xah30/AuraVPN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
35d94dee3316aee934cf6872604df349c4caa1b7
AuraVPN/config/client.toml.example
T
xah30 8f0cf1f017 feat(cli): automation bundle + identity-minimization features 
Reduces manual setup steps and trims user-identifying data exposed by the
server/client, in the spirit of the deployment story: an operator on the
wire sees less, and the admin types fewer commands.

New CLI subcommands:
- `aura server-init`: one shot — pki init + issue-server + writes a ready
  server.toml with auto-detected egress iface; flags --enable-knock,
  --enable-cover-traffic, --no-nat, --run-as toggle the new transport
  defenses and privilege drop.
- `aura provision-client`: issues a client cert and assembles the full
  bundle (ca.crt + client.crt + client.key + client.toml in one directory)
  ready to hand over to the client device. --id is optional (defaults to
  a fresh UUIDv4, so client identities don't have to encode anything real).

Identity / log minimization:
- `aura pki issue-client --id` is now optional — UUIDv4 by default.
- `[server]/[client] no_logs = true` filters peer_id, client_ip,
  source_addr, client_id, local_ip, user, id, assigned_ip, peer field
  values through a custom tracing FormatFields layer (events still fire
  but the identifying fields are redacted before being written).
- `[client] bridges = [...]`: secondary server addresses; build_dial_targets
  shuffles them after the primary, so blocking one IP doesn't kill the
  client.
- Auto-detect egress iface in [server.nat] (via detect_default_egress_iface);
  egress_iface in config becomes optional with graceful fallback.

Config examples updated; backward-compatible (all new sections optional with
serde defaults). Workspace: 207 tests passed (+22), clippy -D warnings clean,
fmt clean. No new workspace deps.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-27 12:14:57 +03:00

129 lines
5.9 KiB
TOML
Raw Blame History

# Aura VPN client configuration (project §9).
# Copy to client.toml and adjust. Paths may begin with `~` (expands to your home directory).
[client]
# Human-readable client name / id.
name = "laptop"
# Server UDP socket address.
server_addr = "203.0.113.10:443"
# Outer-TLS SNI (camouflage hostname) presented to the server. Also the name verified
# inside the Aura handshake against the server certificate's SAN.
sni = "cdn.example.com"
# Optional: drop privileges to this non-root user AFTER the TUN device has been brought up.
# Recommended when `aura client` is launched via sudo so the long-running router loop runs
# as an ordinary user. Linux uses setresuid/setresgid; macOS uses setgid/setuid; Windows is a
# no-op (use a service account instead). When omitted (or already running as non-root) no
# privilege change happens.
# run_as = "nobody"
# Suppress identifier fields (peer_id, client_ip, source_addr, ...) from log output. The events
# still fire; only the identifying fields are dropped before formatting. Default: false. Set to
# true to keep the local log file from accumulating per-session identifiers.
no_logs = false
# Optional fallback server addresses (IP or IP:port). When the primary `server_addr` cannot be
# reached on any transport, the client retries the bridges in a process-randomised order, using
# the same per-transport ports from [transport]. The bridge `:port` part is parsed but ignored.
# bridges = ["203.0.113.11", "203.0.113.12"]
[pki]
# Trust anchor (the Aura CA) and this client's leaf cert/key, all PEM.
# Issue with: aura pki issue-client --id laptop --out ~/.aura --ca ~/.aura
ca_cert = "~/.aura/ca.crt"
cert = "~/.aura/client.crt"
key = "~/.aura/client.key"
[tunnel]
# Requested TUN interface name (advisory on macOS, where the kernel assigns utunN).
tun_name = "aura0"
# Local address assigned to the TUN device, and its prefix length.
local_ip = "10.7.0.2"
prefix = 24
# TUN MTU.
mtu = 1420
# Tunnel resolver DNS (informational; the system resolver is used in v1).
dns = "10.7.0.1"
# Split-tunnel routing: the default action plus per-destination overrides.
[tunnel.split]
# Default for destinations matching no rule below: "VPN" or "DIRECT".
default = "VPN"
# Send these directly (bypass the tunnel): RFC1918 ranges stay on the LAN...
[[tunnel.split.direct]]
cidr = "192.168.0.0/16"
[[tunnel.split.direct]]
cidr = "10.0.0.0/8"
# ...and a corporate domain egresses directly (resolved to host routes at startup).
[[tunnel.split.direct]]
domain = "intranet.example.com"
# Force a more-specific range back through the VPN (longest-prefix wins over 10.0.0.0/8).
[[tunnel.split.vpn]]
cidr = "10.7.0.0/24"
# v2: OS-level split-tunnel routing. With `enabled = true` (the default) the client programs the
# system routing table at startup so DIRECT destinations bypass the TUN entirely — they continue
# to use the host's original default gateway, while only VPN-classified traffic reaches the
# tunnel. This eliminates the v1 user-space `send_direct` stub, where DIRECT packets were merely
# logged and dropped. The guard is RAII: the routes are rolled back when `aura client` exits.
#
# Linux: uses `ip route add ... via <gw> dev <egress>` for bypasses and `ip route add ... dev <tun>`
# for the VPN default; the VPN default carries metric 50 so it wins over DHCP-installed defaults.
# macOS: uses `route add -net <cidr> <gw>` for bypasses and `route add -net <cidr> -interface <tun>`
# for VPN routes.
# Windows: not implemented in v1 (the section is parsed but the install is a logged no-op).
[tunnel.os_routes]
# Master switch. `false` falls back to the v1 user-space router (the `send_direct` path drops
# DIRECT packets; kept intentionally as a fallback). Default: true.
enabled = true
# When `true`, every routing command is only logged (`would run: ...`) and not executed —
# useful for testing the plan without root. Default: false.
dry_run = false
# Optional explicit IPv4 default gateway. When omitted, auto-detected (Linux:
# `ip route show default`; macOS: `route -n get default`).
# gateway = "192.168.1.1"
# Optional explicit egress interface name (e.g. "eth0" on Linux, "en0" on macOS). When omitted,
# auto-detected alongside the gateway.
# egress_iface = "en0"
[mimicry]
# Enable traffic padding to blend packet sizes into HTTPS buckets.
padding = false
[transport]
# Fallback order tried left-to-right ("handover"): the first transport that connects wins. Aura's
# own UDP transport is primary; TCP/443 and QUIC (HTTP/3 mimicry) are fallbacks for networks that
# throttle or block plain UDP. Omitting this whole section uses ["udp","tcp","quic"] on 443/443/444.
order = ["udp", "tcp", "quic"]
# Per-transport server ports. The server IP comes from [client] server_addr above (its port there is
# ignored). The UDP transport and QUIC both ride UDP, so udp_port and quic_port MUST differ; TCP may
# reuse the UDP port number.
udp_port = 443
tcp_port = 443
quic_port = 444
# UDP: pad datagrams up to HTTPS size buckets to blur the on-wire size distribution.
obfuscate = true
# TCP: prepend a minimal HTTP/1.1 preamble (Host = [client] sni) so the open resembles plain HTTP.
masquerade = true
[transport.masks]
# Daily protocol-mask rotation. When `true`, every day at 05:00 MSK (= 02:00 UTC) the client
# derives a new (SNI, User-Agent, Server-header, padding-profile) tuple from
# HKDF-SHA256(CA-fingerprint, MSK-date) and uses it for any subsequent connect — the server derives
# the same tuple independently from the same CA fingerprint, so no wire coordination is needed.
# Existing connections keep the mask they connected with. Default: true.
# When `false`, the static values above ([client] sni, [transport] obfuscate, ...) are used as-is.
enabled = true
[transport.knock]
# UDP port-knocking. Must match the server's setting. Default: false.
enabled = false
knock_secret_source = "ca_fingerprint"
[transport.cover]
# Idle-time cover traffic. Must match the server's setting. Default: false.
enabled = false
mean_interval_ms = 500
jitter = 0.5
Reference in New Issue View Git Blame Copy Permalink