# Getting started

## Prerequisites

- Rust 1.85+ (the project uses Edition 2024)
- A POSIX shell or PowerShell for running commands
- curl (for E2E testing)

## Build

```sh
cd rustunnel
cargo build --release
```

The release binary is produced at `target/release/rustunnel`.

## Run tests

```sh
cargo fmt --check
cargo clippy --all-targets -- -D warnings
cargo check
cargo test --all-targets
```

The test suite includes unit tests for framing, SOCKS5 parsing, TLS config building, credential generation, connection key roundtrips, and full end-to-end tunnel flows.

## Generate credentials

```sh
./target/release/rustunnel generate --out ./creds
```

This creates:

- `creds/ca.pem` — CA certificate
- `creds/ca.key` — CA private key
- `creds/server.crt` — server certificate
- `creds/server.key` — server private key
- `creds/client.crt` — client certificate
- `creds/client.key` — client private key
- `creds/token.txt` — auth token
- `creds/config.json` — configuration file with paths and defaults

## Run a tunnel

### Start the listener

```sh
./target/release/rustunnel listen \
  --listen 127.0.0.1:4180 \
  --cert ./creds/server.crt \
  --key ./creds/server.key \
  --ca-cert ./creds/ca.pem \
  --auth-token-file ./creds/token.txt
```

### Start the connector

```sh
./target/release/rustunnel connect \
  --target 127.0.0.1:4180 \
  --socks 127.0.0.1:1180 \
  --cert ./creds/client.crt \
  --key ./creds/client.key \
  --ca-cert ./creds/ca.pem \
  --auth-token-file ./creds/token.txt
```

### Use the SOCKS5 proxy

```sh
curl --proxy socks5h://127.0.0.1:1180 http://127.0.0.1:4181/
```

## Using a connection key

Instead of passing individual certificate paths, you can generate a single connection key:

```sh
./target/release/rustunnel keygen --target 127.0.0.1:4180
```

Then start the listener with the key (it auto-generates credentials):

```sh
./target/release/rustunnel listen --connection-key <key>
```

And connect with the same key:

```sh
./target/release/rustunnel connect <key>
```

## Defaults

- Listener bind address: `0.0.0.0:4180`
- Connector target: required (or taken from connection key)
- Connector SOCKS5 proxy: `127.0.0.1:1180`