wip: first try on connected client listener

* Initial copy of code from network-requester

* Fix unused

* Fix reading nym-api

* Log env setup steps

* rustfmt

* fix

* Fix unused

* Log number of retransmissions instead of rate

.github/workflows/ci-build-upload-binaries.yml

@@ -4,18 +4,18 @@ on:
   workflow_dispatch:
   pull_request:
     paths:
-      - 'clients/**'
-      - 'common/**'
-      - 'explorer-api/**'
-      - 'gateway/**'
-      - 'integrations/**'
-      - 'mixnode/**'
-      - 'sdk/rust/nym-sdk/**'
-      - 'service-providers/**'
-      - 'nym-api/**'
-      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/ts-rs-cli/**'
+      - "clients/**"
+      - "common/**"
+      - "explorer-api/**"
+      - "gateway/**"
+      - "integrations/**"
+      - "mixnode/**"
+      - "sdk/rust/nym-sdk/**"
+      - "service-providers/**"
+      - "nym-api/**"
+      - "nym-outfox/**"
+      - "tools/nym-cli/**"
+      - "tools/ts-rs-cli/**"
 
 jobs:
   publish-nym:
@@ -53,6 +53,16 @@ jobs:
           command: build
           args: --workspace --release
 
+      - name: Install cargo-deb
+        uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: cargo-deb
+
+      - name: Build deb packages
+        shell: bash
+        run: scripts/ppa.sh ${{ secrets.PPA_SIGNING_KEY }}
+
       - name: Prepare build output
         shell: bash
         env:
@@ -67,6 +77,7 @@ jobs:
           cp target/release/nym-network-statistics $OUTPUT_DIR
           cp target/release/nym-cli $OUTPUT_DIR
           cp target/release/explorer-api $OUTPUT_DIR
+          cp ppa/debian/* $OUTPUT_DIR
 
       - name: Deploy branch to CI www
         continue-on-error: true

.github/workflows/ci-nym-vpn-ui-js.yml

@@ -1,40 +0,0 @@
-name: ci-nym-vpn-ui-js
-
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - 'nym-vpn/ui/src/**'
-      - 'nym-vpn/ui/package.json'
-      - 'nym-vpn/ui/index.html'
-
-jobs:
-  check:
-    runs-on: custom-linux
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install Node
-        uses: actions/setup-node@v3
-        with:
-          node-version: 18
-      - name: Install Yarn
-        run: npm install -g yarn
-      - name: Install dependencies
-        working-directory: nym-vpn/ui
-        run: yarn
-      - name: Type-check
-        working-directory: nym-vpn/ui
-        run: yarn typecheck
-      - name: Check lint
-        working-directory: nym-vpn/ui
-        run: yarn lint
-      - name: Check formatting
-        working-directory: nym-vpn/ui
-        run: yarn fmt:check
-#      - name: Run tests
-#        working-directory: nym-vpn/ui
-#        run: yarn test
-      - name: Check build
-        working-directory: nym-vpn/ui
-        run: yarn build

.github/workflows/ci-nym-vpn-ui-rust.yml

@@ -1,63 +0,0 @@
-name: ci-nym-vpn-ui-rust
-
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - 'nym-vpn/ui/src-tauri/**'
-
-jobs:
-  build:
-    runs-on: custom-linux
-    env:
-      CARGO_TERM_COLOR: always
-      CARGOTOML_PATH: ./nym-vpn/ui/src-tauri/Cargo.toml
-    steps:
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libayatana-appindicator3-dev
-        continue-on-error: true
-
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-          components: rustfmt, clippy
-
-      - name: Prepare build
-        run: mkdir nym-vpn/ui/dist
-
-      - name: Build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --features custom-protocol
-
-#      - name: Run all tests
-#        uses: actions-rs/cargo@v1
-#        with:
-#          command: test
-#          args: --manifest-path ${{ env.CARGOTOML_PATH }}
-
-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all -- --check
-
-      - name: Annotate with clippy checks
-        uses: actions-rs/clippy-check@v1
-        continue-on-error: true
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all-features
-
-      - name: Clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all-features --all-targets -- -D warnings

Cargo.lock

@@ -187,6 +187,16 @@ dependencies = [
  "syn 2.0.38",
 ]
 
+[[package]]
+name = "addr"
+version = "0.15.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a93b8a41dbe230ad5087cc721f8d41611de654542180586b315d9f4cf6b72bef"
+dependencies = [
+ "psl",
+ "psl-types",
+]
+
 [[package]]
 name = "addr2line"
 version = "0.21.0"
@@ -1559,6 +1569,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
 
+[[package]]
+name = "const-str"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aca749d3d3f5b87a0d6100509879f9cf486ab510803a4a4e1001da1ff61c2bd6"
+
 [[package]]
 name = "const_format"
 version = "0.2.32"
@@ -3981,6 +3997,16 @@ dependencies = [
  "unicode-normalization",
 ]
 
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "idna"
 version = "0.4.0"
@@ -6047,6 +6073,7 @@ dependencies = [
  "clap 4.4.7",
  "clap_complete",
  "clap_complete_fig",
+ "const-str",
  "log",
  "opentelemetry",
  "opentelemetry-jaeger",
@@ -6219,6 +6246,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.8",
+ "si-scale",
  "sqlx",
  "tap",
  "tempfile",
@@ -6645,21 +6673,27 @@ name = "nym-ip-packet-router"
 version = "0.1.0"
 dependencies = [
  "bincode",
+ "bs58 0.4.0",
  "bytes",
+ "clap 4.4.7",
  "etherparse",
  "futures",
+ "lazy_static",
  "log",
  "nym-bin-common",
  "nym-client-core",
  "nym-config",
+ "nym-crypto",
  "nym-exit-policy",
  "nym-ip-packet-requests",
+ "nym-network-defaults",
  "nym-network-requester",
  "nym-sdk",
  "nym-service-providers-common",
  "nym-sphinx",
  "nym-task",
  "nym-tun",
+ "nym-types",
  "nym-wireguard",
  "nym-wireguard-types",
  "rand 0.8.5",
@@ -6670,6 +6704,7 @@ dependencies = [
  "thiserror",
  "tokio",
  "tokio-tun",
+ "tokio-util",
  "url",
 ]
 
@@ -6818,6 +6853,7 @@ dependencies = [
  "cfg-if",
  "dotenvy",
  "hex-literal",
+ "log",
  "once_cell",
  "schemars",
  "serde",
@@ -6829,6 +6865,7 @@ dependencies = [
 name = "nym-network-requester"
 version = "1.1.32"
 dependencies = [
+ "addr",
  "anyhow",
  "async-file-watcher",
  "async-trait",
@@ -8558,14 +8595,28 @@ dependencies = [
 ]
 
 [[package]]
-name = "publicsuffix"
-version = "1.5.6"
+name = "psl"
+version = "2.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b4ce31ff0a27d93c8de1849cf58162283752f065a90d508f1105fa6c9a213f"
+checksum = "383703acfc34f7a00724846c14dc5ea4407c59e5aedcbbb18a1c0c1a23fe5013"
 dependencies = [
- "idna 0.2.3",
- "native-tls",
- "url",
+ "psl-types",
+]
+
+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
+[[package]]
+name = "publicsuffix"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96a8c1bda5ae1af7f99a2962e49df150414a43d62404644d98dd5c3a93d07457"
+dependencies = [
+ "idna 0.3.0",
+ "psl-types",
 ]
 
 [[package]]
@@ -10012,6 +10063,12 @@ dependencies = [
  "dirs 4.0.0",
 ]
 
+[[package]]
+name = "si-scale"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44beb68bf488343b13ddbd74d1d5d5e6559a58b6dfaee74eb8d5ed4f7ed7666f"
+
 [[package]]
 name = "signal-hook"
 version = "0.3.17"

Cargo.toml

@@ -128,7 +128,7 @@ default-members = [
     "nym-validator-rewarder",
 ]
 
-exclude = ["explorer", "contracts", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop", "nym-vpn/ui/src-tauri", "cpu-cycles"]
+exclude = ["explorer", "contracts", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop", "nym-vpn/ui/src-tauri", "cpu-cycles", "sdk/ffi/cpp"]
 
 [workspace.package]
 authors = ["Nym Technologies SA"]

Makefile

@@ -12,6 +12,7 @@ help:
 	@echo "  clippy: run clippy for all workspaces"
 	@echo "  test: run clippy, unit tests, and formatting."
 	@echo "  test-all: like test, but also includes the expensive tests"
+	@echo "  ppa: build debian package and generate files required for PPA update"
 
 # -----------------------------------------------------------------------------
 # Meta targets
@@ -157,6 +158,12 @@ build-explorer-api:
 build-nym-cli:
 	cargo build -p nym-cli --release
 
+build-nym-gateway:
+	cargo build -p nym-gateway --release
+
+build-nym-mixnode:
+	cargo build -p nym-mixnode --release
+
 # -----------------------------------------------------------------------------
 # Misc
 # -----------------------------------------------------------------------------
@@ -170,5 +177,5 @@ run-api-tests:
 
 # Build debian package, and update PPA
 # Requires base64 encode GPG key to be set up in environment PPA_SIGNING_KEY
-deb:
-	scripts/ppa.sh
+# ppa: build-nym-mixnode build-nym-gateway
+# 	scripts/ppa.sh

clients/native/src/commands/init.rs

@@ -51,7 +51,7 @@ impl InitialisableClient for NativeClientInit {
     }
 }
 
-#[derive(Args, Clone)]
+#[derive(Args, Clone, Debug)]
 pub(crate) struct Init {
     #[command(flatten)]
     common_args: CommonClientInitArgs,

clients/socks5/src/commands/init.rs

@@ -51,7 +51,7 @@ impl InitialisableClient for Socks5ClientInit {
     }
 }
 
-#[derive(Args, Clone)]
+#[derive(Args, Clone, Debug)]
 pub(crate) struct Init {
     #[command(flatten)]
     common_args: CommonClientInitArgs,

common/bin-common/Cargo.toml

@@ -9,6 +9,7 @@ repository = { workspace = true }
 
 [dependencies]
 atty = "0.2"
+const-str = "0.5.6"
 clap = { workspace = true, features = ["derive"] }
 clap_complete = "4.0"
 clap_complete_fig = "4.0"

common/bin-common/src/build_information/mod.rs

@@ -42,12 +42,20 @@ pub struct BinaryBuildInformation {
 
     // VERGEN_CARGO_DEBUG
     /// Provides the cargo debug mode that was used for the build.
-    pub cargo_debug: &'static str,
+    // NOTE: keep the old name cargo_profile instead of cargo_debug for backwards compatibility
+    pub cargo_profile: &'static str,
 }
 
 impl BinaryBuildInformation {
     // explicitly require the build_version to be passed as it's binary specific
     pub const fn new(binary_name: &'static str, build_version: &'static str) -> Self {
+        let cargo_debug = env!("VERGEN_CARGO_DEBUG");
+        let cargo_profile = if const_str::equal!(cargo_debug, "true") {
+            "debug"
+        } else {
+            "release"
+        };
+
         BinaryBuildInformation {
             binary_name,
             build_timestamp: env!("VERGEN_BUILD_TIMESTAMP"),
@@ -57,7 +65,7 @@ impl BinaryBuildInformation {
             commit_branch: env!("VERGEN_GIT_BRANCH"),
             rustc_version: env!("VERGEN_RUSTC_SEMVER"),
             rustc_channel: env!("VERGEN_RUSTC_CHANNEL"),
-            cargo_debug: env!("VERGEN_CARGO_DEBUG"),
+            cargo_profile,
         }
     }
 
@@ -71,7 +79,7 @@ impl BinaryBuildInformation {
             commit_branch: self.commit_branch.to_owned(),
             rustc_version: self.rustc_version.to_owned(),
             rustc_channel: self.rustc_channel.to_owned(),
-            cargo_debug: self.cargo_debug.to_owned(),
+            cargo_profile: self.cargo_profile.to_owned(),
         }
     }
 
@@ -117,7 +125,8 @@ pub struct BinaryBuildInformationOwned {
 
     // VERGEN_CARGO_DEBUG
     /// Provides the cargo debug mode that was used for the build.
-    pub cargo_debug: String,
+    // NOTE: keep the old name cargo_profile instead of cargo_debug for backwards compatibility
+    pub cargo_profile: String,
 }
 
 impl Display for BinaryBuildInformationOwned {
@@ -151,8 +160,8 @@ impl Display for BinaryBuildInformationOwned {
             self.rustc_version,
             "rustc Channel:",
             self.rustc_channel,
-            "cargo Debug:",
-            self.cargo_debug,
+            "cargo Profile:",
+            self.cargo_profile,
         )
     }
 }

common/client-core/Cargo.toml

@@ -46,6 +46,7 @@ nym-validator-client = { path = "../client-libs/validator-client", default-featu
 nym-task = { path = "../task" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-network-defaults = { path = "../network-defaults" }
+si-scale = "0.2.2"
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
 version = "0.1.11"

common/client-core/src/cli_helpers/client_init.rs

@@ -109,6 +109,8 @@ pub async fn initialise_client<C>(
 ) -> Result<InitResultsWithConfig<C::Config>, C::Error>
 where
     C: InitialisableClient,
+    <C as InitialisableClient>::Config: std::fmt::Debug,
+    <C as InitialisableClient>::InitArgs: std::fmt::Debug,
 {
     info!("initialising {} client", C::NAME);
 
@@ -140,17 +142,32 @@ where
 
     // Attempt to use a user-provided gateway, if possible
     let user_chosen_gateway_id = common_args.gateway;
+    log::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
+
     let selection_spec = GatewaySelectionSpecification::new(
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
         false,
     );
+    log::debug!("Gateway selection specification: {selection_spec:?}");
 
     // Load and potentially override config
+    log::debug!("Init arguments: {init_args:#?}");
     let config = C::construct_config(&init_args);
+    log::debug!("Constructed config: {config:#?}");
     let paths = config.common_paths();
     let core = config.core_config();
 
+    log::info!(
+        "Using nym-api: {}",
+        core.client
+            .nym_api_urls
+            .iter()
+            .map(|url| url.as_str())
+            .collect::<Vec<&str>>()
+            .join(",")
+    );
+
     // Setup gateway by either registering a new one, or creating a new config from the selected
     // one but with keys kept, or reusing the gateway configuration.
     let key_store = OnDiskKeys::new(paths.keys.clone());

common/client-core/src/client/base_client/mod.rs

@@ -1,6 +1,7 @@
 // Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use super::packet_statistics_control::PacketStatisticsReporter;
 use super::received_buffer::ReceivedBufferMessage;
 use super::topology_control::geo_aware_provider::GeoAwareTopologyProvider;
 use crate::client::base_client::storage::gateway_details::GatewayDetailsStore;
@@ -10,6 +11,7 @@ use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputM
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
+use crate::client::packet_statistics_control::PacketStatisticsControl;
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
 use crate::client::received_buffer::{
@@ -254,6 +256,7 @@ where
         self_address: Recipient,
         topology_accessor: TopologyAccessor,
         mix_tx: BatchMixMessageSender,
+        stats_tx: PacketStatisticsReporter,
         shutdown: TaskClient,
     ) {
         info!("Starting loop cover traffic stream...");
@@ -266,6 +269,7 @@ where
             topology_accessor,
             debug_config.traffic,
             debug_config.cover_traffic,
+            stats_tx,
         );
 
         stream.start_with_shutdown(shutdown);
@@ -285,6 +289,7 @@ where
         client_connection_rx: ConnectionCommandReceiver,
         shutdown: TaskClient,
         packet_type: PacketType,
+        stats_tx: PacketStatisticsReporter,
     ) {
         info!("Starting real traffic stream...");
 
@@ -299,6 +304,7 @@ where
             reply_controller_receiver,
             lane_queue_lengths,
             client_connection_rx,
+            stats_tx,
         )
         .start_with_shutdown(shutdown, packet_type);
     }
@@ -312,6 +318,7 @@ where
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
         shutdown: TaskClient,
+        packet_statistics_control: PacketStatisticsReporter,
     ) {
         info!("Starting received messages buffer controller...");
         let controller: ReceivedMessagesBufferController<SphinxMessageReceiver> =
@@ -321,6 +328,7 @@ where
                 mixnet_receiver,
                 reply_key_storage,
                 reply_controller_sender,
+                packet_statistics_control,
             );
         controller.start_with_shutdown(shutdown)
     }
@@ -506,6 +514,13 @@ where
         Ok(())
     }
 
+    fn start_packet_statistics_control(shutdown: TaskClient) -> PacketStatisticsReporter {
+        info!("Starting packet statistics control...");
+        let (packet_statistics_control, packet_stats_reporter) = PacketStatisticsControl::new();
+        packet_statistics_control.start_with_shutdown(shutdown);
+        packet_stats_reporter
+    }
+
     fn start_mix_traffic_controller(
         gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
         shutdown: TaskClient,
@@ -633,6 +648,9 @@ where
         )
         .await?;
 
+        let packet_stats_reporter =
+            Self::start_packet_statistics_control(shutdown.fork("packet_statistics_control"));
+
         let gateway_packet_router = PacketRouter::new(
             ack_sender,
             mixnet_messages_sender,
@@ -662,6 +680,7 @@ where
             reply_storage.key_storage(),
             reply_controller_sender.clone(),
             shutdown.fork("received_messages_buffer"),
+            packet_stats_reporter.clone(),
         );
 
         // The message_sender is the transmitter for any component generating sphinx packets
@@ -700,6 +719,7 @@ where
             client_connection_rx,
             shutdown.fork("real_traffic_controller"),
             self.config.debug.traffic.packet_type,
+            packet_stats_reporter.clone(),
         );
 
         if !self
@@ -714,6 +734,7 @@ where
                 self_address,
                 shared_topology_accessor.clone(),
                 message_sender,
+                packet_stats_reporter,
                 shutdown.fork("cover_traffic_stream"),
             );
         }

common/client-core/src/client/cover_traffic_stream.rs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::client::mix_traffic::BatchMixMessageSender;
+use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
 use crate::client::topology_control::TopologyAccessor;
 use crate::{config, spawn_future};
 use futures::task::{Context, Poll};
@@ -61,6 +62,8 @@ where
     secondary_packet_size: Option<PacketSize>,
 
     packet_type: PacketType,
+
+    stats_tx: PacketStatisticsReporter,
 }
 
 impl<R> Stream for LoopCoverTrafficStream<R>
@@ -97,7 +100,8 @@ where
 // obviously when we finally make shared rng that is on 'higher' level, this should become
 // generic `R`
 impl LoopCoverTrafficStream<OsRng> {
-    pub fn new(
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) fn new(
         ack_key: Arc<AckKey>,
         average_ack_delay: Duration,
         mix_tx: BatchMixMessageSender,
@@ -105,6 +109,7 @@ impl LoopCoverTrafficStream<OsRng> {
         topology_access: TopologyAccessor,
         traffic_config: config::Traffic,
         cover_config: config::CoverTraffic,
+        stats_tx: PacketStatisticsReporter,
     ) -> Self {
         let rng = OsRng;
 
@@ -122,6 +127,7 @@ impl LoopCoverTrafficStream<OsRng> {
             primary_packet_size: traffic_config.primary_packet_size,
             secondary_packet_size: traffic_config.secondary_packet_size,
             packet_type: traffic_config.packet_type,
+            stats_tx,
         }
     }
 
@@ -191,6 +197,10 @@ impl LoopCoverTrafficStream<OsRng> {
                     log::warn!("Failed to send cover message - channel closed");
                 }
             }
+        } else {
+            self.stats_tx.report(PacketStatisticsEvent::CoverPacketSent(
+                cover_traffic_packet_size.size(),
+            ));
         }
 
         // TODO: I'm not entirely sure whether this is really required, because I'm not 100%

common/client-core/src/client/mod.rs

@@ -7,6 +7,7 @@ pub(crate) mod helpers;
 pub mod inbound_messages;
 pub mod key_manager;
 pub mod mix_traffic;
+pub(crate) mod packet_statistics_control;
 pub mod real_messages_control;
 pub mod received_buffer;
 pub mod replies;

common/client-core/src/client/packet_statistics_control.rs

@@ -0,0 +1,498 @@
+use std::{
+    collections::VecDeque,
+    time::{Duration, Instant},
+};
+
+use si_scale::helpers::bibytes2;
+
+use crate::spawn_future;
+
+// Time interval between reporting packet statistics
+const PACKET_REPORT_INTERVAL_SECS: u64 = 2;
+// Interval for taking snapshots of the packet statistics
+const SNAPSHOT_INTERVAL_MS: u64 = 500;
+// When computing rates, we include snapshots that are up to this old. We set it to some odd number
+// a tad larger than an integer number of snapshot intervals, so that we don't have to worry about
+// threshold effects.
+// Also, set it larger than the packet report interval so that we don't miss notable singular events
+const RECORDING_WINDOW_MS: u64 = 2300;
+
+#[derive(Default, Debug, Clone)]
+struct PacketStatistics {
+    // Sent
+    real_packets_sent: u64,
+    real_packets_sent_size: usize,
+    cover_packets_sent: u64,
+    cover_packets_sent_size: usize,
+
+    // Received
+    real_packets_received: u64,
+    real_packets_received_size: usize,
+    cover_packets_received: u64,
+    cover_packets_received_size: usize,
+
+    // Acks
+    total_acks_received: u64,
+    total_acks_received_size: usize,
+    real_acks_received: u64,
+    real_acks_received_size: usize,
+    cover_acks_received: u64,
+    cover_acks_received_size: usize,
+
+    // Types of packets queued
+    // TODO: track the type sent instead
+    real_packets_queued: u64,
+    retransmissions_queued: u64,
+    reply_surbs_queued: u64,
+    additional_reply_surbs_queued: u64,
+}
+
+impl PacketStatistics {
+    fn handle_event(&mut self, event: PacketStatisticsEvent) {
+        match event {
+            PacketStatisticsEvent::RealPacketSent(packet_size) => {
+                self.real_packets_sent += 1;
+                self.real_packets_sent_size += packet_size;
+            }
+            PacketStatisticsEvent::CoverPacketSent(packet_size) => {
+                self.cover_packets_sent += 1;
+                self.cover_packets_sent_size += packet_size;
+            }
+            PacketStatisticsEvent::RealPacketReceived(packet_size) => {
+                self.real_packets_received += 1;
+                self.real_packets_received_size += packet_size;
+            }
+            PacketStatisticsEvent::CoverPacketReceived(packet_size) => {
+                self.cover_packets_received += 1;
+                self.cover_packets_received_size += packet_size;
+            }
+            PacketStatisticsEvent::AckReceived(packet_size) => {
+                self.total_acks_received += 1;
+                self.total_acks_received_size += packet_size;
+            }
+            PacketStatisticsEvent::RealAckReceived(packet_size) => {
+                self.real_acks_received += 1;
+                self.real_acks_received_size += packet_size;
+            }
+            PacketStatisticsEvent::CoverAckReceived(packet_size) => {
+                self.cover_acks_received += 1;
+                self.cover_acks_received_size += packet_size;
+            }
+            PacketStatisticsEvent::RealPacketQueued => {
+                self.real_packets_queued += 1;
+            }
+            PacketStatisticsEvent::RetransmissionQueued => {
+                self.retransmissions_queued += 1;
+            }
+            PacketStatisticsEvent::ReplySurbRequestQueued => {
+                self.reply_surbs_queued += 1;
+            }
+            PacketStatisticsEvent::AdditionalReplySurbRequestQueued => {
+                self.additional_reply_surbs_queued += 1;
+            }
+        }
+    }
+
+    fn summary(&self) -> (String, String) {
+        (
+            format!(
+                "packets sent: {} (real: {}, cover: {}, retransmissions: {})",
+                self.real_packets_sent + self.cover_packets_sent,
+                self.real_packets_sent,
+                self.cover_packets_sent,
+                self.retransmissions_queued,
+            ),
+            format!(
+                "packets received: {}, (real: {}, cover: {}, acks: {}, acks for cover: {})",
+                self.real_packets_received + self.cover_packets_received,
+                self.real_packets_received,
+                self.cover_packets_received,
+                self.real_acks_received,
+                self.cover_acks_received,
+            ),
+        )
+    }
+}
+
+impl std::ops::Sub for PacketStatistics {
+    type Output = Self;
+
+    fn sub(self, rhs: Self) -> Self::Output {
+        Self {
+            real_packets_sent: self.real_packets_sent - rhs.real_packets_sent,
+            real_packets_sent_size: self.real_packets_sent_size - rhs.real_packets_sent_size,
+            cover_packets_sent: self.cover_packets_sent - rhs.cover_packets_sent,
+            cover_packets_sent_size: self.cover_packets_sent_size - rhs.cover_packets_sent_size,
+
+            real_packets_received: self.real_packets_received - rhs.real_packets_received,
+            real_packets_received_size: self.real_packets_received_size
+                - rhs.real_packets_received_size,
+            cover_packets_received: self.cover_packets_received - rhs.cover_packets_received,
+            cover_packets_received_size: self.cover_packets_received_size
+                - rhs.cover_packets_received_size,
+
+            total_acks_received: self.total_acks_received - rhs.total_acks_received,
+            total_acks_received_size: self.total_acks_received_size - rhs.total_acks_received_size,
+            real_acks_received: self.real_acks_received - rhs.real_acks_received,
+            real_acks_received_size: self.real_acks_received_size - rhs.real_acks_received_size,
+            cover_acks_received: self.cover_acks_received - rhs.cover_acks_received,
+            cover_acks_received_size: self.cover_acks_received_size - rhs.cover_acks_received_size,
+
+            real_packets_queued: self.real_packets_queued - rhs.real_packets_queued,
+            retransmissions_queued: self.retransmissions_queued - rhs.retransmissions_queued,
+            reply_surbs_queued: self.reply_surbs_queued - rhs.reply_surbs_queued,
+            additional_reply_surbs_queued: self.additional_reply_surbs_queued
+                - rhs.additional_reply_surbs_queued,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+struct PacketRates {
+    real_packets_sent: f64,
+    real_packets_sent_size: f64,
+    cover_packets_sent: f64,
+    cover_packets_sent_size: f64,
+
+    real_packets_received: f64,
+    real_packets_received_size: f64,
+    cover_packets_received: f64,
+    cover_packets_received_size: f64,
+
+    total_acks_received: f64,
+    total_acks_received_size: f64,
+    real_acks_received: f64,
+    real_acks_received_size: f64,
+    cover_acks_received: f64,
+    cover_acks_received_size: f64,
+
+    real_packets_queued: f64,
+    retransmissions_queued: f64,
+    reply_surbs_queued: f64,
+    additional_reply_surbs_queued: f64,
+}
+
+impl From<PacketStatistics> for PacketRates {
+    fn from(stats: PacketStatistics) -> Self {
+        Self {
+            real_packets_sent: stats.real_packets_sent as f64,
+            real_packets_sent_size: stats.real_packets_sent_size as f64,
+            cover_packets_sent: stats.cover_packets_sent as f64,
+            cover_packets_sent_size: stats.cover_packets_sent_size as f64,
+
+            real_packets_received: stats.real_packets_received as f64,
+            real_packets_received_size: stats.real_packets_received_size as f64,
+            cover_packets_received: stats.cover_packets_received as f64,
+            cover_packets_received_size: stats.cover_packets_received_size as f64,
+
+            total_acks_received: stats.total_acks_received as f64,
+            total_acks_received_size: stats.total_acks_received_size as f64,
+            real_acks_received: stats.real_acks_received as f64,
+            real_acks_received_size: stats.real_acks_received_size as f64,
+            cover_acks_received: stats.cover_acks_received as f64,
+            cover_acks_received_size: stats.cover_acks_received_size as f64,
+
+            real_packets_queued: stats.real_packets_queued as f64,
+            retransmissions_queued: stats.retransmissions_queued as f64,
+            reply_surbs_queued: stats.reply_surbs_queued as f64,
+            additional_reply_surbs_queued: stats.additional_reply_surbs_queued as f64,
+        }
+    }
+}
+
+impl std::ops::Sub for PacketRates {
+    type Output = Self;
+
+    fn sub(self, rhs: Self) -> Self::Output {
+        Self {
+            real_packets_sent: self.real_packets_sent - rhs.real_packets_sent,
+            real_packets_sent_size: self.real_packets_sent_size - rhs.real_packets_sent_size,
+            cover_packets_sent: self.cover_packets_sent - rhs.cover_packets_sent,
+            cover_packets_sent_size: self.cover_packets_sent_size - rhs.cover_packets_sent_size,
+
+            real_packets_received: self.real_packets_received - rhs.real_packets_received,
+            real_packets_received_size: self.real_packets_received_size
+                - rhs.real_packets_received_size,
+            cover_packets_received: self.cover_packets_received - rhs.cover_packets_received,
+            cover_packets_received_size: self.cover_packets_received_size
+                - rhs.cover_packets_received_size,
+
+            total_acks_received: self.total_acks_received - rhs.total_acks_received,
+            total_acks_received_size: self.total_acks_received_size - rhs.total_acks_received_size,
+            real_acks_received: self.real_acks_received - rhs.real_acks_received,
+            real_acks_received_size: self.real_acks_received_size - rhs.real_acks_received_size,
+            cover_acks_received: self.cover_acks_received - rhs.cover_acks_received,
+            cover_acks_received_size: self.cover_acks_received_size - rhs.cover_acks_received_size,
+
+            real_packets_queued: self.real_packets_queued - rhs.real_packets_queued,
+            retransmissions_queued: self.retransmissions_queued - rhs.retransmissions_queued,
+            reply_surbs_queued: self.reply_surbs_queued - rhs.reply_surbs_queued,
+            additional_reply_surbs_queued: self.additional_reply_surbs_queued
+                - rhs.additional_reply_surbs_queued,
+        }
+    }
+}
+
+impl std::ops::Div<f64> for PacketRates {
+    type Output = Self;
+
+    fn div(self, rhs: f64) -> Self::Output {
+        Self {
+            real_packets_sent: self.real_packets_sent / rhs,
+            real_packets_sent_size: self.real_packets_sent_size / rhs,
+            cover_packets_sent: self.cover_packets_sent / rhs,
+            cover_packets_sent_size: self.cover_packets_sent_size / rhs,
+
+            real_packets_received: self.real_packets_received / rhs,
+            real_packets_received_size: self.real_packets_received_size / rhs,
+            cover_packets_received: self.cover_packets_received / rhs,
+            cover_packets_received_size: self.cover_packets_received_size / rhs,
+
+            total_acks_received: self.total_acks_received / rhs,
+            total_acks_received_size: self.total_acks_received_size / rhs,
+            real_acks_received: self.real_acks_received / rhs,
+            real_acks_received_size: self.real_acks_received_size / rhs,
+            cover_acks_received: self.cover_acks_received / rhs,
+            cover_acks_received_size: self.cover_acks_received_size / rhs,
+
+            real_packets_queued: self.real_packets_queued / rhs,
+            retransmissions_queued: self.retransmissions_queued / rhs,
+            reply_surbs_queued: self.reply_surbs_queued / rhs,
+            additional_reply_surbs_queued: self.additional_reply_surbs_queued / rhs,
+        }
+    }
+}
+
+impl PacketRates {
+    fn summary(&self) -> String {
+        format!(
+            "rx: {}/s (real: {}/s), tx: {}/s (real: {}/s)",
+            bibytes2(self.real_packets_received_size + self.cover_packets_received_size),
+            bibytes2(self.real_packets_received_size),
+            bibytes2(self.real_packets_sent_size + self.cover_packets_sent_size),
+            bibytes2(self.real_packets_sent_size),
+        )
+    }
+
+    fn detailed_summary(&self) -> String {
+        format!(
+            "RX: {:.1} mixpkt/s, {}/s (real: {}/s, acks: {}/s), TX: {:.1} mixpkt/s, {}/s (real: {}/s)",
+            self.real_packets_received + self.cover_packets_received,
+            bibytes2(self.real_packets_received_size + self.cover_packets_received_size),
+            bibytes2(self.real_packets_received_size),
+            bibytes2(self.total_acks_received_size),
+            self.real_packets_sent + self.cover_packets_sent,
+            bibytes2(self.real_packets_sent_size + self.cover_packets_sent_size),
+            bibytes2(self.real_packets_sent_size),
+        )
+    }
+}
+
+pub(crate) enum PacketStatisticsEvent {
+    // The real packets sent. Recall that acks are sent by the gateway, so it's not included here.
+    RealPacketSent(usize),
+    // The cover packets sent
+    CoverPacketSent(usize),
+
+    // Real packets received
+    RealPacketReceived(usize),
+    // Cover packets received
+    CoverPacketReceived(usize),
+
+    // Ack of any type received. This is mostly used as a consistency check, and should be the sum
+    // of real and cover acks received.
+    AckReceived(usize),
+    // Out of the total acks received, this is the subset of those that were real
+    RealAckReceived(usize),
+    // Out of the total acks received, this is the subset of those that were for cover traffic
+    CoverAckReceived(usize),
+
+    // Types of packets queued
+    RealPacketQueued,
+    RetransmissionQueued,
+    ReplySurbRequestQueued,
+    AdditionalReplySurbRequestQueued,
+}
+
+type PacketStatisticsReceiver = tokio::sync::mpsc::UnboundedReceiver<PacketStatisticsEvent>;
+
+#[derive(Clone)]
+pub(crate) struct PacketStatisticsReporter {
+    stats_tx: tokio::sync::mpsc::UnboundedSender<PacketStatisticsEvent>,
+}
+
+impl PacketStatisticsReporter {
+    pub(crate) fn new(stats_tx: tokio::sync::mpsc::UnboundedSender<PacketStatisticsEvent>) -> Self {
+        Self { stats_tx }
+    }
+
+    pub(crate) fn report(&self, event: PacketStatisticsEvent) {
+        self.stats_tx.send(event).unwrap_or_else(|err| {
+            log::error!("Failed to report packet stat: {:?}", err);
+        });
+    }
+}
+
+pub(crate) struct PacketStatisticsControl {
+    // Incoming packet stats events from other tasks
+    stats_rx: PacketStatisticsReceiver,
+
+    // Keep track of packet statistics over time
+    stats: PacketStatistics,
+
+    // We keep snapshots of the statistics over time so we can compute rates, and also keeping the
+    // full history allows for some more fancy averaging if we want to do that.
+    history: VecDeque<(Instant, PacketStatistics)>,
+
+    // Keep previous rates so that we can detect notable events
+    rates: VecDeque<(Instant, PacketRates)>,
+}
+
+impl PacketStatisticsControl {
+    pub(crate) fn new() -> (Self, PacketStatisticsReporter) {
+        let (stats_tx, stats_rx) = tokio::sync::mpsc::unbounded_channel();
+
+        (
+            Self {
+                stats_rx,
+                stats: PacketStatistics::default(),
+                history: VecDeque::new(),
+                rates: VecDeque::new(),
+            },
+            PacketStatisticsReporter::new(stats_tx),
+        )
+    }
+
+    // Add the current stats to the history, and remove old ones.
+    fn update_history(&mut self) {
+        // Update latest
+        self.history.push_back((Instant::now(), self.stats.clone()));
+
+        // Filter out old ones
+        let recording_window = Instant::now() - Duration::from_millis(RECORDING_WINDOW_MS);
+        while self
+            .history
+            .front()
+            .map_or(false, |&(t, _)| t < recording_window)
+        {
+            self.history.pop_front();
+        }
+    }
+
+    fn compute_rates(&self) -> Option<PacketRates> {
+        // NOTE: consider changing this to compute rates over the history instead of using current
+        // stats. Currently it should not make much of a difference since we call this just after
+        // updating the history, but it seems like it could be more internally consistent to do it
+        // that way.
+
+        // Do basic averaging over the entire history, which just uses the first and last
+        if let Some((start, start_stats)) = self.history.front() {
+            let duration_secs = Instant::now().duration_since(*start).as_secs_f64();
+            let delta = self.stats.clone() - start_stats.clone();
+            let rates = PacketRates::from(delta) / duration_secs;
+            Some(rates)
+        } else {
+            None
+        }
+    }
+
+    fn update_rates(&mut self) {
+        // Update latest
+        if let Some(rates) = self.compute_rates() {
+            self.rates.push_back((Instant::now(), rates));
+        }
+
+        // Filter out old ones
+        let recording_window = Instant::now() - Duration::from_millis(RECORDING_WINDOW_MS);
+        while self
+            .rates
+            .front()
+            .map_or(false, |&(t, _)| t < recording_window)
+        {
+            self.rates.pop_front();
+        }
+    }
+
+    fn report_rates(&self) {
+        if let Some((_, rates)) = self.rates.back() {
+            log::info!("{}", rates.summary());
+            log::debug!("{}", rates.detailed_summary());
+        }
+    }
+
+    fn report_counters(&self) {
+        log::trace!("packet statistics: {:?}", &self.stats);
+        let (summary_sent, summary_recv) = self.stats.summary();
+        log::debug!("{}", summary_sent);
+        log::debug!("{}", summary_recv);
+    }
+
+    fn check_for_notable_events(&self) {
+        let Some((_, latest_rates)) = self.rates.back() else {
+            return;
+        };
+
+        // If we get a burst of retransmissions
+        // TODO: consider making this the number of retransmissions since last report instead.
+        if latest_rates.retransmissions_queued > 0.0 {
+            log::debug!(
+                "retransmissions: {:.2} pkt/s",
+                latest_rates.retransmissions_queued
+            );
+
+            // Check what the number of retransmissions was during the recording window
+            if let Some((_, start_stats)) = self.history.front() {
+                let delta = self.stats.clone() - start_stats.clone();
+                log::info!("retransmissions: {}", delta.retransmissions_queued,);
+            } else {
+                log::warn!("Unable to check retransmissions during recording window");
+            }
+        }
+
+        // IDEA: if there is a burst of acks, that could indicate tokio task starvation.
+    }
+
+    pub(crate) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        log::debug!("Started PacketStatisticsControl with graceful shutdown support");
+
+        let report_interval = Duration::from_secs(PACKET_REPORT_INTERVAL_SECS);
+        let mut report_interval = tokio::time::interval(report_interval);
+        let snapshot_interval = Duration::from_millis(SNAPSHOT_INTERVAL_MS);
+        let mut snapshot_interval = tokio::time::interval(snapshot_interval);
+
+        loop {
+            tokio::select! {
+                stats_event = self.stats_rx.recv() => match stats_event {
+                    Some(stats_event) => {
+                        log::trace!("PacketStatisticsControl: Received stats event");
+                        self.stats.handle_event(stats_event);
+                    },
+                    None => {
+                        log::trace!("PacketStatisticsControl: stopping since stats channel was closed");
+                        break;
+                    }
+                },
+                _ = snapshot_interval.tick() => {
+                    self.update_history();
+                    self.update_rates();
+                }
+                _ = report_interval.tick() => {
+                    self.report_rates();
+                    self.check_for_notable_events();
+                    self.report_counters();
+                }
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("PacketStatisticsControl: Received shutdown");
+                    break;
+                },
+            }
+        }
+        log::debug!("PacketStatisticsControl: Exiting");
+    }
+
+    pub(crate) fn start_with_shutdown(mut self, task_client: nym_task::TaskClient) {
+        spawn_future(async move {
+            self.run_with_shutdown(task_client).await;
+        })
+    }
+}

common/client-core/src/client/real_messages_control/acknowledgement_control/acknowledgement_listener.rs

@@ -1,6 +1,8 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
+
 use super::action_controller::{AckActionSender, Action};
 use futures::StreamExt;
 use log::*;
@@ -17,6 +19,7 @@ pub(super) struct AcknowledgementListener {
     ack_key: Arc<AckKey>,
     ack_receiver: AcknowledgementReceiver,
     action_sender: AckActionSender,
+    stats_tx: PacketStatisticsReporter,
 }
 
 impl AcknowledgementListener {
@@ -24,16 +27,21 @@ impl AcknowledgementListener {
         ack_key: Arc<AckKey>,
         ack_receiver: AcknowledgementReceiver,
         action_sender: AckActionSender,
+        stats_tx: PacketStatisticsReporter,
     ) -> Self {
         AcknowledgementListener {
             ack_key,
             ack_receiver,
             action_sender,
+            stats_tx,
         }
     }
 
     async fn on_ack(&mut self, ack_content: Vec<u8>) {
         trace!("Received an ack");
+        self.stats_tx
+            .report(PacketStatisticsEvent::AckReceived(ack_content.len()));
+
         let frag_id = match recover_identifier(&self.ack_key, &ack_content)
             .map(FragmentIdentifier::try_from_bytes)
         {
@@ -48,11 +56,14 @@ impl AcknowledgementListener {
         // because nothing was inserted in the first place
         if frag_id == COVER_FRAG_ID {
             trace!("Received an ack for a cover message - no need to do anything");
+            self.stats_tx
+                .report(PacketStatisticsEvent::CoverAckReceived(ack_content.len()));
             return;
         }
 
         trace!("Received {} from the mix network", frag_id);
-
+        self.stats_tx
+            .report(PacketStatisticsEvent::RealAckReceived(ack_content.len()));
         self.action_sender
             .unbounded_send(Action::new_remove(frag_id))
             .unwrap();

common/client-core/src/client/real_messages_control/acknowledgement_control/mod.rs

@@ -8,6 +8,7 @@ use self::{
     sent_notification_listener::SentNotificationListener,
 };
 use crate::client::inbound_messages::InputMessageReceiver;
+use crate::client::packet_statistics_control::PacketStatisticsReporter;
 use crate::client::real_messages_control::message_handler::MessageHandler;
 use crate::client::replies::reply_controller::ReplyControllerSender;
 use crate::spawn_future;
@@ -208,6 +209,7 @@ where
         connectors: AcknowledgementControllerConnectors,
         message_handler: MessageHandler<R>,
         reply_controller_sender: ReplyControllerSender,
+        stats_tx: PacketStatisticsReporter,
     ) -> Self {
         let (retransmission_tx, retransmission_rx) = mpsc::unbounded();
 
@@ -224,6 +226,7 @@ where
             Arc::clone(&ack_key),
             connectors.ack_receiver,
             connectors.ack_action_sender.clone(),
+            stats_tx,
         );
 
         // will listen for any new messages from the client

common/client-core/src/client/real_messages_control/mod.rs

@@ -35,6 +35,8 @@ use crate::client::replies::reply_controller;
 use crate::config;
 pub(crate) use acknowledgement_control::{AckActionSender, Action};
 
+use super::packet_statistics_control::PacketStatisticsReporter;
+
 pub(crate) mod acknowledgement_control;
 pub(crate) mod message_handler;
 pub(crate) mod real_traffic_stream;
@@ -143,6 +145,7 @@ impl RealMessagesController<OsRng> {
         reply_controller_receiver: ReplyControllerReceiver,
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
+        stats_tx: PacketStatisticsReporter,
     ) -> Self {
         let rng = OsRng;
 
@@ -181,6 +184,7 @@ impl RealMessagesController<OsRng> {
             ack_controller_connectors,
             message_handler.clone(),
             reply_controller_sender,
+            stats_tx.clone(),
         );
 
         let reply_control = ReplyController::new(
@@ -199,6 +203,7 @@ impl RealMessagesController<OsRng> {
             topology_access,
             lane_queue_lengths,
             client_connection_rx,
+            stats_tx,
         );
 
         RealMessagesController {

common/client-core/src/client/real_messages_control/real_traffic_stream.rs

@@ -3,6 +3,7 @@
 
 use self::sending_delay_controller::SendingDelayController;
 use crate::client::mix_traffic::BatchMixMessageSender;
+use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
 use crate::client::real_messages_control::acknowledgement_control::SentPacketNotificationSender;
 use crate::client::topology_control::TopologyAccessor;
 use crate::client::transmission_buffer::TransmissionBuffer;
@@ -113,6 +114,9 @@ where
 
     /// Report queue lengths so that upstream can backoff sending data, and keep connections open.
     lane_queue_lengths: LaneQueueLengths,
+
+    /// Channel used for sending statistics events to `PacketStatisticsControl`.
+    stats_tx: PacketStatisticsReporter,
 }
 
 #[derive(Debug)]
@@ -171,6 +175,7 @@ where
         topology_access: TopologyAccessor,
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
+        stats_tx: PacketStatisticsReporter,
     ) -> Self {
         OutQueueControl {
             config,
@@ -184,6 +189,7 @@ where
             transmission_buffer: TransmissionBuffer::new(),
             client_connection_rx,
             lane_queue_lengths,
+            stats_tx,
         }
     }
 
@@ -214,7 +220,7 @@ where
     async fn on_message(&mut self, next_message: StreamMessage) {
         trace!("created new message");
 
-        let (next_message, fragment_id) = match next_message {
+        let (next_message, fragment_id, packet_size) = match next_message {
             StreamMessage::Cover => {
                 let cover_traffic_packet_size = self.loop_cover_message_size();
                 trace!("the next loop cover message will be put in a {cover_traffic_packet_size} packet");
@@ -250,15 +256,28 @@ where
                         "Somehow failed to generate a loop cover message with a valid topology",
                     ),
                     None,
+                    cover_traffic_packet_size.size(),
                 )
             }
             StreamMessage::Real(real_message) => {
-                (real_message.mix_packet, real_message.fragment_id)
+                let packet_size = real_message.packet_size();
+                (
+                    real_message.mix_packet,
+                    real_message.fragment_id,
+                    packet_size,
+                )
             }
         };
 
         if let Err(err) = self.mix_tx.send(vec![next_message]).await {
             log::error!("Failed to send: {err}");
+        } else {
+            let event = if fragment_id.is_some() {
+                PacketStatisticsEvent::RealPacketSent(packet_size)
+            } else {
+                PacketStatisticsEvent::CoverPacketSent(packet_size)
+            };
+            self.stats_tx.report(event);
         }
 
         // notify ack controller about sending our message only after we actually managed to push it
@@ -340,6 +359,28 @@ where
         let lane_length = self.transmission_buffer.lane_length(&lane);
         self.lane_queue_lengths.set(&lane, lane_length);
 
+        // This is the last step in the pipeline where we know the type of the message, so
+        // lets count the number of retransmissions and reply surb messages sent here.
+        let stat_event = match lane {
+            TransmissionLane::General => None,
+            TransmissionLane::ConnectionId(_) => None,
+            TransmissionLane::ReplySurbRequest => {
+                Some(PacketStatisticsEvent::ReplySurbRequestQueued)
+            }
+            TransmissionLane::AdditionalReplySurbs => {
+                Some(PacketStatisticsEvent::AdditionalReplySurbRequestQueued)
+            }
+            TransmissionLane::Retransmission => Some(PacketStatisticsEvent::RetransmissionQueued),
+        };
+        if let Some(stat_event) = stat_event {
+            self.stats_tx.report(stat_event);
+        }
+        // To avoid comparing apples to oranges when presenting the fraction of packets that are
+        // retransmissions, we also need to keep track to the total number of real messages queued,
+        // even though we also track the actual number of messages sent later in the pipeline.
+        self.stats_tx
+            .report(PacketStatisticsEvent::RealPacketQueued);
+
         Some(real_next)
     }
 
@@ -433,6 +474,13 @@ where
             Poll::Ready(Some((real_messages, conn_id))) => {
                 log::trace!("handling real_messages: size: {}", real_messages.len());
 
+                // This is the last step in the pipeline where we know the type of the message, so
+                // lets count the number of retransmissions here.
+                if conn_id == TransmissionLane::Retransmission {
+                    self.stats_tx
+                        .report(PacketStatisticsEvent::RetransmissionQueued);
+                }
+
                 // First store what we got for the given connection id
                 self.transmission_buffer.store(&conn_id, real_messages);
                 let real_next = self.pop_next_message().expect("we just added one");
@@ -471,10 +519,10 @@ where
         let mult = self.sending_delay_controller.current_multiplier();
         let delay = self.current_average_message_sending_delay().as_millis();
         let status_str = if self.config.traffic.disable_main_poisson_packet_distribution {
-            format!("Status: {lanes} lanes, backlog: {backlog:.2} kiB ({packets}), no delay")
+            format!("Packet backlog: {backlog:.2} kiB ({packets}), {lanes} lanes, no delay")
         } else {
             format!(
-                "Status: {lanes} lanes, backlog: {backlog:.2} kiB ({packets}), avg delay: {delay}ms ({mult})"
+                "Packet backlog: {backlog:.2} kiB ({packets}), {lanes} lanes, avg delay: {delay}ms ({mult})"
             )
         };
         if packets > 1000 {

common/client-core/src/client/received_buffer.rs

@@ -1,8 +1,10 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::client::replies::reply_controller::ReplyControllerSender;
-use crate::client::replies::reply_storage::SentReplyKeys;
+use crate::client::{
+    packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter},
+    replies::{reply_controller::ReplyControllerSender, reply_storage::SentReplyKeys},
+};
 use crate::spawn_future;
 use futures::channel::mpsc;
 use futures::lock::Mutex;
@@ -43,15 +45,33 @@ struct ReceivedMessagesBufferInner<R: MessageReceiver> {
     // but perhaps it should be changed to include timestamps of when the message was reconstructed
     // and every now and then remove ids older than X
     recently_reconstructed: HashSet<i32>,
+
+    stats_tx: PacketStatisticsReporter,
 }
 
 impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
-    fn recover_from_fragment(&mut self, fragment_data: &[u8]) -> Option<NymMessage> {
+    fn recover_from_fragment(
+        &mut self,
+        fragment_data: &[u8],
+        fragment_data_size: usize,
+    ) -> Option<NymMessage> {
         if nym_sphinx::cover::is_cover(fragment_data) {
             trace!("The message was a loop cover message! Skipping it");
+            // NOTE: it's important to note that there is quite a bit of difference in size of
+            // received and sent packets due to the sphinx layers being removed by the exit gateway
+            // before it reaches the mixnet client.
+            self.stats_tx
+                .report(PacketStatisticsEvent::CoverPacketReceived(
+                    fragment_data_size,
+                ));
             return None;
         }
 
+        self.stats_tx
+            .report(PacketStatisticsEvent::RealPacketReceived(
+                fragment_data_size,
+            ));
+
         let fragment = match self.message_receiver.recover_fragment(fragment_data) {
             Err(err) => {
                 warn!("failed to recover fragment from raw data: {err}. The whole underlying message might be corrupted and unrecoverable!");
@@ -103,15 +123,17 @@ impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
         reply_ciphertext: &mut [u8],
         reply_key: SurbEncryptionKey,
     ) -> Result<Option<NymMessage>, MessageRecoveryError> {
+        let reply_ciphertext_size = reply_ciphertext.len();
         // note: this performs decryption IN PLACE without extra allocation
         self.message_receiver
             .recover_plaintext_from_reply(reply_ciphertext, reply_key)?;
         let fragment_data = reply_ciphertext;
 
-        Ok(self.recover_from_fragment(fragment_data))
+        Ok(self.recover_from_fragment(fragment_data, reply_ciphertext_size))
     }
 
     fn process_received_regular_packet(&mut self, mut raw_fragment: Vec<u8>) -> Option<NymMessage> {
+        let raw_fragment_size = raw_fragment.len();
         let fragment_data = match self.message_receiver.recover_plaintext_from_regular_packet(
             self.local_encryption_keypair.private_key(),
             &mut raw_fragment,
@@ -123,7 +145,7 @@ impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
             Ok(frag_data) => frag_data,
         };
 
-        self.recover_from_fragment(fragment_data)
+        self.recover_from_fragment(fragment_data, raw_fragment_size)
     }
 }
 
@@ -141,6 +163,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
         local_encryption_keypair: Arc<encryption::KeyPair>,
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
+        stats_tx: PacketStatisticsReporter,
     ) -> Self {
         ReceivedMessagesBuffer {
             inner: Arc::new(Mutex::new(ReceivedMessagesBufferInner {
@@ -149,6 +172,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                 message_receiver: R::new(),
                 message_sender: None,
                 recently_reconstructed: HashSet::new(),
+                stats_tx,
             })),
             reply_key_storage,
             reply_controller_sender,
@@ -353,7 +377,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                 };
 
             if let Some(completed) = completed_message {
-                info!("received {completed}");
+                debug!("received {completed}");
                 completed_messages.push(completed)
             }
         }
@@ -480,11 +504,13 @@ impl<R: MessageReceiver + Clone + Send + 'static> ReceivedMessagesBufferControll
         mixnet_packet_receiver: MixnetMessageReceiver,
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
+        packet_statistics_reporter: PacketStatisticsReporter,
     ) -> Self {
         let received_buffer = ReceivedMessagesBuffer::new(
             local_encryption_keypair,
             reply_key_storage,
             reply_controller_sender,
+            packet_statistics_reporter,
         );
 
         ReceivedMessagesBufferController {

common/client-core/src/init/helpers.rs

@@ -65,7 +65,7 @@ pub async fn current_gateways<R: Rng>(
         .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
     let client = nym_validator_client::client::NymApiClient::new(nym_api.clone());
 
-    log::trace!("Fetching list of gateways from: {nym_api}");
+    log::debug!("Fetching list of gateways from: {nym_api}");
 
     let gateways = client.get_cached_described_gateways().await?;
     log::debug!("Found {} gateways", gateways.len());

common/client-core/src/init/types.rs

@@ -178,7 +178,7 @@ impl<T> From<PersistedGatewayDetails<T>> for GatewayDetails<T> {
     }
 }
 
-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub enum GatewaySelectionSpecification<T = EmptyCustomDetails> {
     /// Uniformly choose a random remote gateway.
     UniformRemote { must_use_tls: bool },

common/network-defaults/Cargo.toml

@@ -11,6 +11,7 @@ repository.workspace = true
 cfg-if = { workspace = true }
 dotenvy = { workspace = true }
 hex-literal = "0.3.3"
+log = { workspace = true }
 once_cell = { workspace = true }
 schemars = { workspace = true, features = ["preserve_order"] }
 serde = { workspace = true, features = ["derive"]}

common/network-defaults/src/lib.rs

@@ -400,11 +400,25 @@ fn fix_deprecated_environmental_variables() {
     }
 }
 
+// Read the variables from the file and log what the corresponding values in the environment are.
+fn print_env_vars_with_keys_in_file<P: AsRef<Path> + Copy>(config_env_file: P) {
+    let items = dotenvy::from_path_iter(config_env_file)
+        .expect("Invalid path to environment configuration file");
+    for item in items {
+        let (key, val) = item.expect("Invalid item in environment configuration file");
+        log::debug!("{}: {}", key, val);
+    }
+}
+
 pub fn setup_env<P: AsRef<Path>>(config_env_file: Option<P>) {
     match std::env::var(var_names::CONFIGURED) {
         // if the configuration is not already set in the env vars
         Err(std::env::VarError::NotPresent) => {
-            if let Some(config_env_file) = config_env_file {
+            if let Some(config_env_file) = &config_env_file {
+                log::debug!(
+                    "Loading environment variables from {:?}",
+                    config_env_file.as_ref()
+                );
                 dotenvy::from_path(config_env_file)
                     .expect("Invalid path to environment configuration file");
                 fix_deprecated_environmental_variables();
@@ -412,17 +426,25 @@ pub fn setup_env<P: AsRef<Path>>(config_env_file: Option<P>) {
                 // if nothing is set, the use mainnet defaults
                 // if the user has not set `CONFIGURED`, then even if they set any of the env variables,
                 // overwrite them
+                log::debug!("Loading mainnet defaults");
                 crate::mainnet::export_to_env();
             }
         }
-        Err(_) => crate::mainnet::export_to_env(),
+        Err(_) => {
+            log::debug!("Environment variables already set. Using them");
+            crate::mainnet::export_to_env()
+        }
         _ => {
             fix_deprecated_environmental_variables();
         }
     }
 
     // if we haven't explicitly defined any of the constants, fallback to defaults
-    crate::mainnet::export_to_env_if_not_set()
+    crate::mainnet::export_to_env_if_not_set();
+
+    if let Some(config_env_file) = &config_env_file {
+        print_env_vars_with_keys_in_file(config_env_file);
+    }
 }
 
 // Name of the event triggered by the eth contract. If the event name is changed,

common/nymsphinx/src/message.rs

@@ -239,8 +239,15 @@ impl NymMessage {
         let (packets_used, space_left) =
             chunking::number_of_required_fragments(total_required_bytes, plaintext_per_packet);
 
-        let wasted_space = space_left as f32 / (bytes.len() + 1 + space_left) as f32;
-        log::trace!("Padding {self_display}: {} of raw plaintext bytes are required. They're going to be put into {packets_used} sphinx packets with {space_left} bytes of leftover space. {wasted_space}% of packet capacity is going to be wasted.", bytes.len() + 1);
+        let wasted_space_percentage =
+            (space_left as f32 / (bytes.len() + 1 + space_left) as f32) * 100.0;
+        log::trace!(
+            "Padding {self_display}: {} of raw plaintext bytes are required. \
+            They're going to be put into {packets_used} sphinx packets with {space_left} bytes \
+            of leftover space. {wasted_space_percentage:.1}% of packet capacity is going to \
+            be wasted.",
+            bytes.len() + 1
+        );
 
         bytes
             .into_iter()

documentation/dev-portal/book.toml

@@ -51,6 +51,10 @@ assets_version = "3.0.0" # do not edit: managed by `mdbook-admonish install`
 minimum_rust_version = "1.66"
 wallet_release_version = "1.2.8"
 
+# nym-vpn related variables
+nym_vpn_latest_binary_url = "https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.3"
+nym_vpn_form_url = "https://opnform.com/forms/nymvpn-user-research-at-37c3-yccqko-2"
+
 [preprocessor.last-changed]
 command = "mdbook-last-changed"
 renderer = ["html"]

documentation/dev-portal/src/SUMMARY.md

@@ -18,6 +18,16 @@
 
 # User Manuals
 
+- [NymVPN alpha](nymvpn/intro.md)
+    - [GUI](nymvpn/gui.md)
+        - [Linux](nymvpn/gui-linux.md)
+        - [MacOS](nymvpn/gui-mac.md)
+    - [CLI](nymvpn/cli.md)
+        - [Linux](nymvpn/cli-linux.md)
+        - [MacOS](nymvpn/cli-mac.md)
+    - [Testing](nymvpn/testing.md)
+    - [Troubleshooting](nymvpn/troubleshooting.md)
+    - [NymVPN FAQ](nymvpn/faq.md)
 - [NymConnect X Monero](tutorials/monero.md)
 - [NymConnect X Matrix](tutorials/matrix.md)
 - [NymConnect X Telegram](tutorials/telegram.md)
@@ -68,12 +78,6 @@
 
 # Events
 
-- [CryptoTalk](events/cryptotalk/nym-vpn.md)
-    - [NymVPN Linux Guide](events/cryptotalk/nym-vpn-linux.md)
-    - [NymVPN MacOS Guide](events/cryptotalk/nym-vpn-mac.md)
-    - [NymVPN Testing](events/cryptotalk/nym-vpn-testing.md)
-    - [NymVPN Troubleshooting](events/cryptotalk/nym-vpn-troubleshooting.md)
-    - [NymVPN FAQ](events/cryptotalk/nym-vpn-faq.md)
 - [Web3Privacy Now](./events/web3-privacy.md)
 - [HCPP23-serinko](./events/hcpp23-serinko.md)
 - [HCPP23-max](./events/hcpp23-max.md)

documentation/dev-portal/src/events/cryptotalk/nym-vpn-linux.md

@@ -1,198 +0,0 @@
-# NymVPN alpha: Guide for GNU/Linux
-
-```admonish warning
-NymVPN is an experimental software and it's for [testing](./nym-vpn-testing.md) purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the event), and follow the steps listed in the form [*NymVPN User research*](https://opnform.com/forms/nymvpn-user-research-at-37c3-yccqko-2).
-```
-
-## Preparation
-
-> Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
-
-You can use our automated script of follow the steps below to download, verify, install and run NymVPN client. 
-
-
-### Automated Script CLI Installation
-
-Open a terminal and follow these steps:
-
-* Download the script
-```sh
-curl -o nym-vpn-cli-executor.sh -L https://gist.githubusercontent.com/tommyv1987/87267ded27e1eb7651aa9cc745ddf4af/raw/99cea8f4d80f2d002802ed1cbedba288bfca4488/execute-nym-vpn-cli-binary.sh
-```
-* Make the script executable
-```sh
-chmod u+x nym-vpn-cli-executor.sh
-```
-* Run the script
-```sh
-./nym-vpn-cli-executor.sh
-```
-* When prompted to verify `sha256sum` paste one from the [release page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.2) including the binary name (all as one input with a space in between), for example:
-```sh
-61a08de46881411e140f66cdb4940041150adb573c10e3f510a58a86a32f08fb  nym-vpn-cli-ubuntu-22.04.zip
-```
-
-The script will automatically start the client. Follow the instructions:
-
-* The script will print a JSON view of existing Gateways and prompt you to:
-    - ***(Make sure to use two different Gateways for entry and exit!)***
-    - `enter a gateway ID:` paste one of the values labeled with a key `"identityKey"` printed above (without `" "`)
-    - `enter an exit address:` paste one of the values labeled with a key `"address"` printed above (without `" "`)
-    - `do you want five hop or two hop?`: type `five` or `two` 
-
-### Manual CLI and GUI Installation
-
-* Visit the [releases page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.2) to download the binary for Debian based Linux
-* Open terminal in the same directory and check the the `sha256sum` by running:
-```sh
-# for CLI
-sha256sum ./nym-vpn-cli_0.1.0_ubuntu-22.04_amd64.zip
-
-# for GUI
-sha256sum ./nym-vpn-ui_0.0.2_ubuntu-22.04_amd64.zip
-```
-* Compare the result with the sha256 hash shared on the [release page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.2)
-* Extract files with `unzip` command or manually as you are used to
-* If you prefer to run `.AppImage` make executable by running:
-```sh
-# for CLI
-chmod +x ./nym-vpn-cli
-
-# for GUI
-chmod +x ./appimage/nym-vpn_0.0.2_amd64.AppImage
-# make sure your path to package is correct and the package name as well
-```
-* If you prefer to use the `.deb` version for installation (Linux only), open terminal in the same directory and run:
-```sh
-cd deb
-
-sudo dpkg -i ./nym-vpn_0.0.2_amd64.deb
-
-# or
-sudo apt-get install -f ./nym-vpn_0.0.2_amd64.deb
-
-```
-* **For CLI**: Create Sandbox environment config file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the same directory as your NymVPN binaries. In case of GUI setup, see the steps below.
-
-### GUI configuration
-
-* Create a NymVPN config directory called `nym-vpn` in your `~/.config`, either manually or by a command:
-```sh
-# for Linux
-mkdir $HOME/.config/nym-vpn/
-```
-* Create the network config by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the directory `nym-vpn` you just created
-* Create the main config file called `config.toml` in the same directory with this content:
-```toml
-# change <USER> to your username
-env_config_file = "/home/<USER>/.config/nym-vpn/sandbox.env"
-entry_node_location = "DE" # two letters country code
-```
-
-## Run NymVPN
-
-* **For NymVPN to work, all other VPNs must be switched off!**
-* At this alpha stage of NymVPN, network connection (wifi) must be re-connected after or in-between NymVPN testing rounds.
-
-### Run CLI
-
-Make sure your terminal is open in the same directory as your `nym-vpn-cli` binary.
-
-* Find the entire command with all the needed arguments' values and your wireguard private key for testing purposes at [nymvpn.com/en/alpha](https://nymvpn.com/en/alpha)
-* Run it with `sudo` as root, the command will look like this with specified arguments:
-```sh
-sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WG_IP>
-```
-* To chose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
-* To see all possibilities see [command explanation](#cli-commands-and-options) below
-
-### Run GUI
-
-In case you used `.deb` package and installed the client, you may be able to have a NymVPN application icon in your app menu. However this may not work as the application needs root permission.
-
-Make sure you went through the GUI configuration in the [preparation section](#gui-configuration). Then open terminal in the same directory where you [installed](#preparation) the binary and run:
-
-```sh
-# .AppImage must be run from the same directory
-sudo -E ./nym-vpn_0.0.2_amd64.AppImage
-
-# .deb installation shall be executable from anywhere as
-sudo -E nym-vpn
-```
-
-In case of errors, see [troubleshooting section](./nym-vpn-troubleshooting.md).
-
-### CLI Commands and Options
-
-The basic syntax of `nym-vpn-cli` is:
-```sh
-sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WG_IP>
-```
-* To chose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
-* To see all possibilities run with `--help` flag:
-```sh
-./nym-vpn-cli --help
-```
-
-~~~admonish example collapsible=true title="Console output"
-```
-Usage: nym-vpn-cli [OPTIONS]
-
-Options:
-  -c, --config-env-file <CONFIG_ENV_FILE>
-          Path pointing to an env file describing the network
-      --mixnet-client-path <MIXNET_CLIENT_PATH>
-          Path to the data directory of a previously initialised mixnet client, where the keys reside
-      --entry-gateway-id <ENTRY_GATEWAY_ID>
-          Mixnet public ID of the entry gateway
-      --entry-gateway-country <ENTRY_GATEWAY_COUNTRY>
-          Auto-select entry gateway by country ISO
-      --exit-router-address <EXIT_ROUTER_ADDRESS>
-          Mixnet recipient address
-      --exit-gateway-id <EXIT_GATEWAY_ID>
-
-      --exit-router-country <EXIT_ROUTER_COUNTRY>
-          Mixnet recipient address
-      --enable-wireguard
-          Enable the wireguard traffic between the client and the entry gateway
-      --private-key <PRIVATE_KEY>
-          Associated private key
-      --wg-ip <WG_IP>
-          The IP address of the wireguard interface
-      --ip <IP>
-          The IP address of the TUN device
-      --mtu <MTU>
-          The MTU of the TUN device
-      --disable-routing
-          Disable routing all traffic through the VPN TUN device
-      --enable-two-hop
-          Enable two-hop mixnet traffic. This means that traffic jumps directly from entry gateway to exit gateway
-      --enable-poisson-rate
-          Enable Poisson process rate limiting of outbound traffic
-  -h, --help
-          Print help
-  -V, --version
-          Print version
-
-
-```
-~~~
-
-**Fundamental commands and arguments**
-
-Here is a list of the options and their descriptions. Some are essential, some are more technical and not needed to adjusted by users:
-
-- `-c` is a path to the [Sandbox config](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) file saved as `sandbox.env`
-- `--entry-gateway-id`: paste one of the values labeled with a key `"identityKey"` (without `" "`) from [here](https://nymvpn.com/en/alpha/api/gateways)
-- `--exit-router-address`: paste one of the values labeled with a key `"address"` (without `" "`) from here [here](https://nymvpn.com/en/alpha/api/gateways)
-- `--enable-wireguard`: Enable the wireguard traffic between the client and the entry gateway. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device
-- `--wg-ip`: The address of the wireguard interface, you can get it [here](https://nymvpn.com/en/alpha)
-- `--private-key`: get your private key for testing purposes [here](https://nymvpn.com/en/alpha)
-- `--enable-two-hop` is a faster setup where the traffic is routed from the client to Entry Gateway and directly to Exit Gateway (default is 5-hops)
-
-**Advanced options**
-
-- `--enable-poisson`: Enables process rate limiting of outbound traffic (disabled by default). It means that NymVPN client will send packets at a steady stream to the Entry Gateway. By default it's on average one sphinx packet per 20ms, but there is some randomness (poisson distribution). When there are no real data to fill the sphinx packets with, cover packets are generated instead.
-- `--ip` is the IP address of the TUN device. That is the IP address of the local private network that is set up between local client and the Exit Gateway.
-- `--mtu`: The MTU of the TUN device. That is the max IP packet size of the local private network that is set up between local client and the Exit Gateway.
-- `--disable-routing`: Disable routing all traffic through the VPN TUN device.

documentation/dev-portal/src/events/cryptotalk/nym-vpn-mac.md

@@ -1,191 +0,0 @@
-# NymVPN alpha: Guide for Mac OS
-
-```admonish warning
-NymVPN is an experimental software and it's for [testing](./nym-vpn-testing.md) purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the event), and follow the steps listed in the form [*NymVPN User research*](https://opnform.com/forms/nymvpn-user-research-at-37c3-yccqko-2).
-```
-
-## Preparation
-
-> Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
-
-### CLI Installation
-
-You can use our automated script of follow the steps below to download, verify, install and run NymVPN client. 
-
-#### Automated Script CLI Installation
-
-Open a terminal and follow these steps:
-
-* Download the script
-```sh
-curl -o nym-vpn-client-executor.sh -L https://gist.githubusercontent.com/tommyv1987/87267ded27e1eb7651aa9cc745ddf4af/raw/99cea8f4d80f2d002802ed1cbedba288bfca4488/execute-nym-vpn-cli-binary.sh
-```
-* Make the script executable
-```sh
-chmod u+x nym-vpn-client-executor.sh
-```
-* Run the script
-```sh
-./nym-vpn-client-executor.sh
-```
-* When prompted to verify `sha256sum` paste one from the [release page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.2) including the binary name (all as one input with a space in between), for example:
-```sh
-96623ccc69bc4cc0e4e3e18528b6dae6be69f645d0a592d926a3158ce2d0c269  nym-vpn-cli_0.1.0_macos_x86_64.zip
-```
-
-The script will automatically start the client. Follow the instructions:
-
-* The script will print a JSON view of existing Gateways and prompt you to:
-    - ***(Make sure to use two different Gateways for entry and exit!)***
-    - `enter a gateway ID:` paste one of the values labeled with a key `"identityKey"` printed above (without `" "`)
-    - `enter an exit address:` paste one of the values labeled with a key `"address"` printed above (without `" "`)
-    - `do you want five hop or two hop?`: type `five` or `two` 
-
-#### Manual CLI Installation
-
-* Visit the [releases page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.2) to download the binary for Debian based Linux
-* Open terminal in the same directory and check the the `sha256sum` by running:
-```sh
-# x86_64
-sha256sum ./nym-vpn-cli_0.1.0_macos_x86_64.zip
-
-# aarch64
-sha256sum ./nym-vpn-cli_0.1.0_macos_aarch64.zip
-```
-* Compare the result with the sha256 hash shared on the [release page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.2)
-* Extract files with `unzip` command or manually as you are used to
-```sh
-# for CLI
-chmod +x ./nym-vpn-cli
-```
-
-* Create Sandbox environment config file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the same directory as your NymVPN binaries. In case of GUI setup, see the steps below.
-
-### GUI Installation
-
-We created a [script](https://gist.github.com/tommyv1987/7d210d4daa8f7abc61f9a696d0321f19) which does download, extraction, installation and configuration for MacOS users automatically following the steps below:
-
-* To download the script, open a terminal in a directory where you want to download the script and run:
-```sh
-curl -o nym-vpn-client-executor.sh - L https://gist.githubusercontent.com/tommyv1987/7d210d4daa8f7abc61f9a696d0321f19/raw/4397365b4cf74594c7f99c1ef5d690b2f5b41192/nym-vpn-client-macos-executor.sh
-```
-* Make executable
-```sh
-chmod u+x nym-vpn-client-macos-executor.sh
-```
-* Run
-```sh
-./nym-vpn-client-macos-executor.sh
-```
-* When prompted to verify `sha256sum` paste one from the [release page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.2) including the binary name (all as one input with a space in between), for example:
-```sh
-06c7c82f032f230187da1002a9a9a88242d3bbf6c5c09dc961a71df151d768d0  nym-vpn-ui_0.0.2_macos_x86_64.zip
-```
-* The script will run the application and it will prompt you for a country code to exit, chose one of the offered options
-
-In case of errors check out the [troubleshooting](./nym-vpn-troubleshooting.html#installing-gui-on-macos-not-working) section.
-
-## Run NymVPN
-
-* **For NymVPN to work, all other VPNs must be switched off!**
-* At this alpha stage of NymVPN, network connection (wifi) must be re-connected after or in-between NymVPN testing rounds.
-
-### Run CLI
-
-Make sure your terminal is open in the same directory as your `nym-vpn-cli` binary.
-
-* Find the entire command with all the needed arguments' values and your wireguard private key for testing purposes at [nymvpn.com/en/alpha](https://nymvpn.com/en/alpha)
-* Run it with `sudo` as root, the command will look like this with specified arguments:
-```sh
-sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WG_IP>
-```
-* To chose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
-* To see all possibilities see [command explanation](#cli-commands-and-options) below
-
-### Run GUI
-
-Make sure you went through the GUI configuration in the [preparation section](#gui-installation).
-
-You may be able to have a NymVPN application icon in your app menu. However this may not work as the application needs root permission.
-
-* Run GUI from terminal:
-```sh
-sudo $nym_vpn_dir/nym-vpn
-```
-
-In case of errors, see [troubleshooting section](./nym-vpn-troubleshooting.md#macos-alert-on-nymvpn-ui-startup).
-
-### CLI Commands and Options
-
-The basic syntax of `nym-vpn-cli` is:
-```sh
-sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WG_IP>
-```
-* To chose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
-* To see all possibilities run with `--help` flag:
-```sh
-./nym-vpn-cli --help
-```
-
-~~~admonish example collapsible=true title="Console output"
-```
-Usage: nym-vpn-cli [OPTIONS]
-
-Options:
-  -c, --config-env-file <CONFIG_ENV_FILE>
-          Path pointing to an env file describing the network
-      --mixnet-client-path <MIXNET_CLIENT_PATH>
-          Path to the data directory of a previously initialised mixnet client, where the keys reside
-      --entry-gateway-id <ENTRY_GATEWAY_ID>
-          Mixnet public ID of the entry gateway
-      --entry-gateway-country <ENTRY_GATEWAY_COUNTRY>
-          Auto-select entry gateway by country ISO
-      --exit-router-address <EXIT_ROUTER_ADDRESS>
-          Mixnet recipient address
-      --exit-gateway-id <EXIT_GATEWAY_ID>
-
-      --exit-router-country <EXIT_ROUTER_COUNTRY>
-          Mixnet recipient address
-      --enable-wireguard
-          Enable the wireguard traffic between the client and the entry gateway
-      --private-key <PRIVATE_KEY>
-          Associated private key
-      --wg-ip <WG_IP>
-          The IP address of the wireguard interface
-      --ip <IP>
-          The IP address of the TUN device
-      --mtu <MTU>
-          The MTU of the TUN device
-      --disable-routing
-          Disable routing all traffic through the VPN TUN device
-      --enable-two-hop
-          Enable two-hop mixnet traffic. This means that traffic jumps directly from entry gateway to exit gateway
-      --enable-poisson-rate
-          Enable Poisson process rate limiting of outbound traffic
-  -h, --help
-          Print help
-  -V, --version
-          Print version
-
-
-```
-~~~
-
-**Fundamental commands and arguments**
-
-Here is a list of the options and their descriptions. Some are essential, some are more technical and not needed to adjusted by users:
-
-- `-c` is a path to the [Sandbox config](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) file saved as `sandbox.env`
-- `--entry-gateway-id`: paste one of the values labeled with a key `"identityKey"` (without `" "`) from [here](https://nymvpn.com/en/alpha/api/gateways)
-- `--exit-router-address`: paste one of the values labeled with a key `"address"` (without `" "`) from here [here](https://nymvpn.com/en/alpha/api/gateways)
-- `--enable-wireguard`: Enable the wireguard traffic between the client and the entry gateway. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device
-- `--wg-ip`: The address of the wireguard interface, you can get it [here](https://nymvpn.com/en/alpha)
-- `--private-key`: get your private key for testing purposes [here](https://nymvpn.com/en/alpha)
-- `--enable-two-hop` is a faster setup where the traffic is routed from the client to Entry Gateway and directly to Exit Gateway (default is 5-hops)
-
-**Advanced options**
-
-- `--enable-poisson`: Enables process rate limiting of outbound traffic (disabled by default). It means that NymVPN client will send packets at a steady stream to the Entry Gateway. By default it's on average one sphinx packet per 20ms, but there is some randomness (poisson distribution). When there are no real data to fill the sphinx packets with, cover packets are generated instead.
-- `--ip` is the IP address of the TUN device. That is the IP address of the local private network that is set up between local client and the Exit Gateway.
-- `--mtu`: The MTU of the TUN device. That is the max IP packet size of the local private network that is set up between local client and the Exit Gateway.
-- `--disable-routing`: Disable routing all traffic through the VPN TUN device.

documentation/dev-portal/src/events/cryptotalk/nym-vpn-troubleshooting.md

@@ -1,100 +0,0 @@
-# Troubleshooting
-
-Below are listed some points which may need to be addressed when testing NymVPN alpha. If you crashed into any errors which are not listed, please contact us at the event.
-
-#### Problems with the newest version `nym-vpn-alpha-0.0.2 demo`
-
-Try the previous version `nym-vpn-alpha-0.0.1 demo` which was tested multiple times by downloading the client from this [release page(https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.1) and doing all the steps with the name of your downloaded binary.
-
-#### Installing GUI on MacOS not working
-
-In case there was a problem running the script, try a manual configuration:
-
-* Visit the [releases page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.1) to download the binary for Debian based Linux
-* Open terminal in the same directory and check the the `sha256sum` by running:
-```sh
-# for MacOS GUI
-sha256sum ./nym-vpn-ui-macos-latest.zip
-```
-* Compare the result with the sha256 hash shared on the [release page](https://github.com/nymtech/nym/releases/tag/nym-vpn-alpha-0.0.1)
-* Extract files with `unzip` command or manually as you are used toi
-* Create a NymVPN config directory called `nym-vpn` in your `~/.config`, either manually or by a command:
-```sh
-mkdir $HOME/Library/Application Support/nym-vpn/
-```
-* Create the network config by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the config directory `nym-vpn` you just created
-* Create the main config file called `config.toml` in the same directory with this content:
-```toml
-env_config_file = "$HOME/Library/Application Support/nym-vpn/"
-entry_node_location = "DE" # two letters country code
-```
-
-**Note:** Some users had a problem to access their home config folder on macOS, in that case save the configuration files in the same directory where you downloaded your `nym-vpn` binary as following:
-
-* Create the network config by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `.env` (yes just like that) in the same directory like `nym-vpn` binaries.
-* Create the main config file called `config.toml` in the very same directory with this content:
-```toml
-env_config_file = "$HOME/Library/Application Support/nym-vpn/"
-entry_node_location = "DE" # two letters country code
-```
-
-#### Thread `main` panicked
-
-If you see a message like:
-```sh
-thread 'main' panicked at /Users/runner/.cargo/git/checkouts/mullvadvpn-app-a575cf705b5dfd76/ccfbaa2/talpid-routing/src/unix.rs:301:30:
-```
-Restart your wifi connection and start again.
-
-#### macOS alert on NymVPN UI startup
-
-If you are running NymVPN on mac OS for the first time, you may see this alert message:
-
-![](images/image3.png)
-
-1. Head to System Settings -> Privacy & Security and click `Allow anyway`
-
-![](images/image5.png)
-
-2. Confirm with your password or TouchID
-
-3. Possibly you may have to confirm again upon running the application
-
-#### Missing `jq` error
-
-In case of missing `jq` on Linux (Debian) install it with:
-```sh
-# Linux (Debian)
-sudo apt-get install jq
-# macOS
-brew install jq
-```
-On some Linux distributions however the [script](./nym-vpn.md#testssh) returns `jq` error even if your system claims that `jq is already the newest version`.
-In that case, comment the `jq` check in the script as follows:
-```sh
-#if ! command -v jq &>/dev/null; then
-#    echo "jq is not installed. Please install jq to proceed."
-#    exit 1
-#fi
-```
-
-#### Error current_time: not found
-
-When running `sudo sh ./test.sh` you may see an error like: `93: current_time: not found`. This has something to do with the `current_time` setup of your system and on itself shall not have a negative impact on the test. It has nothing to do with the client at all as it only relates to the code in our testing script.
-
-#### Not connecting to the endpoint
-
-In case the automatic download of all the Gateways fail (and it shouldn't), you do an easy manual work around:
-
-1. Open the list of Gateways created by API [here](https://nymvpn.com/en/ccc/api/gateways)
-2. On top click on `JSON` option (shall be default view) and `Save`
-3. Save it as `data.json` to the `nym-vpn-tests` folder
-4. Replace line 3 in the [script `tests.sh`](./nym-vpn.md#testssh) with:
-```sh
-NEW_ENDPOINT="http://localhost:8000/data.json"
-```
-5. In a new terminal window run:
-```sh
-python3 -m http.server 8000
-```
-6. Continue with the steps listed in [testing section](./nym-vpn.md#testing)

documentation/dev-portal/src/events/cryptotalk/nym-vpn.md

@@ -1,51 +0,0 @@
-# NymVPN alpha
-
-<div style="padding:56.25% 0 0 0;position:relative;"><iframe src="https://player.vimeo.com/video/897010658?h=1f55870fe6&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" style="position:absolute;top:0;left:0;width:100%;height:100%;" title="NYMVPN alpha demo 37C3"></iframe></div><script src="https://player.vimeo.com/api/player.js"></script>
-
-We are honored to present NymVPN, a client that uses [Nym Mixnet](https://nymtech.net) to anonymise all of a user's internet traffic through either a 5-hop mixnet (for a full network privacy) or the faster 2-hop decentralised VPN (with some extra features). At this event we have the unique opportunity to be part of the initial alpha testing. The following pages provide a how-to guide, explaining steps to install and run NymVPN CLI and GUI on our testing environment Nym Sandbox.
-
-## NymVPN
-
-The following overview provides an easy introduction to the NymVPN alpha client. We recommend interested developers to begin with [Nym network overview](https://nymtech.net/docs/architecture/network-overview.html) and the [Mixnet traffic flow](https://nymtech.net/docs/architecture/traffic-flow.html) pages.
-
-The default is to run in 5-hop mode:
-
-```
-                      ┌─►mix──┐  mix     mix
-                      │       │
-            Entry     │       │                   Exit
-client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───► Gateway ───► internet
-                              │       │
-                              │       │
-                         mix  └─►mix──┘  mix
-```
-
-Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes.
-
-The client can optionally do the first hop (local client to Entry Gateway) using Wireguard. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device.
-
-## NymVPN Guide & FAQ pages
-
-To download, install and test NymVPN alpha, visit pages listed below:
-
-* [GNU/Linux](nym-vpn-linux.md)
-* [Mac OS](nym-vpn-mac.md)
-* [Testing scripts](nym-vpn-testing.md)
-* [Troubleshooting](nym-vpn-troubleshooting.md)
-* [NymVPN FAQ](nym-vpn-faq.md)
-
-## Goals of testing
-
-This alpha testing will help:
-
-* Stabilise NymVPN client
-* Understand NymVPN client behavior in various setups (OS, connectivity, etc.)
-* Stabilize the VPN infrastructure and improve its reliability / speed / features (e.g. IPv6 support)
-* Load test the network in Sandbox environment and identify / anticipate potential weaknesses
-
-
-```admonish info
-Our alpha testing round is done live with some participants at the event. This guide will not work for everyone, as the NymVPN binaries aren't publicly accessible yet. Note that this setup of Nym testnet Sandbox environment is limited event and some of the configurations will not work in the future.
-
-**If you commit to test NymVPN alpha, please start with the [user research form](https://opnform.com/forms/nymvpn-user-research-at-37c3-yccqko-2) where all the steps will be provided**.
-```

documentation/dev-portal/src/nymvpn/cli-linux.md

@@ -0,0 +1,116 @@
+# NymVPN alpha CLI: Guide for GNU/Linux
+
+```admonish info
+NymVPN is an experimental software and it's for [testing](./testing.md) purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the workshop) so we use their results to improve the client, and submit the form [*NymVPN User research*]({{nym_vpn_form_url}}) with the testing results.
+```
+
+## Installation
+
+> Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
+
+1. Open Github [releases page]({{nym_vpn_latest_binary_url}}) and download the binary for Debian based Linux
+2. Verify sha hash of your downloaded binary with the one listed on the [releases page]({{nym_vpn_latest_binary_url}}). You can use a simple `shasum` command and compare strings (ie with Python) or run in the same directory the following command, exchanging `<SHA_STRING>` with the one of your binary, like in the example:
+```sh
+echo "<SHA_STRING>" | shasum -a 256 -c
+
+# choose a correct one according to your binary, this is just an example
+echo "0e4abb461e86b2c168577e0294112a3bacd3a24bf8565b49783bfebd9b530e23  nym-vpn-cli_0.1.0_ubuntu-22.04_amd64.zip" | shasum -a 256 -c
+```
+3. Extract files with `unzip` command or manually as you are used to
+4. Make executable by running:
+```sh
+chmod u+x ./nym-vpn-cli
+```
+5. Create Sandbox environment config file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the same directory as your NymVPN binaries by running:
+```sh
+curl -o sandbox.env -L https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env
+```
+
+## Run NymVPN
+
+**For NymVPN to work, all other VPNs must be switched off!** At this alpha stage of NymVPN, the network connection (wifi) must be reconnected after or in between the testing rounds.
+
+Make sure your terminal is open in the same directory as your `nym-vpn-cli` binary.
+
+1. Go to [nymvpn.com/en/alpha](https://nymvpn.com/en/alpha) to get the entire command with all the needed arguments' values and your wireguard private key for testing purposes
+2. Run it as root with `sudo` - the command will look like this with specified arguments:
+```sh
+sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WIREGUARD_IP>
+```
+3. To choose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways) and pick one
+4. See all possibilities in [command explanation](#cli-commands-and-options) section below
+
+In case of errors, see [troubleshooting section](troubleshooting.md).
+
+### CLI Commands and Options
+
+The basic syntax of `nym-vpn-cli` is:
+```sh
+sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WG_IP>
+```
+* To choose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
+* To see all possibilities run with `--help` flag:
+```sh
+./nym-vpn-cli --help
+```
+~~~admonish example collapsible=true title="Console output"
+```
+Usage: nym-vpn-cli [OPTIONS]
+
+Options:
+  -c, --config-env-file <CONFIG_ENV_FILE>
+          Path pointing to an env file describing the network
+      --mixnet-client-path <MIXNET_CLIENT_PATH>
+          Path to the data directory of a previously initialised mixnet client, where the keys reside
+      --entry-gateway-id <ENTRY_GATEWAY_ID>
+          Mixnet public ID of the entry gateway
+      --entry-gateway-country <ENTRY_GATEWAY_COUNTRY>
+          Auto-select entry gateway by country ISO
+      --exit-router-address <EXIT_ROUTER_ADDRESS>
+          Mixnet recipient address
+      --exit-gateway-id <EXIT_GATEWAY_ID>
+
+      --exit-router-country <EXIT_ROUTER_COUNTRY>
+          Mixnet recipient address
+      --enable-wireguard
+          Enable the wireguard traffic between the client and the entry gateway
+      --private-key <PRIVATE_KEY>
+          Associated private key
+      --wg-ip <WG_IP>
+          The IP address of the wireguard interface used for the first hop to the entry gateway
+      --nym-ip <NYM_IP>
+          The IP address of the nym TUN device that wraps IP packets in sphinx packets
+      --nym-mtu <NYM_MTU>
+          The MTU of the nym TUN device that wraps IP packets in sphinx packets
+      --disable-routing
+          Disable routing all traffic through the nym TUN device. When the flag is set, the nym TUN device will be created, but to route traffic through it you will need to do it manually, e.g. ping -Itun0
+      --enable-two-hop
+          Enable two-hop mixnet traffic. This means that traffic jumps directly from entry gateway to exit gateway
+      --enable-poisson-rate
+          Enable Poisson process rate limiting of outbound traffic
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+
+```
+~~~
+
+Here is a list of the options and their descriptions. Some are essential, some are more technical and not needed to be adjusted by users.
+
+**Fundamental commands and arguments**
+
+- `-c` is a path to the [Sandbox config](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) file saved as `sandbox.env`
+- `--entry-gateway-id`: paste one of the values labeled with a key `"identityKey"` (without `" "`) from [here](https://nymvpn.com/en/alpha/api/gateways)
+- `--exit-router-address`: paste one of the values labeled with a key `"address"` (without `" "`) from here [here](https://nymvpn.com/en/alpha/api/gateways)
+- `--enable-wireguard`: Enable the wireguard traffic between the client and the entry gateway. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device
+- `--wg-ip`: The address of the wireguard interface, you can get it [here](https://nymvpn.com/en/alpha)
+- `--private-key`: get your private key for testing purposes [here](https://nymvpn.com/en/alpha)
+- `--enable-two-hop` is a faster setup where the traffic is routed from the client to Entry Gateway and directly to Exit Gateway (default is 5-hops)
+
+**Advanced options**
+
+- `--enable-poisson`: Enables process rate limiting of outbound traffic (disabled by default). It means that NymVPN client will send packets at a steady stream to the Entry Gateway. By default it's on average one sphinx packet per 20ms, but there is some randomness (poisson distribution). When there are no real data to fill the sphinx packets with, cover packets are generated instead.
+- `--ip` is the IP address of the TUN device. That is the IP address of the local private network that is set up between local client and the Exit Gateway.
+- `--mtu`: The MTU of the TUN device. That is the max IP packet size of the local private network that is set up between local client and the Exit Gateway.
+- `--disable-routing`: Disable routing all traffic through the VPN TUN device.

documentation/dev-portal/src/nymvpn/cli-mac.md

@@ -0,0 +1,117 @@
+# NymVPN alpha CLI: Guide for MacOS
+
+```admonish info
+NymVPN is an experimental software and it's for [testing](./testing.md) purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the workshop) so we use their results to improve the client, and submit the form [*NymVPN User research*]({{nym_vpn_form_url}}) with the testing results.
+```
+
+## Preparation
+
+> Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
+
+1. Open Github [releases page]({{nym_vpn_latest_binary_url}}) and download the binary for MacOS
+2. Verify sha hash of your downloaded binary with the one listed on the [releases page]({{nym_vpn_latest_binary_url}}). You can use a simple `shasum` command and compare strings (ie with Python) or run in the same directory the following command, exchanging `<SHA_STRING>` with the one of your binary, like in the example:
+```sh
+echo "<SHA_STRING>" | shasum -a 256 -c
+
+# choose a correct one according to your binary, this is just an example
+echo "96623ccc69bc4cc0e4e3e18528b6dae6be69f645d0a592d926a3158ce2d0c269  nym-vpn-cli_0.1.0_macos_x86_64.zip" | shasum -a 256 -c
+```
+5. Extract files with `unzip` command or manually as you are used to
+6. Make executable by running:
+```sh
+chmod u+x ./nym-vpn-cli
+```
+7. Create Sandbox environment config file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the same directory as your NymVPN binaries by running:
+```sh
+curl -L "https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env" -o sandbox.env
+```
+
+## Run NymVPN
+
+**For NymVPN to work, all other VPNs must be switched off!** At this alpha stage of NymVPN, the network connection (wifi) must be reconnected after or in between the testing rounds.
+
+Make sure your terminal is open in the same directory as your `nym-vpn-cli` binary.
+
+
+1. Go to [nymvpn.com/en/alpha](https://nymvpn.com/en/alpha) to get the entire command with all the needed arguments' values and your wireguard private key for testing purposes
+2. Run it as root with `sudo` - the command will look like this with specified arguments:
+```sh
+sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WIREGUARD_IP>
+```
+3. To choose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways) and pick one
+4. See all possibilities in [command explanation](#cli-commands-and-options) section below
+
+In case of errors, see [troubleshooting section](troubleshooting.md).
+
+### CLI Commands and Options
+
+The basic syntax of `nym-vpn-cli` is:
+```sh
+sudo ./nym-vpn-cli -c ./sandbox.env --entry-gateway-id <ENTRY_GATEWAY_ID> --exit-router-address <EXIT_ROUTER_ADDRESS> --enable-wireguard --private-key <PRIVATE_KEY> --wg-ip <WG_IP>
+```
+* To choose different Gateways, visit [nymvpn.com/en/alpha/api/gateways](https://nymvpn.com/en/alpha/api/gateways)
+* To see all possibilities run with `--help` flag:
+```sh
+./nym-vpn-cli --help
+```
+~~~admonish example collapsible=true title="Console output"
+```
+Usage: nym-vpn-cli [OPTIONS]
+
+Options:
+  -c, --config-env-file <CONFIG_ENV_FILE>
+          Path pointing to an env file describing the network
+      --mixnet-client-path <MIXNET_CLIENT_PATH>
+          Path to the data directory of a previously initialised mixnet client, where the keys reside
+      --entry-gateway-id <ENTRY_GATEWAY_ID>
+          Mixnet public ID of the entry gateway
+      --entry-gateway-country <ENTRY_GATEWAY_COUNTRY>
+          Auto-select entry gateway by country ISO
+      --exit-router-address <EXIT_ROUTER_ADDRESS>
+          Mixnet recipient address
+      --exit-gateway-id <EXIT_GATEWAY_ID>
+
+      --exit-router-country <EXIT_ROUTER_COUNTRY>
+          Mixnet recipient address
+      --enable-wireguard
+          Enable the wireguard traffic between the client and the entry gateway
+      --private-key <PRIVATE_KEY>
+          Associated private key
+      --wg-ip <WG_IP>
+          The IP address of the wireguard interface used for the first hop to the entry gateway
+      --nym-ip <NYM_IP>
+          The IP address of the nym TUN device that wraps IP packets in sphinx packets
+      --nym-mtu <NYM_MTU>
+          The MTU of the nym TUN device that wraps IP packets in sphinx packets
+      --disable-routing
+          Disable routing all traffic through the nym TUN device. When the flag is set, the nym TUN device will be created, but to route traffic through it you will need to do it manually, e.g. ping -Itun0
+      --enable-two-hop
+          Enable two-hop mixnet traffic. This means that traffic jumps directly from entry gateway to exit gateway
+      --enable-poisson-rate
+          Enable Poisson process rate limiting of outbound traffic
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+
+```
+~~~
+
+Here is a list of the options and their descriptions. Some are essential, some are more technical and not needed to be adjusted by users.
+
+**Fundamental commands and arguments**
+
+- `-c` is a path to the [Sandbox config](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) file saved as `sandbox.env`
+- `--entry-gateway-id`: paste one of the values labeled with a key `"identityKey"` (without `" "`) from [here](https://nymvpn.com/en/alpha/api/gateways)
+- `--exit-router-address`: paste one of the values labeled with a key `"address"` (without `" "`) from here [here](https://nymvpn.com/en/alpha/api/gateways)
+- `--enable-wireguard`: Enable the wireguard traffic between the client and the entry gateway. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device
+- `--wg-ip`: The address of the wireguard interface, you can get it [here](https://nymvpn.com/en/alpha)
+- `--private-key`: get your private key for testing purposes [here](https://nymvpn.com/en/alpha)
+- `--enable-two-hop` is a faster setup where the traffic is routed from the client to Entry Gateway and directly to Exit Gateway (default is 5-hops)
+
+**Advanced options**
+
+- `--enable-poisson`: Enables process rate limiting of outbound traffic (disabled by default). It means that NymVPN client will send packets at a steady stream to the Entry Gateway. By default it's on average one sphinx packet per 20ms, but there is some randomness (poisson distribution). When there are no real data to fill the sphinx packets with, cover packets are generated instead.
+- `--ip` is the IP address of the TUN device. That is the IP address of the local private network that is set up between local client and the Exit Gateway.
+- `--mtu`: The MTU of the TUN device. That is the max IP packet size of the local private network that is set up between local client and the Exit Gateway.
+- `--disable-routing`: Disable routing all traffic through the VPN TUN device.

documentation/dev-portal/src/nymvpn/cli.md

@@ -0,0 +1,46 @@
+# NymVPN Command Line Interface (CLI)
+
+```admonish info
+Our alpha testing round is done with participants at live workshop events. This guide will not work for everyone, as the NymVPN source code is not yet publicly accessible. The alpha testing is done on Nym testnet Sandbox environment, this configuration is limited and will not work in the future.
+
+**If you commit to test NymVPN alpha, please start with the [user research form]({{nym_vpn_form_url}}) where all the steps will be provided**. If you disagree with any of the conditions listed, please leave this page.
+```
+
+NymVPN CLI is a fundamental way to run the client for different purposes, currently it is a must for users who want to run the [testing scripts](testing.md).
+
+Follow the simple [automated script](#automated-script-for-cli-installation) below to install and run NymVPN CLI. If you prefer to do a manual setup follow the steps in the guide for [Linux](cli-linux.md) or [MacOS](cli-mac.md).
+
+## Automated Script for CLI Installation
+
+We wrote a [script](https://gist.github.com/tommyv1987/87267ded27e1eb7651aa9cc745ddf4af) which does download of the CLI, sha256 verification, extraction, installation and configuration for Linux and MacOS users automatically following the steps below:
+
+1. Open a terminal window in a directory where you want the script and NymVPN CLI binary be downloaded and run
+```sh
+curl -o execute-nym-vpn-cli-binary.sh -L https://gist.githubusercontent.com/tommyv1987/87267ded27e1eb7651aa9cc745ddf4af/raw/2a8b703655549f2e515ef1960b5f6dc54adc02fa/execute-nym-vpn-cli-binary.sh
+```
+
+2. Make the script executable
+```sh
+chmod u+x execute-nym-vpn-cli-binary.sh
+```
+
+3. Start the script as root, turn off any VPN and run
+```sh
+sudo ./execute-nym-vpn-cli-binary.sh
+```
+
+4. Follow the prompts in the program
+
+5. The script will automatically start the client. Make sure to **turn off any other VPNs** and follow the prompts:
+
+* It prints a JSON view of existing Gateways and prompt you to:
+    - *Make sure to use two different Gateways for entry and exit!*
+    - `enter a gateway ID:` paste one of the values labeled with a key `"identityKey"` printed above (without `" "`)
+    - `enter an exit address:` paste one of the values labeled with a key `"address"` printed above (without `" "`)
+    - `do you want five hop or two hop?`: type `five` or `two`
+    - `enable WireGuard? (yes/no):` if you chose yes, find your private key and wireguard IP [here](https://nymvpn.com/en/alpha)
+
+To run `nym-vpn-cli` again, reconnect your wifi, move to the directory of your CLI binary `cd ~/nym-vpn-cli-dir` and follow the guide for [Linux](cli-linux.md#run-nymvpn) or [MacOS](cli-mac.md#run-nymvpn). If you find it too difficult, just run this script again - like in step \#3 above.
+
+In case of errors check out the [troubleshooting](troubleshooting.md) section.
+

documentation/dev-portal/src/nymvpn/faq.md

@@ -1,12 +1,14 @@
 # Frequently Asked Questions
 
-This is a FAQ page tailored for this event. If you interested to read more about Nym platform, you can have a look at [Nym general FAQ](https://nymtech.net/developers/faq/general-faq.html) and read through Nym's technical [documentation](https://nymtech.net/docs), [Developer Portal](https://nymtech.net/developers) and [Operators Guide](https://nymtech.net/operators).
+**NymVPN [*Support & FAQ page*](https://nymvpn.com/en/support)** contains all essential FAQs regarding the client. This page (below) is a source of additional information often seeked by users, operators and developers testing NymVPN.
+
+If you interested to read more about Nym platform, you can have a look at [Nym general FAQ](https://nymtech.net/developers/faq/general-faq.html) and read through Nym's technical [documentation](https://nymtech.net/docs), [Developer Portal](https://nymtech.net/developers) and [Operators Guide](https://nymtech.net/operators).
 
 ## NymVPN
 
-If this your first time hearing about NymVPN, make sure you visit [NymVPN webpage](https://nymvpn.com/en), the official NymVPN [support & FAQ page](https://nymvpn.com/en/support) and the proceed to the introduction and guide on how to [install, run and test](./nym-vpn.md) the client.
+If this your first time hearing about NymVPN, make sure you visit [NymVPN webpage](https://nymvpn.com/en), the official NymVPN [support & FAQ page](https://nymvpn.com/en/support) and the proceed to the introduction and guide on how to [install, run and test](intro.md#nymvpn-guides) the client.
 
-Below are some extra FAQs which came out during the initial alpha testing round.
+Below are some extra FAQs which came out during the previous alpha testing rounds.
 
 ### What's the difference between 2-hops and 5-hops
 
@@ -54,11 +56,11 @@ Project Smoosh is a code name for a process in which different components of Nym
 
 ## Exit Gateway
 
-Part of the the transition under code name [Project Smoosh](./nym-vpn-faq.md#project-smoosh) is a creation of [Nym Exit Gateway](https://nymtech.net/operators/legal/exit-gateway.html) functionality. The operators running Gateways would have to “open” their nodes to a wider range of online services, in a similar fashion to Tor exit relays. The main change will be to expand the original short [allowed.list](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a more permissive setup. An [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) will constrain the hosts that the users of the Nym VPN and Mixnet can connect to. This will be done in an effort to protect the operators, as Gateways will act both as SOCKS5 Network Requesters, and exit nodes for IP traffic from Nym VPN and Mixnet clients.
+Part of the the transition under code name [Project Smoosh](#project-smoosh) is a creation of [Nym Exit Gateway](https://nymtech.net/operators/legal/exit-gateway.html) functionality. The operators running Gateways would have to “open” their nodes to a wider range of online services, in a similar fashion to Tor exit relays. The main change will be to expand the original short [allowed.list](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a more permissive setup. An [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) will constrain the hosts that the users of the Nym VPN and Mixnet can connect to. This will be done in an effort to protect the operators, as Gateways will act both as SOCKS5 Network Requesters, and exit nodes for IP traffic from Nym VPN and Mixnet clients.
 
 * Read more how the exit policy gets implemented [here](https://nymtech.net/operators/faq/smoosh-faq.html#how-will-the-exit-policy-be-implemented)
 * Check out [Nym Operators Legal Forum](https://nymtech.net/operators/legal/exit-gateway.html)
-* Do reach out to us during 37c3 with any experiences you may have running Tor Exit relays or legal findings and suggestions for Nym Exit Gateway operators
+* Do reach out to us with any experiences you may have running Tor Exit relays or legal findings and suggestions for Nym Exit Gateway operators
 
 ## Nym Integrations and SDKs
 

documentation/dev-portal/src/nymvpn/gui-linux.md

@@ -0,0 +1,71 @@
+# NymVPN alpha GUI: Guide for GNU/Linux
+
+```admonish info
+NymVPN is an experimental software and it's for [testing](./testing.md) purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the workshop) so we use their results to improve the client, and submit the form [*NymVPN User research*]({{nym_vpn_form_url}}) with the testing results.
+```
+
+## Preparation
+
+> Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
+
+### Installation
+
+1. Open Github [releases page]({{nym_vpn_latest_binary_url}}) and download the binary for Debian based Linux
+2. Verify sha hash of your downloaded binary with the one listed on the [releases page]({{nym_vpn_latest_binary_url}}). You can use a simple `shasum` command and compare strings (ie with Python) or run in the same directory the following command, exchanging `<SHA_STRING>` with the one of your binary, like in the example:
+```sh
+echo "<SHA_STRING>" | shasum -a 256 -c
+
+# choose a correct one according to your binary, this is just an example
+echo "a5f91f20d587975e30b6a75d3a9e195234cf1269eac278139a5b9c39b039e807  nym-vpn-desktop_0.0.3_ubuntu-22.04_x86_64.zip" | shasum -a 256 -c
+```
+3. Extract files with `unzip` command or manually as you are used to
+4. If you prefer to run `.AppImage` make executable by running:
+```sh
+chmod u+x ./appimage/nym-vpn_0.0.2_amd64.AppImage
+```
+5. If you prefer to use the `.deb` version for installation (works on Debian based Linux only), open terminal in the same directory and run:
+```sh
+cd deb
+
+sudo dpkg -i ./nym-vpn_0.0.3_amd64.deb
+# or
+sudo apt-get install -f ./nym-vpn_0.0.3_amd64.deb
+```
+
+### Configuration
+
+6. Create a NymVPN config directory called `nym-vpn` in your `~/.config`, either manually or by a command:
+```sh
+mkdir $HOME/.config/nym-vpn/
+```
+7. Create the network config by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `sandbox.env` in the directory `~/.config/nym-vpn/` you just created by running:
+```sh
+curl -o $HOME/.config/nym-vpn/sandbox.env -L https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env
+```
+
+8. Create NymVPN main config file called `config.toml` in the same directory `~/.config/nym-vpn/` with this content:
+```toml
+# change <USER> to your username
+env_config_file = "/home/<USER>/.config/nym-vpn/sandbox.env"
+entry_node_location = "DE" # two letters country code
+# You can choose different entry by entering one of the following two letter country codes:
+# DE, UK, FR, IE
+```
+
+## Run NymVPN
+
+**For NymVPN to work, all other VPNs must be switched off!** At this alpha stage of NymVPN, the network connection (wifi) must be reconnected after or in between the testing rounds.
+
+In case you used `.deb` package and installed the client, you may be able to have a NymVPN application icon in your app menu. However this may not work as the application needs root permission.
+
+Open terminal and run:
+
+```sh
+# .AppImage must be run from the same directory as the binary
+sudo -E ./nym-vpn_0.0.2_amd64.AppImage
+
+# .deb installation shall be executable from anywhere as
+sudo -E nym-vpn
+```
+
+In case of errors, see [troubleshooting section](troubleshooting.md).

documentation/dev-portal/src/nymvpn/gui-mac.md

@@ -0,0 +1,59 @@
+# NymVPN alpha GUI: Guide for Mac OS
+
+```admonish info
+NymVPN is an experimental software and it's for [testing](./testing.md) purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the workshop) so we use their results to improve the client, and submit the form [*NymVPN User research*]({{nym_vpn_form_url}}) with the testing results.
+```
+
+## Preparation
+
+> Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
+
+### Installation
+
+1. Create a directory `~/nym-vpn-latest`
+```sh
+mkdir -p "$HOME/nym-vpn-latest"
+```
+2. Open Github [releases page]({{nym_vpn_latest_binary_url}}) and download the binary for MacOS
+3. Verify sha hash of your downloaded binary with the one listed on the [releases page]({{nym_vpn_latest_binary_url}}). You can use a simple `shasum` command and compare strings (ie with Python) or run in the same directory the following command, exchanging `<SHA_STRING>` with the one of your binary, like in the example:
+```sh
+echo "<SHA_STRING>" | shasum -a 256 -c
+
+# choose a correct one according to your binary, this is just an example
+echo "da4c0bf8e8b52658312d341fa3581954cfcb6efd516d9a448c76d042a454b5df  nym-vpn-desktop_0.0.3_macos_x86_64.zip" | shasum -a 256 -c
+```
+4. Extract files with `unzip` command or manually as you are used to
+5. Move to the application directory and make executable
+```sh
+cd "macos/nym-vpn.app/Contents/MacOS"
+
+chmod u+x nym-vpn
+```
+6. Move `nym-vpn` to your `~/nym-vpn-latest` directory
+```sh
+mv nym-vpn "$HOME/nym-vpn-latest"
+```
+
+### Configuration
+
+7. Create the configuration file by opening a text editor and saving the lines below as `config.toml` in the same directory `~/nym-vpn-latest`
+```toml
+env_config_file = ".env"
+entry_node_location = "DE" # two letters country code
+# You can choose different entry by entering one of the following two letter country codes:
+# DE, UK, FR, IE
+```
+8. Create testnet configuration file by saving [this](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) as `.env` in the same directory `~/nym-vpn-latest`
+```sh
+curl -L "https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env" -o "$HOME/nym-vpn-latest/.env"
+```
+## Run NymVPN
+
+**For NymVPN to work, all other VPNs must be switched off!** At this alpha stage of NymVPN, the network connection (wifi) must be reconnected after or in between the testing rounds.
+
+Open terminal in your `~/nym-vpn-latest` directory and run:
+```sh
+sudo ./nym-vpn
+```
+
+In case of errors check out the [troubleshooting](troubleshooting.html#installing-gui-on-macos-not-working) section.

documentation/dev-portal/src/nymvpn/gui.md

@@ -0,0 +1,43 @@
+# NymVPN Application (GUI)
+
+```admonish info
+Our alpha testing round is done with participants at live workshop events. This guide will not work for everyone, as the NymVPN source code is not yet publicly accessible. The alpha testing is done on Nym testnet Sandbox environment, this configuration is limited and will not work in the future.
+
+**If you commit to test NymVPN alpha, please start with the [user research form]({{nym_vpn_form_url}}) where all the steps will be provided**. If you disagree with any of the conditions listed, please leave this page.
+```
+
+This is the alpha version of NymVPN application - the GUI. A demo of how the client will look like for majority of day-to-day users. For qualitative testing the [CLI](cli.md) is a necessity but to run the GUI holds the same importance as it provides the user with an experience of the actual app and the developers with a valuable feedback from the users.
+
+Follow the simple [automated script](#automated-script-for-gui-installation) below to install and run NymVPN GUI. If you prefer to do a manual setup follow the steps in the guide for [Linux](gui-linux.md) or [MacOS](gui-mac.md).
+
+## Automated Script for GUI Installation
+
+We wrote a [script](https://gist.github.com/tommyv1987/7d210d4daa8f7abc61f9a696d0321f19) which does download of dependencies and the application, sha256 verification, extraction, installation and configuration for Linux and MacOS users automatically following the steps below:
+
+1. Open a terminal window in a directory where you want the script and NymVPN binary be downloaded and run
+```sh
+curl -o nym-vpn-client-install-run.sh -L https://gist.githubusercontent.com/tommyv1987/7d210d4daa8f7abc61f9a696d0321f19/raw/933962e3e70198ec3d8a1bc5238bbaa20e7f0d52/nym-vpn-client-install-run.sh
+```
+
+2. Make the script executable
+```sh
+chmod u+x nym-vpn-client-install-run.sh
+```
+
+3. Start the script as root, turn off any VPN and run
+```sh
+sudo -E ./nym-vpn-client-install-run.sh
+```
+
+4. Follow the prompts in the program
+
+To start the application again, reconnect your wifi and run
+```sh
+# Linux
+sudo -E ~/nym-vpn-latest/nym-vpn_0.0.3_amd64.AppImage
+
+# MacOS
+sudo $nym_vpn_dir/nym-vpn
+```
+
+In case of errors check out the [troubleshooting](troubleshooting.md#installing-gui-on-macos-not-working) section.

documentation/dev-portal/src/nymvpn/intro.md

@@ -0,0 +1,54 @@
+# NymVPN alpha
+
+<div style="padding:56.25% 0 0 0;position:relative;"><iframe src="https://player.vimeo.com/video/897010658?h=1f55870fe6&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" style="position:absolute;top:0;left:0;width:100%;height:100%;" title="NYMVPN alpha demo 37C3"></iframe></div><script src="https://player.vimeo.com/api/player.js"></script>
+
+**Nym proudly presents NymVPN alpha** - a client that uses [Nym Mixnet](https://nymtech.net) to anonymise all of a user's internet traffic through either a 5-hop mixnet (for a full network privacy) or the faster 2-hop decentralised VPN (with some extra features).
+
+
+**You are invited to take part in the alpha testing** of this new application. The following pages provide a how-to guide, explaining steps to install and run NymVPN [CLI](cli.md) and [GUI](gui.md) on the Sandbox testnet environment as well as provide some scripts for [qualitative testing](testing.md).
+
+**Here is how**
+
+1. Go to the NymVPN [testers form]({{nym_vpn_form_url}})
+2. Please consent to the GDPR so we can use the results
+3. To test the GUI, [go here](gui.md)
+4. To test the CLI, [go here](cli.md)
+5. Run [qualitative testing script](testing.md)
+6. Fill and submit the [form!]({{nym_vpn_form_url}})
+7. Join the [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat) if you have any questions, comments or blockers
+
+***NymVPN alpha testing will last from 15th of January - 15th of February.***
+
+*NOTE: NymVPN alpha is experimental software for [testing purposes](testing.md) only.*
+
+
+## NymVPN Overview
+
+To understand what's under the hood of NymVPN and the mixnet, we recommend interested developers to begin with [Nym network overview](https://nymtech.net/docs/architecture/network-overview.html) and the [Mixnet traffic flow](https://nymtech.net/docs/architecture/traffic-flow.html) pages.
+
+The default setup of NymVPN is to run in 5-hop mode (mixnet):
+
+```
+                      ┌─►mix──┐  mix     mix
+                      │       │
+            Entry     │       │                   Exit
+client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───► Gateway ───► internet
+                              │       │
+                              │       │
+                         mix  └─►mix──┘  mix
+```
+
+Users can switch to 2-hop only mode, which is a faster but less private option. In this mode traffic is only sent between the two Gateways, and is not passed between Mix Nodes.
+
+The client can optionally do the first hop (local client to Entry Gateway) using Wireguard. NymVPN uses Mullvad libraries for wrapping `wireguard-go` and to setup local routing rules to route all traffic to the TUN virtual network device.
+
+## NymVPN Resources & Guides
+
+* [NymVPN webpage](https://nymvpn.com)
+* [Alpha release page]({{nym_vpn_latest_binary_url}})
+* [NymVPN application (GUI) guide](gui.md)
+* [NymVPN Command Line Interface (CLI) guide](cli.md)
+* [Testing scripts](testing.md)
+* [Troubleshooting](troubleshooting.md)
+* [NymVPN FAQ](faq.md)
+* [NymVPN matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat)

documentation/dev-portal/src/nymvpn/testing.md

@@ -1,6 +1,10 @@
 # Testing NymVPN alpha
 
-> Before you get into testing NymVPN, make sure to go through the preparation steps for [Linux](nym-vpn-linux.md) or [MacOS](nym-vpn-mac.md).
+```admonish info
+NymVPN is an experimental software and it's for [testing](./testing.md) purposes only. All users testing the client are expected to sign GDPR Information Sheet and Consent Form (shared at the workshop) so we use their results to improve the client, and submit the form [*NymVPN User research*]({{nym_vpn_form_url}}) with the testing results.
+```
+
+> Before you get into testing NymVPN, make sure to go through the preparation steps for NymVPN [CLI](cli.md).
 
 One of the main aims of NymVPN alpha release is testing; your results will help us to make NymVPN robust and stabilise both the client and the network through provided measurements.
 
@@ -8,14 +12,20 @@ One of the main aims of NymVPN alpha release is testing; your results will help
 
 > Any syntax in `<>` brackets is a user's/version unique variable. Exchange with a corresponding name without the `<>` brackets.
 
-1. Create a directory called `nym-vpn-tests` and copy your `nym-vpn-cli` binary and [`sandbox.env`](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) to that directory
+1. Create a directory called `nym-vpn-tests` and copy your `nym-vpn-cli` binary ([download here]({{nym_vpn_latest_binary_url}})) and [`sandbox.env`](https://raw.githubusercontent.com/nymtech/nym/develop/envs/sandbox.env) to that directory
 2. Copy the [block below](#testssh) and save it as `tests.sh` to the same folder
 3. Open terminal in the same directory
-4. Turn off any existing VPN's (including the NymVPN instances), reconnect your wifi and make the script executable by running `chmod +x ./tests.sh`
-5. Run the tests: `sudo ./tests.sh`
-6. In case of errors, see the [troubleshooting section](./nym-vpn-troubleshooting.md#missing-jq-error) below
+4. Turn off any existing VPN's (including the NymVPN instances), reconnect your wifi and make the script executable by running
+```sh
+chmod u+x ./tests.sh
+```
+5. Run the `tests.sh` script:
+```sh
+sudo ./tests.sh
+````
+6. In case of errors, see the [troubleshooting section](troubleshooting.md#missing-jq-error)
 7. The script will print a JSON view of existing Gateways and prompt you to:
-    - ***(Make sure to use two different Gateways for entry and exit!)***
+    - *Make sure to use two different Gateways for entry and exit!*
     - `enter a gateway ID:` paste one of the values labeled with a key `"identityKey"` printed above (without `" "`)
     - `enter an exit address:` paste one of the values labeled with a key `"address"` printed above (without `" "`)
     - `enable WireGuard? (yes/no):` if you chose yes, find your private key and wireguard IP [here](https://nymvpn.com/en/alpha)
@@ -34,9 +44,8 @@ nym-vpn-tests
 ├── timeout
 └── two_hop_perf_test_results.log
 ```
-10. In case of errors, see [troubleshooting section](./nym-vpn-troubleshooting.md#missing-jq-error) below
-11. When the tests are finished, remove the `nym-vpn-cli` binary from the folder and compress the entire folder as `nym-vpn-tests.zip`
-12. Upload this compressed file to the [questionnaire](https://opnform.com/forms/nymvpn-user-research-at-37c3-yccqko-2) upload field when prompted
+10. When the tests are finished, remove the `nym-vpn-cli` binary from the folder and compress the entire folder as `nym-vpn-tests.zip`
+11. Upload this compressed file to the [form]({{nym_vpn_form_url}}) upload field when prompted
 
 #### tests.sh
 

documentation/dev-portal/src/nymvpn/troubleshooting.md

@@ -0,0 +1,72 @@
+# Troubleshooting
+
+Below are listed some points which may need to be addressed when testing NymVPN alpha. If you crashed into any errors which are not listed, please contact us at the testing workshop or in the NymVPN [Matrix channel](https://matrix.to/#/#NymVPN:nymtech.chat).
+
+#### Problems with the newest version `nym-vpn-alpha-0.0.X demo`
+
+Try the previous version which was tested multiple times by downloading the client from the [release page](https://github.com/nymtech/nym/releases). Then follow all the setup steps the name of your downloaded binary.
+
+#### Installing GUI on MacOS not working
+
+In case there was a problem running the script, try the [manual setup](gui-mac.md) for MacOS.
+
+#### Thread `main` panicked
+
+If you see a message like:
+```sh
+thread 'main' panicked at /Users/runner/.cargo/git/checkouts/mullvadvpn-app-a575cf705b5dfd76/ccfbaa2/talpid-routing/src/unix.rs:301:30:
+```
+Restart your wifi connection and start again.
+
+#### MacOS alert on NymVPN UI startup
+
+If you are running NymVPN on mac OS for the first time, you may see this alert message:
+
+![](images/image3.png)
+
+1. Head to System Settings -> Privacy & Security and click `Allow anyway`
+
+![](images/image5.png)
+
+2. Confirm with your password or TouchID
+
+3. Possibly you may have to confirm again upon running the application
+
+#### Missing `jq` error
+
+In case of missing `jq` on Linux (Debian) install it with:
+```sh
+# Linux (Debian)
+sudo apt-get install jq
+# macOS
+brew install jq
+```
+On some Linux distributions however the [script](testing.md#testssh) returns `jq` error even if your system claims that `jq is already the newest version`.
+In that case, comment the `jq` check in the script as follows:
+```sh
+#if ! command -v jq &>/dev/null; then
+#    echo "jq is not installed. Please install jq to proceed."
+#    exit 1
+#fi
+```
+
+#### Error current_time: not found
+
+When running `sudo sh ./test.sh` you may see an error like: `93: current_time: not found`. This has something to do with the `current_time` setup of your system and on itself shall not have a negative impact on the test. It has nothing to do with the client at all as it only relates to the code in our testing script.
+
+#### Not connecting to the endpoint
+
+In case the automatic download of all the Gateways fail (and it shouldn't), you do an easy manual work around:
+
+1. Open the list of Gateways created by API [here](https://nymvpn.com/en/alpha/api/gateways)
+2. On top click on `JSON` option (shall be default view) and `Save`
+3. Save it as `data.json` to the `nym-vpn-tests` folder
+4. Replace line 3 in the [script `tests.sh`](testing.md#testssh) with:
+```sh
+NEW_ENDPOINT="http://localhost:8000/data.json"
+```
+5. In a new terminal window run:
+```sh
+python3 -m http.server 8000
+```
+6. Continue with the steps listed in [testing section](testing.md)

documentation/operators/src/faq/mixnodes-faq.md

@@ -1,22 +1,51 @@
 # Frequently Asked Questions
 
-## Nym Nodes
+## Nym Mixnet
+
+To see different stats about Nym Mixnet live, we recommend you to visit [status.notrustverify.ch](https://status.notrustverify.ch/d/CW3L7dVVk/nym-mixnet?orgId=1) built by [No Trust Verify](https://notrustverify.ch/) crew, one of the squads within Nym core community.
+
+<iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1702215592419&to=1704807592419&panelId=12" width="800" height="400" frameborder="0"></iframe>
+
+
+### Is there an explorer for Nym Mixnet?
+
+Yes, there are several places, some are built by Nym core community:
+
+* [Nym Explorer](https://explorer.nymtech.net/)
+* [Guru Explorer](https://mixnet.explorers.guru/)
+* [ExploreNYM](https://explorenym.net/)
 
 ### What determines the rewards when running a Mix Node?
 
-The stake required for a Mix Node to achieve maximum rewards is called Mix Node saturation point. This is calculated from the staking supply (all circulating supply + part of unlocked tokens). The target level of staking is to have 50% of the staking supply locked in Mix Nodes.
+The stake required for a Mix Node to achieve maximum rewards is called Mix Node saturation point. This is calculated from the staking supply (all circulating supply + part of unlocked tokens). The target level of staking is to have 40% of the staking supply locked in Mix Nodes.
 
-The node stake saturation point, which we denote by Nsat, is given by the stake supply, target level of staking divided by the number of rewarded (active) nodes. 
+The node stake saturation point, which we denote by Nsat, is given by the stake supply, target level of staking divided between the rewarded nodes.
+
+This design ensures the nodes aim to have a same size of stake (reputation) which can be done by delegation staking, as well as it secures a whale prevention and decentralization of staking, as any higher level of delegated $NYM than Nsat per node results in worsening reward ratio. On the contrary, the more Mix Nodes are active, the lower is Nsat. The equilibrium is reached when the staked tokens are delegated equally across the active Mix nodes and that's our basis for this incentive system.
+
+<iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074760986&to=1705666760986&panelId=5" width="800" height="400" frameborder="0"></iframe>
+
+
+The rewarded nodes are the nodes which will receive some rewards by the end of the given epoch. These can be separated further separated into:
+
+1. Active: Top *N* nodes of the rewarded set (currently all of them but this can change), these are nodes which are used by the clients and mix packets.
+
+2. Standby: Bottom *N* nodes of the rewarded set, they don't mix data from the clients but are used for testing. Their reward is smaller.
 
-This design ensures the nodes aim to have a same size of stake (reputation) which can be done by delegation staking, as well as it ensures that there is a decentralization of staking as any higher level of staked tokens per node results in worse rewards. On the contrary, the more Mix Nodes are active, the lower is Nsat. The equilibrium is reached when the staked tokens are delegated equally across the active mix-nodes and that's our basis for this incentive system.
 
 For more detailed calculation, read our blog post [Nym Token Economics update](https://blog.nymtech.net/nym-token-economics-update-fedff0ed5267). More info on staking can be found [here](https://blog.nymtech.net/staking-in-nym-introducing-mainnet-mixmining-f9bb1cbc7c36). And [here](https://blog.nymtech.net/want-to-stake-in-nym-here-is-how-to-choose-a-mix-node-to-delegate-nym-to-c3b862add165) is more info on how to choose a Mix Node for delegation. And finally an [update](https://blog.nymtech.net/quarterly-token-economic-parameter-update-b2862948710f) on token economics from July 2023.
 
+<iframe src="https://status.notrustverify.ch/d-solo/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074829887&to=1705666829887&panelId=31" width="850" height="400" frameborder="0"></iframe>
+
+*More graphs and stats at [stats.notrustverify.ch](https://status.notrustverify.ch/d/CW3L7dVVk/nym-mixnet?orgId=1&from=1703074861988&to=1705666862004).*
+
 ### Which VPS providers would you recommend?
 
 Consider in which jurisdiction you reside and where do you want to run a Mix Node. Do you want to pay by crypto or not and what are the other important particularities for your case? We always recommend operators to try to choose smaller and decentralised VPS providers over the most known ones controlling a majority of the internet. We receive some good feedback on these: Linode, Ghandi, Flokinet and Exoscale. Do your own research and share with the community.
 
-<!---### Why is a mix node setup on a self-hosted machine so tricky?--->
+### Why is a mix node setup on a self-hosted machine so tricky?
+
+We don't recommend this setup because it's really difficult to get a static IP and route IPv6 traffic.
 
 ### What's the Sphinx packet size?
 
@@ -28,7 +57,7 @@ Because of the way the smart contract works we keep it one-node one-address at t
 
 ### Which nodes are the most needed to be setup to strengthen Nym infrastructure and which ones bring rewards?
 
-Right now only Mix Nodes are rewarded. We're working on Gateway and service payments. Gateways are the weak link right now due mostly to lack of incentivisation. Services like Network Requesters are obviously the most necessary for people to start using the platform, and we're working on smart contracts to allow for people to start advertising them the same way they do Mix Nodes.
+Ath this point the most crutial component needed are [Exit Gateways](../legal/exit-gateway.md).
 
 ### Are Mix Nodes whitelisted?
 
@@ -60,7 +89,6 @@ We are currently working towards building up a closed set of reputable validator
 
 We understand that the early days of the Nyx blockchain will face possible vulnerabilities in terms of size - easy to disrupt or halt the chain if a malicious party entered with a large portion of stake. Besides that, there are some legal issues we need to address before we can distribute the validator set in a fully permissions fashion.
 
-### Why does Nym do many airdrops?
+### Why does Nym do airdrops?
 
 It is part of ensuring decentralisation - we need to avoid a handful of people having too much control over the token and market. Of course ideally people will stake the tokens and contribute to the project at this stage. We run surveys to better understand what people are doing with their tokens and what usability issues there are for staking. Any feedback is appreciated as it helps us improve all aspects of using the token and participating in the ecosystem.
-

documentation/operators/src/nodes/maintenance.md

@@ -726,6 +726,7 @@ server {
   listen 80;
   listen [::]:80;
   server_name "<nym-api.nyx.yourdomain.tld>";
+  add_header 'Access-Control-Allow-Origin' '*';
 
   location / {
     proxy_pass http://127.0.0.1:8000;

documentation/operators/src/nodes/nym-api.md

@@ -2,8 +2,8 @@
 
 [//]: # (> The nym-api binary was built in the [building nym](../binaries/building-nym.md) section. If you haven't yet built Nym and want to run the code, go there first. You can build just the API with `cargo build --release --bin nym-api`.)
 
-> The `nym-api` binary will be released in the immediate future - we're releasing this document beforehand so that Validators have information as soon as possible and get an idea of what to expect. This doc will be expanded over time as we release the API binary itself as well as start enabling functionality.  
-> 
+> The `nym-api` binary will be released in the immediate future - we're releasing this document beforehand so that validators have information as soon as possible and get an idea of what to expect. This doc will be expanded over time as we release the API binary itself as well as start enabling functionality.
+>
 > You can build the API with `cargo build --release --bin nym-api`.
 
 > Any syntax in `<>` brackets is a user's unique variable. Exchange with a corresponding name without the `<>` brackets.
@@ -18,7 +18,7 @@ This is important for both the proper decentralisation of the network uptime cal
 The process of enabling these different aspects of the system will take time. At the moment, Nym API operators will only have to run the binary in a minimal 'caching' mode in order to get used to maintaining an additional process running alongside a full node.
 
 ```admonish warning
-It is highly recommended to run `nym-api` alongside a full node since you will be exposing HTTP port(s) to the Internet. We also observed degradation in p2p and block signing operations when `nym-api` was run alongside a signing validator.
+It is highly recommended to run `nym-api` alongside a full node and NOT a validator node, since you will be exposing HTTP port(s) to the Internet. We also observed degradation in p2p and block signing operations when `nym-api` was run alongside a signing validator.
 ```
 
 ### Rewards
@@ -26,23 +26,75 @@ Operators of Nym API will be rewarded for performing the extra work of taking pa
 
 Rewards for credential signing will be calculated hourly, with API operators receiving a proportional amount of the reward pool (333NYM per hour / 237,600 NYM per month), proportional to the percentage of credentials they have signed.
 
-### (Coming Soon) Machine Specs
-We are working on load testing currently in order to get good specs for a full node + Nym API setup. Bear in mind that credential signing is primarily CPU-bound.
+
+### Hardware Requirements
+
+The specification mentioned below is for running a full node alongside the nym-api. It is recommended to run `nym-api` and a full Nyx node on the same machine for optimum performance.
+
+Bear in mind that credential signing is primarily CPU-bound, so choose the fastest CPU available to you.
+
+#### Minimum Requirements
+
+| Hardware | Minimum Specification                      |
+|----------|--------------------------------------------|
+| CPU      | 8-cores, 2.8GHz base clock speed or higher |
+| RAM      | 16GB DDR4+                                 |
+| Disk     | 500 GiB+ NVMe SSD                          |
+
+#### Recommended Requirements
+
+| Hardware | Minimum Specification                       |
+|----------|---------------------------------------------|
+| CPU      | 16-cores, 2.8GHz base clock speed or higher |
+| RAM      | 32GB DDR4+                                  |
+| Disk     | 1 TiB+ NVMe SSD                             |
+
+### Full node configuration
+
+To install a full node from scratch, refer to the [validator setup guide](./validator-setup.md) and follow the steps outlined there.
+Additionally, to ensure `nym-api` works as expected, ensure the configuration is as below:
+
+#### Ensure transaction index is turned on in your `config.toml`:
+
+```
+[tx_index]
+
+# Ensure that this is not set to "null". You're free to use any indexer
+
+indexer = "kv"
+```
+
+#### Ensure pruning settings are manually configured
+
+`nym-api` needs to check validity of user-submitted transactions (in the past) while issuing credentials and as part of double-spend check. Hence, aggressively pruning data will lead to errors with your `nym-api`
+
+Make sure your pruning settings are configured as below in `app.toml`:
+
+```
+pruning = "custom"
+
+# This number is likely to be updated once zk-nym signing goes live
+pruning-keep-recent = "750000"
+pruning-interval = "100"
+```
+
+The example value of `100` for `pruning-interval` can be customised as per your requirement.
+
 
 ### (Coming Soon) Credential Generation
-Validators that take part in the DKG ceremony will become part of the 'quorum' generating and verifying zk-Nym credentials. These will initially be used for private proof of payment for NymVPN (see our blogposts [here](https://blog.nymtech.net/nymvpn-an-invitation-for-privacy-experts-and-enthusiasts-63644139d09d) and [here](https://blog.nymtech.net/zk-nyms-are-here-a-major-milestone-towards-a-market-ready-mixnet-a3470c9ab10a) for more on this), and in the future will be expanded into more general usecases such as [offline ecash](https://arxiv.org/abs/2303.08221). 
+Validators that take part in the DKG ceremony will become part of the 'quorum' generating and verifying zk-Nym credentials. These will initially be used for private proof of payment for NymVPN (see our blogposts [here](https://blog.nymtech.net/nymvpn-an-invitation-for-privacy-experts-and-enthusiasts-63644139d09d) and [here](https://blog.nymtech.net/zk-nyms-are-here-a-major-milestone-towards-a-market-ready-mixnet-a3470c9ab10a) for more on this), and in the future will be expanded into more general usecases such as [offline ecash](https://arxiv.org/abs/2303.08221).
 
-The DKG ceremony will be used to create a subset of existing validators - referred to as the quorum. As outlined above, they will be the ones taking part in the generation and verification of zk-Nym credentials. The size of the 'minimum viable quorum' is 10 - we are aiming for a larger number than this for the initial quorum in order to have some redundancy in the case of a Validator dropping or going offline. 
+The DKG ceremony will be used to create a subset of existing validators - referred to as the quorum. As outlined above, they will be the ones taking part in the generation and verification of zk-Nym credentials. The size of the 'minimum viable quorum' is 10 - we are aiming for a larger number than this for the initial quorum in order to have some redundancy in the case of a Validator dropping or going offline.
 
 We will be releasing more detailed step-by-step documentation for involved validators nearer to the ceremony itself, but at a high level it will involve:
-* the deployment and initialisation of [`group`](https://github.com/nymtech/nym/tree/develop/contracts/multisig/cw4-group) and [`multisig`](https://github.com/nymtech/nym/tree/develop/contracts/multisig) contracts by Nym. Validators that are members of the `group` contract are the only ones that will be able to take part in the ceremony. 
-* the deployment and initialisation of an instance of the [DKG contract](https://github.com/nymtech/nym/tree/develop/contracts/coconut-dkg) by Nym.  
+* the deployment and initialisation of [`group`](https://github.com/nymtech/nym/tree/develop/contracts/multisig/cw4-group) and [`multisig`](https://github.com/nymtech/nym/tree/develop/contracts/multisig) contracts by Nym. Validators that are members of the `group` contract are the only ones that will be able to take part in the ceremony.
+* the deployment and initialisation of an instance of the [DKG contract](https://github.com/nymtech/nym/tree/develop/contracts/coconut-dkg) by Nym.
 * Validators will update their `nym-api` configs with the address of the deployed contracts. They will also stop running their API instance in caching only mode, instead switching over run with the `--enabled-credentials-mode`.
-* From the perspective of operators, this is all they have to do. Under the hood, each `nym-api` instance will then take part in several rounds of key submission, verification, and derivation. This will continue until quorum is acheived. More information on this will be released closer to the time of the ceremony. 
+* From the perspective of operators, this is all they have to do. Under the hood, each `nym-api` instance will then take part in several rounds of key submission, verification, and derivation. This will continue until quorum is acheived. More information on this will be released closer to the time of the ceremony.
 
-**We will be communicating individually with members of the existing Validator set who have expressed interest in joining the quorum concerning the timing and specifics of the ceremony**. 
+**We will be communicating individually with members of the existing Validator set who have expressed interest in joining the quorum concerning the timing and specifics of the ceremony**.
 
-## Current version 
+## Current version
 ```
 <!-- cmdrun ../../../../target/release/nym-api --version | grep "Build Version" | cut -b 21-26  -->
 ```
@@ -85,10 +137,10 @@ The API binary currently defaults to running in caching mode. You can run your A
 ./nym-api run
 ```
 
-By default the API will be trying to query a running `nyxd` process (either a validator or RPC node) on `localhost:26657`. This value can be modified either via the `--nyxd-validator ` flag on `run`:
+By default the API will be trying to query your full node running locally on `localhost:26657`. If your node is hosted elsewhere, you can specify the RPC location by using the `--nyxd-validator ` flag on `run`:
 
 ```
-./nym-api run --nyxd-validator https://rpc.nymtech.net:443
+./nym-api run --nyxd-validator https://rpc-nym.yourcorp.tld:443
 ```
 
 > You can also change the value of `local_validator` in the config file found by default in `$HOME/.nym/nym-api/<ID>/config/config.toml`.
@@ -179,4 +231,6 @@ Starting nym api...
 You will most likely want to automate your validator restarting if your server reboots. Checkout the [maintenance page](./maintenance.md) for an example `service` file.
 
 ## Exposing web endpoint using HTTPS
-It is recommended to expose the webserver over HTTPS by using a webserver like Nginx. An example configuration for configuring Nginx is listed [on the maintenance page](maintenance.md#nym-api-configuration)
+It is recommended to expose the webserver over HTTPS by using a webserver like Nginx. An example configuration for configuring Nginx is listed [on the maintenance page](maintenance.md#nym-api-configuration). If you're using a custom solution, ensure to allow requests from anywhere by setting a permissive CORS policy.
+
+For example, it is configured in Nginx using: `add_header 'Access-Control-Allow-Origin' '*';`

envs/sandbox.env

@@ -13,13 +13,13 @@ DENOMS_EXPONENT=6
 REWARDING_VALIDATOR_ADDRESS=n1pefc2utwpy5w78p2kqdsfmpjxfwmn9d39k5mqa
 MIXNET_CONTRACT_ADDRESS=n1xr3rq8yvd7qplsw5yx90ftsr2zdhg4e9z60h5duusgxpv72hud3sjkxkav
 VESTING_CONTRACT_ADDRESS=n1unyuj8qnmygvzuex3dwmg9yzt9alhvyeat0uu0jedg2wj33efl5qackslz
-COCONUT_BANDWIDTH_CONTRACT_ADDRESS=n16a32stm6kknhq5cc8rx77elr66pygf2hfszw7wvpq746x3uffylqkjar4l
-GROUP_CONTRACT_ADDRESS=n1pd7kfgvr5tpcv0xnlv46c4jsq9jg2r799xxrcwqdm4l2jhq2pjwqrmz5ju
-MULTISIG_CONTRACT_ADDRESS=n14ph4e660eyqz0j36zlkaey4zgzexm5twkmjlqaequxr2cjm9eprqsmad6k
-COCONUT_DKG_CONTRACT_ADDRESS=n1ahg0erc2fs6xx3j5m8sfx3ryuzdjh6kf6qm9plsf865fltekyrfsesac6a
-EPHEMERA_CONTRACT_ADDRESS=n19lc9u84cz0yz3fww5283nucc9yvr8gsjmgeul0
+COCONUT_BANDWIDTH_CONTRACT_ADDRESS=n13902g92xfefeyzuyed49snlm5fxv5ms6mdq5kvrut27hasdw5a9q9vyw6c
+GROUP_CONTRACT_ADDRESS=n18nczmqw6adwxg2wnlef3hf0etf8anccafp2pjpul5rrtmv96umyq5mv7t5
+MULTISIG_CONTRACT_ADDRESS=n1q3zzxl78rlmxv3vn0uf4vkyz285lk8q2xzne299yt9x6mpfgk90qukuzmv
+COCONUT_DKG_CONTRACT_ADDRESS=n1jsz20ggp5a6v76j060erkzvxmeus8htlpl77yxp878f0gf95cyaq6p2pee
 NAME_SERVICE_CONTRACT_ADDRESS=n12ne7qtmdwd0j03t9t5es8md66wq4e5xg9neladrsag8fx3y89rcs36asfp
 SERVICE_PROVIDER_DIRECTORY_CONTRACT_ADDRESS=n1ps5yutd7sufwg058qd7ac7ldnlazsvmhzqwucsfxmm445d70u8asqxpur4
+EPHEMERA_CONTRACT_ADDRESS=n19lc9u84cz0yz3fww5283nucc9yvr8gsjmgeul0
 
 STATISTICS_SERVICE_DOMAIN_ADDRESS="http://0.0.0.0"
 EXPLORER_API=https://sandbox-explorer.nymtech.net/api

explorer/src/components/MixNodes/BondBreakdown.tsx

@@ -29,21 +29,23 @@ export const BondBreakdownTable: FCWithChildren = () => {
   React.useEffect(() => {
     if (mixNode?.data) {
       // delegations
-      const decimalisedDelegations = currencyToString(
-        mixNode.data.total_delegation.amount.toString(),
-        mixNode.data.total_delegation.denom,
-      );
+      const decimalisedDelegations = currencyToString({
+        amount: mixNode.data.total_delegation.amount.toString(),
+        denom: mixNode.data.total_delegation.denom,
+      });
 
       // pledges
-      const decimalisedPledges = currencyToString(
-        mixNode.data.pledge_amount.amount.toString(),
-        mixNode.data.pledge_amount.denom,
-      );
+      const decimalisedPledges = currencyToString({
+        amount: mixNode.data.pledge_amount.amount.toString(),
+        denom: mixNode.data.pledge_amount.denom,
+      });
 
       // bonds total (del + pledges)
       const pledgesSum = Number(mixNode.data.pledge_amount.amount);
       const delegationsSum = Number(mixNode.data.total_delegation.amount);
-      const bondsTotal = currencyToString((delegationsSum + pledgesSum).toString());
+      const bondsTotal = currencyToString({
+        amount: (pledgesSum + delegationsSum).toString(),
+      });
 
       setBonds({
         delegations: decimalisedDelegations,
@@ -186,12 +188,12 @@ export const BondBreakdownTable: FCWithChildren = () => {
             </TableHead>
 
             <TableBody>
-              {uniqDelegations?.data?.map(({ owner, amount: { amount, denom } }) => (
+              {uniqDelegations?.data?.map(({ owner, amount: { amount } }) => (
                 <TableRow key={owner}>
                   <TableCell sx={isMobile ? { width: 190 } : null} align="left">
                     {owner}
                   </TableCell>
-                  <TableCell align="left">{currencyToString(amount.toString(), denom)}</TableCell>
+                  <TableCell align="left">{currencyToString({ amount: amount.toString() })}</TableCell>
                   <TableCell align="left">{calcBondPercentage(amount)}%</TableCell>
                 </TableRow>
               ))}

explorer/src/components/MixNodes/Economics/Rows.ts

@@ -11,9 +11,13 @@ export const EconomicsInfoRows = (): EconomicsInfoRowWithIndex => {
   const { economicDynamicsStats, mixNode } = useMixnodeContext();
 
   const estimatedNodeRewards =
-    currencyToString((economicDynamicsStats?.data?.estimated_total_node_reward || '').toString()) || '-';
+    currencyToString({
+      amount: economicDynamicsStats?.data?.estimated_total_node_reward.toString() || '',
+    }) || '-';
   const estimatedOperatorRewards =
-    currencyToString((economicDynamicsStats?.data?.estimated_operator_reward || '').toString()) || '-';
+    currencyToString({
+      amount: economicDynamicsStats?.data?.estimated_operator_reward.toString() || '',
+    }) || '-';
   const profitMargin = mixNode?.data?.profit_margin_percent
     ? toPercentIntegerString(mixNode?.data?.profit_margin_percent)
     : '-';

explorer/src/pages/Mixnodes/index.tsx

@@ -142,7 +142,7 @@ export const PageMixnodes: FCWithChildren = () => {
           component={RRDLink}
           to={`/network-components/mixnode/${params.row.mix_id}`}
         >
-          {currencyToString(params.value)}
+          {currencyToString({ amount: params.value, dp: 2 })}
         </MuiLink>
       ),
     },
@@ -187,7 +187,7 @@ export const PageMixnodes: FCWithChildren = () => {
           component={RRDLink}
           to={`/network-components/mixnode/${params.row.mix_id}`}
         >
-          {currencyToString(params.value)}
+          {currencyToString({ amount: params.value, dp: 2 })}
         </MuiLink>
       ),
     },

explorer/src/utils/currency.ts

@@ -4,11 +4,31 @@ import Big from 'big.js';
 const DENOM = process.env.CURRENCY_DENOM || 'unym';
 const DENOM_STAKING = process.env.CURRENCY_STAKING_DENOM || 'unyx';
 
-export const currencyToString = (amount: string, denom: string = DENOM) =>
-  printableCoin({
+export const toDisplay = (val: string | number | Big, dp = 4) => {
+  let displayValue;
+  try {
+    displayValue = Big(val).toFixed(dp);
+  } catch (e: any) {
+    console.warn(`${displayValue} not a valid decimal number: ${e}`);
+  }
+  return displayValue;
+};
+
+export const currencyToString = ({ amount, dp, denom = DENOM }: { amount: string; dp?: number; denom?: string }) => {
+  if (!dp) {
+    printableCoin({
+      amount,
+      denom,
+    });
+  }
+
+  const [printableAmount, printableDenom] = printableCoin({
     amount,
     denom,
-  });
+  }).split(/\s+/);
+
+  return `${toDisplay(printableAmount, dp)} ${printableDenom}`;
+};
 
 export const stakingCurrencyToString = (amount: string, denom: string = DENOM_STAKING) =>
   printableCoin({
@@ -24,15 +44,6 @@ export const stakingCurrencyToString = (amount: string, denom: string = DENOM_ST
  * @param dp - number of decimal places (4 by default ie. 0.0000)
  * @returns A prettyfied decimal number
  */
-export const toDisplay = (val: string | number | Big, dp = 4) => {
-  let displayValue;
-  try {
-    displayValue = Big(val).toFixed(dp);
-  } catch (e: any) {
-    console.warn(`${displayValue} not a valid decimal number: ${e}`);
-  }
-  return displayValue;
-};
 
 /**
  * Converts a decimal number of μNYM (micro NYM) to NYM.

gateway/Cargo.toml

@@ -98,3 +98,9 @@ sqlx = { workspace = true, features = [
 
 [features]
 wireguard = ["nym-wireguard", "defguard_wireguard_rs"]
+
+[package.metadata.deb]
+name = "nym-gateway"
+maintainer-scripts = "debian"
+depends = "curl"
+systemd-units = { enable = false }

gateway/README.md

@@ -22,4 +22,46 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License
-along with this program.  If not, see <https://www.gnu.org/licenses/>.
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+## Install debian
+
+```bash
+sudo curl -s --compressed "https://nymtech.github.io/nym/nymtech.gpg" | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nymtech.gpg > /dev/null
+sudo echo "deb [signed-by=/etc/apt/trusted.gpg.d/nymtech.gpg] https://nymtech.github.io/nym/ /" > nymtech.list
+
+sudo apt-get update
+sudo apt-get install nym-gateway
+
+# See below for starting and managing the node
+```
+
+## Systemd support
+
+```bash
+sudo systemctl enable nym-gateway
+
+# Run 
+sudo systemctl start nym-gateway
+
+# Check status
+sudo systemctl status nym-mixnode
+
+# Logs
+journalctl -f -u nym-mixnode
+
+```
+
+## Build debian package
+
+```bash 
+# cargo install cargo-deb
+
+# Build package
+cargo deb -p nym-gateway
+
+# Install
+
+# This will init the mixnode to `/etc/nym` as `nym` user, and create a systemd service
+sudo dpkg -i target/debian/<PACKAGE>
+```

gateway/debian/postinst

@@ -0,0 +1,6 @@
+#DEBHELPER#
+
+useradd nym
+mkdir -p /etc/nym
+chown -R nym /etc/nym
+su nym -c 'NYM_HOME_DIR=/etc/nym nym-gateway init --host 0.0.0.0 --id nym-gateway --public-ips $(curl https://ipinfo.io/ip)'

gateway/debian/service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Nym Gateway
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/nym-gateway run --id nym-gateway
+User=nym
+Environment="NYM_HOME_DIR=/etc/nym"
+
+[Install]
+WantedBy=multi-user.target

gateway/src/commands/helpers.rs

@@ -240,6 +240,7 @@ pub(crate) fn override_network_requester_config(
     )
 }
 
+// NOTE: make sure this is in sync with service-providers/ip-packet-router/src/cli/mod.rs::override_config
 pub(crate) fn override_ip_packet_router_config(
     mut cfg: nym_ip_packet_router::Config,
     opts: Option<OverrideIpPacketRouterConfig>,

nym-validator-rewarder/migrations/01_initial.sql

@@ -27,6 +27,7 @@ CREATE TABLE block_signing_reward
     rewarding_epoch_id          INTEGER NOT NULL REFERENCES rewarding_epoch (id),
     validator_consensus_address TEXT    NOT NULL,
     operator_account            TEXT    NOT NULL,
+    whitelisted                 BOOLEAN NOT NULL,
     amount                      TEXT    NOT NULL,
     voting_power                BIGINT  NOT NULL,
     voting_power_share          TEXT    NOT NULL,
@@ -38,11 +39,11 @@ CREATE TABLE block_signing_reward
 
 CREATE TABLE epoch_credential_issuance
 (
-    rewarding_epoch_id       INTEGER NOT NULL PRIMARY KEY REFERENCES rewarding_epoch (id),
-    starting_dkg_epoch       INTEGER NOT NULL,
-    ending_dkg_epoch         INTEGER NOT NULL,
+    rewarding_epoch_id               INTEGER NOT NULL PRIMARY KEY REFERENCES rewarding_epoch (id),
+    starting_dkg_epoch               INTEGER NOT NULL,
+    ending_dkg_epoch                 INTEGER NOT NULL,
     total_issued_partial_credentials INTEGER NOT NULL,
-    budget                   TEXT    NOT NULL
+    budget                           TEXT    NOT NULL
 );
 
 CREATE TABLE malformed_credential
@@ -56,6 +57,7 @@ CREATE TABLE credential_issuance_reward
     rewarding_epoch_id           INTEGER NOT NULL REFERENCES rewarding_epoch (id),
     operator_account             TEXT    NOT NULL,
     amount                       TEXT    NOT NULL,
+    whitelisted                  BOOLEAN NOT NULL,
     api_endpoint                 TEXT    NOT NULL,
     issued_partial_credentials   INTEGER NOT NULL,
     issued_credentials_share     TEXT    NOT NULL,

nym-validator-rewarder/src/config/mod.rs

@@ -9,7 +9,7 @@ use nym_config::{
     must_get_home, read_config_from_toml_file, save_formatted_config_to_file, NymConfigTemplate,
     DEFAULT_CONFIG_DIR, DEFAULT_CONFIG_FILENAME, DEFAULT_DATA_DIR, NYM_DIR,
 };
-use nym_validator_client::nyxd::Coin;
+use nym_validator_client::nyxd::{AccountId, Coin};
 use serde::{Deserialize, Serialize};
 use serde_with::{serde_as, DisplayFromStr};
 use std::io;
@@ -225,7 +225,7 @@ impl Default for RewardingRatios {
 impl RewardingRatios {
     pub fn ensure_is_valid(&self) -> Result<(), NymRewarderError> {
         if self.block_signing + self.credential_verification + self.credential_issuance != 1.0 {
-            todo!()
+            return Err(NymRewarderError::InvalidRewardingRatios { ratios: *self });
         }
         Ok(())
     }
@@ -238,19 +238,26 @@ pub struct NyxdScraper {
     // TODO: debug with everything that's currently hardcoded in the scraper
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize, Copy)]
+#[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct BlockSigning {
     /// Specifies whether credential issuance for block signing is enabled.
     pub enabled: bool,
+
+    /// List of validators that will receive rewards for block signing.
+    /// If not on the list, the validator will be treated as if it had 0 voting power.
+    pub whitelist: Vec<AccountId>,
 }
 
 impl Default for BlockSigning {
     fn default() -> Self {
-        BlockSigning { enabled: true }
+        BlockSigning {
+            enabled: true,
+            whitelist: vec![],
+        }
     }
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize, Copy)]
+#[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct IssuanceMonitor {
     /// Specifies whether credential issuance monitoring (and associated rewards) are enabled.
     pub enabled: bool,
@@ -264,15 +271,20 @@ pub struct IssuanceMonitor {
 
     /// The sampling rate of the issued credentials
     pub sampling_rate: f64,
+
+    /// List of validators that will receive rewards for credential issuance.
+    /// If not on the list, the validator will be treated as if it hadn't issued a single credential.
+    pub whitelist: Vec<AccountId>,
 }
 
 impl Default for IssuanceMonitor {
     fn default() -> Self {
         IssuanceMonitor {
-            enabled: true,
+            enabled: false,
             run_interval: DEFAULT_MONITOR_RUN_INTERVAL,
             min_validate_per_issuer: DEFAULT_MONITOR_MIN_VALIDATE,
             sampling_rate: DEFAULT_MONITOR_SAMPLING_RATE,
+            whitelist: vec![],
         }
     }
 }

nym-validator-rewarder/src/config/template.rs

@@ -40,7 +40,14 @@ credential_verification = {{ rewarding.ratios.credential_verification }}
 [block_signing]
 # Specifies whether credential issuance for block signing is enabled.
 enabled = {{ block_signing.enabled }}
-    
+
+# List of validators that will receive rewards for block signing.
+# If not on the list, the validator will be treated as if it had 0 voting power.
+whitelist = [
+    # needs to be manually populated; expects nvalcons1... addresses.
+    # you can get them from, for example, `/cosmos/base/tendermint/v1beta1/validatorsets/latest` endpoint
+]
+ 
     
 [issuance_monitor]
 # Specifies whether credential issuance monitoring (and associated rewards) are enabled.
@@ -54,6 +61,12 @@ min_validate_per_issuer = {{ issuance_monitor.min_validate_per_issuer }}
 
 # The sampling rate of the issued credentials
 sampling_rate = {{ issuance_monitor.sampling_rate }}
+
+# List of validators that will receive rewards for credential issuance.
+# If not on the list, the validator will be treated as if it hadn't issued a single credential.
+whitelist = [
+    # needs to be manually populated; expects n1... addresses
+]
     
 [nyxd_scraper]
 # Url to the websocket endpoint of a validator, for example `wss://rpc.nymtech.net/websocket`

nym-validator-rewarder/src/error.rs

@@ -1,6 +1,7 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
+use crate::config::RewardingRatios;
 use nym_coconut::CoconutError;
 use nym_validator_client::nym_api::error::NymAPIError;
 use nym_validator_client::nyxd::error::NyxdError;
@@ -50,7 +51,7 @@ pub enum NymRewarderError {
     NyxdFailure(#[from] NyxdError),
 
     #[error("the provided rewarding ratios don't add up to 1. ratios: {ratios:?}")]
-    InvalidRewardingRatios { ratios: Vec<f32> },
+    InvalidRewardingRatios { ratios: RewardingRatios },
 
     #[error("chain scraping failure: {source}")]
     ScraperFailure {
@@ -156,6 +157,12 @@ pub enum NymRewarderError {
 
     #[error("the scraper websocket endpoint hasn't been provided")]
     UnavailableWebsocketUrl,
+
+    #[error("block signing rewarding is enabled, but the validator whitelist is empty")]
+    EmptyBlockSigningWhitelist,
+
+    #[error("credential issuance rewarding is enabled, but the validator whitelist is empty")]
+    EmptyCredentialIssuanceWhitelist,
 }
 
 #[derive(Debug)]

nym-validator-rewarder/src/main.rs

@@ -1,8 +1,10 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
 #![warn(clippy::expect_used)]
 #![warn(clippy::unwrap_used)]
+#![warn(clippy::todo)]
+#![warn(clippy::dbg_macro)]
 
 use crate::cli::Cli;
 use clap::{crate_name, crate_version, Parser};

nym-validator-rewarder/src/rewarder/block_signing/mod.rs

@@ -6,18 +6,19 @@ use crate::rewarder::block_signing::types::{EpochSigningResults, RawValidatorRes
 use crate::rewarder::epoch::Epoch;
 use crate::rewarder::nyxd_client::NyxdClient;
 use nym_validator_client::nyxd::module_traits::staking;
-use nym_validator_client::nyxd::PageRequest;
+use nym_validator_client::nyxd::{AccountId, PageRequest};
 use nyxd_scraper::NyxdScraper;
 use std::cmp::min;
 use std::collections::HashMap;
 use std::ops::Range;
-use tracing::info;
+use tracing::{debug, info, warn};
 
 pub(crate) mod types;
 
 pub struct EpochSigning {
     pub(crate) nyxd_client: NyxdClient,
     pub(crate) nyxd_scraper: NyxdScraper,
+    pub(crate) whitelist: Vec<AccountId>,
 }
 
 impl EpochSigning {
@@ -116,14 +117,29 @@ impl EpochSigning {
             else {
                 continue;
             };
-            total_vp += vp;
+
+            let cons_address = &validator.consensus_address;
+            // if this validator is NOT whitelisted, do not increase the total VP
+            let whitelisted = if let Ok(parsed) = cons_address.parse() {
+                if self.whitelist.contains(&parsed) {
+                    debug!("{cons_address} is on the whitelist");
+                    total_vp += vp;
+                    true
+                } else {
+                    warn!("{cons_address} is not a valid consensus address");
+                    false
+                }
+            } else {
+                debug!("{cons_address} is not on the whitelist");
+                false
+            };
 
             let signed = self
                 .nyxd_scraper
                 .storage
                 .get_signed_between_times(&validator.consensus_address, epoch_start, epoch_end)
                 .await?;
-            signed_in_epoch.insert(validator, RawValidatorResult::new(signed, vp));
+            signed_in_epoch.insert(validator, RawValidatorResult::new(signed, vp, whitelisted));
         }
 
         let total = self

nym-validator-rewarder/src/rewarder/block_signing/types.rs

@@ -15,6 +15,7 @@ pub struct ValidatorSigning {
     pub validator: models::Validator,
     pub staking_details: staking::Validator,
     pub operator_account: AccountId,
+    pub whitelisted: bool,
 
     pub voting_power_at_epoch_start: i64,
     pub voting_power_ratio: Decimal,
@@ -33,6 +34,10 @@ impl ValidatorSigning {
     }
 
     pub fn reward_amount(&self, signing_budget: &Coin) -> Coin {
+        if !self.whitelisted {
+            return Coin::new(0, &signing_budget.denom);
+        }
+
         let amount =
             Uint128::new(signing_budget.amount) * self.ratio_signed * self.voting_power_ratio;
 
@@ -51,13 +56,15 @@ pub struct EpochSigningResults {
 pub struct RawValidatorResult {
     pub signed_blocks: i32,
     pub voting_power: i64,
+    pub whitelisted: bool,
 }
 
 impl RawValidatorResult {
-    pub fn new(signed_blocks: i32, voting_power: i64) -> Self {
+    pub fn new(signed_blocks: i32, voting_power: i64, whitelisted: bool) -> Self {
         Self {
             signed_blocks,
             voting_power,
+            whitelisted,
         }
     }
 }
@@ -93,7 +100,11 @@ impl EpochSigningResults {
             let vp: u64 = raw_results.voting_power.try_into().unwrap_or_default();
             let signed: u64 = raw_results.signed_blocks.try_into().unwrap_or_default();
 
-            let voting_power_ratio = Decimal::from_ratio(vp, total_vp_u64);
+            let voting_power_ratio = if raw_results.whitelisted {
+                Decimal::from_ratio(vp, total_vp_u64)
+            } else {
+                Decimal::zero()
+            };
 
             debug_assert!(signed <= blocks_u64);
             let ratio_signed = Decimal::from_ratio(signed, blocks_u64);
@@ -110,6 +121,7 @@ impl EpochSigningResults {
                 validator,
                 staking_details,
                 operator_account,
+                whitelisted: raw_results.whitelisted,
                 voting_power_at_epoch_start: raw_results.voting_power,
                 voting_power_ratio,
                 signed_blocks: raw_results.signed_blocks,
@@ -129,10 +141,11 @@ impl EpochSigningResults {
             .iter()
             .inspect(|v| {
                 info!(
-                    "validator {} will receive {} at address {} for block signing work",
+                    "validator {} will receive {} at address {} for block signing work (whitelisted: {})",
                     v.moniker(),
                     v.reward_amount(budget),
-                    v.operator_account
+                    v.operator_account,
+                    v.whitelisted
                 );
             })
             .map(|v| (v.operator_account.clone(), vec![v.reward_amount(budget)]))

nym-validator-rewarder/src/rewarder/credential_issuance/mod.rs

@@ -8,6 +8,7 @@ use crate::rewarder::credential_issuance::types::{CredentialIssuanceResults, Mon
 use crate::rewarder::epoch::Epoch;
 use crate::rewarder::nyxd_client::NyxdClient;
 use nym_task::TaskClient;
+use nym_validator_client::nyxd::AccountId;
 use tracing::info;
 
 mod monitor;
@@ -21,9 +22,11 @@ impl CredentialIssuance {
     pub(crate) async fn new(
         epoch: Epoch,
         nyxd_client: &NyxdClient,
+        whitelist: &[AccountId],
     ) -> Result<Self, NymRewarderError> {
         Ok(CredentialIssuance {
-            monitoring_results: MonitoringResults::new_initial(epoch, nyxd_client).await?,
+            monitoring_results: MonitoringResults::new_initial(epoch, nyxd_client, whitelist)
+                .await?,
         })
     }
 

nym-validator-rewarder/src/rewarder/credential_issuance/monitor.rs

@@ -235,12 +235,15 @@ impl CredentialIssuanceMonitor {
         let api_client = api_client(&issuer)?;
 
         let epoch_credentials = api_client.epoch_credentials(epoch_id).await?;
+        let whitelisted = self.config.whitelist.contains(&issuer.operator_account);
+
         let Some(first_id) = epoch_credentials.first_epoch_credential_id else {
             // no point in doing anything more - if they haven't issued anything, there's nothing to verify
             debug!("no credentials issued this epoch",);
             return Ok(RawOperatorResult::new_empty(
                 issuer.operator_account,
                 issuer.api_runner,
+                whitelisted,
             ));
         };
         trace!("issued credentials: {epoch_credentials:?}");
@@ -283,6 +286,7 @@ impl CredentialIssuanceMonitor {
         Ok(RawOperatorResult {
             operator_account: issuer.operator_account,
             api_runner: issuer.api_runner,
+            whitelisted,
             issued_credentials: epoch_credentials.total_issued,
             validated_credentials: sampled,
         })

nym-validator-rewarder/src/rewarder/credential_issuance/types.rs

@@ -25,6 +25,7 @@ impl MonitoringResults {
     pub(crate) async fn new_initial(
         initial_epoch: Epoch,
         nyxd_client: &NyxdClient,
+        whitelist: &[AccountId],
     ) -> Result<Self, NymRewarderError> {
         let epoch = nyxd_client.dkg_epoch().await?;
         let issuers = nyxd_client.get_credential_issuers(epoch.epoch_id).await?;
@@ -36,6 +37,7 @@ impl MonitoringResults {
             let mut raw_issuer = RawOperatorIssuing {
                 api_runner: issuer.api_runner.clone(),
                 runner_account: issuer.operator_account.clone(),
+                whitelisted: whitelist.contains(&issuer.operator_account),
                 per_epoch: Default::default(),
             };
 
@@ -132,6 +134,7 @@ impl MonitoringResults {
                 RawOperatorIssuing {
                     api_runner: result.api_runner.clone(),
                     runner_account: result.runner_account.clone(),
+                    whitelisted: result.whitelisted,
                     per_epoch: kept_epoch,
                 },
             );
@@ -157,18 +160,20 @@ pub(crate) struct MonitoringResultsInner {
 
 impl From<MonitoringResultsInner> for CredentialIssuanceResults {
     fn from(value: MonitoringResultsInner) -> Self {
-        let total_issued = value
-            .operators
-            .values()
-            .map(|o| {
-                let operator_issued: u32 = o
+        let mut total_issued = 0;
+
+        for operator in value.operators.values() {
+            // if this validator is NOT whitelisted, do not increase the total issued credentials
+            if operator.whitelisted {
+                let operator_issued: u32 = operator
                     .per_epoch
                     .values()
                     .map(|e| e.issued_since_monitor_started)
                     .sum();
-                operator_issued
-            })
-            .sum();
+
+                total_issued += operator_issued
+            }
+        }
 
         CredentialIssuanceResults {
             total_issued_partial_credentials: total_issued,
@@ -177,7 +182,7 @@ impl From<MonitoringResultsInner> for CredentialIssuanceResults {
                 .operators
                 .into_values()
                 .map(|runner| {
-                    let issued_ratio = if total_issued == 0 {
+                    let issued_ratio = if total_issued == 0 || !runner.whitelisted {
                         Decimal::zero()
                     } else {
                         Decimal::from_ratio(runner.issued_credentials(), total_issued)
@@ -187,6 +192,7 @@ impl From<MonitoringResultsInner> for CredentialIssuanceResults {
                         issued_credentials: runner.issued_credentials(),
                         validated_credentials: runner.validated_credentials(),
                         api_runner: runner.api_runner,
+                        whitelisted: runner.whitelisted,
                         runner_account: runner.runner_account,
                     }
                 })
@@ -212,6 +218,7 @@ impl MonitoringResultsInner {
 pub(crate) struct RawOperatorResult {
     pub(crate) operator_account: AccountId,
     pub(crate) api_runner: String,
+    pub(crate) whitelisted: bool,
 
     // how many credentials the operator claims to have issued in **TOTAL** in this **DKG** epoch
     pub(crate) issued_credentials: u32,
@@ -219,10 +226,15 @@ pub(crate) struct RawOperatorResult {
 }
 
 impl RawOperatorResult {
-    pub(crate) fn new_empty(operator_account: AccountId, api_runner: String) -> RawOperatorResult {
+    pub(crate) fn new_empty(
+        operator_account: AccountId,
+        api_runner: String,
+        whitelisted: bool,
+    ) -> RawOperatorResult {
         RawOperatorResult {
             operator_account,
             api_runner,
+            whitelisted,
             issued_credentials: 0,
             validated_credentials: Default::default(),
         }
@@ -232,6 +244,7 @@ impl RawOperatorResult {
 pub struct RawOperatorIssuing {
     pub api_runner: String,
     pub runner_account: AccountId,
+    pub whitelisted: bool,
 
     pub per_epoch: HashMap<u32, IssuedEpochCredentials>,
 }
@@ -243,6 +256,7 @@ impl RawOperatorIssuing {
         RawOperatorIssuing {
             api_runner: raw_result.api_runner,
             runner_account: raw_result.operator_account,
+            whitelisted: raw_result.whitelisted,
             per_epoch,
         }
     }
@@ -278,6 +292,7 @@ impl IssuedEpochCredentials {
 
 pub struct OperatorIssuing {
     pub api_runner: String,
+    pub whitelisted: bool,
     pub runner_account: AccountId,
 
     pub issued_ratio: Decimal,
@@ -286,10 +301,14 @@ pub struct OperatorIssuing {
 }
 
 impl OperatorIssuing {
-    pub fn reward_amount(&self, signing_budget: &Coin) -> Coin {
-        let amount = Uint128::new(signing_budget.amount) * self.issued_ratio;
+    pub fn reward_amount(&self, issuance_budget: &Coin) -> Coin {
+        if !self.whitelisted {
+            return Coin::new(0, &issuance_budget.denom);
+        }
 
-        Coin::new(amount.u128(), &signing_budget.denom)
+        let amount = Uint128::new(issuance_budget.amount) * self.issued_ratio;
+
+        Coin::new(amount.u128(), &issuance_budget.denom)
     }
 }
 
@@ -305,10 +324,11 @@ impl CredentialIssuanceResults {
             .iter()
             .inspect(|a| {
                 info!(
-                    "operator {} will receive {} at address {} for credential issuance work",
+                    "operator {} will receive {} at address {} for credential issuance work (whitelisted: {})",
                     a.api_runner,
                     a.reward_amount(budget),
                     a.runner_account,
+                    a.whitelisted
                 );
             })
             .map(|v| (v.runner_account.clone(), vec![v.reward_amount(budget)]))

nym-validator-rewarder/src/rewarder/mod.rs

@@ -41,17 +41,19 @@ impl EpochRewards {
         let mut amounts = Vec::new();
 
         if let Some(signing) = &self.signing {
-            for signing_amount in signing.rewarding_amounts(&self.signing_budget) {
-                if signing_amount.1[0].amount != 0 {
-                    amounts.push(signing_amount)
+            for (account, signing_amount) in signing.rewarding_amounts(&self.signing_budget) {
+                if signing_amount[0].amount != 0 {
+                    amounts.push((account, signing_amount))
                 }
             }
         }
 
         if let Some(credentials) = &self.credentials {
-            for credential_amount in credentials.rewarding_amounts(&self.credentials_budget) {
-                if credential_amount.1[0].amount != 0 {
-                    amounts.push(credential_amount)
+            for (account, credential_amount) in
+                credentials.rewarding_amounts(&self.credentials_budget)
+            {
+                if credential_amount[0].amount != 0 {
+                    amounts.push((account, credential_amount))
                 }
             }
         }
@@ -86,18 +88,29 @@ impl Rewarder {
         };
 
         let epoch_signing = if config.block_signing.enabled {
+            let whitelist = config.block_signing.whitelist.clone();
+            if whitelist.is_empty() {
+                return Err(NymRewarderError::EmptyBlockSigningWhitelist);
+            }
+
             let nyxd_scraper = NyxdScraper::new(config.scraper_config()).await?;
 
             Some(EpochSigning {
                 nyxd_scraper,
                 nyxd_client: nyxd_client.clone(),
+                whitelist,
             })
         } else {
             None
         };
 
         let credential_issuance = if config.issuance_monitor.enabled {
-            Some(CredentialIssuance::new(current_epoch, &nyxd_client).await?)
+            let whitelist = &config.issuance_monitor.whitelist;
+            if whitelist.is_empty() {
+                return Err(NymRewarderError::EmptyCredentialIssuanceWhitelist);
+            }
+
+            Some(CredentialIssuance::new(current_epoch, &nyxd_client, whitelist).await?)
         } else {
             None
         };
@@ -239,7 +252,7 @@ impl Rewarder {
 
         if let Some(ref credential_issuance) = self.credential_issuance {
             credential_issuance.start_monitor(
-                self.config.issuance_monitor,
+                self.config.issuance_monitor.clone(),
                 self.nyxd_client.clone(),
                 task_manager.subscribe(),
             );

nym-validator-rewarder/src/rewarder/storage/manager.rs

@@ -74,6 +74,7 @@ impl StorageManager {
         epoch: i64,
         consensus_address: String,
         operator_account: String,
+        whitelisted: bool,
         amount: String,
         voting_power: i64,
         voting_power_share: String,
@@ -86,16 +87,18 @@ impl StorageManager {
                     rewarding_epoch_id,
                     validator_consensus_address,
                     operator_account,
+                    whitelisted,
                     amount,
                     voting_power,
                     voting_power_share,
                     signed_blocks,
                     signed_blocks_percent
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
             "#,
             epoch,
             consensus_address,
             operator_account,
+            whitelisted,
             amount,
             voting_power,
             voting_power_share,
@@ -144,6 +147,7 @@ impl StorageManager {
         &self,
         epoch: i64,
         operator_account: String,
+        whitelisted: bool,
         amount: String,
         api_endpoint: String,
         issued_partial_credentials: u32,
@@ -155,15 +159,17 @@ impl StorageManager {
                 INSERT INTO credential_issuance_reward (
                     rewarding_epoch_id,
                     operator_account,
+                    whitelisted,
                     amount,
                     api_endpoint,
                     issued_partial_credentials,
                     issued_credentials_share,
                     validated_issued_credentials
-                ) VALUES (?, ?, ?, ?, ?, ?, ?)
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
             "#,
             epoch,
             operator_account,
+            whitelisted,
             amount,
             api_endpoint,
             issued_partial_credentials,

nym-validator-rewarder/src/rewarder/storage/mod.rs

@@ -104,6 +104,7 @@ impl RewarderStorage {
                         epoch_id,
                         validator.validator.consensus_address,
                         validator.operator_account.to_string(),
+                        validator.whitelisted,
                         reward_amount,
                         validator.voting_power_at_epoch_start,
                         validator.voting_power_ratio.to_string(),
@@ -152,6 +153,7 @@ impl RewarderStorage {
                     .insert_rewarding_epoch_credential_issuance_reward(
                         epoch_id,
                         api_runner.runner_account.to_string(),
+                        api_runner.whitelisted,
                         reward_amount,
                         api_runner.api_runner,
                         api_runner.issued_credentials,

nym-vpn/android/.gitignore

@@ -1,71 +0,0 @@
-# Built application files
-*.apk
-*.aar
-*.ap_
-*.aab
-# Files for the ART/Dalvik VM
-*.dex
-# Java class files
-*.class
-# Generated files
-bin/
-gen/
-out/
-release/
-build/
-# Gradle files
-.gradle/
-# Local configuration file (sdk path, etc)
-local.properties
-# Proguard folder generated by Eclipse
-proguard/
-# Log Files
-*.log
-# Android Studio Navigation editor temp files
-.navigation/
-# Android Studio captures folder
-captures/
-# IntelliJ
-*.iml
-.idea/
-# .idea/workspace.xml
-# .idea/tasks.xml
-# .idea/gradle.xml
-# .idea/assetWizardSettings.xml
-# .idea/dictionaries
-.idea/libraries
-# Android Studio 3 in .gitignore file.
-.idea/caches
-.idea/modules.xml
-# Comment next line if keeping position of elements in Navigation Editor is relevant for you
-.idea/navEditor.xml
-# Keystore files
-# Uncomment the following lines if you do not want to check your keystore files in.
-*.jks
-*.keystore
-# External native build folder generated in Android Studio 2.2 and later
-.externalNativeBuild
-.cxx/
-# Freeline
-freeline.py
-freeline/
-freeline_project_description.json
-# fastlane
-fastlane/report.xml
-fastlane/Preview.html
-fastlane/screenshots
-fastlane/test_output
-fastlane/readme.md
-# Version control
-vcs.xml
-# lint
-lint/intermediates/
-lint/generated/
-lint/outputs/
-lint/tmp/
-# lint/reports/
-# MacOS
-.DS_Store
-# App Specific cases
-app/release/output.json
-.idea/codeStyles/

nym-vpn/android/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2023 NymConnect
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

nym-vpn/android/README.md

@@ -1,42 +0,0 @@
-## NymConnect for Android
-
-### Prerequisites
-
-_TODO_
-
-### Getting started
-
-[Install](https://developer.android.com/studio/install) Android Studio and open
-the project.\
-Setup an android emulator using AVD.\
-[Run](https://developer.android.com/studio/run/emulator) the project.
-
-**⚠ NOTE**: be sure
-to [set](https://developer.android.com/studio/run#changing-variant)
-the build variant to `x86_64Debug` when running on emulator
-
-### Features
-
-* Add tunnels via .conf file
-* Auto connect to VPN based on Wi-Fi SSID
-* Split tunneling by application with search
-* Always-on VPN for Android support
-* Quick tile support for vpn toggling
-* Dynamic shortcuts support for automation integration
-* Configurable Trusted Network list 
-* Optional auto connect on mobile data
-* Automatic service restart after reboot
-* Service will stay running in background after app has been closed
-
-### Building
-
-_TODO_
-
-### Credits
-
-This project is based on the "WG Tunnel" project made by Zane Schepke
-https://github.com/zaneschepke/wgtunnel
-
-### License
-
-MIT

nym-vpn/android/app/.gitignore

@@ -1,2 +0,0 @@
-/build
-/release

nym-vpn/android/app/build.gradle.kts

@@ -1,159 +0,0 @@
-val rExtra = rootProject.extra
-
-plugins {
-    id("com.android.application")
-    id("org.jetbrains.kotlin.android")
-    kotlin("kapt")
-    id("com.google.dagger.hilt.android")
-    id("org.jetbrains.kotlin.plugin.serialization")
-    id("io.objectbox")
-}
-
-android {
-    namespace = "net.nymtech.nymconnect"
-    compileSdk = 34
-
-    val versionMajor = 1
-    val versionMinor = 0
-    val versionPatch = 0
-    val versionBuild = 0
-
-    defaultConfig {
-        applicationId = "net.nymtech.nymconnect"
-        minSdk = 28
-        targetSdk = 34
-        versionCode = versionMajor * 10000 + versionMinor * 1000 + versionPatch * 100 + versionBuild
-        versionName = "${versionMajor}.${versionMinor}.${versionPatch}"
-
-        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
-        vectorDrawables {
-            useSupportLibrary = true
-        }
-    }
-
-    buildTypes {
-        release {
-            isDebuggable = false
-            isMinifyEnabled = false
-            proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro"
-            )
-        }
-    }
-    compileOptions {
-        sourceCompatibility = JavaVersion.VERSION_17
-        targetCompatibility = JavaVersion.VERSION_17
-    }
-    kotlinOptions {
-        jvmTarget = "17"
-    }
-    buildFeatures {
-        compose = true
-    }
-    composeOptions {
-        kotlinCompilerExtensionVersion = "1.4.8"
-    }
-    packaging {
-        resources {
-            excludes += "/META-INF/{AL2.0,LGPL2.1}"
-        }
-    }
-
-    /* flavorDimensions += "abi"
-    productFlavors {
-        create("universal") {
-            dimension = "abi"
-            ndk {
-                abiFilters += listOf("arm64-v8a", "armeabi-v7a", "x86_64", "x86")
-            }
-        }
-        create("arch64") {
-            dimension = "abi"
-            ndk {
-                abiFilters += listOf("arm64-v8a", "x86_64")
-            }
-        }
-        create("arm64") {
-            dimension = "abi"
-            ndk {
-                abiFilters += "arm64-v8a"
-            }
-        }
-        create("arm") {
-            dimension = "abi"
-            ndk {
-                abiFilters += "armeabi-v7a"
-            }
-        }
-        create("x86_64") {
-            dimension = "abi"
-            ndk {
-                abiFilters += "x86_64"
-            }
-        }
-        create("x86") {
-            dimension = "abi"
-            ndk {
-                abiFilters += "x86"
-            }
-        }
-    } */
-}
-
-dependencies {
-    implementation("androidx.core:core-ktx:1.10.1")
-    implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.6.1")
-    implementation("androidx.activity:activity-compose:1.7.2")
-    implementation(platform("androidx.compose:compose-bom:2023.03.00"))
-    implementation("androidx.compose.ui:ui")
-    implementation("androidx.compose.ui:ui-graphics")
-    implementation("androidx.compose.ui:ui-tooling-preview")
-    implementation("androidx.compose.material3:material3:1.1.1")
-    implementation("androidx.appcompat:appcompat:1.6.1")
-
-    testImplementation("junit:junit:4.13.2")
-    androidTestImplementation("androidx.test.ext:junit:1.1.5")
-    androidTestImplementation("androidx.test.espresso:espresso-core:3.5.1")
-    androidTestImplementation(platform("androidx.compose:compose-bom:2023.03.00"))
-    androidTestImplementation("androidx.compose.ui:ui-test-junit4")
-    debugImplementation("androidx.compose.ui:ui-tooling")
-    debugImplementation("androidx.compose.ui:ui-test-manifest")
-
-    //wireguard tunnel
-    implementation("com.wireguard.android:tunnel:1.0.20230706")
-
-    //logging
-    implementation("com.jakewharton.timber:timber:5.0.1")
-
-    // compose navigation
-    implementation("androidx.navigation:navigation-compose:2.7.1")
-    implementation("androidx.hilt:hilt-navigation-compose:1.0.0")
-
-    // hilt
-    implementation("com.google.dagger:hilt-android:${rExtra.get("hiltVersion")}")
-    kapt("com.google.dagger:hilt-android-compiler:${rExtra.get("hiltVersion")}")
-
-    //accompanist
-    implementation("com.google.accompanist:accompanist-systemuicontroller:${rExtra.get("accompanistVersion")}")
-    implementation("com.google.accompanist:accompanist-permissions:${rExtra.get("accompanistVersion")}")
-    implementation("com.google.accompanist:accompanist-flowlayout:${rExtra.get("accompanistVersion")}")
-    implementation("com.google.accompanist:accompanist-navigation-animation:${rExtra.get("accompanistVersion")}")
-    implementation("com.google.accompanist:accompanist-drawablepainter:${rExtra.get("accompanistVersion")}")
-
-    //db
-    implementation("io.objectbox:objectbox-kotlin:${rExtra.get("objectBoxVersion")}")
-
-    //lifecycle
-    implementation("androidx.lifecycle:lifecycle-runtime-compose:2.6.1")
-
-    //icons
-    implementation("androidx.compose.material:material-icons-extended:1.5.0")
-
-
-    implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.5.1")
-}
-
-kapt {
-    correctErrorTypes = true
-}

nym-vpn/android/app/objectbox-models/default.json

@@ -1,99 +0,0 @@
-{
-  "_note1": "KEEP THIS FILE! Check it into a version control system (VCS) like git.",
-  "_note2": "ObjectBox manages crucial IDs for your object model. See docs for details.",
-  "_note3": "If you have VCS merge conflicts, you must resolve them according to ObjectBox docs.",
-  "entities": [
-    {
-      "id": "1:2692736974585027589",
-      "lastPropertyId": "15:5057486545428188436",
-      "name": "TunnelConfig",
-      "properties": [
-        {
-          "id": "1:1985347930017457084",
-          "name": "id",
-          "type": 6,
-          "flags": 1
-        },
-        {
-          "id": "12:2409068226744965585",
-          "name": "name",
-          "indexId": "1:4811206443952699137",
-          "type": 9,
-          "flags": 34848
-        },
-        {
-          "id": "13:8987443291286312275",
-          "name": "wgQuick",
-          "type": 9
-        }
-      ],
-      "relations": []
-    },
-    {
-      "id": "2:8887605597748372702",
-      "lastPropertyId": "9:4468844863383145378",
-      "name": "Settings",
-      "properties": [
-        {
-          "id": "1:7485739868216068651",
-          "name": "id",
-          "type": 6,
-          "flags": 1
-        },
-        {
-          "id": "2:5814013113141456749",
-          "name": "isAutoTunnelEnabled",
-          "type": 1
-        },
-        {
-          "id": "4:5645665441196906014",
-          "name": "trustedNetworkSSIDs",
-          "type": 30
-        },
-        {
-          "id": "5:4989886999117763881",
-          "name": "isTunnelOnMobileDataEnabled",
-          "type": 1
-        },
-        {
-          "id": "6:3370284381040192129",
-          "name": "defaultTunnel",
-          "type": 9
-        },
-        {
-          "id": "9:4468844863383145378",
-          "name": "isAlwaysOnVpnEnabled",
-          "type": 1
-        }
-      ],
-      "relations": []
-    }
-  ],
-  "lastEntityId": "2:8887605597748372702",
-  "lastIndexId": "1:4811206443952699137",
-  "lastRelationId": "0:0",
-  "lastSequenceId": "0:0",
-  "modelVersion": 5,
-  "modelVersionParserMinimum": 5,
-  "retiredEntityUids": [],
-  "retiredIndexUids": [],
-  "retiredPropertyUids": [
-    1763475292291320186,
-    6483820955437198310,
-    8323071516033820771,
-    5904440563612311217,
-    1408037976996390989,
-    7737847485212546994,
-    8215616901775229364,
-    8021610768066328637,
-    6174306582797008721,
-    2175939938544485767,
-    7555225587864607050,
-    969146862000617878,
-    5057486545428188436,
-    2814640993034665120,
-    4981008812459251156
-  ],
-  "retiredRelationUids": [],
-  "version": 1
-}

nym-vpn/android/app/objectbox-models/default.json.bak

@@ -1,94 +0,0 @@
-{
-  "_note1": "KEEP THIS FILE! Check it into a version control system (VCS) like git.",
-  "_note2": "ObjectBox manages crucial IDs for your object model. See docs for details.",
-  "_note3": "If you have VCS merge conflicts, you must resolve them according to ObjectBox docs.",
-  "entities": [
-    {
-      "id": "1:2692736974585027589",
-      "lastPropertyId": "15:5057486545428188436",
-      "name": "TunnelConfig",
-      "properties": [
-        {
-          "id": "1:1985347930017457084",
-          "name": "id",
-          "type": 6,
-          "flags": 1
-        },
-        {
-          "id": "12:2409068226744965585",
-          "name": "name",
-          "indexId": "1:4811206443952699137",
-          "type": 9,
-          "flags": 34848
-        },
-        {
-          "id": "13:8987443291286312275",
-          "name": "wgQuick",
-          "type": 9
-        }
-      ],
-      "relations": []
-    },
-    {
-      "id": "2:8887605597748372702",
-      "lastPropertyId": "8:4981008812459251156",
-      "name": "Settings",
-      "properties": [
-        {
-          "id": "1:7485739868216068651",
-          "name": "id",
-          "type": 6,
-          "flags": 1
-        },
-        {
-          "id": "2:5814013113141456749",
-          "name": "isAutoTunnelEnabled",
-          "type": 1
-        },
-        {
-          "id": "4:5645665441196906014",
-          "name": "trustedNetworkSSIDs",
-          "type": 30
-        },
-        {
-          "id": "5:4989886999117763881",
-          "name": "isTunnelOnMobileDataEnabled",
-          "type": 1
-        },
-        {
-          "id": "6:3370284381040192129",
-          "name": "defaultTunnel",
-          "type": 9
-        }
-      ],
-      "relations": []
-    }
-  ],
-  "lastEntityId": "2:8887605597748372702",
-  "lastIndexId": "1:4811206443952699137",
-  "lastRelationId": "0:0",
-  "lastSequenceId": "0:0",
-  "modelVersion": 5,
-  "modelVersionParserMinimum": 5,
-  "retiredEntityUids": [],
-  "retiredIndexUids": [],
-  "retiredPropertyUids": [
-    1763475292291320186,
-    6483820955437198310,
-    8323071516033820771,
-    5904440563612311217,
-    1408037976996390989,
-    7737847485212546994,
-    8215616901775229364,
-    8021610768066328637,
-    6174306582797008721,
-    2175939938544485767,
-    7555225587864607050,
-    969146862000617878,
-    5057486545428188436,
-    2814640993034665120,
-    4981008812459251156
-  ],
-  "retiredRelationUids": [],
-  "version": 1
-}

nym-vpn/android/app/proguard-rules.pro

@@ -1,21 +0,0 @@
-# Add project specific ProGuard rules here.
-# You can control the set of applied configuration files using the
-# proguardFiles setting in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
-
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile

nym-vpn/android/app/src/androidTest/java/com/zaneschepke/wireguardautotunnel/ExampleInstrumentedTest.kt

@@ -1,24 +0,0 @@
-package net.nymtech.nymconnect
-
-import androidx.test.platform.app.InstrumentationRegistry
-import androidx.test.ext.junit.runners.AndroidJUnit4
-
-import org.junit.Test
-import org.junit.runner.RunWith
-
-import org.junit.Assert.*
-
-/**
- * Instrumented test, which will execute on an Android device.
- *
- * See [testing documentation](http://d.android.com/tools/testing).
- */
-@RunWith(AndroidJUnit4::class)
-class ExampleInstrumentedTest {
-    @Test
-    fun useAppContext() {
-        // Context of the app under test.
-        val appContext = InstrumentationRegistry.getInstrumentation().targetContext
-        assertEquals("net.nymtech.nymconnect", appContext.packageName)
-    }
-}

nym-vpn/android/app/src/main/AndroidManifest.xml

@@ -1,115 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-    <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"
-        android:maxSdkVersion="32" />
-    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"
-        android:maxSdkVersion="30"
-        tools:ignore="LeanbackUsesWifi" />
-    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
-    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
-    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
-    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/>
-    <uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_LOCATION"/>
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_REMOTE_MESSAGING"/>
-    <!--foreground service permissions-->
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <uses-permission android:name="android.permission.WAKE_LOCK" />
-    <!--start service on boot permission-->
-    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
-    <!--android tv support-->
-    <uses-feature android:name="android.software.leanback"
-        android:required="false" />
-    <uses-feature android:name="android.hardware.touchscreen"
-        android:required="false" />
-    <uses-feature
-        android:name="android.hardware.location.gps"
-        android:required="false" />
-    <uses-feature
-    android:name="android.hardware.screen.portrait"
-    android:required="false" />
-    <queries>
-        <intent>
-            <action android:name="android.intent.action.MAIN" />
-        </intent>
-    </queries>
-    <application
-        android:allowBackup="true"
-        android:name=".WireGuardAutoTunnel"
-        android:dataExtractionRules="@xml/data_extraction_rules"
-        android:fullBackupContent="@xml/backup_rules"
-        android:icon="@mipmap/ic_launcher"
-        android:banner="@mipmap/ic_launcher"
-        android:label="@string/app_name"
-        android:roundIcon="@mipmap/ic_launcher_round"
-        android:supportsRtl="true"
-        android:theme="@style/Theme.WireguardAutoTunnel"
-        tools:targetApi="31">
-        <activity
-            android:name=".ui.MainActivity"
-            android:exported="true"
-            android:theme="@style/Theme.WireguardAutoTunnel">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
-            </intent-filter>
-        </activity>
-        <activity
-            android:finishOnTaskLaunch="true"
-            android:theme="@android:style/Theme.NoDisplay"
-            android:name=".service.shortcut.ShortcutsActivity"/>
-        <service
-            android:name=".service.foreground.ForegroundService"
-            android:enabled="true"
-            android:foregroundServiceType="remoteMessaging"
-            android:exported="false">
-        </service>
-        <service
-            android:exported="true"
-            android:name=".service.tile.TunnelControlTile"
-            android:icon="@drawable/shield"
-            android:label="NymConnect"
-            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE">
-            <meta-data android:name="android.service.quicksettings.ACTIVE_TILE"
-                android:value="true" />
-            <meta-data android:name="android.service.quicksettings.TOGGLEABLE_TILE"
-                android:value="true" />
-            <intent-filter>
-                <action android:name="android.service.quicksettings.action.QS_TILE" />
-            </intent-filter>
-        </service>
-        <service
-            android:name=".service.foreground.WireGuardTunnelService"
-            android:permission="android.permission.BIND_VPN_SERVICE"
-            android:enabled="true"
-            android:persistent="true"
-            android:foregroundServiceType="remoteMessaging"
-            android:exported="false">
-            <intent-filter>
-                <action android:name="android.net.VpnService"/>
-            </intent-filter>
-            <meta-data android:name="android.net.VpnService.SUPPORTS_ALWAYS_ON"
-                android:value="true"/>
-        </service>
-        <service
-            android:name=".service.foreground.WireGuardConnectivityWatcherService"
-            android:enabled="true"
-            android:stopWithTask="false"
-            android:persistent="true"
-            android:foregroundServiceType="location"
-            android:permission=""
-            android:exported="false">
-        </service>
-        <receiver android:enabled="true" android:name=".receiver.BootReceiver"
-            android:exported="true">
-            <intent-filter>
-                <action android:name="android.intent.action.BOOT_COMPLETED"/>
-            </intent-filter>
-        </receiver>
-        <receiver android:exported="false" android:name=".receiver.NotificationActionReceiver"/>
-    </application>
-</manifest>

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/Constants.kt

@@ -1,6 +0,0 @@
-package net.nymtech.nymconnect
-
-object Constants {
-    const val VPN_CONNECTIVITY_CHECK_INTERVAL = 3000L;
-    const val VPN_STATISTIC_CHECK_INTERVAL = 10000L;
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/WireGuardAutoTunnel.kt

@@ -1,27 +0,0 @@
-package net.nymtech.nymconnect
-
-import android.app.Application
-import android.content.Context
-import android.content.pm.PackageManager
-import net.nymtech.nymconnect.repository.Repository
-import net.nymtech.nymconnect.service.tunnel.model.Settings
-import dagger.hilt.android.HiltAndroidApp
-import javax.inject.Inject
-
-@HiltAndroidApp
-class WireGuardAutoTunnel : Application() {
-
-    @Inject
-    lateinit var settingsRepo : Repository<Settings>
-
-    override fun onCreate() {
-        super.onCreate()
-        settingsRepo.init()
-    }
-
-    companion object {
-        fun isRunningOnAndroidTv(context : Context) : Boolean {
-            return context.packageManager.hasSystemFeature(PackageManager.FEATURE_LEANBACK)
-        }
-    }
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/module/BoxModule.kt

@@ -1,40 +0,0 @@
-package net.nymtech.nymconnect.module
-
-import android.content.Context
-import net.nymtech.nymconnect.service.tunnel.model.MyObjectBox
-import net.nymtech.nymconnect.service.tunnel.model.Settings
-import net.nymtech.nymconnect.service.tunnel.model.TunnelConfig
-import dagger.Module
-import dagger.Provides
-import dagger.hilt.InstallIn
-import dagger.hilt.android.qualifiers.ApplicationContext
-import dagger.hilt.components.SingletonComponent
-import io.objectbox.Box
-import io.objectbox.BoxStore
-import javax.inject.Singleton
-
-@Module
-@InstallIn(SingletonComponent::class)
-class BoxModule {
-
-    @Provides
-    @Singleton
-    fun provideBoxStore(@ApplicationContext context : Context) : BoxStore {
-        return MyObjectBox.builder()
-            .androidContext(context.applicationContext)
-            .build()
-    }
-
-    @Provides
-    @Singleton
-    fun provideBoxForSettings(store : BoxStore) : Box<Settings> {
-        return store.boxFor(Settings::class.java)
-    }
-
-    @Provides
-    @Singleton
-    fun provideBoxForTunnels(store : BoxStore) : Box<TunnelConfig> {
-        return store.boxFor(TunnelConfig::class.java)
-    }
-
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/module/RepositoryModule.kt

@@ -1,25 +0,0 @@
-package net.nymtech.nymconnect.module
-
-import net.nymtech.nymconnect.repository.Repository
-import net.nymtech.nymconnect.repository.SettingsBox
-import net.nymtech.nymconnect.repository.TunnelBox
-import net.nymtech.nymconnect.service.tunnel.model.Settings
-import net.nymtech.nymconnect.service.tunnel.model.TunnelConfig
-import dagger.Binds
-import dagger.Module
-import dagger.hilt.InstallIn
-import dagger.hilt.components.SingletonComponent
-import javax.inject.Singleton
-
-@Module
-@InstallIn(SingletonComponent::class)
-abstract class RepositoryModule {
-
-    @Binds
-    @Singleton
-    abstract fun provideSettingsRepository(settingsBox: SettingsBox) : Repository<Settings>
-
-    @Binds
-    @Singleton
-    abstract fun provideTunnelRepository(tunnelBox: TunnelBox) : Repository<TunnelConfig>
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/module/ServiceModule.kt

@@ -1,29 +0,0 @@
-package net.nymtech.nymconnect.module
-
-import net.nymtech.nymconnect.service.network.MobileDataService
-import net.nymtech.nymconnect.service.network.NetworkService
-import net.nymtech.nymconnect.service.network.WifiService
-import net.nymtech.nymconnect.service.notification.NotificationService
-import net.nymtech.nymconnect.service.notification.WireGuardNotification
-import dagger.Binds
-import dagger.Module
-import dagger.hilt.InstallIn
-import dagger.hilt.android.components.ServiceComponent
-import dagger.hilt.android.scopes.ServiceScoped
-
-@Module
-@InstallIn(ServiceComponent::class)
-abstract class ServiceModule {
-
-    @Binds
-    @ServiceScoped
-    abstract fun provideNotificationService(wireGuardNotification: WireGuardNotification) : NotificationService
-
-    @Binds
-    @ServiceScoped
-    abstract fun provideWifiService(wifiService: WifiService) : NetworkService<WifiService>
-
-    @Binds
-    @ServiceScoped
-    abstract fun provideMobileDataService(mobileDataService : MobileDataService) : NetworkService<MobileDataService>
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/module/TunnelModule.kt

@@ -1,31 +0,0 @@
-package net.nymtech.nymconnect.module
-
-import android.content.Context
-import com.wireguard.android.backend.Backend
-import com.wireguard.android.backend.GoBackend
-import net.nymtech.nymconnect.service.tunnel.VpnService
-import net.nymtech.nymconnect.service.tunnel.WireGuardTunnel
-import dagger.Module
-import dagger.Provides
-import dagger.hilt.InstallIn
-import dagger.hilt.android.qualifiers.ApplicationContext
-import dagger.hilt.components.SingletonComponent
-import javax.inject.Singleton
-
-@Module
-@InstallIn(SingletonComponent::class)
-class TunnelModule {
-
-    @Provides
-    @Singleton
-    fun provideBackend(@ApplicationContext context : Context) : Backend {
-        return GoBackend(context)
-    }
-
-    @Provides
-    @Singleton
-    fun provideVpnService(backend: Backend) : VpnService {
-        return WireGuardTunnel(backend)
-    }
-
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/receiver/BootReceiver.kt

@@ -1,39 +0,0 @@
-package net.nymtech.nymconnect.receiver
-
-import android.content.BroadcastReceiver
-import android.content.Context
-import android.content.Intent
-import net.nymtech.nymconnect.repository.Repository
-import net.nymtech.nymconnect.service.foreground.ServiceManager
-import net.nymtech.nymconnect.service.tunnel.model.Settings
-import dagger.hilt.android.AndroidEntryPoint
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-@AndroidEntryPoint
-class BootReceiver : BroadcastReceiver() {
-
-    @Inject
-    lateinit var settingsRepo : Repository<Settings>
-
-    override fun onReceive(context: Context, intent: Intent) {
-        if (intent.action == Intent.ACTION_BOOT_COMPLETED) {
-            CoroutineScope(Dispatchers.IO).launch {
-                try {
-                    val settings = settingsRepo.getAll()
-                    if (!settings.isNullOrEmpty()) {
-                        val setting = settings.first()
-                        if (setting.isAutoTunnelEnabled && setting.defaultTunnel != null) {
-                            ServiceManager.startWatcherService(context, setting.defaultTunnel!!)
-                        }
-                    }
-                } finally {
-                    cancel()
-                }
-            }
-        }
-    }
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/receiver/NotificationActionReceiver.kt

@@ -1,39 +0,0 @@
-package net.nymtech.nymconnect.receiver
-
-import android.content.BroadcastReceiver
-import android.content.Context
-import android.content.Intent
-import net.nymtech.nymconnect.repository.Repository
-import net.nymtech.nymconnect.service.foreground.ServiceManager
-import net.nymtech.nymconnect.service.tunnel.model.Settings
-import dagger.hilt.android.AndroidEntryPoint
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-@AndroidEntryPoint
-class NotificationActionReceiver : BroadcastReceiver() {
-
-    @Inject
-    lateinit var settingsRepo : Repository<Settings>
-    override fun onReceive(context: Context, intent: Intent?) {
-        CoroutineScope(Dispatchers.IO).launch {
-            try {
-                val settings = settingsRepo.getAll()
-                if (!settings.isNullOrEmpty()) {
-                    val setting = settings.first()
-                    if (setting.defaultTunnel != null) {
-                        ServiceManager.stopVpnService(context)
-                        delay(1000)
-                        ServiceManager.startVpnService(context, setting.defaultTunnel.toString())
-                    }
-                }
-            } finally {
-                cancel()
-            }
-        }
-    }
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/repository/Repository.kt

@@ -1,16 +0,0 @@
-package net.nymtech.nymconnect.repository
-
-import kotlinx.coroutines.flow.Flow
-
-interface Repository<T> {
-    suspend fun save(t : T)
-    suspend fun saveAll(t : List<T>)
-    suspend fun getById(id : Long) : T?
-    suspend fun getAll() : List<T>?
-    suspend fun delete(t : T) : Boolean?
-    suspend fun count() : Long?
-
-    val itemFlow : Flow<MutableList<T>>
-
-    fun init()
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/repository/SettingsBox.kt

@@ -1,63 +0,0 @@
-package net.nymtech.nymconnect.repository
-
-import net.nymtech.nymconnect.service.tunnel.model.Settings
-import io.objectbox.Box
-import io.objectbox.BoxStore
-import io.objectbox.kotlin.awaitCallInTx
-import io.objectbox.kotlin.toFlow
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.ExperimentalCoroutinesApi
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-
-class SettingsBox @Inject constructor(private val box : Box<Settings>, private val boxStore : BoxStore) : Repository<Settings> {
-
-    @OptIn(ExperimentalCoroutinesApi::class)
-    override val itemFlow = box.query().build().subscribe().toFlow()
-
-    override fun init() {
-        CoroutineScope(Dispatchers.IO).launch {
-            if(getAll().isNullOrEmpty()) {
-                save(Settings())
-            }
-        }
-    }
-
-    override suspend fun save(t : Settings) {
-        boxStore.awaitCallInTx {
-            box.put(t)
-        }
-    }
-
-    override suspend fun saveAll(t : List<Settings>) {
-        boxStore.awaitCallInTx {
-            box.put(t)
-        }
-    }
-
-    override suspend fun getById(id: Long): Settings? {
-        return boxStore.awaitCallInTx {
-            box[id]
-        }
-    }
-
-    override suspend fun getAll(): List<Settings>? {
-        return boxStore.awaitCallInTx {
-            box.all
-        }
-    }
-
-    override suspend fun delete(t : Settings): Boolean? {
-        return boxStore.awaitCallInTx {
-            box.remove(t)
-        }
-    }
-
-    override suspend fun count() : Long? {
-        return boxStore.awaitCallInTx {
-            box.count()
-        }
-    }
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/repository/TunnelBox.kt

@@ -1,57 +0,0 @@
-package net.nymtech.nymconnect.repository
-
-import net.nymtech.nymconnect.service.tunnel.model.TunnelConfig
-import io.objectbox.Box
-import io.objectbox.BoxStore
-import io.objectbox.kotlin.awaitCallInTx
-import io.objectbox.kotlin.toFlow
-import kotlinx.coroutines.ExperimentalCoroutinesApi
-import timber.log.Timber
-import javax.inject.Inject
-
-class TunnelBox @Inject constructor(private val box : Box<TunnelConfig>,private val boxStore : BoxStore) : Repository<TunnelConfig> {
-
-    @OptIn(ExperimentalCoroutinesApi::class)
-    override val itemFlow = box.query().build().subscribe().toFlow()
-    override fun init() {
-
-    }
-
-    override suspend fun save(t : TunnelConfig) {
-        Timber.d("Saving tunnel config")
-        boxStore.awaitCallInTx {
-            box.put(t)
-        }
-
-    }
-
-    override suspend fun saveAll(t : List<TunnelConfig>) {
-        boxStore.awaitCallInTx {
-            box.put(t)
-        }
-    }
-
-    override suspend fun getById(id: Long): TunnelConfig? {
-       return boxStore.awaitCallInTx {
-            box[id]
-        }
-    }
-
-    override suspend fun getAll(): List<TunnelConfig>? {
-        return boxStore.awaitCallInTx {
-            box.all
-        }
-    }
-
-    override suspend fun delete(t : TunnelConfig): Boolean? {
-        return boxStore.awaitCallInTx {
-            box.remove(t)
-        }
-    }
-
-    override suspend fun count() : Long? {
-        return boxStore.awaitCallInTx {
-            box.count()
-        }
-    }
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/Action.kt

@@ -1,6 +0,0 @@
-package net.nymtech.nymconnect.service.foreground
-
-enum class Action {
-    START,
-    STOP
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/ForegroundService.kt

@@ -1,64 +0,0 @@
-package net.nymtech.nymconnect.service.foreground
-
-import android.app.Service
-import android.content.Intent
-import android.os.Bundle
-import android.os.IBinder
-import timber.log.Timber
-
-
-open class ForegroundService : Service() {
-
-    private var isServiceStarted = false
-
-    override fun onBind(intent: Intent): IBinder? {
-        // We don't provide binding, so return null
-        return null
-    }
-
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        Timber.d("onStartCommand executed with startId: $startId")
-        if (intent != null) {
-            val action = intent.action
-            Timber.d("using an intent with action $action")
-            when (action) {
-                Action.START.name -> startService(intent.extras)
-                Action.STOP.name -> stopService(intent.extras)
-                "android.net.VpnService" -> {
-                    Timber.d("Always-on VPN starting service")
-                    startService(intent.extras)
-                }
-                else -> Timber.d("This should never happen. No action in the received intent")
-            }
-        } else {
-            Timber.d(
-                "with a null intent. It has been probably restarted by the system."
-            )
-        }
-        // by returning this we make sure the service is restarted if the system kills the service
-        return START_STICKY
-    }
-
-
-    override fun onDestroy() {
-        super.onDestroy()
-        Timber.d("The service has been destroyed")
-    }
-
-    protected open fun startService(extras : Bundle?) {
-        if (isServiceStarted) return
-        Timber.d("Starting ${this.javaClass.simpleName}")
-        isServiceStarted = true
-    }
-
-    protected open fun stopService(extras : Bundle?) {
-        Timber.d("Stopping ${this.javaClass.simpleName}")
-        try {
-            stopForeground(STOP_FOREGROUND_REMOVE)
-            stopSelf()
-        } catch (e: Exception) {
-            Timber.d("Service stopped without being started: ${e.message}")
-        }
-        isServiceStarted = false
-    }
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/ServiceManager.kt

@@ -1,90 +0,0 @@
-package net.nymtech.nymconnect.service.foreground
-
-import android.app.ActivityManager
-import android.app.Application
-import android.app.Service
-import android.content.Context
-import android.content.Context.ACTIVITY_SERVICE
-import android.content.Intent
-import net.nymtech.nymconnect.R
-import timber.log.Timber
-
-object ServiceManager {
-    @Suppress("DEPRECATION")
-    private // Deprecated for third party Services.
-    fun <T> Context.isServiceRunning(service: Class<T>) =
-        (getSystemService(ACTIVITY_SERVICE) as ActivityManager)
-            .getRunningServices(Integer.MAX_VALUE)
-            .any { it.service.className == service.name }
-
-    fun <T : Service> getServiceState(context: Context, cls : Class<T>): ServiceState {
-        val isServiceRunning = context.isServiceRunning(cls)
-        return if(isServiceRunning) ServiceState.STARTED else ServiceState.STOPPED
-    }
-
-    private fun <T : Service> actionOnService(action: Action, context: Context, cls : Class<T>, extras : Map<String,String>? = null) {
-        if (getServiceState(context, cls) == ServiceState.STOPPED && action == Action.STOP) return
-        if (getServiceState(context, cls) == ServiceState.STARTED && action == Action.START) return
-        val intent = Intent(context, cls).also {
-            it.action = action.name
-            extras?.forEach {(k, v) ->
-                it.putExtra(k, v)
-            }
-        }
-        intent.component?.javaClass
-        try {
-            when(action) {
-                Action.START -> {
-                    try {
-                        context.startForegroundService(intent)
-                    } catch (e : Exception) {
-                        Timber.e("Unable to start service foreground ${e.message}")
-                        context.startService(intent)
-                    }
-                }
-                Action.STOP -> context.startService(intent)
-            }
-        } catch (e : Exception) {
-            Timber.tag("ServiceManager").e(e)
-        }
-    }
-
-    fun startVpnService(context : Context, tunnelConfig : String) {
-        actionOnService(
-            Action.START,
-            context,
-            WireGuardTunnelService::class.java,
-            mapOf(context.getString(R.string.tunnel_extras_key) to tunnelConfig))
-    }
-    fun stopVpnService(context : Context) {
-        actionOnService(
-            Action.STOP,
-            context,
-            WireGuardTunnelService::class.java
-        )
-    }
-
-    fun startWatcherService(context : Context, tunnelConfig : String) {
-        actionOnService(
-            Action.START, context,
-            WireGuardConnectivityWatcherService::class.java, mapOf(context.
-            getString(R.string.tunnel_extras_key) to
-                    tunnelConfig))
-    }
-
-    fun stopWatcherService(context : Context) {
-        actionOnService(
-            Action.STOP, context,
-            WireGuardConnectivityWatcherService::class.java)
-    }
-
-    fun toggleWatcherService(context: Context, tunnelConfig : String) {
-        when(getServiceState(
-            context,
-            WireGuardConnectivityWatcherService::class.java,
-        )) {
-            ServiceState.STARTED -> stopWatcherService(context)
-            ServiceState.STOPPED -> startWatcherService(context, tunnelConfig)
-        }
-    }
-}

nym-vpn/android/app/src/main/java/com/zaneschepke/wireguardautotunnel/service/foreground/ServiceState.kt

@@ -1,6 +0,0 @@
-package net.nymtech.nymconnect.service.foreground
-
-enum class ServiceState {
-    STARTED,
-    STOPPED,
-}