Add Waylume Manifesto and update API routes for peer management

TODO.md

@@ -0,0 +1,194 @@
+# Waylume Server Node - Production Readiness TODO
+
+## Self-Managing Node Infrastructure
+- [x] Automatic server registration in `waylume_servers` table
+- [x] Continuous heartbeat monitoring and health reporting
+- [x] Geolocation integration for client server selection
+- [x] Zero-touch deployment with Docker
+- [x] Self-recovery for WireGuard interface failures
+- [x] Resource management and peer lifecycle automation
+- [ ] **HIGH PRIORITY**: Implement server load balancing registration
+- [ ] **HIGH PRIORITY**: Add automatic failover mechanisms
+- [ ] Multi-region deployment coordination
+- [ ] Server capacity monitoring and reporting
+- [ ] Automatic scaling triggers based on load
+
+## WireGuard Management (Core Service)
+- [x] WireGuard interface initialization (`wg0` on `10.0.0.1/24`)
+- [x] Dynamic peer creation with unique keys and IP assignments
+- [x] Peer isolation enforcement (iptables rules)
+- [x] Traffic control implementation (HTB-based speed limiting)
+- [x] Data quota enforcement (iptables quota management)
+- [x] Automatic peer cleanup and configuration removal
+- [x] IP subnet management (`10.0.0.2` - `10.255.255.254`)
+- [ ] **MEDIUM PRIORITY**: WireGuard interface health monitoring
+- [ ] Peer connection quality metrics
+- [ ] Advanced traffic shaping policies
+- [ ] Network performance optimization
+
+## Internal API Endpoints (Supabase Edge Functions Only)
+- [x] POST /api/peers (called by `connection-request` edge function)
+- [x] POST /api/peers/delete (called by session cleanup processes)
+- [x] POST /api/peers/speed-limit (called by subscription management)
+- [x] POST /api/peers/data-cap (called by usage monitoring systems)
+- [x] Basic error handling with HTTP status codes
+- [x] JSON request/response handling
+- [x] Input validation for required parameters
+- [ ] **MEDIUM PRIORITY**: GET /api/peers (for internal monitoring)
+- [ ] **MEDIUM PRIORITY**: GET /api/peers/{id} (for session management)
+- [ ] **LOW PRIORITY**: Add pagination for peer listings
+- [ ] Server health endpoints for load balancer integration
+- [ ] Internal metrics endpoints for monitoring systems
+- [ ] Peer connection quality reporting endpoints
+- [ ] **LOW PRIORITY**: API versioning strategy
+- [ ] **LOW PRIORITY**: OpenAPI documentation for internal APIs
+
+## Supabase Edge Functions Integration
+- [x] Integration with `connection-request` function for peer creation
+- [x] Session tracking through `vpn_sessions` table
+- [x] Configuration delivery through Supabase to Flutter clients
+- [x] Server registration in `waylume_servers` table for `vpn-nodes-list`
+- [ ] **HIGH PRIORITY**: Implement proper edge function authentication
+- [ ] **HIGH PRIORITY**: Add request validation from edge functions
+- [ ] **MEDIUM PRIORITY**: Implement edge function request signing
+- [ ] Circuit breaker for Supabase connectivity issues
+- [ ] Retry logic for failed edge function communications
+- [ ] Edge function timeout handling
+- [ ] Rate limiting coordination with edge functions
+
+## Ecosystem Integration (Flutter Client & Supabase)
+- [x] Server discovery through `vpn-nodes-list` edge function
+- [x] Geolocation data provision for Flutter map interface
+- [x] VPN session creation workflow with client
+- [x] Heartbeat system for server availability status
+- [ ] **MEDIUM PRIORITY**: Integration with subscription management (speed-limit/data-cap)
+- [ ] **MEDIUM PRIORITY**: Support for Stripe-driven service tier enforcement
+- [ ] **LOW PRIORITY**: Real-time connection status updates to client
+- [ ] **LOW PRIORITY**: Usage analytics reporting for client dashboard
+- [ ] Support for payment history and account management flows
+- [ ] Integration with trial period and subscription state changes
+
+## Security & Network Isolation
+- [x] Port 3000 restricted to internal access (no direct client access)
+- [x] Peer isolation through iptables rules
+- [x] WireGuard peer-to-peer communication prevention
+- [ ] **HIGH PRIORITY**: Network firewall rules for Supabase-only access
+- [ ] **HIGH PRIORITY**: Implement secure communication with edge functions
+- [ ] **MEDIUM PRIORITY**: Add request origin validation
+- [ ] Security audit of iptables rules and WireGuard configuration
+- [ ] Implement secure key storage and rotation
+- [ ] Network segmentation for additional security
+- [ ] Intrusion detection for API access patterns
+
+## Monitoring & Observability
+- [x] Basic request logging with timestamps
+- [x] Client IP and user agent tracking
+- [x] VPN session monitoring and health checks
+- [x] Connection status detection (alive/dead peers)
+- [ ] **HIGH PRIORITY**: Add comprehensive health check endpoints for load balancers
+- [ ] Implement metrics collection (Prometheus/OpenTelemetry)
+- [ ] Add structured logging with log levels
+- [ ] Monitor WireGuard interface status
+- [ ] Track peer connection metrics and analytics
+- [ ] Implement alerting for server issues
+- [ ] Add distributed tracing support
+- [ ] Resource usage monitoring (CPU, memory, network)
+
+## Error Handling & Resilience
+- [x] Basic API error responses
+- [x] Process error handling for system commands
+- [x] Graceful degradation for missing WireGuard tools
+- [ ] **HIGH PRIORITY**: Implement graceful shutdown handling
+- [ ] Add retry logic for Supabase operations
+- [ ] Improve error responses with more detailed messages
+- [ ] Add circuit breaker pattern for external dependencies
+- [ ] Implement backup/recovery procedures
+- [ ] Handle WireGuard interface failures
+- [ ] Add database connection pooling and failover
+
+## Configuration Management
+- [x] Environment variable support (.env files)
+- [x] Docker environment configuration
+- [x] Supabase client configuration
+- [x] Automatic environment detection
+- [ ] **MEDIUM PRIORITY**: Configuration validation on startup
+- [ ] Move hardcoded values to configuration files
+- [ ] Add environment-specific configurations
+- [ ] Add support for configuration hot-reloading
+- [ ] Document all environment variables
+- [ ] Add configuration templates for different deployments
+
+## Docker & Infrastructure
+- [x] Complete Docker setup with WireGuard tools
+- [x] Network capabilities (NET_ADMIN) configuration
+- [x] Device access (/dev/net/tun) mapping
+- [x] Port mapping (API 3000, WireGuard 51820)
+- [x] Volume mounting for WireGuard runtime
+- [x] Restart policy configuration
+- [ ] Multi-stage Docker builds for smaller images
+- [ ] Add Kubernetes deployment manifests
+- [ ] Implement blue-green deployment strategy
+- [ ] Container security scanning in CI/CD
+- [ ] Infrastructure as code (Terraform/CloudFormation)
+- [ ] Multi-region deployment support
+
+## Performance & Scalability
+- [x] Efficient peer creation/deletion operations
+- [x] Optimized traffic control implementation
+- [ ] Implement connection pooling for database operations
+- [ ] Add caching layer for frequently accessed data
+- [ ] Load testing and performance benchmarking
+- [ ] Implement horizontal scaling strategies
+- [ ] Optimize memory usage and garbage collection
+- [ ] Performance monitoring and profiling
+
+## Testing & Quality Assurance
+- [x] Basic API endpoint testing script
+- [x] End-to-end workflow testing
+- [x] Response validation testing
+- [ ] Add unit tests for all services
+- [ ] Implement integration tests
+- [ ] Add automated testing in CI/CD pipeline
+- [ ] Load testing for concurrent connections
+- [ ] Security penetration testing
+- [ ] Performance regression testing
+
+## Data Management
+- [x] Session monitoring and peer tracking
+- [ ] Implement persistent peer data storage
+- [ ] Add peer usage analytics and reporting
+- [ ] Implement data retention policies
+- [ ] Add data backup and recovery procedures
+- [ ] Implement audit logging for compliance
+- [ ] Add peer lifecycle management
+
+## Documentation & Compliance
+- [x] Comprehensive README with API examples
+- [x] Docker deployment instructions
+- [x] Network architecture documentation
+- [ ] Add deployment guides for different platforms
+- [ ] Create troubleshooting documentation
+- [ ] Add detailed API documentation with examples
+- [ ] Document security best practices
+- [ ] Add compliance documentation (GDPR, etc.)
+- [ ] Create operational runbooks
+
+## High Priority for Production (Self-Managing Node)
+1. **🔴 CRITICAL**: Edge function authentication and request validation
+2. **🔴 CRITICAL**: Network firewall rules (Supabase-only access)
+3. **🔴 CRITICAL**: Server load balancing and failover mechanisms
+4. **🟡 HIGH**: Health check endpoints for load balancers
+5. **🟡 HIGH**: Graceful shutdown and recovery handling
+6. **🟡 HIGH**: Comprehensive monitoring and alerting
+7. **🟡 HIGH**: Automated scaling triggers
+8. **🟡 HIGH**: Circuit breaker for Supabase connectivity
+
+## Current Status Summary (Waylume Node Architecture)
+✅ **Self-Managing Foundation**: Zero-touch deployment with automatic registration  
+✅ **WireGuard Service**: Complete VPN functionality with traffic control and isolation  
+✅ **Supabase Integration**: Edge function integration with session management  
+✅ **Docker Infrastructure**: Production-ready containerization with network capabilities  
+✅ **Monitoring Base**: Heartbeat system with basic session tracking  
+⚠️ **Security Architecture**: No edge function authentication or network isolation  
+⚠️ **Resilience Gap**: No failover, circuit breakers, or scaling automation  
+⚠️ **Observability Gap**: Basic logging only, no metrics or comprehensive health checks