xah30
d5b9a8611d
- aura-cli config gains [transport] (order + per-transport ports + obfuscate/ masquerade); server binds all enabled transports via MultiServer, client uses dial() with UDP->TCP->QUIC handover. Config examples updated; backward-compatible (defaults to udp,tcp,quic). 21 cli tests incl. a real-UDP-transport loopback. - docs/sing-box.md: integration approach note (process-bridge now; native Go outbound for phones, with crypto-library mapping + KAT requirement). - Normalize rustfmt across the v2 transport files (tcp/dial/udp contract). Whole workspace: 97 tests pass, clippy -D warnings clean, fmt clean. Deploy flow (pki init/issue-server/issue-client) validated with the release binary. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
48 lines
1.9 KiB
TOML
48 lines
1.9 KiB
TOML
# Aura VPN server configuration (project §9).
|
|
# Copy to server.toml and adjust. Paths may begin with `~` (expands to your home directory).
|
|
|
|
[server]
|
|
# Human-readable name (also the server's inner-handshake identity).
|
|
name = "aura-edge-1"
|
|
# UDP socket to listen on. ":443" mimics HTTPS; binding it needs privileges.
|
|
listen = "0.0.0.0:443"
|
|
# Accept workers (advisory in v1).
|
|
workers = 4
|
|
|
|
[pki]
|
|
# Trust anchor (the Aura CA) and this server's leaf cert/key, all PEM.
|
|
# Generate with: aura pki init --ca-name "Aura CA" --out ~/.aura
|
|
# aura pki issue-server --domain vpn.example.com --out ~/.aura --ca ~/.aura
|
|
ca_cert = "~/.aura/ca.crt"
|
|
cert = "~/.aura/server.crt"
|
|
key = "~/.aura/server.key"
|
|
|
|
[tunnel]
|
|
# Address pool for clients; v1 uses a single shared server-side TUN on this network.
|
|
pool_cidr = "10.7.0.0/24"
|
|
# TUN MTU (leave headroom under the path MTU for QUIC + Aura framing).
|
|
mtu = 1420
|
|
# DNS server advertised to clients (informational in v1).
|
|
dns = "10.7.0.1"
|
|
|
|
[mimicry]
|
|
# Outer-TLS camouflage hostname the server presents/expects.
|
|
sni = "cdn.example.com"
|
|
# Enable traffic padding to blend packet sizes into HTTPS buckets.
|
|
padding = true
|
|
|
|
[transport]
|
|
# Aura's own post-quantum transport runs over plain UDP (primary), with TCP/443 and QUIC (HTTP/3
|
|
# mimicry) as fallbacks. On the server, `order` selects exactly which transports are bound and
|
|
# accepted simultaneously. Omitting this whole section enables udp/tcp/quic on 443/443/444.
|
|
order = ["udp", "tcp", "quic"]
|
|
# The UDP transport and QUIC both ride UDP, so udp_port and quic_port MUST differ. TCP may reuse the
|
|
# UDP port number (different protocol). Ports bind on the IP from [server] listen above.
|
|
udp_port = 443
|
|
tcp_port = 443
|
|
quic_port = 444
|
|
# UDP: pad datagrams up to HTTPS size buckets to blur the on-wire size distribution.
|
|
obfuscate = true
|
|
# TCP: prepend a minimal HTTP/1.1 preamble (Host = [mimicry] sni) so the open resembles plain HTTP.
|
|
masquerade = true
|