or three minutes for a member means its tunnel is up and talking to this computer (a keepalive every 25 s keeps it so behind a cellular modem); **Reachable** `yes` means the member's program answered on its port through the tunnel - a box's page on 8780, a window's control panel - and that is the address to pull from.
+
+**What this page will not call a measurement**: a handshake is not a pull - a box reachable through the tunnel still has to be pulled in the Field tab for its files to become a station; the tunnel encrypts and addresses, it does not verify a file (the SHA-256 beside every record does that, through the tunnel or not); and the private addresses are the site's own convention - nothing of the network is known outside the hub and its members.
+
+Related: `gea help recorder`, `gea help site`, `gea help backup`.

{gea_program-0.74.0 → gea_program-0.75.1}/gea/helplib.py

@@ -37,6 +37,7 @@ INDEX: List[tuple] = [
     ('sites', 'Sites - the engagement', 'the wells, stations and tracks of one client\'s ground, and the one report for all of it'),
     ('seismic', 'Seismic - the second leg', 'miniSEED/SAC in, spectra and persistent lines out, the detectability test against known rigs'),
     ('bit-image', 'The image - drill-bit seismic from the ground', "the drilling itself as the seismic source of known position: ground stations correlated against the one beside the rig, the velocity column layer by layer, the layer below the bit, the property column, and what a field recorder must capture - end to end on a labelled scene"),
+    ('vpn', 'GEA-VPN - the private network between the programs', "WireGuard managed from GEA: the hub on a small server of the site's own, a key and a configuration per computer, the office reaching each box at a fixed private address; nothing typed on a pad"),
     ('recorder', 'The field recorder - the black box', "GEA Recorder on a Raspberry Pi in the pad: the ground channels and the rig feed on one GPS clock into hourly miniSEED files with hashes and a manifest; GEA pulls them in and makes stations of them"),
     ('patches', 'Patches', 'supervised live connections, their states and records'),
     ('files', 'Files', 'import and export roots, detection by content, the evidence pack'),