Phase10 followups and clients

.github/workflows/ci.yml

@@ -0,0 +1,93 @@
+name: CI
+
+# TECH_DOC.md §9 Phase 9. Four independent jobs, one per subproject stack --
+# nothing here depends on anything else, so they run in parallel rather
+# than serialized. Each job runs exactly the commands already verified by
+# hand against this repo (see TODO.md's Phase 9 row for when this was
+# added): no step here should ever surprise a contributor who just ran the
+# same command locally.
+#
+# rustfmt is deliberately NOT enforced yet -- the codebase isn't
+# rustfmt-clean (a `cargo fmt --all` pass is its own separate, deliberate
+# change, not bundled into standing up CI). clippy IS enforced
+# (-D warnings) for both Rust jobs; both were brought to a clean slate
+# before this workflow was written specifically so the gate isn't red on
+# day one.
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  server:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: server
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: server
+      - run: cargo test
+      - run: cargo clippy --all-targets -- -D warnings
+
+  client:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: client
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: client
+      # raba-napi builds as a plain cdylib crate under a normal `cargo
+      # build`/`test`/`clippy` -- the napi-rs CLI (`napi build`) is only
+      # needed to produce a distributable native binary, which is
+      # release.yml's job, not this one's.
+      - run: cargo test --workspace
+      - run: cargo clippy --workspace --all-targets -- -D warnings
+
+  dashboard:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: dashboard
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+      - run: npm ci
+      - run: npx tsc --noEmit
+      - run: npm run lint
+      - run: npm run build
+
+  docs-site:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: docs-site
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: docs-site/package-lock.json
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run build

BRAND.md

@@ -0,0 +1,53 @@
+# Brand
+
+## Name
+
+*raba* is Hausa for "to divide, separate, share, or distribute." Both senses map onto what
+the tool does: "share/distribute" is the pitch — share your localhost with the world.
+"Divide/separate" is the problem being solved — bridging a machine that's cut off from the
+public internet by NAT or a firewall.
+
+## Logo
+
+The mark is an arch bridging two connection points: a direct read of both senses of the
+name above — the arch is the connection made, the two points are what's being bridged.
+
+<p>
+  <img src="docs-site/static/img/brand/mark.svg" alt="raba mark" width="80" />
+</p>
+
+- Rounded-square badge, dark neutral background (`#111827`).
+- A single smooth arch, stroked in green (`#22C55E`) — the connection made across the divide.
+- Two connection-point circles in orange (`#F97316`) at the arch's base — the two things
+  being bridged.
+- Flat fills only — no gradients, shadows, or 3D effects.
+
+## Wordmark
+
+`raba`, always lowercase, sans-serif, medium weight. Optional tagline beneath, small and
+muted: "share your localhost."
+
+## Color palette
+
+| Role | Hex |
+|---|---|
+| Badge background | `#111827` |
+| Bridge arch | `#22C55E` |
+| Connection points | `#F97316` |
+
+## Assets
+
+All variants live in [`docs-site/static/img/brand/`](docs-site/static/img/brand/):
+
+| File | Use |
+|---|---|
+| `mark.svg` | Badge alone — favicon, avatar, terminal splash |
+| `wordmark.svg` | Text only, no badge |
+| `lockup-compact.svg` | Badge + wordmark, no tagline — app/dashboard headers |
+| `lockup-full.svg` | Badge + wordmark + tagline — marketing pages, README |
+
+## What to avoid
+
+Literal pipe/tube imagery, 3D effects or drop shadows, extra accent colors beyond the two
+above, capitalized/stylized treatments of the wordmark ("Raba", "RABA"), and putting the
+tagline inside the badge itself.

LICENSE

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 codad5
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

README.md

@@ -0,0 +1,78 @@
+<p align="center">
+  <img src="docs-site/static/img/brand/lockup-full.svg" alt="raba: share your localhost" width="320" />
+</p>
+
+<p align="center">
+  A self-hosted, open-source alternative to ngrok / Cloudflare Tunnel / frp — HTTP, TCP,
+  and UDP tunneling, deployed as a single Docker image, managed via a web dashboard.
+</p>
+
+---
+
+## Why "raba"?
+
+*raba* is Hausa for "to divide, separate, share, or distribute." Both senses map onto what
+this tool actually does: the "share/distribute" sense is the pitch (share your localhost
+with the world); the "divide/separate" sense is the exact problem being solved (bridging a
+machine that's cut off from the public internet by NAT/firewall). The logo's arch, bridging
+two connection points, is a direct visual read of that same idea — see [`BRAND.md`](BRAND.md)
+for the full brand guide.
+
+## What it does
+
+- **HTTP, TCP, and UDP tunneling** — expose a local server on any of the three, from a
+  single CLI command.
+- **Self-hosted, single Docker image** — your own server, your own domain, no third-party
+  relay.
+- **Web dashboard** — projects, request logs, traffic stats, team management, all served by
+  the same binary.
+- **Multi-tenancy** — teams, per-team roles, and per-team custom domains with automated
+  DNS-01 TLS issuance/renewal (Let's Encrypt via Cloudflare DNS today).
+- **Byte-level forwarding** — the server never parses HTTP request/response bodies; it
+  forwards raw bytes. Nothing you tunnel is inspected or logged beyond connection metadata.
+
+## Quickstart
+
+### Local development
+
+```
+npm install
+npm run dev
+```
+
+Runs the server (auto-restarting on change) and the dashboard dev server together.
+Dashboard: `http://localhost:5173`. Server: `https://127.0.0.1:7222` (self-signed dev cert
+— your browser will warn once, that's expected locally).
+
+### Docker
+
+```
+docker build -f docker/Dockerfile -t raba .
+cp docker/.env.example .env   # then edit: set JWT_SECRET, RABA_DOMAIN
+docker compose up -d --build
+```
+
+See `docker/.env.example` for the full list of configuration variables (TLS/ACME
+automation, ports, signup policy, etc.).
+
+### CLI
+
+```
+raba login --server https://your-domain.example
+raba http 3000
+```
+
+See `raba --help` for the full command list (`tcp`, `udp`, `connect`, `team`, `stats`, ...).
+
+## Project status
+
+Under active development, pre-release. Core protocol, server, dashboard, multi-tenancy,
+dynamic TLS/domain automation, and hardening (rate limiting, logging, graceful shutdown,
+traffic stats) are done. CI/CD and a public landing site are the current gaps before a v1.
+
+## License
+
+[Functional Source License, Version 1.1, Apache 2.0 Future License](LICENSE) — free to use,
+copy, modify, and self-host, including commercially, for any purpose other than offering it
+(or a substitute for it) as a competing hosted/managed service. Each version automatically
+becomes available under Apache License 2.0 two years after its release.