changing dkg timings on migration

HACK: change dealing storage keys
Merge pull request #4241 from nymtech/bugfix/concurrent-proposals
2023-12-13 09:34:18 +00:00 · 2023-12-13 09:21:03 +00:00 · 2023-12-12 10:58:05 +00:00 · 2023-12-12 10:40:28 +00:00 · 2023-12-09 06:33:13 +00:00 · 2023-12-08 13:50:59 +00:00
774 changed files with 13930 additions and 3916 deletions
@@ -3,8 +3,27 @@ import fetch from "node-fetch";
 import { Octokit } from "@octokit/rest";
 import fs from "fs";
 import path from "path";
+import { execSync } from "child_process";
+
+function getBinInfo(path) {
+    // let's be super naive about it. add a+x bits on the file and try to run the command
+    try {
+        let mode = fs.statSync(path).mode
+        fs.chmodSync(path, mode | 0o111)
+
+        const raw = execSync(`${path} build-info --output=json`, { stdio: 'pipe', encoding: "utf8" });
+        const parsed = JSON.parse(raw)
+        return parsed
+    } catch (_) {
+        return undefined
+    }
+}

 async function run(assets, algorithm, filename, cache) {
+    if (!cache) {
+        console.warn("cache is set to 'false', but we we no longer support it")
+    }
+
    try {
        fs.mkdirSync('.tmp');
    } catch(e) {
@@ -19,26 +38,25 @@ async function run(assets, algorithm, filename, cache) {

            let buffer = null;
            let sig = null;
-            if(cache) {
-                // cache in `${WORKING_DIR}/.tmp/`
-                const cacheFilename = path.resolve(`.tmp/${asset.name}`);
-                if(!fs.existsSync(cacheFilename)) {
-                    console.log(`Downloading ${asset.browser_download_url}... to ${cacheFilename}`);
-                    buffer = Buffer.from(await fetch(asset.browser_download_url).then(res => res.arrayBuffer()));
-                    fs.writeFileSync(cacheFilename, buffer);
-                } else {
-                    console.log(`Loading from ${cacheFilename}`);
-                    buffer = Buffer.from(fs.readFileSync(cacheFilename));

-                    // console.log('Reading signature from content');
-                    // if(asset.name.endsWith('.sig')) {
-                    //     sig = fs.readFileSync(cacheFilename).toString();
-                    // }
-                }
-            } else {
-                // fetch always
+            // cache in `${WORKING_DIR}/.tmp/`
+            const cacheFilename = path.resolve(`.tmp/${asset.name}`);
+            if(!fs.existsSync(cacheFilename)) {
+                console.log(`Downloading ${asset.browser_download_url}... to ${cacheFilename}`);
                buffer = Buffer.from(await fetch(asset.browser_download_url).then(res => res.arrayBuffer()));
+                fs.writeFileSync(cacheFilename, buffer);
+            } else {
+                console.log(`Loading from ${cacheFilename}`);
+                buffer = Buffer.from(fs.readFileSync(cacheFilename));
+
+                // console.log('Reading signature from content');
+                // if(asset.name.endsWith('.sig')) {
+                //     sig = fs.readFileSync(cacheFilename).toString();
+                // }
            }
+
+            const binInfo = getBinInfo(cacheFilename)
+
            if(!hashes[asset.name]) {
                hashes[asset.name] = {};
            }
@@ -99,6 +117,9 @@ async function run(assets, algorithm, filename, cache) {
            if(kind) {
                hashes[asset.name].kind = kind;
            }
+            if(binInfo) {
+                hashes[asset.name].details = binInfo;
+            }

            // process Tauri signature files
            if(asset.name.endsWith('.sig')) {
@@ -225,6 +246,8 @@ export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrI
            assets: hashes,
        };

+        console.log(output)
+
        if(upload) {
            console.log(`🚚 Uploading ${filename} to release name="${release.name}" id=${release.id} (${release.upload_url})...`);

@@ -2,15 +2,14 @@ name: cd-docs

 on:
  workflow_dispatch:
-  push:
-    paths:
-      - 'documentation/docs/**'

 jobs:
  build:
-    runs-on: custom-linux
+    runs-on: ubuntu-20.04-16-core
    steps:
      - uses: actions/checkout@v3
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
      - name: Install rsync
        run: sudo apt-get install rsync
      - uses: rlespinasse/github-slug-action@v3.x
@@ -26,14 +25,11 @@ jobs:
        with:
          command: build
          args: --workspace --release
-      - name: Install mdbook
-        run: (test -x $HOME/.cargo/bin/mdbook || cargo install --vers "^0.4.33" mdbook)
-      - name: Install mdbook plugins
-        run: |
-          cargo install --vers "=0.2.2" mdbook-variables && cargo install \
-            --vers "^1.8.0" mdbook-admonish && cargo install --vers \
-            "^0.1.2" mdbook-last-changed && cargo install --vers "^0.1.2" mdbook-theme \
-            && cargo install --vers "^0.7.7" mdbook-linkcheck
+      - name: Install mdbook and plugins
+        run: cd documentation && ./install_mdbook_deps.sh
+      - name: Remove existing Nym config directory (`~/.nym/`)
+        run: cd documentation && ./remove_existing_config.sh
+        continue-on-error: false
      - name: Build all projects in documentation/ & move to ~/dist/docs/
        run: cd documentation && ./build_all_to_dist.sh
        continue-on-error: false
@@ -52,6 +48,7 @@ jobs:

      - name: Install Vercel CLI
        run: npm install --global vercel@latest
+        continue-on-error: false

      - name: Pull Vercel Environment Information (preview)
        if: github.ref != 'refs/heads/master'
@@ -61,15 +58,18 @@ jobs:
        if: github.ref == 'refs/heads/master'
        run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
        working-directory: dist/docs
+        continue-on-error: false

      - name: Build Project Artifacts (preview)
        if: github.ref != 'refs/heads/master'
        run: vercel build --token=${{ secrets.VERCEL_TOKEN }}
        working-directory: dist/docs
+        continue-on-error: false
      - name: Build Project Artifacts (production)
        if: github.ref == 'refs/heads/master'
        run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
        working-directory: dist/docs
+        continue-on-error: false

      - name: Deploy Project Artifacts to Vercel (preview)
        if: github.ref != 'refs/heads/master'
@@ -79,6 +79,7 @@ jobs:
        if: github.ref == 'refs/heads/master'
        run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
        working-directory: dist/docs
+        continue-on-error: false

      - name: Matrix - Node Install
        run: npm install
@@ -9,9 +9,11 @@ on:

 jobs:
  build:
-    runs-on: custom-linux
+    runs-on: ubuntu-20.04-16-core
    steps:
      - uses: actions/checkout@v3
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
      - name: Install rsync
        run: sudo apt-get install rsync
      - uses: rlespinasse/github-slug-action@v3.x
@@ -27,22 +29,15 @@ jobs:
        with:
          command: build
          args: --workspace --release
-      - name: Install mdbook
-        run: (test -x $HOME/.cargo/bin/mdbook || cargo install --vers "^0.4.35" mdbook)
-      - name: Install mdbook plugins
-        run: |
-          cargo install --vers "=0.2.2" mdbook-variables && cargo install \
-            --vers "^1.8.0" mdbook-admonish --force && cargo install --vers \
-            "^0.1.2" mdbook-last-changed && cargo install --vers "^0.1.2" mdbook-theme \
-            && cargo install --vers "^0.7.7" mdbook-linkcheck \
-            # && cd documentation \
-            # && mdbook-admonish install dev-portal \
-            # && mdbook-admonish install docs \
-            # && mdbook-admonish install operators
-
-      - name: Build all projects in documentation/ & move to ~/dist/docs/
-        run: cd documentation && ./build_all_to_dist.sh 
+      - name: Install mdbook and plugins
+        run: cd documentation && ./install_mdbook_deps.sh
+      - name: Remove existing Nym config directory (`~/.nym/`)
+        run: cd documentation && ./remove_existing_config.sh
        continue-on-error: false
+      - name: Build all projects in documentation/ & move to ~/dist/docs/
+        run: cd documentation && ./build_all_to_dist.sh
+        continue-on-error: false
+
      - name: Deploy branch to CI www
        continue-on-error: true
        uses: easingthemes/ssh-deploy@main
@@ -54,6 +49,7 @@ jobs:
          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-${{ env.GITHUB_REF_SLUG }}
          EXCLUDE: "/node_modules/"
+
      - name: Matrix - Node Install
        run: npm install
        working-directory: .github/workflows/support-files
@@ -35,7 +35,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --lib --features custom-protocol
+          args: --manifest-path ${{ env.CARGOTOML_PATH }} --features custom-protocol

 #      - name: Run all tests
 #        uses: actions-rs/cargo@v1
@@ -0,0 +1,43 @@
+# Simple workflow for deploying static content to GitHub Pages
+name: Deploy static content to Pages
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: ["feature/ppa-repo"]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
+# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  # Single deploy job since we're just deploying
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Pages
+        uses: actions/configure-pages@v3
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v2
+        with:
+          # Upload entire repository
+          path: './ppa'
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v2
@@ -45,4 +45,6 @@ envs/qwerty.env
 cpu-cycles/libcpucycles/build
 foxyfox.env

-.next
+.next
+ppa-private-key.b64
+ppa-private-key.asc
@@ -4,17 +4,41 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2023.5-rolo] (2023-11-28)
+
+- Gateway won't open websocket listener until embedded Network Requester becomes available ([#4166])
+- Feature/gateway described nr ([#4147])
+- Bugfix/prerelease versionbump ([#4145])
+- returning 'nil' for non-existing origin as opposed to an empty string ([#4135])
+- using performance^20 when calculating active set selection weight ([#4126])
+- Change default http API timeout from 3s to 10s ([#4117])
+
+[#4166]: https://github.com/nymtech/nym/issues/4166
+[#4147]: https://github.com/nymtech/nym/pull/4147
+[#4145]: https://github.com/nymtech/nym/pull/4145
+[#4135]: https://github.com/nymtech/nym/pull/4135
+[#4126]: https://github.com/nymtech/nym/pull/4126
+[#4117]: https://github.com/nymtech/nym/pull/4117
+
+## [2023.nyxd-upgrade] (2023-11-22)
+
+- Chore/nyxd 043 upgrade ([#3968])
+
+[#3968]: https://github.com/nymtech/nym/pull/3968
+
 ## [2023.4-galaxy] (2023-11-07)

 - DRY up client cli ([#4077])
 - [mixnode] replace rocket with axum ([#4071])
 - incorporate the nym node HTTP api into the mixnode ([#4070])
 - replaced '--disable-sign-ext' with '--signext-lowering' when running wasm-opt ([#3896])
+- Added PPA repo hosting support and nym-mixnode package with tooling for publishing ([#4165])

 [#4077]: https://github.com/nymtech/nym/pull/4077
 [#4071]: https://github.com/nymtech/nym/pull/4071
 [#4070]: https://github.com/nymtech/nym/issues/4070
 [#3896]: https://github.com/nymtech/nym/pull/3896
+[#4165]: https://github.com/nymtech/nym/pull/4165

 ## [2023.3-kinder] (2023-10-31)

@@ -628,17 +628,6 @@ dependencies = [
 "event-listener",
 ]

-[[package]]
-name = "async-recursion"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fd55a5ba1179988837d24ab4c7cc8ed6efdeff578ede0416b4225a5fca35bd0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.38",
-]
-
 [[package]]
 name = "async-stream"
 version = "0.3.5"
@@ -1030,29 +1019,6 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "845141a4fade3f790628b7daaaa298a25b204fb28907eb54febe5142db6ce653"

-[[package]]
-name = "boringtun"
-version = "0.6.0"
-source = "git+https://github.com/cloudflare/boringtun?rev=e1d6360d6ab4529fc942a078e4c54df107abe2ba#e1d6360d6ab4529fc942a078e4c54df107abe2ba"
-dependencies = [
- "aead 0.5.2",
- "base64 0.13.1",
- "blake2 0.10.6",
- "chacha20poly1305 0.10.1",
- "hex",
- "hmac 0.12.1",
- "ip_network",
- "ip_network_table",
- "libc",
- "nix 0.25.1",
- "parking_lot 0.12.1",
- "rand_core 0.6.4",
- "ring 0.16.20",
- "tracing",
- "untrusted 0.9.0",
- "x25519-dalek 2.0.0",
-]
-
 [[package]]
 name = "brotli"
 version = "3.4.0"
@@ -1554,8 +1520,8 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2895653b4d9f1538a83970077cb01dfc77a4810524e51a110944688e916b18e"
 dependencies = [
- "prost",
- "prost-types",
+ "prost 0.11.9",
+ "prost-types 0.11.9",
 "tonic",
 "tracing-core",
 ]
@@ -1572,7 +1538,7 @@ dependencies = [
 "futures",
 "hdrhistogram",
 "humantime 2.1.0",
- "prost-types",
+ "prost-types 0.11.9",
 "serde",
 "serde_json",
 "thread_local",
@@ -1661,30 +1627,30 @@ dependencies = [

 [[package]]
 name = "cosmos-sdk-proto"
-version = "0.19.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73c9d2043a9e617b0d602fbc0a0ecd621568edbf3a9774890a6d562389bd8e1c"
+checksum = "32560304ab4c365791fd307282f76637213d8083c1a98490c35159cd67852237"
 dependencies = [
- "prost",
- "prost-types",
+ "prost 0.12.1",
+ "prost-types 0.12.1",
 "tendermint-proto",
 ]

 [[package]]
 name = "cosmrs"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af13955d6f356272e6def9ff5e2450a7650df536d8934f47052a20c76513d2f6"
+checksum = "47126f5364df9387b9d8559dcef62e99010e1d4098f39eb3f7ee4b5c254e40ea"
 dependencies = [
 "bip32",
 "cosmos-sdk-proto",
 "ecdsa 0.16.8",
 "eyre",
- "getrandom 0.2.10",
 "k256",
 "rand_core 0.6.4",
 "serde",
 "serde_json",
+ "signature 2.1.0",
 "subtle-encoding",
 "tendermint",
 "tendermint-rpc",
@@ -2009,15 +1975,6 @@ dependencies = [
 "subtle 2.4.1",
 ]

-[[package]]
-name = "ct-logs"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1a816186fa68d9e426e3cb4ae4dff1fcd8e4a2c34b781bf7a822574a0d0aac8"
-dependencies = [
- "sct 0.6.1",
-]
-
 [[package]]
 name = "ctor"
 version = "0.1.26"
@@ -2346,6 +2303,25 @@ dependencies = [
 "syn 1.0.109",
 ]

+[[package]]
+name = "defguard_wireguard_rs"
+version = "0.3.0"
+source = "git+https://github.com/neacsu/wireguard-rs.git?rev=c2cd0c1119f699f4bc43f5e6ffd6fc242caa42ed#c2cd0c1119f699f4bc43f5e6ffd6fc242caa42ed"
+dependencies = [
+ "base64 0.21.4",
+ "libc",
+ "log",
+ "netlink-packet-core 0.7.0",
+ "netlink-packet-generic",
+ "netlink-packet-route 0.17.1",
+ "netlink-packet-utils",
+ "netlink-packet-wireguard",
+ "netlink-sys",
+ "nix 0.27.1",
+ "serde",
+ "thiserror",
+]
+
 [[package]]
 name = "der"
 version = "0.6.1"
@@ -2938,7 +2914,7 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"

 [[package]]
 name = "explorer-api"
-version = "1.1.31"
+version = "1.1.32"
 dependencies = [
 "chrono",
 "clap 4.4.7",
@@ -3696,30 +3672,6 @@ dependencies = [
 "num-traits",
 ]

-[[package]]
-name = "headers"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
-dependencies = [
- "base64 0.21.4",
- "bytes",
- "headers-core",
- "http",
- "httpdate",
- "mime",
- "sha1",
-]
-
-[[package]]
-name = "headers-core"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
-dependencies = [
- "http",
-]
-
 [[package]]
 name = "heck"
 version = "0.3.3"
@@ -3958,40 +3910,17 @@ dependencies = [
 ]

 [[package]]
-name = "hyper-proxy"
-version = "0.9.1"
+name = "hyper-rustls"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca815a891b24fdfb243fa3239c86154392b0953ee584aa1a2a1f66d20cbe75cc"
+checksum = "8d78e1e73ec14cf7375674f74d7dde185c8206fd9dea6fb6295e8a98098aaa97"
 dependencies = [
- "bytes",
- "futures",
- "headers",
+ "futures-util",
 "http",
 "hyper",
- "hyper-rustls",
- "rustls-native-certs",
+ "rustls 0.21.7",
 "tokio",
- "tokio-rustls 0.22.0",
- "tower-service",
- "webpki 0.21.4",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f9f7a97316d44c0af9b0301e65010573a853a9fc97046d7331d7f6bc0fd5a64"
-dependencies = [
- "ct-logs",
- "futures-util",
- "hyper",
- "log",
- "rustls 0.19.1",
- "rustls-native-certs",
- "tokio",
- "tokio-rustls 0.22.0",
- "webpki 0.21.4",
- "webpki-roots 0.21.1",
+ "tokio-rustls 0.24.1",
 ]

 [[package]]
@@ -4248,22 +4177,6 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa2f047c0a98b2f299aa5d6d7088443570faae494e9ae1305e48be000c9e0eb1"

-[[package]]
-name = "ip_network_table"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4099b7cfc5c5e2fe8c5edf3f6f7adf7a714c9cc697534f63a5a5da30397cb2c0"
-dependencies = [
- "ip_network",
- "ip_network_table-deps-treebitmap",
-]
-
-[[package]]
-name = "ip_network_table-deps-treebitmap"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e537132deb99c0eb4b752f0346b6a836200eaaa3516dd7e5514b63930a09e5d"
-
 [[package]]
 name = "ipconfig"
 version = "0.3.2"
@@ -4658,7 +4571,7 @@ dependencies = [
 "once_cell",
 "parking_lot 0.12.1",
 "pin-project",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "rand 0.8.5",
 "rw-stream-sink 0.3.0 (git+https://github.com/ChainSafe/rust-libp2p.git?rev=e3440d25681df380c9f0f8cfdcfd5ecc0a4f2fb6)",
@@ -4744,7 +4657,7 @@ dependencies = [
 "libp2p-swarm 0.42.0",
 "log",
 "prometheus-client",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "prost-codec",
 "rand 0.8.5",
@@ -4802,7 +4715,7 @@ dependencies = [
 "libp2p-swarm 0.42.0",
 "log",
 "lru 0.9.0",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "prost-codec",
 "smallvec",
@@ -4952,7 +4865,7 @@ dependencies = [
 "libp2p-core 0.39.0",
 "log",
 "once_cell",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "rand 0.8.5",
 "sha2 0.10.8",
@@ -5204,7 +5117,7 @@ dependencies = [
 "libp2p-noise 0.42.0",
 "log",
 "multihash",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "prost-codec",
 "rand 0.8.5",
@@ -5750,6 +5663,29 @@ dependencies = [
 "netlink-packet-utils",
 ]

+[[package]]
+name = "netlink-packet-core"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72724faf704479d67b388da142b186f916188505e7e0b26719019c525882eda4"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "netlink-packet-utils",
+]
+
+[[package]]
+name = "netlink-packet-generic"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cd7eb8ad331c84c6b8cb7f685b448133e5ad82e1ffd5acafac374af4a5a308b"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "netlink-packet-core 0.7.0",
+ "netlink-packet-utils",
+]
+
 [[package]]
 name = "netlink-packet-route"
 version = "0.12.0"
@@ -5760,7 +5696,21 @@ dependencies = [
 "bitflags 1.3.2",
 "byteorder",
 "libc",
- "netlink-packet-core",
+ "netlink-packet-core 0.4.2",
+ "netlink-packet-utils",
+]
+
+[[package]]
+name = "netlink-packet-route"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053998cea5a306971f88580d0829e90f270f940befd7cf928da179d4187a5a66"
+dependencies = [
+ "anyhow",
+ "bitflags 1.3.2",
+ "byteorder",
+ "libc",
+ "netlink-packet-core 0.7.0",
 "netlink-packet-utils",
 ]

@@ -5776,6 +5726,20 @@ dependencies = [
 "thiserror",
 ]

+[[package]]
+name = "netlink-packet-wireguard"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60b25b050ff1f6a1e23c6777b72db22790fe5b6b5ccfd3858672587a79876c8f"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "libc",
+ "log",
+ "netlink-packet-generic",
+ "netlink-packet-utils",
+]
+
 [[package]]
 name = "netlink-proto"
 version = "0.10.0"
@@ -5785,7 +5749,7 @@ dependencies = [
 "bytes",
 "futures",
 "log",
- "netlink-packet-core",
+ "netlink-packet-core 0.4.2",
 "netlink-sys",
 "thiserror",
 "tokio",
@@ -5816,18 +5780,6 @@ dependencies = [
 "memoffset 0.6.5",
 ]

-[[package]]
-name = "nix"
-version = "0.25.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f346ff70e7dbfd675fe90590b92d59ef2de15a8779ae305ebcbfd3f0caf59be4"
-dependencies = [
- "autocfg 1.1.0",
- "bitflags 1.3.2",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "nix"
 version = "0.27.1"
@@ -5837,6 +5789,7 @@ dependencies = [
 "bitflags 2.4.1",
 "cfg-if",
 "libc",
+ "memoffset 0.9.0",
 ]

 [[package]]
@@ -5961,7 +5914,7 @@ dependencies = [

 [[package]]
 name = "nym-api"
-version = "1.1.32"
+version = "1.1.34"
 dependencies = [
 "actix-web",
 "anyhow",
@@ -6111,7 +6064,7 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.31"
+version = "1.1.33"
 dependencies = [
 "anyhow",
 "base64 0.13.1",
@@ -6184,7 +6137,7 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.31"
+version = "1.1.32"
 dependencies = [
 "clap 4.4.7",
 "dirs 4.0.0",
@@ -6528,7 +6481,7 @@ dependencies = [

 [[package]]
 name = "nym-gateway"
-version = "1.1.31"
+version = "1.1.32"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -6538,6 +6491,7 @@ dependencies = [
 "clap 4.4.7",
 "colored",
 "dashmap",
+ "defguard_wireguard_rs",
 "dirs 4.0.0",
 "dotenvy",
 "futures",
@@ -6657,27 +6611,48 @@ dependencies = [
 "thiserror",
 ]

+[[package]]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "bytes",
+ "nym-sphinx",
+ "rand 0.8.5",
+ "serde",
+ "thiserror",
+]
+
 [[package]]
 name = "nym-ip-packet-router"
 version = "0.1.0"
 dependencies = [
+ "bincode",
+ "bytes",
 "etherparse",
 "futures",
 "log",
 "nym-bin-common",
 "nym-client-core",
 "nym-config",
+ "nym-exit-policy",
+ "nym-ip-packet-requests",
+ "nym-network-requester",
 "nym-sdk",
 "nym-service-providers-common",
 "nym-sphinx",
 "nym-task",
+ "nym-tun",
 "nym-wireguard",
 "nym-wireguard-types",
+ "rand 0.8.5",
+ "reqwest",
 "serde",
 "serde_json",
 "tap",
 "thiserror",
 "tokio",
+ "tokio-tun",
 "url",
 ]

@@ -6716,7 +6691,7 @@ dependencies = [

 [[package]]
 name = "nym-mixnode"
-version = "1.1.33"
+version = "1.1.34"
 dependencies = [
 "anyhow",
 "axum",
@@ -6836,7 +6811,7 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.31"
+version = "1.1.32"
 dependencies = [
 "anyhow",
 "async-file-watcher",
@@ -6884,7 +6859,7 @@ dependencies = [

 [[package]]
 name = "nym-network-statistics"
-version = "1.1.31"
+version = "1.1.32"
 dependencies = [
 "dirs 4.0.0",
 "log",
@@ -6917,6 +6892,7 @@ dependencies = [
 "nym-crypto",
 "nym-node-requests",
 "nym-task",
+ "nym-wireguard",
 "nym-wireguard-types",
 "rand 0.7.3",
 "serde",
@@ -7128,7 +7104,7 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.31"
+version = "1.1.32"
 dependencies = [
 "clap 4.4.7",
 "lazy_static",
@@ -7459,6 +7435,18 @@ dependencies = [
 "wasm-utils",
 ]

+[[package]]
+name = "nym-tun"
+version = "0.1.0"
+dependencies = [
+ "etherparse",
+ "log",
+ "nym-wireguard-types",
+ "thiserror",
+ "tokio",
+ "tokio-tun",
+]
+
 [[package]]
 name = "nym-types"
 version = "1.0.0"
@@ -7495,6 +7483,7 @@ version = "0.1.0"
 dependencies = [
 "async-trait",
 "base64 0.13.1",
+ "bip32",
 "bip39",
 "colored",
 "cosmrs",
@@ -7525,7 +7514,7 @@ dependencies = [
 "nym-service-provider-directory-common",
 "nym-vesting-contract-common",
 "openssl",
- "prost",
+ "prost 0.12.1",
 "reqwest",
 "serde",
 "serde_json",
@@ -7576,25 +7565,15 @@ dependencies = [
 name = "nym-wireguard"
 version = "0.1.0"
 dependencies = [
- "async-recursion",
 "base64 0.21.4",
- "boringtun",
- "bytes",
- "dashmap",
- "etherparse",
- "futures",
+ "defguard_wireguard_rs",
 "ip_network",
- "ip_network_table",
 "log",
+ "nym-network-defaults",
 "nym-task",
 "nym-wireguard-types",
- "rand 0.8.5",
- "serde",
- "tap",
- "thiserror",
 "tokio",
- "tokio-stream",
- "tokio-tun",
+ "x25519-dalek 2.0.0",
 ]

 [[package]]
@@ -7602,9 +7581,9 @@ name = "nym-wireguard-types"
 version = "0.1.0"
 dependencies = [
 "base64 0.21.4",
- "boringtun",
 "dashmap",
 "hmac 0.12.1",
+ "log",
 "nym-crypto",
 "rand 0.7.3",
 "serde",
@@ -7615,6 +7594,36 @@ dependencies = [
 "x25519-dalek 2.0.0",
 ]

+[[package]]
+name = "nymvisor"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-file-watcher",
+ "bytes",
+ "clap 4.4.7",
+ "dotenvy",
+ "flate2",
+ "futures",
+ "hex",
+ "humantime 2.1.0",
+ "humantime-serde",
+ "nix 0.27.1",
+ "nym-bin-common",
+ "nym-config",
+ "nym-task",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.10.8",
+ "tar",
+ "thiserror",
+ "time",
+ "tokio",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "object"
 version = "0.32.1"
@@ -8394,7 +8403,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
 dependencies = [
 "bytes",
- "prost-derive",
+ "prost-derive 0.11.9",
+]
+
+[[package]]
+name = "prost"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4fdd22f3b9c31b53c060df4a0613a1c7f062d4115a2b984dd15b1858f7e340d"
+dependencies = [
+ "bytes",
+ "prost-derive 0.12.1",
 ]

 [[package]]
@@ -8411,8 +8430,8 @@ dependencies = [
 "multimap",
 "petgraph",
 "prettyplease",
- "prost",
- "prost-types",
+ "prost 0.11.9",
+ "prost-types 0.11.9",
 "regex",
 "syn 1.0.109",
 "tempfile",
@@ -8426,7 +8445,7 @@ source = "git+https://github.com/ChainSafe/rust-libp2p.git?rev=e3440d25681df380c
 dependencies = [
 "asynchronous-codec",
 "bytes",
- "prost",
+ "prost 0.11.9",
 "thiserror",
 "unsigned-varint",
 ]
@@ -8444,13 +8463,35 @@ dependencies = [
 "syn 1.0.109",
 ]

+[[package]]
+name = "prost-derive"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "265baba7fabd416cf5078179f7d2cbeca4ce7a9041111900675ea7c4cb8a4c32"
+dependencies = [
+ "anyhow",
+ "itertools 0.11.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.38",
+]
+
 [[package]]
 name = "prost-types"
 version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "213622a1460818959ac1181aaeb2dc9c7f63df720db7d788b3e24eacd1983e13"
 dependencies = [
- "prost",
+ "prost 0.11.9",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e081b29f63d83a4bc75cfc9f3fe424f9156cf92d8a4f0c9407cce9a1b67327cf"
+dependencies = [
+ "prost 0.12.1",
 ]

 [[package]]
@@ -8962,6 +9003,7 @@ dependencies = [
 "http",
 "http-body",
 "hyper",
+ "hyper-rustls",
 "hyper-tls",
 "ipnet",
 "js-sys",
@@ -8971,17 +9013,23 @@ dependencies = [
 "once_cell",
 "percent-encoding",
 "pin-project-lite 0.2.13",
+ "rustls 0.21.7",
+ "rustls-native-certs",
+ "rustls-pemfile",
 "serde",
 "serde_json",
 "serde_urlencoded",
 "system-configuration",
 "tokio",
 "tokio-native-tls",
+ "tokio-rustls 0.24.1",
 "tokio-socks",
+ "tokio-util",
 "tower-service",
 "url",
 "wasm-bindgen",
 "wasm-bindgen-futures",
+ "wasm-streams",
 "web-sys",
 "winreg",
 ]
@@ -9200,7 +9248,7 @@ checksum = "322c53fd76a18698f1c27381d58091de3a043d356aa5bd0d510608b565f469a0"
 dependencies = [
 "futures",
 "log",
- "netlink-packet-route",
+ "netlink-packet-route 0.12.0",
 "netlink-proto",
 "nix 0.24.3",
 "thiserror",
@@ -9376,12 +9424,12 @@ dependencies = [

 [[package]]
 name = "rustls-native-certs"
-version = "0.5.0"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a07b7c1885bd8ed3831c289b7870b13ef46fe0e856d288c30d9cc17d75a2092"
+checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
 dependencies = [
 "openssl-probe",
- "rustls 0.19.1",
+ "rustls-pemfile",
 "schannel",
 "security-framework",
 ]
@@ -9440,9 +9488,9 @@ checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"

 [[package]]
 name = "safer-ffi"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9c1d19b288ca9898cd421c7b105fb7269918a7f8e9253a991e228981ca421ad"
+checksum = "395ace5aff9629c7268ca8255aceb945525b2cb644015f3caec5131a6a537c11"
 dependencies = [
 "inventory",
 "libc",
@@ -9457,9 +9505,9 @@ dependencies = [

 [[package]]
 name = "safer_ffi-proc_macros"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d7a04caa3ca2224f5ea4ddd850e2629c3b36b2b83621f87a8303bf41020110"
+checksum = "9255504d5467bae9e07d58b8de446ba6739b29bf72e1fa35b2387e30d29dcbfe"
 dependencies = [
 "macro_rules_attribute",
 "prettyplease",
@@ -10567,6 +10615,17 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"

+[[package]]
+name = "tar"
+version = "0.4.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b16afcea1f22891c49a00c751c7b63b2233284064f11a200fc624137c51e2ddb"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.8.0"
@@ -10582,9 +10641,9 @@ dependencies = [

 [[package]]
 name = "tendermint"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f0a7d05cf78524782337f8edd55cbc578d159a16ad4affe2135c92f7dbac7f0"
+checksum = "bc2294fa667c8b548ee27a9ba59115472d0a09c2ba255771092a7f1dcf03a789"
 dependencies = [
 "bytes",
 "digest 0.10.7",
@@ -10595,8 +10654,8 @@ dependencies = [
 "k256",
 "num-traits",
 "once_cell",
- "prost",
- "prost-types",
+ "prost 0.12.1",
+ "prost-types 0.12.1",
 "ripemd",
 "serde",
 "serde_bytes",
@@ -10613,9 +10672,9 @@ dependencies = [

 [[package]]
 name = "tendermint-config"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71a72dbbea6dde12045d261f2c70c0de039125675e8a026c8d5ad34522756372"
+checksum = "5a25dbe8b953e80f3d61789fbdb83bf9ad6c0ef16df5ca6546f49912542cc137"
 dependencies = [
 "flex-error",
 "serde",
@@ -10627,16 +10686,16 @@ dependencies = [

 [[package]]
 name = "tendermint-proto"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cec054567d16d85e8c3f6a3139963d1a66d9d3051ed545d31562550e9bcc3d"
+checksum = "2cc728a4f9e891d71adf66af6ecaece146f9c7a11312288a3107b3e1d6979aaf"
 dependencies = [
 "bytes",
 "flex-error",
 "num-derive",
 "num-traits",
- "prost",
- "prost-types",
+ "prost 0.12.1",
+ "prost-types 0.12.1",
 "serde",
 "serde_bytes",
 "subtle-encoding",
@@ -10645,21 +10704,18 @@ dependencies = [

 [[package]]
 name = "tendermint-rpc"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d119d83a130537fc4a98c3c9eb6899ebe857fea4860400a61675bfb5f0b35129"
+checksum = "dfbf0a4753b46a190f367337e0163d0b552a2674a6bac54e74f9f2cdcde2969b"
 dependencies = [
 "async-trait",
 "bytes",
 "flex-error",
 "futures",
 "getrandom 0.2.10",
- "http",
- "hyper",
- "hyper-proxy",
- "hyper-rustls",
 "peg",
 "pin-project",
+ "reqwest",
 "semver 1.0.20",
 "serde",
 "serde_bytes",
@@ -10883,6 +10939,16 @@ dependencies = [
 "webpki 0.22.4",
 ]

+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.7",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-socks"
 version = "0.5.1"
@@ -10922,9 +10988,9 @@ dependencies = [

 [[package]]
 name = "tokio-tun"
-version = "0.9.1"
+version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a67d1405a577ba1f4cd61f46608f1db2cadbb6a9549c3fc2eed7f1195393c9"
+checksum = "bf2efaf33e86779a3a68b1f1d6e9e13a346c1c75ee3cab7a4293235c463b2668"
 dependencies = [
 "libc",
 "nix 0.27.1",
@@ -11074,7 +11140,7 @@ dependencies = [
 "hyper-timeout",
 "percent-encoding",
 "pin-project",
- "prost",
+ "prost 0.11.9",
 "tokio",
 "tokio-stream",
 "tower",
@@ -11924,6 +11990,19 @@ dependencies = [
 "wasm-utils",
 ]

+[[package]]
+name = "wasm-streams"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4609d447824375f43e1ffbc051b50ad8f4b3ae8219680c94452ea05eb240ac7"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "wasm-timer"
 version = "0.2.5"
@@ -12548,6 +12627,15 @@ dependencies = [
 "time",
 ]

+[[package]]
+name = "xattr"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4686009f71ff3e5c4dbcf1a282d0a44db3f021ba69350cd42086b3e5f1c6985"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "yamux"
 version = "0.10.2"
@@ -49,6 +49,7 @@ members = [
    "common/exit-policy",
    "common/http-api-client",
    "common/inclusion-probability",
+    "common/ip-packet-requests",
    "common/ledger",
    "common/mixnode-common",
    "common/network-defaults",
@@ -74,6 +75,7 @@ members = [
    "common/store-cipher",
    "common/task",
    "common/topology",
+    "common/tun",
    "common/types",
    "common/wasm/client-core",
    "common/wasm/storage",
@@ -103,6 +105,7 @@ members = [
    "tools/internal/sdk-version-bump",
    "tools/nym-cli",
    "tools/nym-nr-query",
+    "tools/nymvisor",
    "tools/ts-rs-cli",
    "wasm/client",
 #    "wasm/full-nym-wasm",
@@ -118,6 +121,7 @@ default-members = [
    "service-providers/network-statistics",
    "mixnode",
    "nym-api",
+    "tools/nymvisor",
    "explorer-api",
 ]

@@ -137,24 +141,8 @@ async-trait = "0.1.68"
 axum = "0.6.20"
 base64 = "0.21.4"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
-boringtun = { git = "https://github.com/cloudflare/boringtun", rev = "e1d6360d6ab4529fc942a078e4c54df107abe2ba" }
 clap = "4.4.7"
 cfg-if = "1.0.0"
-cosmwasm-derive = "=1.3.0"
-cosmwasm-schema = "=1.3.0"
-cosmwasm-std = "=1.3.0"
-# use 0.5.0 as that's the version used by cosmwasm-std 1.3.0
-# (and ideally we don't want to pull the same dependency twice)
-serde-json-wasm = "=0.5.0"
-cosmwasm-storage = "=1.3.0"
-cosmrs = "=0.14.0"
-# same version as used by cosmrs
-cw-utils = "=1.0.1"
-cw-storage-plus = "=1.1.0"
-cw2 = { version = "=1.1.0" }
-cw3 = { version = "=1.1.0" }
-cw4 = { version = "=1.1.0" }
-cw-controllers = { version = "=1.1.0" }
 dashmap = "5.5.3"
 dotenvy = "0.15.6"
 futures = "0.3.28"
@@ -172,7 +160,7 @@ schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
 tap = "1.0.1"
-tendermint-rpc = "0.32" # same version as used by cosmrs
+time = "0.3.30"
 thiserror = "1.0.48"
 tokio = "1.24.1"
 tokio-tungstenite = "0.20.1"
@@ -184,6 +172,28 @@ utoipa-swagger-ui = "3.1.5"
 url = "2.4"
 zeroize = "1.6.0"

+# cosmwasm-related
+cosmwasm-derive = "=1.3.0"
+cosmwasm-schema = "=1.3.0"
+cosmwasm-std = "=1.3.0"
+# use 0.5.0 as that's the version used by cosmwasm-std 1.3.0
+# (and ideally we don't want to pull the same dependency twice)
+serde-json-wasm = "=0.5.0"
+cosmwasm-storage = "=1.3.0"
+# same version as used by cosmwasm
+cw-utils = "=1.0.1"
+cw-storage-plus = "=1.1.0"
+cw2 = { version = "=1.1.0" }
+cw3 = { version = "=1.1.0" }
+cw4 = { version = "=1.1.0" }
+cw-controllers = { version = "=1.1.0" }
+
+# cosmrs-related
+bip32 = "0.5.1"
+cosmrs = "=0.15.0"
+tendermint-rpc = "0.34" # same version as used by cosmrs
+prost = "0.12"
+
 # wasm-related dependencies
 gloo-utils = "0.1.7"
 js-sys = "0.3.63"
@@ -0,0 +1,439 @@
+Attribution-NonCommercial-ShareAlike 4.0 International
+
+=======================================================================
+
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
+
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+    wiki.creativecommons.org/Considerations_for_licensors
+
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More considerations
+     for the public:
+    wiki.creativecommons.org/Considerations_for_licensees
+
+=======================================================================
+
+Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International
+Public License
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution-NonCommercial-ShareAlike 4.0 International Public License
+("Public License"). To the extent this Public License may be
+interpreted as a contract, You are granted the Licensed Rights in
+consideration of Your acceptance of these terms and conditions, and the
+Licensor grants You such rights in consideration of benefits the
+Licensor receives from making the Licensed Material available under
+these terms and conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. BY-NC-SA Compatible License means a license listed at
+     creativecommons.org/compatiblelicenses, approved by Creative
+     Commons as essentially the equivalent of this Public License.
+
+  d. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  e. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  f. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  g. License Elements means the license attributes listed in the name
+     of a Creative Commons Public License. The License Elements of this
+     Public License are Attribution, NonCommercial, and ShareAlike.
+
+  h. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  i. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  j. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  k. NonCommercial means not primarily intended for or directed towards
+     commercial advantage or monetary compensation. For purposes of
+     this Public License, the exchange of the Licensed Material for
+     other material subject to Copyright and Similar Rights by digital
+     file-sharing or similar means is NonCommercial provided there is
+     no payment of monetary compensation in connection with the
+     exchange.
+
+  l. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  m. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  n. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part, for NonCommercial purposes only; and
+
+            b. produce, reproduce, and Share Adapted Material for
+               NonCommercial purposes only.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. Additional offer from the Licensor -- Adapted Material.
+               Every recipient of Adapted Material from You
+               automatically receives an offer from the Licensor to
+               exercise the Licensed Rights in the Adapted Material
+               under the conditions of the Adapter's License You apply.
+
+            c. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties, including when
+          the Licensed Material is used other than for NonCommercial
+          purposes.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+  b. ShareAlike.
+
+     In addition to the conditions in Section 3(a), if You Share
+     Adapted Material You produce, the following conditions also apply.
+
+       1. The Adapter's License You apply must be a Creative Commons
+          license with the same License Elements, this version or
+          later, or a BY-NC-SA Compatible License.
+
+       2. You must include the text of, or the URI or hyperlink to, the
+          Adapter's License You apply. You may satisfy this condition
+          in any reasonable manner based on the medium, means, and
+          context in which You Share Adapted Material.
+
+       3. You may not offer or impose any additional or different terms
+          or conditions on, or apply any Effective Technological
+          Measures to, Adapted Material that restrict exercise of the
+          rights granted under the Adapter's License You apply.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database for NonCommercial purposes
+     only;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material,
+     including for purposes of Section 3(b); and
+
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+=======================================================================
+
+Creative Commons is not a party to its public
+licenses. Notwithstanding, Creative Commons may elect to apply one of
+its public licenses to material it publishes and in those instances
+will be considered the â€œLicensor.â€ The text of the Creative Commons
+public licenses is dedicated to the public domain under the CC0 Public
+Domain Dedication. Except for the limited purpose of indicating that
+material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the
+public licenses.
+
+Creative Commons may be contacted at creativecommons.org.
+
+
@@ -0,0 +1,675 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means tocopy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
+ 
@@ -168,3 +168,7 @@ generate-typescript:
 run-api-tests:
 	cd nym-api/tests/functional_test && yarn test:qa

+# Build debian package, and update PPA
+# Requires base64 encode GPG key to be set up in environment PPA_SIGNING_KEY
+deb:
+	scripts/ppa.sh
@@ -15,7 +15,6 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr
 * nym-explorer - a (projected) block explorer and (existing) mixnet viewer.
 * nym-wallet - a desktop wallet implemented using the [Tauri](https://tauri.studio/en/docs/about/intro) framework.

-[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg?style=for-the-badge)](https://opensource.org/licenses/Apache-2.0)
 [![Build Status](https://img.shields.io/github/actions/workflow/status/nymtech/nym/build.yml?branch=develop&style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)


@@ -83,4 +82,11 @@ where `s'` is stake `s` scaled over total token circulating supply.

 ### Licensing and copyright information

-This program is available as open source under the terms of the Apache 2.0 license. However, some elements are being licensed under CC0-1.0 and MIT. For accurate information, please check individual files.
+This is a monorepo and components that make up Nym as a system are licensed individually, so for accurate information, please check individual files.
+
+As a general approach, licensing is as follows this pattern:
+- applications and binaries are GPLv3
+- libraries and components are Apache 2.0 or MIT
+- documentation is Apache 2.0 or CC0-1.0
+
+Again, for accurate information, please check individual files.
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.31"
+version = "1.1.32"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -22,5 +22,10 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
    }
    setup_logging();

-    commands::execute(args).await
+    if let Err(err) = commands::execute(args).await {
+        log::error!("{err}");
+        println!("An error occurred: {err}");
+        std::process::exit(1);
+    }
+    Ok(())
 }
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.31"
+version = "1.1.32"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -21,5 +21,10 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
    }
    setup_logging();

-    commands::execute(args).await
+    if let Err(err) = commands::execute(args).await {
+        log::error!("{err}");
+        println!("An error occurred: {err}");
+        std::process::exit(1);
+    }
+    Ok(())
 }
@@ -10,6 +10,8 @@ use std::path::{Path, PathBuf};
 use std::time::Duration;
 use tokio::time::Instant;

+pub use notify::{Error as NotifyError, Result as NotifyResult};
+
 pub type FileWatcherEventSender = mpsc::UnboundedSender<Event>;
 pub type FileWatcherEventReceiver = mpsc::UnboundedReceiver<Event>;

@@ -22,7 +24,7 @@ pub struct AsyncFileWatcher {
    last_received: HashMap<EventKind, Instant>,
    tick_duration: Duration,

-    inner_rx: mpsc::UnboundedReceiver<notify::Result<Event>>,
+    inner_rx: mpsc::UnboundedReceiver<NotifyResult<Event>>,
    event_sender: FileWatcherEventSender,
 }

@@ -30,7 +32,7 @@ impl AsyncFileWatcher {
    pub fn new_file_changes_watcher<P: AsRef<Path>>(
        path: P,
        event_sender: FileWatcherEventSender,
-    ) -> notify::Result<Self> {
+    ) -> NotifyResult<Self> {
        Self::new(
            path,
            event_sender,
@@ -48,7 +50,7 @@ impl AsyncFileWatcher {
        event_sender: FileWatcherEventSender,
        filters: Option<Vec<EventKind>>,
        tick_duration: Option<Duration>,
-    ) -> notify::Result<Self> {
+    ) -> NotifyResult<Self> {
        let watcher_config = Config::default();
        let (inner_tx, inner_rx) = mpsc::unbounded();
        let watcher = RecommendedWatcher::new(
@@ -112,17 +114,17 @@ impl AsyncFileWatcher {
        false
    }

-    fn start_watching(&mut self) -> notify::Result<()> {
+    fn start_watching(&mut self) -> NotifyResult<()> {
        self.is_watching = true;
        self.watcher.watch(&self.path, RecursiveMode::NonRecursive)
    }

-    fn stop_watching(&mut self) -> notify::Result<()> {
+    fn stop_watching(&mut self) -> NotifyResult<()> {
        self.is_watching = false;
        self.watcher.unwatch(&self.path)
    }

-    pub async fn watch(&mut self) -> notify::Result<()> {
+    pub async fn watch(&mut self) -> NotifyResult<()> {
        self.start_watching()?;

        while let Some(event) = self.inner_rx.next().await {
@@ -47,8 +47,9 @@ default = []
 openapi = ["utoipa"]
 output_format = ["serde_json"]
 bin_info_schema = ["schemars"]
+basic_tracing = ["tracing-subscriber"]
 tracing = [
-    "tracing-subscriber",
+    "basic_tracing",
    "tracing-tree",
    "opentelemetry-jaeger",
    "tracing-opentelemetry",
@@ -80,7 +80,7 @@ impl BinaryBuildInformation {
    }
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 #[cfg_attr(feature = "bin_info_schema", derive(schemars::JsonSchema))]
 pub struct BinaryBuildInformationOwned {
@@ -43,6 +43,30 @@ pub fn setup_logging() {
        .init();
 }

+#[cfg(feature = "basic_tracing")]
+pub fn setup_tracing_logger() {
+    let log_builder = tracing_subscriber::fmt()
+        // Use a more compact, abbreviated log format
+        .compact()
+        // Display source code file paths
+        .with_file(true)
+        // Display source code line numbers
+        .with_line_number(true)
+        // Don't display the event's target (module path)
+        .with_target(false);
+
+    if ::std::env::var("RUST_LOG").is_ok() {
+        log_builder
+            .with_env_filter(tracing_subscriber::filter::EnvFilter::from_default_env())
+            .init()
+    } else {
+        // default to 'Info
+        log_builder
+            .with_max_level(tracing_subscriber::filter::LevelFilter::INFO)
+            .init()
+    }
+}
+
 // TODO: This has to be a macro, running it as a function does not work for the file_appender for some reason
 #[cfg(feature = "tracing")]
 #[macro_export]
@@ -77,7 +77,7 @@ pub struct PersistedGatewayConfig {
    key_hash: Vec<u8>,

    /// Actual gateway details being persisted.
-    pub(crate) details: GatewayEndpointConfig,
+    pub details: GatewayEndpointConfig,
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -28,6 +28,7 @@ pub enum InputMessage {
        recipient: Recipient,
        data: Vec<u8>,
        lane: TransmissionLane,
+        mix_hops: Option<u8>,
    },

    /// Creates a message used for a duplex anonymous communication where the recipient
@@ -43,6 +44,7 @@ pub enum InputMessage {
        data: Vec<u8>,
        reply_surbs: u32,
        lane: TransmissionLane,
+        mix_hops: Option<u8>,
    },

    /// Attempt to use our internally received and stored `ReplySurb` to send the message back
@@ -92,6 +94,29 @@ impl InputMessage {
            recipient,
            data,
            lane,
+            mix_hops: None,
+        };
+        if let Some(packet_type) = packet_type {
+            InputMessage::new_wrapper(message, packet_type)
+        } else {
+            message
+        }
+    }
+
+    // IMHO `new_regular` should take `mix_hops: Option<u8>` as an argument instead of creating
+    // this function, but that would potentially break backwards compatibility with the current API
+    pub fn new_regular_with_custom_hops(
+        recipient: Recipient,
+        data: Vec<u8>,
+        lane: TransmissionLane,
+        packet_type: Option<PacketType>,
+        mix_hops: Option<u8>,
+    ) -> Self {
+        let message = InputMessage::Regular {
+            recipient,
+            data,
+            lane,
+            mix_hops,
        };
        if let Some(packet_type) = packet_type {
            InputMessage::new_wrapper(message, packet_type)
@@ -112,6 +137,31 @@ impl InputMessage {
            data,
            reply_surbs,
            lane,
+            mix_hops: None,
+        };
+        if let Some(packet_type) = packet_type {
+            InputMessage::new_wrapper(message, packet_type)
+        } else {
+            message
+        }
+    }
+
+    // IMHO `new_anonymous` should take `mix_hops: Option<u8>` as an argument instead of creating
+    // this function, but that would potentially break backwards compatibility with the current API
+    pub fn new_anonymous_with_custom_hops(
+        recipient: Recipient,
+        data: Vec<u8>,
+        reply_surbs: u32,
+        lane: TransmissionLane,
+        packet_type: Option<PacketType>,
+        mix_hops: Option<u8>,
+    ) -> Self {
+        let message = InputMessage::Anonymous {
+            recipient,
+            data,
+            reply_surbs,
+            lane,
+            mix_hops,
        };
        if let Some(packet_type) = packet_type {
            InputMessage::new_wrapper(message, packet_type)
@@ -263,7 +263,7 @@ impl ActionController {
    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
        debug!("Started ActionController with graceful shutdown support");

-        while !shutdown.is_shutdown() {
+        loop {
            tokio::select! {
                action = self.incoming_actions.next() => match action {
                    Some(action) => self.process_action(action),
@@ -283,6 +283,7 @@ impl ActionController {
                },
                _ = shutdown.recv_with_delay() => {
                    log::trace!("ActionController: Received shutdown");
+                    break;
                }
            }
        }
@@ -73,10 +73,11 @@ where
        content: Vec<u8>,
        lane: TransmissionLane,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) {
        if let Err(err) = self
            .message_handler
-            .try_send_plain_message(recipient, content, lane, packet_type)
+            .try_send_plain_message(recipient, content, lane, packet_type, mix_hops)
            .await
        {
            warn!("failed to send a plain message - {err}")
@@ -90,10 +91,18 @@ where
        reply_surbs: u32,
        lane: TransmissionLane,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) {
        if let Err(err) = self
            .message_handler
-            .try_send_message_with_reply_surbs(recipient, content, reply_surbs, lane, packet_type)
+            .try_send_message_with_reply_surbs(
+                recipient,
+                content,
+                reply_surbs,
+                lane,
+                packet_type,
+                mix_hops,
+            )
            .await
        {
            warn!("failed to send a repliable message - {err}")
@@ -106,8 +115,9 @@ where
                recipient,
                data,
                lane,
+                mix_hops,
            } => {
-                self.handle_plain_message(recipient, data, lane, PacketType::Mix)
+                self.handle_plain_message(recipient, data, lane, PacketType::Mix, mix_hops)
                    .await
            }
            InputMessage::Anonymous {
@@ -115,9 +125,17 @@ where
                data,
                reply_surbs,
                lane,
+                mix_hops,
            } => {
-                self.handle_repliable_message(recipient, data, reply_surbs, lane, PacketType::Mix)
-                    .await
+                self.handle_repliable_message(
+                    recipient,
+                    data,
+                    reply_surbs,
+                    lane,
+                    PacketType::Mix,
+                    mix_hops,
+                )
+                .await
            }
            InputMessage::Reply {
                recipient_tag,
@@ -135,8 +153,9 @@ where
                    recipient,
                    data,
                    lane,
+                    mix_hops,
                } => {
-                    self.handle_plain_message(recipient, data, lane, packet_type)
+                    self.handle_plain_message(recipient, data, lane, packet_type, mix_hops)
                        .await
                }
                InputMessage::Anonymous {
@@ -144,9 +163,17 @@ where
                    data,
                    reply_surbs,
                    lane,
+                    mix_hops,
                } => {
-                    self.handle_repliable_message(recipient, data, reply_surbs, lane, packet_type)
-                        .await
+                    self.handle_repliable_message(
+                        recipient,
+                        data,
+                        reply_surbs,
+                        lane,
+                        packet_type,
+                        mix_hops,
+                    )
+                    .await
                }
                InputMessage::Reply {
                    recipient_tag,
@@ -69,6 +69,7 @@ pub(crate) struct PendingAcknowledgement {
    message_chunk: Fragment,
    delay: SphinxDelay,
    destination: PacketDestination,
+    mix_hops: Option<u8>,
 }

 impl PendingAcknowledgement {
@@ -77,11 +78,13 @@ impl PendingAcknowledgement {
        message_chunk: Fragment,
        delay: SphinxDelay,
        recipient: Recipient,
+        mix_hops: Option<u8>,
    ) -> Self {
        PendingAcknowledgement {
            message_chunk,
            delay,
            destination: PacketDestination::KnownRecipient(recipient.into()),
+            mix_hops,
        }
    }

@@ -98,6 +101,9 @@ impl PendingAcknowledgement {
                recipient_tag,
                extra_surb_request,
            },
+            // Messages sent using SURBs are using the number of mix hops set by the recipient when
+            // they provided the SURBs, so it doesn't make sense to include it here.
+            mix_hops: None,
        }
    }

@@ -49,12 +49,18 @@ where
        packet_recipient: Recipient,
        chunk_data: Fragment,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<PreparedFragment, PreparationError> {
        debug!("retransmitting normal packet...");

        // TODO: Figure out retransmission packet type signaling
        self.message_handler
-            .try_prepare_single_chunk_for_sending(packet_recipient, chunk_data, packet_type)
+            .try_prepare_single_chunk_for_sending(
+                packet_recipient,
+                chunk_data,
+                packet_type,
+                mix_hops,
+            )
            .await
    }

@@ -89,6 +95,7 @@ where
                    **recipient,
                    timed_out_ack.message_chunk.clone(),
                    packet_type,
+                    timed_out_ack.mix_hops,
                )
                .await
            }
@@ -40,7 +40,7 @@ impl SentNotificationListener {
    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
        debug!("Started SentNotificationListener with graceful shutdown support");

-        while !shutdown.is_shutdown() {
+        loop {
            tokio::select! {
                frag_id = self.sent_notifier.next() => match frag_id {
                    Some(frag_id) => {
@@ -53,6 +53,7 @@ impl SentNotificationListener {
                },
                _ = shutdown.recv_with_delay() => {
                    log::trace!("SentNotificationListener: Received shutdown");
+                    break;
                }
            }
        }
@@ -418,9 +418,10 @@ where
        message: Vec<u8>,
        lane: TransmissionLane,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<(), PreparationError> {
        let message = NymMessage::new_plain(message);
-        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type)
+        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type, mix_hops)
            .await
    }

@@ -430,6 +431,7 @@ where
        recipient: Recipient,
        lane: TransmissionLane,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<(), PreparationError> {
        debug!("Sending non-reply message with packet type {packet_type}");
        // TODO: I really dislike existence of this assertion, it implies code has to be re-organised
@@ -461,6 +463,7 @@ where
                &self.config.ack_key,
                &recipient,
                packet_type,
+                mix_hops,
            )?;

            let real_message = RealMessage::new(
@@ -468,7 +471,8 @@ where
                Some(fragment.fragment_identifier()),
            );
            let delay = prepared_fragment.total_delay;
-            let pending_ack = PendingAcknowledgement::new_known(fragment, delay, recipient);
+            let pending_ack =
+                PendingAcknowledgement::new_known(fragment, delay, recipient, mix_hops);

            real_messages.push(real_message);
            pending_acks.push(pending_ack);
@@ -485,6 +489,7 @@ where
        recipient: Recipient,
        amount: u32,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<(), PreparationError> {
        debug!("Sending additional reply SURBs with packet type {packet_type}");
        let sender_tag = self.get_or_create_sender_tag(&recipient);
@@ -501,6 +506,7 @@ where
            recipient,
            TransmissionLane::AdditionalReplySurbs,
            packet_type,
+            mix_hops,
        )
        .await?;

@@ -517,6 +523,7 @@ where
        num_reply_surbs: u32,
        lane: TransmissionLane,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<(), SurbWrappedPreparationError> {
        debug!("Sending message with reply SURBs with packet type {packet_type}");
        let sender_tag = self.get_or_create_sender_tag(&recipient);
@@ -527,7 +534,7 @@ where
        let message =
            NymMessage::new_repliable(RepliableMessage::new_data(message, sender_tag, reply_surbs));

-        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type)
+        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type, mix_hops)
            .await?;

        log::trace!("storing {} reply keys", reply_keys.len());
@@ -541,6 +548,7 @@ where
        recipient: Recipient,
        chunk: Fragment,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<PreparedFragment, PreparationError> {
        debug!("Sending single chunk with packet type {packet_type}");
        let topology_permit = self.topology_access.get_read_permit().await;
@@ -554,6 +562,7 @@ where
                &self.config.ack_key,
                &recipient,
                packet_type,
+                mix_hops,
            )
            .unwrap();

@@ -500,11 +500,12 @@ where
        {
            let mut status_timer = tokio::time::interval(Duration::from_secs(5));

-            while !shutdown.is_shutdown() {
+            loop {
                tokio::select! {
                    biased;
                    _ = shutdown.recv_with_delay() => {
                        log::trace!("OutQueueControl: Received shutdown");
+                        break;
                    }
                    _ = status_timer.tick() => {
                        self.log_status(&mut shutdown);
@@ -516,6 +516,7 @@ where
                    recipient,
                    to_send,
                    nym_sphinx::params::PacketType::Mix,
+                    self.config.reply_surbs.surb_mix_hops,
                )
                .await
            {
@@ -39,7 +39,7 @@ where
        mem_state: CombinedReplyStorage,
        mut shutdown: nym_task::TaskClient,
    ) {
-        use log::{debug, error, info, warn};
+        use log::{debug, error, info};

        debug!("Started PersistentReplyStorage");
        if let Err(err) = self.backend.start_storage_session().await {
@@ -50,7 +50,7 @@ where
        shutdown.recv().await;

        info!("PersistentReplyStorage is flushing all reply-related data to underlying storage");
-        warn!("you MUST NOT forcefully shutdown now or you risk data corruption!");
+        info!("you MUST NOT forcefully shutdown now or you risk data corruption!");
        if let Err(err) = self.backend.flush_surb_storage(&mem_state).await {
            error!("failed to flush our reply-related data to the persistent storage: {err}")
        } else {
@@ -607,6 +607,10 @@ pub struct ReplySurbs {
    /// This is going to be superseded by key rotation once implemented.
    #[serde(with = "humantime_serde")]
    pub maximum_reply_key_age: Duration,
+
+    /// Specifies the number of mixnet hops the packet should go through. If not specified, then
+    /// the default value is used.
+    pub surb_mix_hops: Option<u8>,
 }

 impl Default for ReplySurbs {
@@ -622,6 +626,7 @@ impl Default for ReplySurbs {
            maximum_reply_surb_drop_waiting_period: DEFAULT_MAXIMUM_REPLY_SURB_DROP_WAITING_PERIOD,
            maximum_reply_surb_age: DEFAULT_MAXIMUM_REPLY_SURB_AGE,
            maximum_reply_key_age: DEFAULT_MAXIMUM_REPLY_KEY_AGE,
+            surb_mix_hops: None,
        }
    }
 }
@@ -155,6 +155,7 @@ impl From<ConfigV1_1_30> for Config {
                        .maximum_reply_surb_drop_waiting_period,
                    maximum_reply_surb_age: value.debug.reply_surbs.maximum_reply_surb_age,
                    maximum_reply_key_age: value.debug.reply_surbs.maximum_reply_key_age,
+                    surb_mix_hops: None,
                },
            },
        }
@@ -15,34 +15,34 @@ pub enum ClientCoreError {
    #[error("I/O error: {0}")]
    IoError(#[from] std::io::Error),

-    #[error("Gateway client error ({gateway_id}): {source}")]
+    #[error("gateway client error ({gateway_id}): {source}")]
    GatewayClientError {
        gateway_id: String,
        source: GatewayClientError,
    },

-    #[error("Custom gateway client error: {source}")]
+    #[error("custom gateway client error: {source}")]
    ErasedGatewayClientError {
        #[from]
        source: ErasedGatewayError,
    },

-    #[error("Ed25519 error: {0}")]
+    #[error("ed25519 error: {0}")]
    Ed25519RecoveryError(#[from] Ed25519RecoveryError),

-    #[error("Validator client error: {0}")]
+    #[error("validator client error: {0}")]
    ValidatorClientError(#[from] ValidatorClientError),

-    #[error("No gateway with id: {0}")]
+    #[error("no gateway with id: {0}")]
    NoGatewayWithId(String),

-    #[error("No gateways on network")]
+    #[error("no gateways on network")]
    NoGatewaysOnNetwork,

-    #[error("List of nym apis is empty")]
+    #[error("list of nym apis is empty")]
    ListOfNymApisIsEmpty,

-    #[error("The current network topology seem to be insufficient to route any packets through")]
+    #[error("the current network topology seem to be insufficient to route any packets through")]
    InsufficientNetworkTopology(#[from] NymTopologyError),

    #[error("experienced a failure with our reply surb persistent storage: {source}")]
@@ -60,7 +60,7 @@ pub enum ClientCoreError {
        source: Box<dyn Error + Send + Sync>,
    },

-    #[error("The gateway id is invalid - {0}")]
+    #[error("the gateway id is invalid - {0}")]
    UnableToCreatePublicKeyFromGatewayId(Ed25519RecoveryError),

    #[error("The gateway is malformed: {source}")]
@@ -79,23 +79,23 @@ pub enum ClientCoreError {
    #[error("failed to establish gateway connection (wasm)")]
    GatewayJsConnectionFailure,

-    #[error("Gateway connection was abruptly closed")]
+    #[error("gateway connection was abruptly closed")]
    GatewayConnectionAbruptlyClosed,

-    #[error("Timed out while trying to establish gateway connection")]
+    #[error("timed out while trying to establish gateway connection")]
    GatewayConnectionTimeout,

-    #[error("No ping measurements for the gateway ({identity}) performed")]
+    #[error("no ping measurements for the gateway ({identity}) performed")]
    NoGatewayMeasurements { identity: String },

    #[error("failed to register receiver for reconstructed mixnet messages")]
    FailedToRegisterReceiver,

-    #[error("Unexpected exit")]
+    #[error("unexpected exit")]
    UnexpectedExit,

    #[error(
-        "This operation would have resulted in clients keys being overwritten without permission"
+        "this operation would have resulted in clients keys being overwritten without permission"
    )]
    ForbiddenKeyOverwrite,

@@ -68,13 +68,23 @@ pub async fn current_gateways<R: Rng>(
    log::trace!("Fetching list of gateways from: {nym_api}");

    let gateways = client.get_cached_described_gateways().await?;
+    log::debug!("Found {} gateways", gateways.len());
+    log::trace!("Gateways: {:#?}", gateways);
+
    let valid_gateways = gateways
        .into_iter()
        .filter_map(|gateway| gateway.try_into().ok())
        .collect::<Vec<gateway::Node>>();
+    log::debug!("Ater checking validity: {}", valid_gateways.len());
+    log::trace!("Valid gateways: {:#?}", valid_gateways);

    // we were always filtering by version so I'm not removing that 'feature'
    let filtered_gateways = valid_gateways.filter_by_version(env!("CARGO_PKG_VERSION"));
+    log::debug!("After filtering for version: {}", filtered_gateways.len());
+    log::trace!("Filtered gateways: {:#?}", filtered_gateways);
+
+    log::info!("nym-api reports {} valid gateways", filtered_gateways.len());
+
    Ok(filtered_gateways)
 }

@@ -94,6 +94,8 @@ where
    D::StorageError: Send + Sync + 'static,
    T: DeserializeOwned + Serialize + Send + Sync,
 {
+    log::trace!("Setting up new gateway");
+
    // if we're setting up new gateway, failing to load existing information is fine.
    // as a matter of fact, it's only potentially a problem if we DO succeed
    if _load_gateway_details(details_store).await.is_ok() && !overwrite_data {
@@ -210,6 +212,7 @@ where
    D::StorageError: Send + Sync + 'static,
    T: DeserializeOwned + Serialize + Send + Sync,
 {
+    log::trace!("Setting up gateway");
    match setup {
        GatewaySetup::MustLoad => use_loaded_gateway_details(key_store, details_store).await,
        GatewaySetup::New {
@@ -45,13 +45,17 @@ cosmrs = { workspace = true, features = ["bip32", "cosmwasm"] }
 # import it just for the `Client` trait
 tendermint-rpc = { workspace = true }

+# this is an extremely nasty import. we're explicitly bringing in bip32 so that via the magic (or curse, pick your poison)
+# of cargo's feature unification we'd get `bip32/std` meaning we'd get `std::error::Error` for the re-exported (via cosmrs) bip32::Error type
+bip32 = { workspace = true, default-features = false, features = ["std"] }
+
 eyre = { version = "0.6" }
 cw-utils = { workspace = true }
 cw2 = { workspace = true }
 cw3 = { workspace = true }
 cw4 = { workspace = true }
 cw-controllers = { workspace = true }
-prost = { version = "0.11", default-features = false }
+prost = { workspace = true, default-features = false }
 flate2 = { version = "1.0.20" }
 sha2 = { version = "0.9.5" }
 itertools = { version = "0.10" }
@@ -20,12 +20,12 @@ impl CheckResponse for broadcast::tx_commit::Response {
            });
        }

-        if self.deliver_tx.code.is_err() {
+        if self.tx_result.code.is_err() {
            return Err(NyxdError::BroadcastTxErrorDeliverTx {
                hash: self.hash,
                height: Some(self.height),
-                code: self.deliver_tx.code.value(),
-                raw_log: self.deliver_tx.log,
+                code: self.tx_result.code.value(),
+                raw_log: self.tx_result.log,
            });
        }

@@ -11,7 +11,7 @@ pub mod gas_price;

 pub type GasAdjustment = f32;

-pub const DEFAULT_SIMULATED_GAS_MULTIPLIER: GasAdjustment = 1.3;
+pub const DEFAULT_SIMULATED_GAS_MULTIPLIER: GasAdjustment = 1.5;

 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AutoFeeGrant {
@@ -34,7 +34,9 @@ pub use crate::nyxd::fee::Fee;
 pub use crate::rpc::TendermintRpcClient;
 pub use coin::Coin;
 pub use cosmrs::bank::MsgSend;
-pub use cosmrs::tendermint::abci::{response::DeliverTx, Event, EventAttribute};
+pub use cosmrs::tendermint::abci::{
+    response::DeliverTx, types::ExecTxResult, Event, EventAttribute,
+};
 pub use cosmrs::tendermint::block::Height;
 pub use cosmrs::tendermint::hash::{self, Algorithm, Hash};
 pub use cosmrs::tendermint::validator::Info as TendermintValidatorInfo;
@@ -374,7 +376,11 @@ where
        })
    }

-    pub async fn simulate<I, M>(&self, messages: I) -> Result<SimulateResponse, NyxdError>
+    pub async fn simulate<I, M>(
+        &self,
+        messages: I,
+        memo: impl Into<String> + Send + 'static,
+    ) -> Result<SimulateResponse, NyxdError>
    where
        I: IntoIterator<Item = M> + Send,
        M: Msg,
@@ -389,7 +395,7 @@ where
                    .map_err(|_| {
                        NyxdError::SerializationError("custom simulate messages".to_owned())
                    })?,
-                "simulating execution of transactions",
+                memo,
            )
            .await
    }
@@ -28,7 +28,7 @@ where
    U: TryInto<HttpClientUrl, Error = Error>,
 {
    HttpRpcClient::builder(url.try_into()?)
-        .compat_mode(CompatMode::V0_34)
+        .compat_mode(CompatMode::V0_37)
        .build()
 }

@@ -36,7 +36,8 @@ pub struct ReqwestRpcClient {
 impl ReqwestRpcClient {
    pub fn new(url: Url) -> Self {
        ReqwestRpcClient {
-            compat: CompatMode::V0_34,
+            // after updating to nyxd 0.42 and thus updating to cometbft, the compat mode changed
+            compat: CompatMode::V0_37,
            inner: reqwest::Client::new(),
            url,
        }
@@ -21,7 +21,7 @@ rand = {version = "0.6", features = ["std"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
-time = { version = "0.3.6", features = ["parsing", "formatting"] }
+time = { workspace = true, features = ["parsing", "formatting"] }
 toml = "0.5.6"
 url = { workspace = true }
 tap = "1"
@@ -4,6 +4,7 @@
 use clap::{Args, Subcommand};

 pub mod update_config;
+pub mod update_cost_params;
 pub mod vesting_update_config;

 #[derive(Debug, Args)]
@@ -20,7 +21,5 @@ pub enum MixnetOperatorsMixnodeSettingsCommands {
    /// Update mixnode configuration for a mixnode bonded with locked tokens
    VestingUpdateConfig(vesting_update_config::Args),
    /// Update mixnode cost parameters
-    UpdateCostParameters,
-    /// Update mixnode cost parameters for a mixnode bonded with locked tokens
-    VestingUpdateCostParameters,
+    UpdateCostParameters(update_cost_params::Args),
 }
@@ -0,0 +1,48 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use cosmwasm_std::Uint128;
+use log::info;
+use nym_mixnet_contract_common::{MixNodeCostParams, Percent};
+use nym_validator_client::nyxd::contract_traits::MixnetSigningClient;
+use nym_validator_client::nyxd::CosmWasmCoin;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(
+        long,
+        help = "input your profit margin as follows; (so it would be 10, rather than 0.1)"
+    )]
+    pub profit_margin_percent: Option<u8>,
+
+    #[clap(
+        long,
+        help = "operating cost in current DENOMINATION (so it would be 'unym', rather than 'nym')"
+    )]
+    pub interval_operating_cost: Option<u128>,
+}
+
+pub async fn update_cost_params(args: Args, client: SigningClient) {
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+
+    let cost_params = MixNodeCostParams {
+        profit_margin_percent: Percent::from_percentage_value(
+            args.profit_margin_percent.unwrap_or(10) as u64,
+        )
+        .unwrap(),
+        interval_operating_cost: CosmWasmCoin {
+            denom: denom.into(),
+            amount: Uint128::new(args.interval_operating_cost.unwrap_or(40_000_000)),
+        },
+    };
+
+    info!("Starting mixnode params updating!");
+    let res = client
+        .update_mixnode_cost_params(cost_params, None)
+        .await
+        .expect("failed to update cost params");
+
+    info!("Cost params result: {:?}", res)
+}
@@ -4,7 +4,7 @@
 use handlebars::{Handlebars, TemplateRenderError};
 use serde::de::DeserializeOwned;
 use serde::Serialize;
-use std::fs::File;
+use std::fs::{create_dir_all, File};
 use std::io::Write;
 use std::path::{Path, PathBuf};
 use std::{fs, io};
@@ -25,12 +25,20 @@ pub const DEFAULT_CONFIG_FILENAME: &str = "config.toml";

 #[cfg(feature = "dirs")]
 pub fn must_get_home() -> PathBuf {
-    dirs::home_dir().expect("Failed to evaluate $HOME value")
+    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
+        home_dir.into()
+    } else {
+        dirs::home_dir().expect("Failed to evaluate $HOME value")
+    }
 }

 #[cfg(feature = "dirs")]
 pub fn may_get_home() -> Option<PathBuf> {
-    dirs::home_dir()
+    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
+        Some(home_dir.into())
+    } else {
+        dirs::home_dir()
+    }
 }

 pub trait NymConfigTemplate: Serialize {
@@ -64,16 +72,22 @@ where
    C: NymConfigTemplate,
    P: AsRef<Path>,
 {
-    log::debug!("trying to save config file to {}", path.as_ref().display());
-    let file = File::create(path.as_ref())?;
+    let path = path.as_ref();
+    log::debug!("trying to save config file to {}", path.display());

-    // TODO: check for whether any of our configs stores anything sensitive
+    if let Some(parent) = path.parent() {
+        create_dir_all(parent)?;
+    }
+
+    let file = File::create(path)?;
+
+    // TODO: check for whether any of our configs store anything sensitive
    // and change that to 0o644 instead
    #[cfg(target_family = "unix")]
    {
        use std::os::unix::fs::PermissionsExt;

-        let mut perms = fs::metadata(path.as_ref())?.permissions();
+        let mut perms = fs::metadata(path)?.permissions();
        perms.set_mode(0o600);
        fs::set_permissions(path, perms)?;
    }
@@ -142,7 +142,7 @@ pub fn funds_from_cosmos_msgs(msgs: Vec<CosmosMsg>) -> Option<Coin> {
        contract_addr: _,
        msg,
        funds: _,
-    })) = msgs.get(0)
+    })) = msgs.first()
    {
        if let Ok(ExecuteMsg::ReleaseFunds { funds }) = from_binary::<ExecuteMsg>(msg) {
            return Some(funds);
@@ -62,7 +62,7 @@ pub fn owner_from_cosmos_msgs(msgs: &[CosmosMsg]) -> Option<Addr> {
        contract_addr: _,
        msg,
        funds: _,
-    })) = msgs.get(0)
+    })) = msgs.first()
    {
        if let Ok(ExecuteMsg::VerifyVerificationKeyShare { owner, .. }) =
            from_binary::<ExecuteMsg>(msg)
@@ -3,6 +3,7 @@

 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::Decimal;
+use cosmwasm_std::OverflowError;
 use cosmwasm_std::Uint128;
 use serde::de::Error;
 use serde::{Deserialize, Deserializer};
@@ -71,6 +72,10 @@ impl Percent {
        // we know the cast from u128 to u8 is a safe one since the internal value must be within 0 - 1 range
        truncate_decimal(hundred * self.0).u128() as u8
    }
+
+    pub fn checked_pow(&self, exp: u32) -> Result<Self, OverflowError> {
+        self.0.checked_pow(exp).map(Percent)
+    }
 }

 impl Display for Percent {
@@ -25,12 +25,12 @@ humantime-serde = "1.1.1"

 # TO CHECK WHETHER STILL NEEDED:
 log = { workspace = true }
-time = { version = "0.3.6", features = ["parsing", "formatting"] }
+time = { workspace = true, features = ["parsing", "formatting"] }
 ts-rs = { workspace = true, optional = true }

 [dev-dependencies]
 rand_chacha = "0.3"
-time = { version = "0.3.5", features = ["serde", "macros"] }
+time = { workspace = true, features = ["serde", "macros"] }

 [features]
 default = []
@@ -49,7 +49,7 @@ impl Account {

    pub fn period_duration(&self) -> Result<u64, VestingContractError> {
        self.periods
-            .get(0)
+            .first()
            .ok_or(VestingContractError::UnpopulatedVestingPeriods {
                owner: self.owner_address.clone(),
            })
@@ -366,11 +366,7 @@ pub fn creating_proof_of_chunking_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
    let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
@@ -400,11 +396,7 @@ pub fn verifying_proof_of_chunking_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
    let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
@@ -436,11 +428,7 @@ pub fn creating_proof_of_secret_sharing_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);

@@ -478,11 +466,7 @@ pub fn verifying_proof_of_secret_sharing_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);

@@ -545,11 +529,7 @@ pub fn share_encryption_100(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();

    c.bench_function("100 shares encryption", |b| {
        b.iter(|| black_box(encrypt_shares(&remote_share_key_pairs, &params, &mut rng)))
@@ -115,11 +115,7 @@ impl Dealing {
            .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
            .collect::<Vec<_>>();

-        let remote_share_key_pairs = shares
-            .iter()
-            .zip(receivers.values())
-            .map(|(share, key)| (share, key))
-            .collect::<Vec<_>>();
+        let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
        let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();

        let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, params, &mut rng);
@@ -0,0 +1,19 @@
+[package]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+bincode = "1.3.3"
+bytes = "1.5.0"
+nym-sphinx = { path = "../nymsphinx" }
+rand = "0.8.5"
+serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }
@@ -0,0 +1,383 @@
+use std::net::IpAddr;
+
+use nym_sphinx::addressing::clients::Recipient;
+use serde::{Deserialize, Serialize};
+
+pub const CURRENT_VERSION: u8 = 1;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct IpPacketRequest {
+    pub version: u8,
+    pub data: IpPacketRequestData,
+}
+
+impl IpPacketRequest {
+    pub fn new_static_connect_request(
+        ip: IpAddr,
+        reply_to: Recipient,
+        reply_to_hops: Option<u8>,
+        reply_to_avg_mix_delays: Option<f64>,
+    ) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::StaticConnect(StaticConnectRequest {
+                    request_id,
+                    ip,
+                    reply_to,
+                    reply_to_hops,
+                    reply_to_avg_mix_delays,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_dynamic_connect_request(
+        reply_to: Recipient,
+        reply_to_hops: Option<u8>,
+        reply_to_avg_mix_delays: Option<f64>,
+    ) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::DynamicConnect(DynamicConnectRequest {
+                    request_id,
+                    reply_to,
+                    reply_to_hops,
+                    reply_to_avg_mix_delays,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketRequestData::Data(DataRequest { ip_packet }),
+        }
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            IpPacketRequestData::StaticConnect(request) => Some(request.request_id),
+            IpPacketRequestData::DynamicConnect(request) => Some(request.request_id),
+            IpPacketRequestData::Data(_) => None,
+        }
+    }
+
+    pub fn recipient(&self) -> Option<&Recipient> {
+        match &self.data {
+            IpPacketRequestData::StaticConnect(request) => Some(&request.reply_to),
+            IpPacketRequestData::DynamicConnect(request) => Some(&request.reply_to),
+            IpPacketRequestData::Data(_) => None,
+        }
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub enum IpPacketRequestData {
+    StaticConnect(StaticConnectRequest),
+    DynamicConnect(DynamicConnectRequest),
+    Data(DataRequest),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct StaticConnectRequest {
+    pub request_id: u64,
+    pub ip: IpAddr,
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+    // The number of mix node hops that responses should take, in addition to the entry and exit
+    // node. Zero means only client -> entry -> exit -> client.
+    pub reply_to_hops: Option<u8>,
+    // The average delay at each mix node, in milliseconds. Currently this is not supported by the
+    // ip packet router.
+    pub reply_to_avg_mix_delays: Option<f64>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DynamicConnectRequest {
+    pub request_id: u64,
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+    // The number of mix node hops that responses should take, in addition to the entry and exit
+    // node. Zero means only client -> entry -> exit -> client.
+    pub reply_to_hops: Option<u8>,
+    // The average delay at each mix node, in milliseconds. Currently this is not supported by the
+    // ip packet router.
+    pub reply_to_avg_mix_delays: Option<f64>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DataRequest {
+    pub ip_packet: bytes::Bytes,
+}
+
+// ---
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct IpPacketResponse {
+    pub version: u8,
+    pub data: IpPacketResponseData,
+}
+
+impl IpPacketResponse {
+    pub fn new_static_connect_success(request_id: u64, reply_to: Recipient) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
+                request_id,
+                reply_to,
+                reply: StaticConnectResponseReply::Success,
+            }),
+        }
+    }
+
+    pub fn new_static_connect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: StaticConnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
+                request_id,
+                reply_to,
+                reply: StaticConnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_dynamic_connect_success(request_id: u64, reply_to: Recipient, ip: IpAddr) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
+                request_id,
+                reply_to,
+                reply: DynamicConnectResponseReply::Success(DynamicConnectSuccess { ip }),
+            }),
+        }
+    }
+
+    pub fn new_dynamic_connect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: DynamicConnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
+                request_id,
+                reply_to,
+                reply: DynamicConnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Data(DataResponse { ip_packet }),
+        }
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            IpPacketResponseData::StaticConnect(response) => Some(response.request_id),
+            IpPacketResponseData::DynamicConnect(response) => Some(response.request_id),
+            IpPacketResponseData::Data(_) => None,
+        }
+    }
+
+    pub fn recipient(&self) -> Option<&Recipient> {
+        match &self.data {
+            IpPacketResponseData::StaticConnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::DynamicConnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::Data(_) => None,
+        }
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum IpPacketResponseData {
+    StaticConnect(StaticConnectResponse),
+    DynamicConnect(DynamicConnectResponse),
+    Data(DataResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct StaticConnectResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: StaticConnectResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum StaticConnectResponseReply {
+    Success,
+    Failure(StaticConnectFailureReason),
+}
+
+impl StaticConnectResponseReply {
+    pub fn is_success(&self) -> bool {
+        match self {
+            StaticConnectResponseReply::Success => true,
+            StaticConnectResponseReply::Failure(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum StaticConnectFailureReason {
+    #[error("requested ip address is already in use")]
+    RequestedIpAlreadyInUse,
+    #[error("requested nym-address is already in use")]
+    RequestedNymAddressAlreadyInUse,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DynamicConnectResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: DynamicConnectResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum DynamicConnectResponseReply {
+    Success(DynamicConnectSuccess),
+    Failure(DynamicConnectFailureReason),
+}
+
+impl DynamicConnectResponseReply {
+    pub fn is_success(&self) -> bool {
+        match self {
+            DynamicConnectResponseReply::Success(_) => true,
+            DynamicConnectResponseReply::Failure(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DynamicConnectSuccess {
+    pub ip: IpAddr,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum DynamicConnectFailureReason {
+    #[error("requested nym-address is already in use")]
+    RequestedNymAddressAlreadyInUse,
+    #[error("no available ip address")]
+    NoAvailableIp,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DataResponse {
+    pub ip_packet: bytes::Bytes,
+}
+
+fn make_bincode_serializer() -> impl bincode::Options {
+    use bincode::Options;
+    bincode::DefaultOptions::new()
+        .with_big_endian()
+        .with_varint_encoding()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn check_size_of_request() {
+        let connect = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::StaticConnect(
+                StaticConnectRequest {
+                    request_id: 123,
+                    ip: IpAddr::from([10, 0, 0, 1]),
+                    reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+                    reply_to_hops: None,
+                    reply_to_avg_mix_delays: None,
+                },
+            )
+        };
+        assert_eq!(connect.to_bytes().unwrap().len(), 107);
+    }
+
+    #[test]
+    fn check_size_of_data() {
+        let data = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::Data(DataRequest {
+                ip_packet: bytes::Bytes::from(vec![1u8; 32]),
+            }),
+        };
+        assert_eq!(data.to_bytes().unwrap().len(), 35);
+    }
+
+    #[test]
+    fn serialize_and_deserialize_data_request() {
+        let data = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::Data(DataRequest {
+                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+            }),
+        };
+
+        let serialized = data.to_bytes().unwrap();
+        let deserialized = IpPacketRequest::from_reconstructed_message(
+            &nym_sphinx::receiver::ReconstructedMessage {
+                message: serialized,
+                sender_tag: None,
+            },
+        )
+        .unwrap();
+
+        assert_eq!(deserialized.version, 4);
+        assert_eq!(
+            deserialized.data,
+            IpPacketRequestData::Data(DataRequest {
+                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+            })
+        );
+    }
+}
@@ -476,3 +476,11 @@ pub const DEFAULT_NYM_NODE_HTTP_PORT: u16 = 8080;
 pub const TOTAL_SUPPLY: u128 = 1_000_000_000_000_000;

 pub const DEFAULT_PROFIT_MARGIN: u8 = 10;
+
+// WIREGUARD
+pub const WG_PORT: u16 = 51822;
+
+// The interface used to route traffic
+pub const WG_TUN_BASE_NAME: &str = "nymwg";
+pub const WG_TUN_DEVICE_ADDRESS: &str = "10.1.0.1";
+pub const WG_TUN_DEVICE_NETMASK: &str = "255.255.255.0";
@@ -258,6 +258,7 @@ where
            &address,
            &address,
            PacketType::Mix,
+            None,
        )?)
    }

@@ -6,9 +6,10 @@ use criterion::{criterion_group, criterion_main, Criterion};
 use ff::Field;
 use group::{Curve, Group};
 use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, elgamal_keygen,
-    prepare_blind_sign, prove_bandwidth_credential, setup, ttp_keygen, verify_credential,
-    Attribute, BlindedSignature, Parameters, Signature, SignatureShare, VerificationKey,
+    aggregate_signature_shares, aggregate_verification_keys, blind_sign, prepare_blind_sign,
+    prove_bandwidth_credential, setup, ttp_keygen, verify_credential,
+    verify_partial_blind_signature, Attribute, BlindedSignature, Parameters, Signature,
+    SignatureShare, VerificationKey,
 };
 use rand::seq::SliceRandom;
 use std::ops::Neg;
@@ -175,8 +176,6 @@ fn bench_coconut(c: &mut Criterion) {
    let binding_number = params.random_scalar();
    let private_attributes = vec![serial_number, binding_number];

-    let _elgamal_keypair = elgamal_keygen(&params);
-
    // The prepare blind sign is performed by the user
    let (pedersen_commitments_openings, blind_sign_request) =
        prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
@@ -242,6 +241,29 @@ fn bench_coconut(c: &mut Criterion) {
        .map(|keypair| keypair.verification_key())
        .collect();

+    // verify a random partial blind signature
+    let rand_idx = 1;
+    let random_blind_signature = blinded_signatures.get(rand_idx).unwrap();
+    let partial_verification_key = verification_keys.get(rand_idx).unwrap();
+
+    group.bench_function(
+        &format!(
+            "verify_partial_blind_signature_{}_private_attributes_{}_public_attributes",
+            case.num_private_attrs, case.num_public_attrs
+        ),
+        |b| {
+            b.iter(|| {
+                verify_partial_blind_signature(
+                    &params,
+                    &blind_sign_request,
+                    &public_attributes,
+                    random_blind_signature,
+                    partial_verification_key,
+                )
+            })
+        },
+    );
+
    // Lets bench worse case, ie aggregating all
    let indices: Vec<u64> = (1..=case.num_authorities).collect();
    // aggregate verification keys
@@ -14,6 +14,7 @@ pub use scheme::aggregation::aggregate_signature_shares;
 pub use scheme::aggregation::aggregate_verification_keys;
 pub use scheme::issuance::blind_sign;
 pub use scheme::issuance::prepare_blind_sign;
+pub use scheme::issuance::verify_partial_blind_signature;
 pub use scheme::issuance::BlindSignRequest;
 pub use scheme::keygen::ttp_keygen;
 pub use scheme::keygen::KeyPair;
@@ -50,7 +50,7 @@ where
 impl Aggregatable for PartialSignature {
    fn aggregate(sigs: &[PartialSignature], indices: Option<&[u64]>) -> Result<Signature> {
        let h = sigs
-            .get(0)
+            .first()
            .ok_or_else(|| CoconutError::Aggregation("Empty set of signatures".to_string()))?
            .sig1();

@@ -3,12 +3,14 @@

 use std::convert::TryFrom;
 use std::convert::TryInto;
+use std::ops::Neg;

-use bls12_381::{G1Affine, G1Projective, Scalar};
-use group::{Curve, GroupEncoding};
+use bls12_381::{multi_miller_loop, G1Affine, G1Projective, G2Prepared, Scalar};
+use group::{Curve, Group, GroupEncoding};

 use crate::error::{CoconutError, Result};
 use crate::proofs::ProofCmCs;
+use crate::scheme::keygen::VerificationKey;
 use crate::scheme::setup::Parameters;
 use crate::scheme::BlindedSignature;
 use crate::scheme::SecretKey;
@@ -318,6 +320,97 @@ pub fn blind_sign(
    Ok(BlindedSignature(h, sig))
 }

+/// Verifies a partial blind signature using the provided parameters and validator's verification key.
+///
+/// # Arguments
+///
+/// * `params` - A reference to the cryptographic parameters.
+/// * `blind_sign_request` - A reference to the blind signature request signed by the client.
+/// * `public_attributes` - A reference to the public attributes included in the client's request.
+/// * `blind_sig` - A reference to the issued partial blinded signature to be verified.
+/// * `partial_verification_key` - A reference to the validator's partial verification key.
+///
+/// # Returns
+///
+/// A boolean indicating whether the partial blind signature is valid (`true`) or not (`false`).
+///
+/// # Remarks
+///
+/// This function verifies the correctness and validity of a partial blind signature using
+/// the provided cryptographic parameters, blind signature request, blinded signature,
+/// and partial verification key.
+/// It calculates pairings based on the provided values and checks whether the partial blind signature
+/// is consistent with the verification key and commitments in the blind signature request.
+/// The function returns `true` if the partial blind signature is valid, and `false` otherwise.
+pub fn verify_partial_blind_signature(
+    params: &Parameters,
+    blind_sign_request: &BlindSignRequest,
+    public_attributes: &[Attribute],
+    blind_sig: &BlindedSignature,
+    partial_verification_key: &VerificationKey,
+) -> bool {
+    let num_private_attributes = blind_sign_request.private_attributes_commitments.len();
+    if num_private_attributes + public_attributes.len() > partial_verification_key.beta_g2.len() {
+        return false;
+    }
+
+    // TODO: we're losing some memory here due to extra allocation,
+    // but worst-case scenario (given SANE amount of attributes), it's just few kb at most
+    let c_neg = blind_sig.1.to_affine().neg();
+    let g2_prep = params.prepared_miller_g2();
+
+    let mut terms = vec![
+        // (c^{-1}, g2)
+        (c_neg, g2_prep.clone()),
+        // (s, alpha)
+        (
+            blind_sig.0.to_affine(),
+            G2Prepared::from(partial_verification_key.alpha.to_affine()),
+        ),
+    ];
+
+    // for each private attribute, add (cm_i, beta_i) to the miller terms
+    for (private_attr_commit, beta_g2) in blind_sign_request
+        .private_attributes_commitments
+        .iter()
+        .zip(&partial_verification_key.beta_g2)
+    {
+        // (cm_i, beta_i)
+        terms.push((
+            private_attr_commit.to_affine(),
+            G2Prepared::from(beta_g2.to_affine()),
+        ))
+    }
+
+    // for each public attribute, add (s^pub_j, beta_{priv + j}) to the miller terms
+    for (pub_attr, beta_g2) in public_attributes.iter().zip(
+        partial_verification_key
+            .beta_g2
+            .iter()
+            .skip(num_private_attributes),
+    ) {
+        // (s^pub_j, beta_j)
+        terms.push((
+            (blind_sig.0 * pub_attr).to_affine(),
+            G2Prepared::from(beta_g2.to_affine()),
+        ))
+    }
+
+    // get the references to all the terms to get the arguments the miller loop expects
+    #[allow(clippy::map_identity)]
+    let terms_refs = terms.iter().map(|(g1, g2)| (g1, g2)).collect::<Vec<_>>();
+
+    // since checking whether e(a, b) == e(c, d)
+    // is equivalent to checking e(a, b) • e(c, d)^{-1} == id
+    // and thus to e(a, b) • e(c^{-1}, d) == id
+    //
+    // compute e(c^1, g2) • e(s, alpha) • e(cm_0, beta_0) • e(cm_i, beta_i) • (s^pub_0, beta_{i+1}) (s^pub_j, beta_{i + j})
+    multi_miller_loop(&terms_refs)
+        .final_exponentiation()
+        .is_identity()
+        .into()
+}
+
 #[cfg(test)]
 pub fn sign(
    params: &mut Parameters,
@@ -354,6 +447,7 @@ pub fn sign(
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::scheme::keygen::keygen;

    #[test]
    fn blind_sign_request_bytes_roundtrip() {
@@ -385,4 +479,81 @@ mod tests {
            lambda
        );
    }
+
+    #[test]
+    fn successful_verify_partial_blind_signature() {
+        let params = Parameters::new(4).unwrap();
+        let private_attributes = params.n_random_scalars(2);
+        let public_attributes = params.n_random_scalars(2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let blind_sig = blind_sign(
+            &params,
+            &validator_keypair.secret_key(),
+            &request,
+            &public_attributes,
+        )
+        .unwrap();
+
+        assert!(verify_partial_blind_signature(
+            &params,
+            &request,
+            &public_attributes,
+            &blind_sig,
+            &validator_keypair.verification_key()
+        ));
+    }
+
+    #[test]
+    fn successful_verify_partial_blind_signature_no_public_attributes() {
+        let params = Parameters::new(4).unwrap();
+        let private_attributes = params.n_random_scalars(2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &[]).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let blind_sig =
+            blind_sign(&params, &validator_keypair.secret_key(), &request, &[]).unwrap();
+
+        assert!(verify_partial_blind_signature(
+            &params,
+            &request,
+            &[],
+            &blind_sig,
+            &validator_keypair.verification_key()
+        ));
+    }
+
+    #[test]
+    fn fail_verify_partial_blind_signature_with_wrong_key() {
+        let params = Parameters::new(4).unwrap();
+        let private_attributes = params.n_random_scalars(2);
+        let public_attributes = params.n_random_scalars(2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let validator2_keypair = keygen(&params);
+        let blind_sig = blind_sign(
+            &params,
+            &validator_keypair.secret_key(),
+            &request,
+            &public_attributes,
+        )
+        .unwrap();
+
+        // this assertion should fail, as we try to verify with a wrong validator key
+        assert!(!verify_partial_blind_signature(
+            &params,
+            &request,
+            &public_attributes,
+            &blind_sig,
+            &validator2_keypair.verification_key()
+        ),);
+    }
 }
@@ -181,6 +181,7 @@ pub trait FragmentPreparer {
    /// - compute vk_b = g^x || v_b
    /// - compute sphinx_plaintext = SURB_ACK || g^x || v_b
    /// - compute sphinx_packet = Sphinx(recipient, sphinx_plaintext)
+    #[allow(clippy::too_many_arguments)]
    fn prepare_chunk_for_sending(
        &mut self,
        fragment: Fragment,
@@ -189,6 +190,7 @@ pub trait FragmentPreparer {
        packet_sender: &Recipient,
        packet_recipient: &Recipient,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<PreparedFragment, NymTopologyError> {
        // each plain or repliable packet (i.e. not a reply) attaches an ephemeral public key so that the recipient
        // could perform diffie-hellman with its own keys followed by a kdf to re-derive
@@ -226,7 +228,8 @@ pub trait FragmentPreparer {
        };

        // generate pseudorandom route for the packet
-        let hops = self.num_mix_hops();
+        let hops = mix_hops.unwrap_or(self.num_mix_hops());
+        log::trace!("Preparing chunk for sending with {} mix hops", hops);
        let route =
            topology.random_route_to_gateway(self.rng(), hops, packet_recipient.gateway())?;
        let destination = packet_recipient.as_sphinx_destination();
@@ -389,6 +392,7 @@ where
        ack_key: &AckKey,
        packet_recipient: &Recipient,
        packet_type: PacketType,
+        mix_hops: Option<u8>,
    ) -> Result<PreparedFragment, NymTopologyError> {
        let sender = self.sender_address;

@@ -400,6 +404,7 @@ where
            &sender,
            packet_recipient,
            packet_type,
+            mix_hops,
        )
    }

@@ -169,6 +169,10 @@ pub struct SphinxMessageReceiver {

 impl SphinxMessageReceiver {
    /// Allows setting non-default number of expected mix hops in the network.
+    // IMPORTANT NOTE: this is among others used to deserialize SURBs. Meaning that this is a
+    // global setting and currently always set to the default value. The implication is that it is
+    // not currently possible to have different number of hops for different SURB messages. So,
+    // don't try to use <3 mix hops for SURBs until this is refactored.
    #[must_use]
    pub fn with_mix_hops(mut self, hops: u8) -> Self {
        self.num_mix_hops = hops;
@@ -493,10 +493,16 @@ impl TaskClient {
 impl Drop for TaskClient {
    fn drop(&mut self) {
        if !self.mode.should_signal_on_drop() {
-            self.log(Level::Debug, "the task client is getting dropped");
+            self.log(
+                Level::Debug,
+                "the task client is getting dropped: this is expected during client shutdown",
+            );
            return;
        } else {
-            self.log(Level::Info, "the task client is getting dropped");
+            self.log(
+                Level::Info,
+                "the task client is getting dropped: this is expected during client shutdown",
+            );
        }

        if !self.is_shutdown_poll() {
@@ -1,7 +1,6 @@
 use crate::{manager::SentError, TaskManager};

 #[cfg(unix)]
-#[deprecated]
 pub async fn wait_for_signal() {
    use tokio::signal::unix::{signal, SignalKind};
    let mut sigterm = signal(SignalKind::terminate()).expect("Failed to setup SIGTERM channel");
@@ -0,0 +1,21 @@
+[package]
+name = "nym-tun"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+thiserror.workspace = true
+tokio = { workspace = true, features = ["rt-multi-thread", "net", "io-util", "time", "sync", "macros"] }
+etherparse = "0.13.0"
+log.workspace = true
+nym-wireguard-types = { path = "../wireguard-types", optional = true }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+tokio-tun = "0.11.2"
@@ -0,0 +1,7 @@
+#[cfg(target_os = "linux")]
+mod linux;
+
+pub mod tun_task_channel;
+
+#[cfg(target_os = "linux")]
+pub use linux::tun_device;
@@ -0,0 +1,255 @@
+use std::{
+    collections::HashMap,
+    net::{IpAddr, Ipv4Addr},
+    time::Duration,
+};
+
+use etherparse::{InternetSlice, SlicedPacket};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    time::timeout,
+};
+
+use crate::tun_task_channel::{
+    tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
+    TunTaskResponseSendError, TunTaskResponseTx, TunTaskRx, TunTaskTx,
+};
+
+const TUN_WRITE_TIMEOUT_MS: u64 = 1000;
+
+#[derive(thiserror::Error, Debug)]
+pub enum TunDeviceError {
+    #[error("timeout writing to tun device, dropping packet")]
+    TunWriteTimeout,
+
+    #[error("error writing to tun device: {source}")]
+    TunWriteError { source: std::io::Error },
+
+    #[error("failed to forward responding packet with tag: {source}")]
+    ForwardNatResponseFailed {
+        #[from]
+        source: TunTaskResponseSendError,
+    },
+
+    #[error("unable to parse headers in packet")]
+    UnableToParseHeaders {
+        #[from]
+        source: etherparse::ReadError,
+    },
+
+    #[error("unable to parse src and dst address from packet: ip header missing")]
+    UnableToParseAddressIpHeaderMissing,
+
+    #[error("unable to lock peer mutex")]
+    FailedToLockPeer,
+}
+
+fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun {
+    log::info!("Creating TUN device with: address={address}, netmask={netmask}");
+    // Read MTU size from env variable NYM_MTU_SIZE, else default to 1420.
+    let mtu = std::env::var("NYM_MTU_SIZE")
+        .map(|mtu| mtu.parse().expect("NYM_MTU_SIZE must be a valid integer"))
+        .unwrap_or(1420);
+    log::info!("Using MTU size: {mtu}");
+    tokio_tun::Tun::builder()
+        .name(name)
+        .tap(false)
+        .packet_info(false)
+        .mtu(mtu)
+        .up()
+        .address(address)
+        .netmask(netmask)
+        .try_build()
+        .expect("Failed to setup tun device, do you have permission?")
+}
+
+pub struct TunDevice {
+    // The TUN device that we read/write to, to send/receive packets
+    tun: tokio_tun::Tun,
+
+    // Incoming data that we should send
+    tun_task_rx: TunTaskRx,
+
+    // And when we get replies, this is where we should send it
+    tun_task_response_tx: TunTaskResponseTx,
+
+    routing_mode: RoutingMode,
+}
+
+pub enum RoutingMode {
+    // This is an alternative to the routing table, where we just match outgoing source IP with
+    // incoming destination IP.
+    Nat(NatInner),
+
+    // Just forward without checking anything
+    Passthrough,
+}
+
+impl RoutingMode {
+    pub fn new_nat() -> Self {
+        RoutingMode::Nat(NatInner {
+            nat_table: HashMap::new(),
+        })
+    }
+
+    pub fn new_passthrough() -> Self {
+        RoutingMode::Passthrough
+    }
+}
+
+pub struct NatInner {
+    nat_table: HashMap<IpAddr, u64>,
+}
+
+pub struct TunDeviceConfig {
+    pub base_name: String,
+    pub ip: Ipv4Addr,
+    pub netmask: Ipv4Addr,
+}
+
+impl TunDevice {
+    pub fn new(
+        routing_mode: RoutingMode,
+        config: TunDeviceConfig,
+    ) -> (Self, TunTaskTx, TunTaskResponseRx) {
+        let tun = Self::new_device_only(config);
+
+        // Channels to communicate with the other tasks
+        let (tun_task_tx, tun_task_rx) = tun_task_channel();
+        let (tun_task_response_tx, tun_task_response_rx) = tun_task_response_channel();
+
+        let tun_device = TunDevice {
+            tun_task_rx,
+            tun_task_response_tx,
+            tun,
+            routing_mode,
+        };
+
+        (tun_device, tun_task_tx, tun_task_response_rx)
+    }
+
+    pub fn new_device_only(config: TunDeviceConfig) -> tokio_tun::Tun {
+        let TunDeviceConfig {
+            base_name,
+            ip,
+            netmask,
+        } = config;
+        let name = format!("{base_name}%d");
+
+        let tun = setup_tokio_tun_device(&name, ip, netmask);
+        log::info!("Created TUN device: {}", tun.name());
+        tun
+    }
+
+    // Send outbound packets out on the wild internet
+    async fn handle_tun_write(&mut self, data: TunTaskPayload) -> Result<(), TunDeviceError> {
+        let (tag, packet) = data;
+        let ParsedAddresses { src_addr, dst_addr } = parse_src_dst_address(&packet)?;
+        log::debug!(
+            "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
+            packet.len()
+        );
+
+        // TODO: expire old entries
+        if let RoutingMode::Nat(nat_table) = &mut self.routing_mode {
+            nat_table.nat_table.insert(src_addr, tag);
+        }
+
+        timeout(
+            Duration::from_millis(TUN_WRITE_TIMEOUT_MS),
+            self.tun.write_all(&packet),
+        )
+        .await
+        .map_err(|_| TunDeviceError::TunWriteTimeout)?
+        .map_err(|err| TunDeviceError::TunWriteError { source: err })
+    }
+
+    // Receive reponse packets from the wild internet
+    async fn handle_tun_read(&self, packet: &[u8]) -> Result<(), TunDeviceError> {
+        let ParsedAddresses { src_addr, dst_addr } = parse_src_dst_address(packet)?;
+        log::debug!(
+            "iface: read Packet({dst_addr} <- {src_addr}, {} bytes)",
+            packet.len(),
+        );
+
+        // Route packet to the correct peer.
+
+        match self.routing_mode {
+            // But we can also do it by consulting the NAT table.
+            RoutingMode::Nat(ref nat_table) => {
+                if let Some(tag) = nat_table.nat_table.get(&dst_addr) {
+                    log::debug!("Forward packet with NAT tag: {tag}");
+                    return self
+                        .tun_task_response_tx
+                        .try_send((*tag, packet.to_vec()))
+                        .map_err(|err| err.into());
+                }
+            }
+
+            RoutingMode::Passthrough => {
+                // TODO: skip the parsing at the top of the function
+                log::debug!("Forward packet without checking anything");
+                return self
+                    .tun_task_response_tx
+                    .try_send((0, packet.to_vec()))
+                    .map_err(|err| err.into());
+            }
+        }
+
+        log::info!("No peer found, packet dropped");
+        Ok(())
+    }
+
+    pub async fn run(mut self) {
+        let mut buf = [0u8; 65535];
+
+        loop {
+            tokio::select! {
+                // Reading from the TUN device
+                len = self.tun.read(&mut buf) => match len {
+                    Ok(len) => {
+                        let packet = &buf[..len];
+                        if let Err(err) = self.handle_tun_read(packet).await {
+                            log::error!("iface: handle_tun_read failed: {err}")
+                        }
+                    },
+                    Err(err) => {
+                        log::info!("iface: read error: {err}");
+                        // break;
+                    }
+                },
+                // Writing to the TUN device
+                Some(data) = self.tun_task_rx.recv() => {
+                    if let Err(err) = self.handle_tun_write(data).await {
+                        log::error!("iface: handle_tun_write failed: {err}");
+                    }
+                }
+            }
+        }
+        // log::info!("TUN device shutting down");
+    }
+
+    pub fn start(self) {
+        tokio::spawn(async move { self.run().await });
+    }
+}
+
+struct ParsedAddresses {
+    src_addr: IpAddr,
+    dst_addr: IpAddr,
+}
+
+fn parse_src_dst_address(packet: &[u8]) -> Result<ParsedAddresses, TunDeviceError> {
+    let headers = SlicedPacket::from_ip(packet)?;
+    match headers.ip {
+        Some(InternetSlice::Ipv4(ip, _)) => Ok(ParsedAddresses {
+            src_addr: ip.source_addr().into(),
+            dst_addr: ip.destination_addr().into(),
+        }),
+        Some(InternetSlice::Ipv6(ip, _)) => Ok(ParsedAddresses {
+            src_addr: ip.source_addr().into(),
+            dst_addr: ip.destination_addr().into(),
+        }),
+        None => Err(TunDeviceError::UnableToParseAddressIpHeaderMissing),
+    }
+}
@@ -1,25 +1,26 @@
+#![cfg_attr(not(target_os = "linux"), allow(dead_code))]
+
 use std::time::Duration;

-use tokio::{
-    sync::mpsc::{self, error::SendError},
-    time::{error::Elapsed, timeout},
+use tokio::sync::mpsc::{
+    self,
+    error::{SendError, SendTimeoutError, TrySendError},
 };

 pub(crate) type TunTaskPayload = (u64, Vec<u8>);

 #[derive(Clone)]
 pub struct TunTaskTx(mpsc::Sender<TunTaskPayload>);
-pub(crate) struct TunTaskRx(pub(crate) mpsc::Receiver<TunTaskPayload>);
-
-pub(crate) struct TunTaskRxStream(pub(crate) tokio_stream::wrappers::ReceiverStream<TunTaskPayload>);
+pub(crate) struct TunTaskRx(mpsc::Receiver<TunTaskPayload>);

 impl TunTaskTx {
-    pub async fn send(
-        &self,
-        data: TunTaskPayload,
-    ) -> Result<(), tokio::sync::mpsc::error::SendError<TunTaskPayload>> {
+    pub async fn send(&self, data: TunTaskPayload) -> Result<(), SendError<TunTaskPayload>> {
        self.0.send(data).await
    }
+
+    pub fn try_send(&self, data: TunTaskPayload) -> Result<(), TrySendError<TunTaskPayload>> {
+        self.0.try_send(data)
+    }
 }

 impl TunTaskRx {
@@ -29,28 +30,42 @@ impl TunTaskRx {
 }

 pub(crate) fn tun_task_channel() -> (TunTaskTx, TunTaskRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
    (TunTaskTx(tun_task_tx), TunTaskRx(tun_task_rx))
 }

+const TUN_TASK_RESPONSE_SEND_TIMEOUT_MS: u64 = 1_000;
+
 // Send responses back from the tun device back to the PacketRelayer
 pub(crate) struct TunTaskResponseTx(mpsc::Sender<TunTaskPayload>);
 pub struct TunTaskResponseRx(mpsc::Receiver<TunTaskPayload>);

 #[derive(thiserror::Error, Debug)]
 pub enum TunTaskResponseSendError {
-    #[error("failed to send: timeout")]
-    Timeout(#[from] Elapsed),
+    #[error("failed to send tun response: {0}")]
+    SendTimeoutError(#[from] SendTimeoutError<TunTaskPayload>),

-    #[error("failed to send: {0}")]
+    #[error("failed to send tun response: {0}")]
    SendError(#[from] SendError<TunTaskPayload>),
+
+    #[error("failed to send tun response: {0}")]
+    TrySendError(#[from] TrySendError<TunTaskPayload>),
 }

 impl TunTaskResponseTx {
+    #[allow(unused)]
    pub(crate) async fn send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
-        timeout(Duration::from_millis(1000), self.0.send(data))
-            .await?
-            .map_err(|err| err.into())
+        Ok(self
+            .0
+            .send_timeout(
+                data,
+                Duration::from_millis(TUN_TASK_RESPONSE_SEND_TIMEOUT_MS),
+            )
+            .await?)
+    }
+
+    pub(crate) fn try_send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
+        Ok(self.0.try_send(data)?)
    }
 }

@@ -61,7 +76,7 @@ impl TunTaskResponseRx {
 }

 pub(crate) fn tun_task_response_channel() -> (TunTaskResponseTx, TunTaskResponseRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
    (
        TunTaskResponseTx(tun_task_tx),
        TunTaskResponseRx(tun_task_rx),
@@ -77,7 +77,7 @@ impl GatewayBond {
    }
 }

-#[derive(Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize)]
 pub struct GatewayNodeDetailsResponse {
    pub identity_key: String,
    pub sphinx_key: String,
@@ -88,6 +88,7 @@ pub struct GatewayNodeDetailsResponse {
    pub data_store: String,

    pub network_requester: Option<GatewayNetworkRequesterDetails>,
+    pub ip_packet_router: Option<GatewayIpPacketRouterDetails>,
 }

 impl fmt::Display for GatewayNodeDetailsResponse {
@@ -98,7 +99,7 @@ impl fmt::Display for GatewayNodeDetailsResponse {
        writeln!(f, "bind address: {}", self.bind_address)?;
        writeln!(
            f,
-            "mix Port: {}, clients port: {}",
+            "mix port: {}, clients port: {}",
            self.mix_port, self.clients_port
        )?;

@@ -107,11 +108,15 @@ impl fmt::Display for GatewayNodeDetailsResponse {
        if let Some(nr) = &self.network_requester {
            nr.fmt(f)?;
        }
+
+        if let Some(ipr) = &self.ip_packet_router {
+            ipr.fmt(f)?;
+        }
        Ok(())
    }
 }

-#[derive(Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize)]
 pub struct GatewayNetworkRequesterDetails {
    pub enabled: bool,

@@ -149,7 +154,7 @@ impl fmt::Display for GatewayNetworkRequesterDetails {
    }
 }

-#[derive(Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize)]
 pub struct GatewayIpPacketRouterDetails {
    pub enabled: bool,

@@ -164,7 +169,7 @@ pub struct GatewayIpPacketRouterDetails {

 impl fmt::Display for GatewayIpPacketRouterDetails {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        writeln!(f, "IP packet router:")?;
+        writeln!(f, "ip packet router:")?;
        writeln!(f, "\tenabled: {}", self.enabled)?;
        writeln!(f, "\tconfig path: {}", self.config_path)?;

@@ -434,6 +434,10 @@ pub struct ReplySurbsWasm {
    /// Defines maximum amount of time given reply key is going to be valid for.
    /// This is going to be superseded by key rotation once implemented.
    pub maximum_reply_key_age_ms: u32,
+
+    /// Defines how many mix nodes the reply surb should go through.
+    /// If not set, the default value is going to be used.
+    pub surb_mix_hops: Option<u8>,
 }

 impl Default for ReplySurbsWasm {
@@ -463,6 +467,7 @@ impl From<ReplySurbsWasm> for ConfigReplySurbs {
            maximum_reply_key_age: Duration::from_millis(
                reply_surbs.maximum_reply_key_age_ms as u64,
            ),
+            surb_mix_hops: reply_surbs.surb_mix_hops,
        }
    }
 }
@@ -484,6 +489,7 @@ impl From<ConfigReplySurbs> for ReplySurbsWasm {
                .as_millis() as u32,
            maximum_reply_surb_age_ms: reply_surbs.maximum_reply_surb_age.as_millis() as u32,
            maximum_reply_key_age_ms: reply_surbs.maximum_reply_key_age.as_millis() as u32,
+            surb_mix_hops: reply_surbs.surb_mix_hops,
        }
    }
 }
@@ -303,6 +303,9 @@ pub struct ReplySurbsWasmOverride {
    /// This is going to be superseded by key rotation once implemented.
    #[tsify(optional)]
    pub maximum_reply_key_age_ms: Option<u32>,
+
+    #[tsify(optional)]
+    pub surb_mix_hops: Option<u8>,
 }

 impl From<ReplySurbsWasmOverride> for ReplySurbsWasm {
@@ -337,6 +340,7 @@ impl From<ReplySurbsWasmOverride> for ReplySurbsWasm {
            maximum_reply_key_age_ms: value
                .maximum_reply_key_age_ms
                .unwrap_or(def.maximum_reply_key_age_ms),
+            surb_mix_hops: value.surb_mix_hops,
        }
    }
 }
@@ -13,6 +13,7 @@ license.workspace = true
 [dependencies]
 base64 = { workspace = true }
 dashmap = { workspace = true }
+log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }

@@ -28,13 +29,7 @@ sha2 = { version = "0.10.8", optional = true }
 utoipa = { workspace = true, optional = true }
 serde_json = { workspace = true, optional = true }

-# target-specific dependencies
-[target."cfg(not(target_arch = \"wasm32\"))".dependencies.boringtun]
-workspace = true
-
-[target."cfg(target_arch = \"wasm32\")".dependencies.x25519-dalek]
-version = "2.0.0"
-
+x25519-dalek = { version = "2.0.0", features = ["static_secrets"] }

 [dev-dependencies]
 rand = "0.7.3"
@@ -45,4 +40,4 @@ nym-crypto = { path = "../crypto", features = ["rand"]}
 default = ["verify"]
 openapi = ["utoipa", "serde_json"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
-verify = ["hmac", "sha2"]
+verify = ["hmac", "sha2"]
@@ -13,5 +13,3 @@ pub use registration::{

 #[cfg(feature = "verify")]
 pub use registration::HmacSha256;
-
-pub const WG_PORT: u16 = 51822;
@@ -10,20 +10,14 @@ use std::hash::{Hash, Hasher};
 use std::ops::Deref;
 use std::str::FromStr;

-// underneath the same library is being used, i.e. x25519-dalek 2.0,
-// which is being reexported by boringtun but wasm hates internals of boringtun
-#[cfg(target_arch = "wasm32")]
-use x25519_dalek::PublicKey as BoringtunPublicKey;
-
-#[cfg(not(target_arch = "wasm32"))]
-use boringtun::x25519::PublicKey as BoringtunPublicKey;
+use x25519_dalek::PublicKey;

 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
-pub struct PeerPublicKey(BoringtunPublicKey);
+pub struct PeerPublicKey(PublicKey);

 impl PeerPublicKey {
    #[allow(dead_code)]
-    pub fn new(key: BoringtunPublicKey) -> Self {
+    pub fn new(key: PublicKey) -> Self {
        PeerPublicKey(key)
    }

@@ -45,7 +39,7 @@ impl Hash for PeerPublicKey {
 }

 impl Deref for PeerPublicKey {
-    type Target = BoringtunPublicKey;
+    type Target = PublicKey;

    fn deref(&self) -> &Self::Target {
        &self.0
@@ -71,7 +65,7 @@ impl FromStr for PeerPublicKey {
            })?;
        };

-        Ok(PeerPublicKey(BoringtunPublicKey::from(key_arr)))
+        Ok(PeerPublicKey(PublicKey::from(key_arr)))
    }
 }

@@ -93,11 +93,10 @@ impl GatewayClient {
    ) -> Self {
        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
        #[allow(clippy::expect_used)]
-        let static_secret = boringtun::x25519::StaticSecret::try_from(local_secret.to_bytes())
-            .expect("conversion between x25519 private keys is infallible");
-        let local_public: boringtun::x25519::PublicKey = (&static_secret).into();
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();

-        let remote_public = boringtun::x25519::PublicKey::from(remote_public.to_bytes());
+        let remote_public = x25519_dalek::PublicKey::from(remote_public.to_bytes());

        let dh = static_secret.diffie_hellman(&remote_public);

@@ -123,8 +122,7 @@ impl GatewayClient {
    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
        #[allow(clippy::expect_used)]
-        let static_secret = boringtun::x25519::StaticSecret::try_from(gateway_key.to_bytes())
-            .expect("conversion between x25519 private keys is infallible");
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());

        let dh = static_secret.diffie_hellman(&self.pub_key);

@@ -11,28 +11,15 @@ license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
-async-recursion = "1.0.4"
 base64 = "0.21.3"
 # The latest version on crates.io at the time of writing this (6.0.0) has a
 # version mismatch with x25519-dalek/curve25519-dalek that is resolved in the
 # latest commit. So pick that for now.
-#boringtun = "0.6.0"
-boringtun = { workspace = true }
-bytes = "1.5.0"
-dashmap = "5.5.3"
-etherparse = "0.13.0"
-futures = "0.3.28"
+x25519-dalek = "2.0.0"
+defguard_wireguard_rs = { git = "https://github.com/neacsu/wireguard-rs.git", rev = "c2cd0c1119f699f4bc43f5e6ffd6fc242caa42ed" }
 ip_network = "0.4.1"
-ip_network_table = "0.2.0"
 log.workspace = true
+nym-network-defaults = { path = "../network-defaults" }
 nym-task = { path = "../task" }
 nym-wireguard-types = { path = "../wireguard-types" }
-rand.workspace = true
-serde = { workspace = true, features = ["derive"] }
-tap.workspace = true
-thiserror.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "net", "io-util"] }
-tokio-stream = { version = "0.1.11" }
-
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio-tun = "0.9.0"
@@ -1,94 +0,0 @@
-use std::{net::SocketAddr, time::Duration};
-
-use boringtun::x25519;
-use dashmap::{
-    mapref::one::{Ref, RefMut},
-    DashMap,
-};
-use tokio::{
-    sync::mpsc::{self},
-    time::{error::Elapsed, timeout},
-};
-
-use crate::event::Event;
-
-// Channels that are used to communicate with the various tunnels
-#[derive(Clone)]
-pub struct PeerEventSender(mpsc::Sender<Event>);
-pub(crate) struct PeerEventReceiver(mpsc::Receiver<Event>);
-
-#[derive(thiserror::Error, Debug)]
-pub enum PeerEventSenderError {
-    #[error("timeout")]
-    Timeout {
-        #[from]
-        source: Elapsed,
-    },
-
-    #[error("send failed: {source}")]
-    SendError {
-        #[from]
-        source: mpsc::error::SendError<Event>,
-    },
-}
-
-impl PeerEventSender {
-    pub(crate) async fn send(&self, event: Event) -> Result<(), PeerEventSenderError> {
-        timeout(Duration::from_millis(1000), self.0.send(event))
-            .await?
-            .map_err(|err| err.into())
-    }
-}
-
-impl PeerEventReceiver {
-    pub(crate) async fn recv(&mut self) -> Option<Event> {
-        self.0.recv().await
-    }
-}
-
-pub(crate) fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
-    let (tx, rx) = mpsc::channel(16);
-    (PeerEventSender(tx), PeerEventReceiver(rx))
-}
-
-pub(crate) type PeersByKey = DashMap<x25519::PublicKey, PeerEventSender>;
-pub(crate) type PeersByAddr = DashMap<SocketAddr, PeerEventSender>;
-
-#[derive(Default)]
-pub(crate) struct ActivePeers {
-    active_peers: PeersByKey,
-    active_peers_by_addr: PeersByAddr,
-}
-
-impl ActivePeers {
-    pub(crate) fn remove(&self, public_key: &x25519::PublicKey) {
-        log::info!("Removing peer: {public_key:?}");
-        self.active_peers.remove(public_key);
-        log::warn!("TODO: remove from peers_by_ip?");
-        log::warn!("TODO: remove from peers_by_addr");
-    }
-
-    pub(crate) fn insert(
-        &self,
-        public_key: x25519::PublicKey,
-        addr: SocketAddr,
-        peer_tx: PeerEventSender,
-    ) {
-        self.active_peers.insert(public_key, peer_tx.clone());
-        self.active_peers_by_addr.insert(addr, peer_tx);
-    }
-
-    pub(crate) fn get_by_key_mut(
-        &self,
-        public_key: &x25519::PublicKey,
-    ) -> Option<RefMut<'_, x25519::PublicKey, PeerEventSender>> {
-        self.active_peers.get_mut(public_key)
-    }
-
-    pub(crate) fn get_by_addr(
-        &self,
-        addr: &SocketAddr,
-    ) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
-        self.active_peers_by_addr.get(addr)
-    }
-}
@@ -1,9 +0,0 @@
-use thiserror::Error;
-
-#[derive(Error, Debug)]
-pub enum WgError {
-    #[error("unable to get tunnel")]
-    UnableToGetTunnel,
-    #[error("handshake failed")]
-    HandshakeFailed,
-}
@@ -1,34 +0,0 @@
-use std::fmt::{Display, Formatter};
-
-use bytes::Bytes;
-
-#[allow(unused)]
-#[derive(Debug)]
-pub enum Event {
-    /// IP packet received from the WireGuard tunnel that should be passed through to the
-    /// corresponding virtual device/internet.
-    Wg(Bytes),
-    /// IP packet received from the WireGuard tunnel that was verified as part of the handshake.
-    WgVerified(Bytes),
-    /// IP packet to be sent through the WireGuard tunnel as crafted by the virtual device.
-    Ip(Bytes),
-}
-
-impl Display for Event {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Event::Wg(data) => {
-                let size = data.len();
-                write!(f, "Wg{{ size={size} }}")
-            }
-            Event::WgVerified(data) => {
-                let size = data.len();
-                write!(f, "WgVerified{{ size={size} }}")
-            }
-            Event::Ip(data) => {
-                let size = data.len();
-                write!(f, "Ip{{ size={size} }}")
-            }
-        }
-    }
-}
@@ -3,89 +3,55 @@
 // #![warn(clippy::expect_used)]
 // #![warn(clippy::unwrap_used)]

-mod active_peers;
-mod error;
-mod event;
-mod network_table;
-mod packet_relayer;
-mod platform;
-mod registered_peers;
-mod setup;
-pub mod tun_task_channel;
-mod udp_listener;
-mod wg_tunnel;
+pub mod setup;

 use nym_wireguard_types::registration::GatewayClientRegistry;
 use std::sync::Arc;

 // Currently the module related to setting up the virtual network device is platform specific.
 #[cfg(target_os = "linux")]
-pub use platform::linux::tun_device;
+use crate::setup::{peer_allowed_ips, peer_static_public_key, PRIVATE_KEY};
+use defguard_wireguard_rs::WGApi;
+#[cfg(target_os = "linux")]
+use defguard_wireguard_rs::{
+    host::Peer, key::Key, net::IpAddrMask, InterfaceConfiguration, WireguardInterfaceApi,
+};
+#[cfg(target_os = "linux")]
+use nym_network_defaults::{WG_PORT, WG_TUN_DEVICE_ADDRESS};

-/// Start wireguard UDP listener and TUN device
-///
-/// # Errors
-///
-/// This function will return an error if either the UDP listener of the TUN device fails to start.
+/// Start wireguard device
 #[cfg(target_os = "linux")]
 pub async fn start_wireguard(
-    task_client: nym_task::TaskClient,
-    gateway_client_registry: Arc<GatewayClientRegistry>,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync + 'static>> {
-    // TODO: make this configurable
-
-    // We can optionally index peers by their IP like standard wireguard. If we don't then we do
-    // plain NAT where we match incoming destination IP with outgoing source IP.
-    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(network_table::NetworkTable::new()));
-
-    // Alternative 1:
-    let routing_mode = tun_device::RoutingMode::new_allowed_ips(peers_by_ip.clone());
-    // Alternative 2:
-    //let routing_mode = tun_device::RoutingMode::new_nat();
-
-    // Start the tun device that is used to relay traffic outbound
-    let config = tun_device::TunDeviceConfig {
-        base_name: setup::TUN_BASE_NAME.to_string(),
-        ip: setup::TUN_DEVICE_ADDRESS.parse().unwrap(),
-        netmask: setup::TUN_DEVICE_NETMASK.parse().unwrap(),
+    mut task_client: nym_task::TaskClient,
+    _gateway_client_registry: Arc<GatewayClientRegistry>,
+) -> Result<WGApi, Box<dyn std::error::Error + Send + Sync + 'static>> {
+    let ifname = String::from("wg0");
+    let wgapi = WGApi::new(ifname.clone(), false)?;
+    wgapi.create_interface()?;
+    let interface_config = InterfaceConfiguration {
+        name: ifname.clone(),
+        prvkey: PRIVATE_KEY.to_string(),
+        address: WG_TUN_DEVICE_ADDRESS.to_string(),
+        port: WG_PORT as u32,
+        peers: vec![],
    };
-    let (tun, tun_task_tx, tun_task_response_rx) = tun_device::TunDevice::new(routing_mode, config);
-    tun.start();
+    wgapi.configure_interface(&interface_config)?;
+    let peer = peer_static_public_key();
+    let mut peer = Peer::new(Key::new(peer.to_bytes()));
+    let peer_ip = peer_allowed_ips();
+    let peer_ip_mask = IpAddrMask::new(peer_ip.network_address(), peer_ip.netmask());
+    peer.set_allowed_ips(vec![peer_ip_mask]);
+    wgapi.configure_peer(&peer)?;
+    wgapi.configure_peer_routing(&[peer.clone()])?;

-    // We also index peers by a tag
-    let peers_by_tag = Arc::new(tokio::sync::Mutex::new(wg_tunnel::PeersByTag::new()));
+    tokio::spawn(async move { task_client.recv().await });

-    // If we want to have the tun device on a separate host, it's the tun_task and
-    // tun_task_response channels that needs to be sent over the network to the host where the tun
-    // device is running.
-
-    // The packet relayer's responsibility is to route packets between the correct tunnel and the
-    // tun device. The tun device may or may not be on a separate host, which is why we can't do
-    // this routing in the tun device itself.
-    let (packet_relayer, packet_tx) = packet_relayer::PacketRelayer::new(
-        tun_task_tx.clone(),
-        tun_task_response_rx,
-        peers_by_tag.clone(),
-    );
-    packet_relayer.start();
-
-    // Start the UDP listener that clients connect to
-    let udp_listener = udp_listener::WgUdpListener::new(
-        packet_tx,
-        peers_by_ip,
-        peers_by_tag,
-        Arc::clone(&gateway_client_registry),
-    )
-    .await?;
-    udp_listener.start(task_client);
-
-    Ok(())
+    Ok(wgapi)
 }
-
 #[cfg(not(target_os = "linux"))]
 pub async fn start_wireguard(
    _task_client: nym_task::TaskClient,
    _gateway_client_registry: Arc<GatewayClientRegistry>,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync + 'static>> {
+) -> Result<WGApi, Box<dyn std::error::Error + Send + Sync + 'static>> {
    todo!("WireGuard is currently only supported on Linux")
 }
@@ -1,25 +0,0 @@
-use std::net::IpAddr;
-
-use ip_network::IpNetwork;
-use ip_network_table::IpNetworkTable;
-
-#[derive(Default)]
-pub struct NetworkTable<T> {
-    ips: IpNetworkTable<T>,
-}
-
-impl<T> NetworkTable<T> {
-    pub(crate) fn new() -> Self {
-        Self {
-            ips: IpNetworkTable::new(),
-        }
-    }
-
-    pub fn insert<N: Into<IpNetwork>>(&mut self, network: N, data: T) -> Option<T> {
-        self.ips.insert(network, data)
-    }
-
-    pub fn longest_match<I: Into<IpAddr>>(&self, ip: I) -> Option<(IpNetwork, &T)> {
-        self.ips.longest_match(ip)
-    }
-}
@@ -1,76 +0,0 @@
-use std::{collections::HashMap, sync::Arc};
-
-use tap::TapFallible;
-use tokio::sync::mpsc::{self};
-
-use crate::{
-    active_peers::PeerEventSender,
-    event::Event,
-    tun_task_channel::{TunTaskResponseRx, TunTaskTx},
-};
-
-#[derive(Clone)]
-pub struct PacketRelaySender(pub(crate) mpsc::Sender<(u64, Vec<u8>)>);
-pub(crate) struct PacketRelayReceiver(pub(crate) mpsc::Receiver<(u64, Vec<u8>)>);
-
-pub(crate) fn packet_relay_channel() -> (PacketRelaySender, PacketRelayReceiver) {
-    let (tx, rx) = mpsc::channel(16);
-    (PacketRelaySender(tx), PacketRelayReceiver(rx))
-}
-
-// The tunnels send packets to the packet relayer, which then relays it to the tun device. And
-// conversely, it's where the tun device send responses to, which are relayed back to the correct
-// tunnel.
-pub(crate) struct PacketRelayer {
-    // Receive packets from the various tunnels
-    packet_rx: PacketRelayReceiver,
-
-    // After receive from tunnels, send to the tun device
-    tun_task_tx: TunTaskTx,
-
-    // Receive responses from the tun device
-    tun_task_response_rx: TunTaskResponseRx,
-
-    // After receiving from the tun device, relay back to the correct tunnel
-    peers_by_tag: Arc<tokio::sync::Mutex<HashMap<u64, PeerEventSender>>>,
-}
-
-impl PacketRelayer {
-    pub(crate) fn new(
-        tun_task_tx: TunTaskTx,
-        tun_task_response_rx: TunTaskResponseRx,
-        peers_by_tag: Arc<tokio::sync::Mutex<HashMap<u64, PeerEventSender>>>,
-    ) -> (Self, PacketRelaySender) {
-        let (packet_tx, packet_rx) = packet_relay_channel();
-        (
-            Self {
-                packet_rx,
-                tun_task_tx,
-                tun_task_response_rx,
-                peers_by_tag,
-            },
-            packet_tx,
-        )
-    }
-
-    pub(crate) async fn run(mut self) {
-        loop {
-            tokio::select! {
-                Some((tag, packet)) = self.packet_rx.0.recv() => {
-                    log::info!("Sent packet to tun device with tag: {tag}");
-                    self.tun_task_tx.send((tag, packet)).await.tap_err(|e| log::error!("{e}")).ok();
-                },
-                Some((tag, packet)) = self.tun_task_response_rx.recv() => {
-                    log::info!("Received response from tun device with tag: {tag}");
-                    if let Some(tx) = self.peers_by_tag.lock().await.get(&tag) {
-                        tx.send(Event::Ip(packet.into())).await.tap_err(|e| log::error!("{e}")).ok();
-                    }
-                }
-            }
-        }
-    }
-
-    pub(crate) fn start(self) {
-        tokio::spawn(async move { self.run().await });
-    }
-}
@@ -1,302 +0,0 @@
-use std::{
-    collections::HashMap,
-    net::{IpAddr, Ipv4Addr},
-    sync::Arc,
-    time::Duration,
-};
-
-use etherparse::{InternetSlice, SlicedPacket};
-use tokio::{
-    io::{AsyncReadExt, AsyncWriteExt},
-    time::timeout,
-};
-
-use crate::{
-    active_peers::PeerEventSenderError,
-    event::Event,
-    tun_task_channel::{
-        tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
-        TunTaskResponseSendError, TunTaskResponseTx, TunTaskRx, TunTaskTx,
-    },
-    udp_listener::PeersByIp,
-};
-
-#[derive(thiserror::Error, Debug)]
-pub enum TunDeviceError {
-    #[error("iface: timeout writing to tun device, dropping packet")]
-    TunWriteTimeout,
-
-    #[error("iface: failed forwarding packet to peer: {source}")]
-    ForwardToPeerFailed {
-        #[from]
-        source: PeerEventSenderError,
-    },
-
-    #[error("iface: failed to forward responding packet with tag: {source}")]
-    ForwardNatResponseFailed {
-        #[from]
-        source: TunTaskResponseSendError,
-    },
-
-    #[error("iface: error writing to tun device: {source}")]
-    TunWriteError { source: std::io::Error },
-
-    #[error("unable to parse destination address from packet")]
-    UnableToParseDstAdddress,
-
-    #[error("unable to parse source address from packet")]
-    UnableToParseSrcAddress {
-        #[from]
-        source: etherparse::ReadError,
-    },
-
-    #[error("unable to parse source address from packet: ip header missing")]
-    UnableToParseSrcAddressIpHeaderMissing,
-
-    #[error("unable to lock peer mutex")]
-    FailedToLockPeer,
-}
-
-fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun {
-    log::info!("Creating TUN device with: address={address}, netmask={netmask}");
-    // Read MTU size from env variable NYM_MTU_SIZE, else default to 1420.
-    let mtu = std::env::var("NYM_MTU_SIZE")
-        .map(|mtu| mtu.parse().expect("NYM_MTU_SIZE must be a valid integer"))
-        .unwrap_or(1420);
-    log::info!("Using MTU size: {mtu}");
-    tokio_tun::Tun::builder()
-        .name(name)
-        .tap(false)
-        .packet_info(false)
-        .mtu(mtu)
-        .up()
-        .address(address)
-        .netmask(netmask)
-        .try_build()
-        .expect("Failed to setup tun device, do you have permission?")
-}
-
-pub struct TunDevice {
-    // The TUN device that we read/write to, to send/receive packets
-    tun: Option<tokio_tun::Tun>,
-
-    // Incoming data that we should send
-    tun_task_rx: Option<TunTaskRx>,
-
-    // And when we get replies, this is where we should send it
-    tun_task_response_tx: TunTaskResponseTx,
-
-    routing_mode: RoutingMode,
-}
-
-pub enum RoutingMode {
-    // The routing table, as how wireguard does it
-    AllowedIps(AllowedIpsInner),
-
-    // This is an alternative to the routing table, where we just match outgoing source IP with
-    // incoming destination IP.
-    Nat(NatInner),
-}
-
-impl RoutingMode {
-    pub fn new_nat() -> Self {
-        RoutingMode::Nat(NatInner {
-            nat_table: HashMap::new(),
-        })
-    }
-
-    pub fn new_allowed_ips(peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>) -> Self {
-        RoutingMode::AllowedIps(AllowedIpsInner { peers_by_ip })
-    }
-}
-
-pub struct AllowedIpsInner {
-    peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
-}
-
-impl AllowedIpsInner {
-    async fn lock(&self) -> Result<tokio::sync::MutexGuard<PeersByIp>, TunDeviceError> {
-        timeout(Duration::from_millis(200), self.peers_by_ip.as_ref().lock())
-            .await
-            .map_err(|_| TunDeviceError::FailedToLockPeer)
-    }
-}
-
-pub struct NatInner {
-    nat_table: HashMap<IpAddr, u64>,
-}
-
-pub struct TunDeviceConfig {
-    pub base_name: String,
-    pub ip: Ipv4Addr,
-    pub netmask: Ipv4Addr,
-}
-
-impl TunDevice {
-    pub fn new(
-        routing_mode: RoutingMode,
-        config: TunDeviceConfig,
-    ) -> (Self, TunTaskTx, TunTaskResponseRx) {
-        let TunDeviceConfig {
-            base_name,
-            ip,
-            netmask,
-        } = config;
-        let name = format!("{base_name}%d");
-
-        let tun = setup_tokio_tun_device(&name, ip, netmask);
-        log::info!("Created TUN device: {}", tun.name());
-
-        // Channels to communicate with the other tasks
-        let (tun_task_tx, tun_task_rx) = tun_task_channel();
-        let (tun_task_response_tx, tun_task_response_rx) = tun_task_response_channel();
-
-        let tun_device = TunDevice {
-            tun_task_rx: Some(tun_task_rx),
-            tun_task_response_tx,
-            tun: Some(tun),
-            routing_mode,
-        };
-
-        (tun_device, tun_task_tx, tun_task_response_rx)
-    }
-
-    // Send outbound packets out on the wild internet
-    async fn handle_tun_write(&mut self, data: TunTaskPayload) -> Result<(), TunDeviceError> {
-        {
-            let (tag, ref packet) = data;
-            let dst_addr = boringtun::noise::Tunn::dst_address(packet)
-                .ok_or_else(|| TunDeviceError::UnableToParseDstAdddress)?;
-
-            let src_addr = parse_src_address(packet)?;
-            log::info!(
-                "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
-                packet.len()
-            );
-
-            // TODO: expire old entries
-            if let RoutingMode::Nat(nat_table) = &mut self.routing_mode {
-                nat_table.nat_table.insert(src_addr, tag);
-            }
-        }
-
-        // timeout(Duration::from_millis(1000), self.tun.write_all(&data.1))
-        //     .await
-        //     .map_err(|_| TunDeviceError::TunWriteTimeout)?
-        //     .map_err(|err| TunDeviceError::TunWriteError { source: err })
-    }
-
-    // Receive reponse packets from the wild internet
-    async fn handle_tun_read(&self, packet: &[u8]) -> Result<(), TunDeviceError> {
-        let dst_addr = boringtun::noise::Tunn::dst_address(packet)
-            .ok_or(TunDeviceError::UnableToParseDstAdddress)?;
-        let src_addr = parse_src_address(packet)?;
-        log::info!(
-            "iface: read Packet({src_addr} -> {dst_addr}, {} bytes)",
-            packet.len(),
-        );
-
-        // Route packet to the correct peer.
-
-        match self.routing_mode {
-            // This is how wireguard does it, by consulting the AllowedIPs table.
-            RoutingMode::AllowedIps(ref peers_by_ip) => {
-                let peers = peers_by_ip.lock().await?;
-                if let Some(peer_tx) = peers.longest_match(dst_addr).map(|(_, tx)| tx) {
-                    log::info!("Forward packet to wg tunnel");
-                    return peer_tx
-                        .send(Event::Ip(packet.to_vec().into()))
-                        .await
-                        .map_err(|err| err.into());
-                }
-            }
-
-            // But we can also do it by consulting the NAT table.
-            RoutingMode::Nat(ref nat_table) => {
-                if let Some(tag) = nat_table.nat_table.get(&dst_addr) {
-                    log::info!("Forward packet with NAT tag: {tag}");
-                    return self
-                        .tun_task_response_tx
-                        .send((*tag, packet.to_vec()))
-                        .await
-                        .map_err(|err| err.into());
-                }
-            }
-        }
-
-        log::info!("No peer found, packet dropped");
-        Ok(())
-    }
-
-    pub async fn run(mut self) {
-        let mut buf = [0u8; 65535];
-
-        let tun_task_rx_stream =
-            tokio_stream::wrappers::ReceiverStream::new(self.tun_task_rx.take().unwrap().0);
-        use futures::StreamExt;
-        let tun_task_rx_stream = tun_task_rx_stream.map(|data| {
-            //{
-            //    let (tag, ref packet) = data;
-            //    let dst_addr = boringtun::noise::Tunn::dst_address(packet).unwrap();
-            //    // .ok_or_else(|| TunDeviceError::UnableToParseDstAdddress)?;
-
-            //    let src_addr = parse_src_address(packet).unwrap();
-            //    log::info!(
-            //        "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
-            //        packet.len()
-            //    );
-
-            //    // TODO: expire old entries
-            //    // if let RoutingMode::Nat(nat_table) = &mut self.routing_mode {
-            //        // nat_table.nat_table.insert(src_addr, tag);
-            //    // }
-            //}
-            // data.1
-            4
-        });
-
-        let (mut tun_read, tun_write) = tokio::io::split(self.tun);
-
-        loop {
-            tokio::select! {
-                // Reading from the TUN device
-                // len = self.tun.read(&mut buf) => match len {
-                len = tun_read.read(&mut buf) => match len {
-                    Ok(len) => {
-                        let packet = &buf[..len];
-                        if let Err(err) = self.handle_tun_read(packet).await {
-                            log::error!("iface: handle_tun_read failed: {err}")
-                        }
-                    },
-                    Err(err) => {
-                        log::info!("iface: read error: {err}");
-                        // break;
-                    }
-                },
-                // Writing to the TUN device
-                //Some(data) = self.tun_task_rx.recv() => {
-                //    if let Err(err) = self.handle_tun_write(data).await {
-                //        log::error!("ifcae: handle_tun_write failed: {err}");
-                //    }
-                //}
-                // res = self.tun.send_all(&mut tun_task_rx_stream) => {
-                //     log::error!("finished");
-                // }
-            }
-        }
-        // log::info!("TUN device shutting down");
-    }
-
-    pub fn start(self) {
-        tokio::spawn(async move { self.run().await });
-    }
-}
-
-fn parse_src_address(packet: &[u8]) -> Result<IpAddr, TunDeviceError> {
-    let headers = SlicedPacket::from_ip(packet)?;
-    match headers.ip {
-        Some(InternetSlice::Ipv4(ip, _)) => Ok(ip.source_addr().into()),
-        Some(InternetSlice::Ipv6(ip, _)) => Ok(ip.source_addr().into()),
-        None => Err(TunDeviceError::UnableToParseSrcAddressIpHeaderMissing),
-    }
-}
@@ -1,2 +0,0 @@
-#[cfg(target_os = "linux")]
-pub(crate) mod linux;
@@ -1,61 +0,0 @@
-use std::{collections::HashMap, sync::Arc};
-
-use ip_network::IpNetwork;
-use nym_wireguard_types::PeerPublicKey;
-
-pub(crate) type PeerIdx = u32;
-
-#[derive(Debug)]
-pub(crate) struct RegisteredPeer {
-    pub(crate) public_key: PeerPublicKey,
-    pub(crate) index: PeerIdx,
-    pub(crate) allowed_ips: IpNetwork,
-    // endpoint: SocketAddr,
-}
-
-#[derive(Debug, Default)]
-pub(crate) struct RegisteredPeers {
-    peers: HashMap<PeerPublicKey, Arc<tokio::sync::Mutex<RegisteredPeer>>>,
-    peers_by_idx: HashMap<PeerIdx, Arc<tokio::sync::Mutex<RegisteredPeer>>>,
-}
-
-impl RegisteredPeers {
-    pub(crate) fn contains_key(&self, public_key: &PeerPublicKey) -> bool {
-        self.peers.contains_key(public_key)
-    }
-
-    pub(crate) fn next_idx(&self) -> PeerIdx {
-        self.peers_by_idx.keys().max().unwrap_or(&0) + 1
-    }
-
-    pub(crate) async fn insert(&mut self, peer: Arc<tokio::sync::Mutex<RegisteredPeer>>) {
-        let peer_idx = { peer.lock().await.index };
-        let public_key = { peer.lock().await.public_key };
-        self.peers.insert(public_key, Arc::clone(&peer));
-        self.peers_by_idx.insert(peer_idx, peer);
-    }
-
-    #[allow(unused)]
-    pub(crate) async fn remove(&mut self, public_key: &PeerPublicKey) {
-        if let Some(peer) = self.peers.remove(public_key) {
-            let peer_idx = peer.lock().await.index;
-            if self.peers_by_idx.remove(&peer_idx).is_none() {
-                log::error!("Removed registered peer but no registered index was found");
-            }
-        }
-    }
-
-    pub(crate) fn get_by_key(
-        &self,
-        public_key: &PeerPublicKey,
-    ) -> Option<&Arc<tokio::sync::Mutex<RegisteredPeer>>> {
-        self.peers.get(public_key)
-    }
-
-    pub(crate) fn get_by_idx(
-        &self,
-        peer_idx: PeerIdx,
-    ) -> Option<&Arc<tokio::sync::Mutex<RegisteredPeer>>> {
-        self.peers_by_idx.get(&peer_idx)
-    }
-}
@@ -1,20 +1,14 @@
 use std::net::IpAddr;

 use base64::{engine::general_purpose, Engine as _};
-use boringtun::x25519;
 use log::info;

 // The wireguard UDP listener
 pub const WG_ADDRESS: &str = "0.0.0.0";

-// The interface used to route traffic
-pub const TUN_BASE_NAME: &str = "nymwg";
-pub const TUN_DEVICE_ADDRESS: &str = "10.1.0.1";
-pub const TUN_DEVICE_NETMASK: &str = "255.255.255.0";
-
 // The private key of the listener
 // Corresponding public key: "WM8s8bYegwMa0TJ+xIwhk+dImk2IpDUKslDBCZPizlE="
-const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg=";
+pub(crate) const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg=";

 // The AllowedIPs for the connected peer, which is one a single IP and the same as the IP that the
 // peer has configured on their side.
@@ -28,11 +22,11 @@ fn decode_base64_key(base64_key: &str) -> [u8; 32] {
        .unwrap()
 }

-pub fn server_static_private_key() -> x25519::StaticSecret {
+pub fn server_static_private_key() -> x25519_dalek::StaticSecret {
    // TODO: this is a temporary solution for development
    let static_private_bytes: [u8; 32] = decode_base64_key(PRIVATE_KEY);
-    let static_private = x25519::StaticSecret::try_from(static_private_bytes).unwrap();
-    let static_public = x25519::PublicKey::from(&static_private);
+    let static_private = x25519_dalek::StaticSecret::from(static_private_bytes);
+    let static_public = x25519_dalek::PublicKey::from(&static_private);
    info!(
        "wg public key: {}",
        general_purpose::STANDARD.encode(static_public)
@@ -40,14 +34,14 @@ pub fn server_static_private_key() -> x25519::StaticSecret {
    static_private
 }

-pub fn peer_static_public_key() -> x25519::PublicKey {
+pub fn peer_static_public_key() -> x25519_dalek::PublicKey {
    // A single static public key is used during development

    // Read from NYM_PEER_PUBLIC_KEY env variable
    let peer = std::env::var("NYM_PEER_PUBLIC_KEY").expect("NYM_PEER_PUBLIC_KEY must be set");

    let peer_static_public_bytes: [u8; 32] = decode_base64_key(&peer);
-    let peer_static_public = x25519::PublicKey::try_from(peer_static_public_bytes).unwrap();
+    let peer_static_public = x25519_dalek::PublicKey::from(peer_static_public_bytes);
    info!(
        "Adding wg peer public key: {}",
        general_purpose::STANDARD.encode(peer_static_public)
@@ -57,6 +51,6 @@ pub fn peer_static_public_key() -> x25519::PublicKey {

 pub fn peer_allowed_ips() -> ip_network::IpNetwork {
    let key: IpAddr = ALLOWED_IPS.parse().unwrap();
-    let cidr = 0u8;
+    let cidr = 32u8;
    ip_network::IpNetwork::new_truncate(key, cidr).unwrap()
 }
@@ -1,279 +0,0 @@
-use std::{net::SocketAddr, sync::Arc, time::Duration};
-
-use boringtun::{
-    noise::{self, handshake::parse_handshake_anon, rate_limiter::RateLimiter, TunnResult},
-    x25519,
-};
-use futures::StreamExt;
-use log::error;
-use nym_task::TaskClient;
-use nym_wireguard_types::{registration::GatewayClientRegistry, PeerPublicKey, WG_PORT};
-use tap::TapFallible;
-use tokio::{net::UdpSocket, sync::Mutex};
-
-use crate::{
-    active_peers::{ActivePeers, PeerEventSender},
-    error::WgError,
-    event::Event,
-    network_table::NetworkTable,
-    packet_relayer::PacketRelaySender,
-    registered_peers::{RegisteredPeer, RegisteredPeers},
-    setup::{self, WG_ADDRESS},
-    wg_tunnel::PeersByTag,
-};
-
-const MAX_PACKET: usize = 65535;
-
-// Registered peers
-pub(crate) type PeersByIp = NetworkTable<PeerEventSender>;
-
-async fn add_test_peer(registered_peers: &mut RegisteredPeers) {
-    let peer_static_public = PeerPublicKey::new(setup::peer_static_public_key());
-    let peer_index = 0;
-    let peer_allowed_ips = setup::peer_allowed_ips();
-    let test_peer = Arc::new(tokio::sync::Mutex::new(RegisteredPeer {
-        public_key: peer_static_public,
-        index: peer_index,
-        allowed_ips: peer_allowed_ips,
-    }));
-    registered_peers.insert(test_peer).await;
-}
-
-pub struct WgUdpListener {
-    // Our private key
-    static_private: x25519::StaticSecret,
-
-    // Our public key
-    static_public: x25519::PublicKey,
-
-    // The list of registered peers that we allow
-    registered_peers: RegisteredPeers,
-
-    // The routing table, as defined by wireguard
-    peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
-
-    // ... or alternatively we can map peers by their tag
-    peers_by_tag: Arc<tokio::sync::Mutex<PeersByTag>>,
-
-    // The UDP socket to the peer
-    udp: Arc<UdpSocket>,
-
-    // Send data to the TUN device for sending
-    packet_tx: PacketRelaySender,
-
-    // Wireguard rate limiter
-    rate_limiter: RateLimiter,
-
-    gateway_client_registry: Arc<GatewayClientRegistry>,
-}
-
-impl WgUdpListener {
-    pub async fn new(
-        packet_tx: PacketRelaySender,
-        peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
-        peers_by_tag: Arc<tokio::sync::Mutex<PeersByTag>>,
-        gateway_client_registry: Arc<GatewayClientRegistry>,
-    ) -> Result<Self, Box<dyn std::error::Error + Send + Sync + 'static>> {
-        let wg_address = SocketAddr::new(WG_ADDRESS.parse().unwrap(), WG_PORT);
-        log::info!("Starting wireguard UDP listener on {wg_address}");
-        let udp = Arc::new(UdpSocket::bind(wg_address).await?);
-
-        // Setup our own keys
-        let static_private = setup::server_static_private_key();
-        let static_public = x25519::PublicKey::from(&static_private);
-        let handshake_max_rate = 100u64;
-        let rate_limiter = RateLimiter::new(&static_public, handshake_max_rate);
-
-        // Create a test peer for dev
-        let mut registered_peers = RegisteredPeers::default();
-        add_test_peer(&mut registered_peers).await;
-
-        Ok(Self {
-            static_private,
-            static_public,
-            registered_peers,
-            peers_by_ip,
-            peers_by_tag,
-            udp,
-            packet_tx,
-            rate_limiter,
-            gateway_client_registry,
-        })
-    }
-
-    pub async fn run(mut self, mut task_client: TaskClient) {
-        // The set of active tunnels
-        let active_peers = ActivePeers::default();
-        // Each tunnel is run in its own task, and the task handle is stored here so we can remove
-        // it from `active_peers` when the tunnel is closed
-        let mut active_peers_task_handles = futures::stream::FuturesUnordered::new();
-
-        let mut buf = [0u8; MAX_PACKET];
-        let mut dst_buf = [0u8; MAX_PACKET];
-
-        while !task_client.is_shutdown() {
-            tokio::select! {
-                () = task_client.recv() => {
-                    log::trace!("WireGuard UDP listener: received shutdown");
-                    break;
-                }
-                // Reset the rate limiter every 1 sec
-                () = tokio::time::sleep(Duration::from_secs(1)) => {
-                    self.rate_limiter.reset_count();
-                },
-                // Handle tunnel closing
-                Some(public_key) = active_peers_task_handles.next() => {
-                    match public_key {
-                        Ok(public_key) => {
-                            active_peers.remove(&public_key);
-                        }
-                        Err(err) => {
-                            error!("WireGuard UDP listener: error receiving shutdown from peer: {err}");
-                        }
-                    }
-                },
-                // Handle incoming packets
-                Ok((len, addr)) = self.udp.recv_from(&mut buf) => {
-                    log::trace!("udp: received {} bytes from {}", len, addr);
-
-                    // If this addr has already been encountered, send directly to tunnel
-                    // TODO: optimization opportunity to instead create a connected UDP socket
-                    // inside the wg tunnel, where you can recv the data directly.
-                    if let Some(peer_tx) = active_peers.get_by_addr(&addr) {
-                        log::info!("udp: received {len} bytes from {addr} from known peer");
-                        peer_tx
-                            .send(Event::Wg(buf[..len].to_vec().into()))
-                            .await
-                            .tap_err(|e| log::error!("{e}"))
-                            .ok();
-                        continue;
-                    }
-
-                    // Verify the incoming packet
-                    let verified_packet = match self.rate_limiter.verify_packet(Some(addr.ip()), &buf[..len], &mut dst_buf) {
-                        Ok(packet) => packet,
-                        Err(TunnResult::WriteToNetwork(cookie)) => {
-                            log::info!("Send back cookie to: {addr}");
-                            self.udp.send_to(cookie, addr).await.tap_err(|e| log::error!("{e}")).ok();
-                            continue;
-                        }
-                        Err(err) => {
-                            log::warn!("{err:?}");
-                            continue;
-                        }
-                    };
-
-                    // Check if this is a registered peer, if not, just skip
-                    let registered_peer = match parse_peer(
-                        verified_packet,
-                        &mut self.registered_peers,
-                        &self.static_private,
-                        &self.static_public,
-                        Arc::clone(&self.gateway_client_registry),
-                    ).await {
-                        Ok(Some(peer)) => peer.lock().await,
-                        Ok(None) => {
-                            log::warn!("Peer not registered: {addr}");
-                            continue;
-                        }
-                        Err(err) => {
-                            log::error!("{err}");
-                            continue;
-                        },
-                    };
-
-                    // Look up if the peer is already connected
-                    if let Some(peer_tx) = active_peers.get_by_key_mut(&registered_peer.public_key) {
-                        // We found the peer as connected, even though the addr was not known
-                        log::info!("udp: received {len} bytes from {addr} which is a known peer with unknown addr");
-                        peer_tx.send(Event::WgVerified(buf[..len].to_vec().into()))
-                            .await
-                            .tap_err(|err| log::error!("{err}"))
-                            .ok();
-                    } else {
-                        // If it isn't, start a new tunnel
-                        log::info!("udp: received {len} bytes from {addr} from unknown peer, starting tunnel");
-                        // NOTE: we are NOT passing in the existing rate_limiter. Re-visit this
-                        // choice later.
-                        log::warn!("Creating new rate limiter, consider re-using?");
-                        let (join_handle, peer_tx, tag) = crate::wg_tunnel::start_wg_tunnel(
-                            addr,
-                            self.udp.clone(),
-                            self.static_private.clone(),
-                            *registered_peer.public_key,
-                            registered_peer.index,
-                            registered_peer.allowed_ips,
-                            // self.tun_task_tx.clone(),
-                            self.packet_tx.clone(),
-                        );
-
-                        self.peers_by_ip.lock().await.insert(registered_peer.allowed_ips, peer_tx.clone());
-                        self.peers_by_tag.lock().await.insert(tag, peer_tx.clone());
-
-                        peer_tx.send(Event::Wg(buf[..len].to_vec().into()))
-                            .await
-                            .tap_err(|e| log::error!("{e}"))
-                            .ok();
-
-                        log::info!("Adding peer: {:?}: {addr}", registered_peer.public_key);
-                        active_peers.insert(*registered_peer.public_key, addr, peer_tx);
-                        active_peers_task_handles.push(join_handle);
-                    }
-                },
-            }
-        }
-        log::info!("WireGuard listener: shutting down");
-    }
-
-    pub fn start(self, task_client: TaskClient) {
-        tokio::spawn(async move { self.run(task_client).await });
-    }
-}
-
-async fn parse_peer<'a>(
-    verified_packet: noise::Packet<'a>,
-    registered_peers: &'a mut RegisteredPeers,
-    static_private: &x25519::StaticSecret,
-    static_public: &x25519::PublicKey,
-    gateway_client_registry: Arc<GatewayClientRegistry>,
-) -> Result<Option<&'a Arc<tokio::sync::Mutex<RegisteredPeer>>>, WgError> {
-    let registered_peer = match verified_packet {
-        noise::Packet::HandshakeInit(ref packet) => {
-            let Ok(handshake) = parse_handshake_anon(static_private, static_public, packet) else {
-                return Err(WgError::HandshakeFailed);
-            };
-            let peer_public_key =
-                PeerPublicKey::new(x25519::PublicKey::from(handshake.peer_static_public));
-
-            let already_registered = registered_peers.contains_key(&peer_public_key);
-
-            if already_registered {
-                registered_peers.get_by_key(&peer_public_key)
-            } else if gateway_client_registry.contains_key(&peer_public_key) {
-                let peer_idx = registered_peers.next_idx();
-                let peer = Arc::new(Mutex::new(RegisteredPeer {
-                    public_key: peer_public_key,
-                    index: peer_idx,
-                    allowed_ips: setup::peer_allowed_ips(),
-                }));
-                registered_peers.insert(peer).await;
-                registered_peers.get_by_key(&peer_public_key)
-            } else {
-                None
-            }
-        }
-        noise::Packet::HandshakeResponse(packet) => {
-            let peer_idx = packet.receiver_idx >> 8;
-            registered_peers.get_by_idx(peer_idx)
-        }
-        noise::Packet::PacketCookieReply(packet) => {
-            let peer_idx = packet.receiver_idx >> 8;
-            registered_peers.get_by_idx(peer_idx)
-        }
-        noise::Packet::PacketData(packet) => {
-            let peer_idx = packet.receiver_idx >> 8;
-            registered_peers.get_by_idx(peer_idx)
-        }
-    };
-    Ok(registered_peer)
-}
@@ -1,353 +0,0 @@
-use std::{collections::HashMap, net::SocketAddr, sync::Arc, time::Duration};
-
-use async_recursion::async_recursion;
-use boringtun::{
-    noise::{errors::WireGuardError, rate_limiter::RateLimiter, Tunn, TunnResult},
-    x25519,
-};
-use bytes::Bytes;
-use log::{debug, error, info, warn};
-use rand::RngCore;
-use tap::TapFallible;
-use tokio::{net::UdpSocket, sync::broadcast, time::timeout};
-
-use crate::{
-    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
-    error::WgError,
-    event::Event,
-    network_table::NetworkTable,
-    packet_relayer::PacketRelaySender,
-    registered_peers::PeerIdx,
-};
-
-const HANDSHAKE_MAX_RATE: u64 = 10;
-
-const MAX_PACKET: usize = 65535;
-
-// We index the tunnels by tag
-pub(crate) type PeersByTag = HashMap<u64, PeerEventSender>;
-
-pub struct WireGuardTunnel {
-    // Incoming data from the UDP socket received in the main event loop
-    peer_rx: PeerEventReceiver,
-
-    // UDP socket used for sending data
-    udp: Arc<UdpSocket>,
-
-    // Peer endpoint
-    endpoint: Arc<tokio::sync::RwLock<SocketAddr>>,
-
-    // AllowedIPs for this peer
-    allowed_ips: NetworkTable<()>,
-
-    // `boringtun` tunnel, used for crypto & WG protocol
-    wg_tunnel: Arc<tokio::sync::Mutex<Tunn>>,
-
-    // Signal close
-    close_tx: broadcast::Sender<()>,
-    close_rx: broadcast::Receiver<()>,
-
-    // Send data to the task that handles sending data through the tun device
-    packet_tx: PacketRelaySender,
-
-    tag: u64,
-}
-
-impl Drop for WireGuardTunnel {
-    fn drop(&mut self) {
-        info!("WireGuard tunnel: dropping");
-        self.close();
-    }
-}
-
-impl WireGuardTunnel {
-    pub(crate) fn new(
-        udp: Arc<UdpSocket>,
-        endpoint: SocketAddr,
-        static_private: x25519::StaticSecret,
-        peer_static_public: x25519::PublicKey,
-        index: PeerIdx,
-        peer_allowed_ips: ip_network::IpNetwork,
-        // rate_limiter: Option<RateLimiter>,
-        packet_tx: PacketRelaySender,
-    ) -> (Self, PeerEventSender, u64) {
-        let local_addr = udp.local_addr().unwrap();
-        let peer_addr = udp.peer_addr();
-        log::info!("New wg tunnel: endpoint: {endpoint}, local_addr: {local_addr}, peer_addr: {peer_addr:?}");
-
-        let preshared_key = None;
-        let persistent_keepalive = None;
-
-        let static_public = x25519::PublicKey::from(&static_private);
-        let rate_limiter = Some(Arc::new(RateLimiter::new(
-            &static_public,
-            HANDSHAKE_MAX_RATE,
-        )));
-
-        let wg_tunnel = Arc::new(tokio::sync::Mutex::new(
-            Tunn::new(
-                static_private,
-                peer_static_public,
-                preshared_key,
-                persistent_keepalive,
-                index,
-                rate_limiter,
-            )
-            .expect("failed to create Tunn instance"),
-        ));
-
-        // Channels with incoming data that is received by the main event loop
-        let (peer_tx, peer_rx) = peer_event_channel();
-
-        // Signal close tunnel
-        let (close_tx, close_rx) = broadcast::channel(1);
-
-        let mut allowed_ips = NetworkTable::new();
-        allowed_ips.insert(peer_allowed_ips, ());
-
-        let tag = Self::new_tag();
-
-        let tunnel = WireGuardTunnel {
-            peer_rx,
-            udp,
-            endpoint: Arc::new(tokio::sync::RwLock::new(endpoint)),
-            allowed_ips,
-            wg_tunnel,
-            close_tx,
-            close_rx,
-            packet_tx,
-            tag,
-        };
-
-        (tunnel, peer_tx, tag)
-    }
-
-    fn new_tag() -> u64 {
-        // TODO: check for collisions
-        rand::thread_rng().next_u64()
-    }
-
-    fn close(&self) {
-        let _ = self.close_tx.send(());
-    }
-
-    pub async fn spin_off(&mut self) {
-        loop {
-            tokio::select! {
-                _ = self.close_rx.recv() => {
-                    info!("WireGuard tunnel: received msg to close");
-                    break;
-                },
-                packet = self.peer_rx.recv() => match packet {
-                    Some(packet) => {
-                        info!("event loop: {packet}");
-                        match packet {
-                            Event::Wg(data) => {
-                                let _ = self.consume_wg(&data)
-                                    .await
-                                    .tap_err(|err| error!("WireGuard tunnel: consume_wg error: {err}"));
-                            },
-                            Event::WgVerified(data) => {
-                                let _ = self.consume_verified_wg(&data)
-                                    .await
-                                    .tap_err(|err| error!("WireGuard tunnel: consume_verified_wg error: {err}"));
-                            }
-                            Event::Ip(data) => self.consume_eth(&data).await,
-                        }
-                    },
-                    None => {
-                        info!("WireGuard tunnel: incoming UDP stream closed, closing tunnel");
-                        break;
-                    },
-                },
-                () = tokio::time::sleep(Duration::from_millis(250)) => {
-                    let _ = self.update_wg_timers()
-                        .await
-                        .map_err(|err| error!("WireGuard tunnel: update_wg_timers error: {err}"));
-                },
-            }
-        }
-        info!("WireGuard tunnel ({}): closed", self.endpoint.read().await);
-    }
-
-    async fn wg_tunnel_lock(&self) -> Result<tokio::sync::MutexGuard<'_, Tunn>, WgError> {
-        timeout(Duration::from_millis(100), self.wg_tunnel.lock())
-            .await
-            .map_err(|_| WgError::UnableToGetTunnel)
-    }
-
-    #[allow(unused)]
-    async fn set_endpoint(&self, addr: SocketAddr) {
-        if *self.endpoint.read().await != addr {
-            log::info!("wg tunnel update endpoint: {addr}");
-            *self.endpoint.write().await = addr;
-        }
-    }
-
-    async fn consume_wg(&mut self, data: &[u8]) -> Result<(), WgError> {
-        let mut send_buf = [0u8; MAX_PACKET];
-        let mut tunnel = self.wg_tunnel_lock().await?;
-        match tunnel.decapsulate(None, data, &mut send_buf) {
-            TunnResult::WriteToNetwork(packet) => {
-                let endpoint = self.endpoint.read().await;
-                log::info!("udp: send {} bytes to {}", packet.len(), *endpoint);
-                if let Err(err) = self.udp.send_to(packet, *endpoint).await {
-                    error!("Failed to send decapsulation-instructed packet to WireGuard endpoint: {err:?}");
-                };
-                // Flush pending queue
-                loop {
-                    let mut send_buf = [0u8; MAX_PACKET];
-                    match tunnel.decapsulate(None, &[], &mut send_buf) {
-                        TunnResult::WriteToNetwork(packet) => {
-                            log::info!("udp: send {} bytes to {}", packet.len(), *endpoint);
-                            if let Err(err) = self.udp.send_to(packet, *endpoint).await {
-                                error!("Failed to send decapsulation-instructed packet to WireGuard endpoint: {err:?}");
-                                break;
-                            };
-                        }
-                        _ => {
-                            break;
-                        }
-                    }
-                }
-            }
-            TunnResult::WriteToTunnelV4(packet, addr) => {
-                if self.allowed_ips.longest_match(addr).is_some() {
-                    self.packet_tx
-                        .0
-                        .send((self.tag, packet.to_vec()))
-                        .await
-                        .unwrap();
-                } else {
-                    warn!("Packet from {addr} not in allowed_ips");
-                }
-            }
-            TunnResult::WriteToTunnelV6(packet, addr) => {
-                if self.allowed_ips.longest_match(addr).is_some() {
-                    self.packet_tx
-                        .0
-                        .send((self.tag, packet.to_vec()))
-                        .await
-                        .unwrap();
-                } else {
-                    warn!("Packet (v6) from {addr} not in allowed_ips");
-                }
-            }
-            TunnResult::Done => {
-                debug!("WireGuard: decapsulate done");
-            }
-            TunnResult::Err(err) => {
-                error!("WireGuard: decapsulate error: {err:?}");
-            }
-        }
-        Ok(())
-    }
-
-    async fn consume_verified_wg(&mut self, data: &[u8]) -> Result<(), WgError> {
-        // Potentially we could take some shortcuts here in the name of performance, but currently
-        // I don't see that the needed functions in boringtun is exposed in the public API.
-        // TODO: make sure we don't put double pressure on the rate limiter!
-        self.consume_wg(data).await
-    }
-
-    async fn consume_eth(&self, data: &Bytes) {
-        info!("consume_eth: raw packet size: {}", data.len());
-        let encapsulated_packet = self.encapsulate_packet(data).await;
-        info!(
-            "consume_eth: after encapsulate: {}",
-            encapsulated_packet.len()
-        );
-
-        let endpoint = self.endpoint.read().await;
-        info!("consume_eth: send to {}: {}", *endpoint, data.len());
-        self.udp
-            .send_to(&encapsulated_packet, *endpoint)
-            .await
-            .unwrap();
-    }
-
-    async fn encapsulate_packet(&self, payload: &[u8]) -> Vec<u8> {
-        // TODO: use fixed dst and src buffers that we can reuse
-        let len = 148.max(payload.len() + 32);
-        let mut dst = vec![0; len];
-
-        let mut wg_tunnel = self.wg_tunnel_lock().await.unwrap();
-
-        match wg_tunnel.encapsulate(payload, &mut dst) {
-            TunnResult::WriteToNetwork(packet) => packet.to_vec(),
-            unexpected => {
-                error!("{:?}", unexpected);
-                vec![]
-            }
-        }
-    }
-
-    async fn update_wg_timers(&mut self) -> Result<(), WgError> {
-        let mut send_buf = [0u8; MAX_PACKET];
-        let mut tun = self.wg_tunnel_lock().await?;
-        let tun_result = tun.update_timers(&mut send_buf);
-        self.handle_routine_tun_result(tun_result).await;
-        Ok(())
-    }
-
-    #[async_recursion]
-    async fn handle_routine_tun_result<'a: 'async_recursion>(&self, result: TunnResult<'a>) {
-        match result {
-            TunnResult::WriteToNetwork(packet) => {
-                let endpoint = self.endpoint.read().await;
-                log::info!("routine: write to network: {}: {}", endpoint, packet.len());
-                if let Err(err) = self.udp.send_to(packet, *endpoint).await {
-                    error!("routine: failed to send packet: {err:?}");
-                };
-            }
-            TunnResult::Err(WireGuardError::ConnectionExpired) => {
-                warn!("Wireguard handshake has expired!");
-                // WIP(JON): consider just closing the tunnel here
-                let mut buf = vec![0u8; MAX_PACKET];
-                let Ok(mut peer) = self.wg_tunnel_lock().await else {
-                    warn!("Failed to lock WireGuard peer, closing tunnel");
-                    self.close();
-                    return;
-                };
-                peer.format_handshake_initiation(&mut buf[..], false);
-                self.handle_routine_tun_result(result).await;
-            }
-            TunnResult::Err(err) => {
-                error!("Failed to prepare routine packet for WireGuard endpoint: {err:?}");
-            }
-            TunnResult::Done => {}
-            other => {
-                warn!("Unexpected WireGuard routine task state: {other:?}");
-            }
-        };
-    }
-}
-
-pub(crate) fn start_wg_tunnel(
-    endpoint: SocketAddr,
-    udp: Arc<UdpSocket>,
-    static_private: x25519::StaticSecret,
-    peer_static_public: x25519::PublicKey,
-    peer_index: PeerIdx,
-    peer_allowed_ips: ip_network::IpNetwork,
-    packet_tx: PacketRelaySender,
-) -> (
-    tokio::task::JoinHandle<x25519::PublicKey>,
-    PeerEventSender,
-    u64,
-) {
-    let (mut tunnel, peer_tx, tag) = WireGuardTunnel::new(
-        udp,
-        endpoint,
-        static_private,
-        peer_static_public,
-        peer_index,
-        peer_allowed_ips,
-        packet_tx,
-    );
-    let join_handle = tokio::spawn(async move {
-        tunnel.spin_off().await;
-        peer_static_public
-    });
-    (join_handle, peer_tx, tag)
-}
@@ -551,6 +551,15 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "deranged"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f32d04922c60427da6f9fef14d042d9edddef64cb9d4ce0d64d0685fbeb1fd3"
+dependencies = [
+ "powerfmt",
+]
+
 [[package]]
 name = "derivative"
 version = "2.2.0"
@@ -1558,6 +1567,12 @@ version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"

+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
@@ -1870,9 +1885,9 @@ checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"

 [[package]]
 name = "serde"
-version = "1.0.160"
+version = "1.0.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2f3770c8bce3bcda7e149193a069a0f4365bda1fa5cd88e03bca26afc1216c"
+checksum = "91d3c334ca1ee894a2c6f6ad698fe8c435b76d504b13d436f0685d648d6d96f7"
 dependencies = [
 "serde_derive",
 ]
@@ -1888,9 +1903,9 @@ dependencies = [

 [[package]]
 name = "serde_derive"
-version = "1.0.160"
+version = "1.0.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291a097c63d8497e00160b166a967a4a79c64f3facdd01cbd7502231688d77df"
+checksum = "67c5609f394e5c2bd7fc51efda478004ea80ef42fee983d5c67a65e34f32c0e3"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2085,11 +2100,13 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.20"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890"
+checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5"
 dependencies = [
+ "deranged",
 "itoa",
+ "powerfmt",
 "serde",
 "time-core",
 "time-macros",
@@ -2097,15 +2114,15 @@ dependencies = [

 [[package]]
 name = "time-core"
-version = "0.1.0"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"

 [[package]]
 name = "time-macros"
-version = "0.2.8"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd80a657e71da814b8e5d60d3374fc6d35045062245d80224748ae522dd76f36"
+checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
 dependencies = [
 "time-core",
 ]
@@ -127,7 +127,26 @@ pub fn query(deps: Deps<'_>, _env: Env, msg: QueryMsg) -> Result<QueryResponse,
 }

 #[entry_point]
-pub fn migrate(_deps: DepsMut<'_>, _env: Env, _msg: MigrateMsg) -> Result<Response, ContractError> {
+pub fn migrate(deps: DepsMut<'_>, _env: Env, _msg: MigrateMsg) -> Result<Response, ContractError> {
+    let mut current_epoch = CURRENT_EPOCH.load(deps.storage)?;
+    current_epoch
+        .time_configuration
+        .public_key_submission_time_secs = 1200;
+    current_epoch.time_configuration.dealing_exchange_time_secs = 1200;
+    current_epoch
+        .time_configuration
+        .verification_key_submission_time_secs = 600;
+    current_epoch
+        .time_configuration
+        .verification_key_validation_time_secs = 600;
+    current_epoch
+        .time_configuration
+        .verification_key_finalization_time_secs = 600;
+    current_epoch.time_configuration.in_progress_time_secs = 60 * 60 * 24 * 365 * 10;
+
+    CURRENT_EPOCH.save(deps.storage, &current_epoch)?;
+
+    //
    Ok(Default::default())
 }

@@ -25,9 +25,9 @@ type DealingKey<'a> = &'a Addr;
 // if TOTAL_DEALINGS is modified to anything other then current value (5), this part will also need
 // to be modified
 pub(crate) const DEALINGS_BYTES: [Map<'_, DealingKey<'_>, ContractSafeBytes>; TOTAL_DEALINGS] = [
-    Map::new("dbyt1"),
-    Map::new("dbyt2"),
-    Map::new("dbyt3"),
-    Map::new("dbyt4"),
-    Map::new("dbyt5"),
+    Map::new("dbyt1-tmp2"),
+    Map::new("dbyt2-tmp2"),
+    Map::new("dbyt3-tmp2"),
+    Map::new("dbyt4-tmp2"),
+    Map::new("dbyt5-tmp2"),
 ];
@@ -6,7 +6,34 @@ Each directory contains a readme with more information about running and contrib
 * `dev-portal` contains developer documentation hosted at [https://nymtech.net/developers](https://nymtech.net/developers)
 * `operators` contains node setup and maintenance guides hosted at [https://nymtech.net/operators](https://nymtech.net/operators)

+> If you are looking for the Typescript SDK documentation located at [sdk.nymtech.net](https://sdk.nymtech.net) this can be found in `../sdk/typescript/docs/`
+
+## Contribution 
+* If you wish to add to the documentation please create a PR against this repo. 
+* If you are **adding a plugin dependency** make sure to also **add that to the list of plugins in `install_mdbook_deps.sh` line 12**. 
+
 ## Scripts 
 * `bump_versions.sh` allows you to update the ~~`platform_release_version` and~~ `wallet_release_version` variable~~s~~ in the `book.toml` of each mdbook project at once. You can also optionally update the `minimum_rust_version` as well. Helpful for lazy-updating when cutting a new version of the docs. 
-* `build_all_to_dist.sh` is used by the `ci-dev.yml` and `cd-dev.yml` scripts for building all mdbook projects and moving the rendered html to `../dist/` to be rsynced with various servers. 
-* `post_process.sh` is a script called by the github CI and CD workflows to post process CSS/image/href links for serving several mdbooks from a subdirectory. 
+
+* The following scripts are used by the `ci-dev.yml` and `cd-dev.yml` scripts (located in `../.github/workflows/`):
+  * `build_all_to_dist.sh` is used for building all mdbook projects and moving the rendered html to `../dist/` to be rsynced with various servers. 
+  * `install_mdbook_deps.sh` checks for an existing install of mdbook (and plugins), uninstalls them, and then installs them on a clean slate. This is to avoid weird dependency clashes if relying on an existing mdbook version. 
+  * `post_process.sh` is used to post process CSS/image/href links for serving several mdbooks from a subdirectory. 
+  * `removed_existing_config.sh` is used to check for existing nym client/node config files on the CI/CD server and remove it if it exists. This is to mitigate issues with `mdbook-cmdrun` where e.g. a node is already initialised, and the command fails.   
+
+## CI/CD 
+Deployment of the docs is partially automated and partially manual. 
+* `ci-docs.yml` will run on pushes to all branches **apart from `master`**
+* `cd-docs.yml` must be run manually. This pushes to a staging branch which then must be manually promoted to production. 
+
+## Licensing and copyright information
+This is a monorepo and components that make up Nym as a system are licensed individually, so for accurate information, please check individual files.
+
+As a general approach, licensing is as follows this pattern:
+
+* <p xmlns:cc="http://creativecommons.org/ns#" xmlns:dct="http://purl.org/dc/terms/"><a property="dct:title" rel="cc:attributionURL" href="https://nymtech.net/docs">Nym Documentation</a> by <a rel="cc:attributionURL dct:creator" property="cc:attributionName" href="https://nymtech.net">Nym Technologies</a> is licensed under <a href="http://creativecommons.org/licenses/by-nc-sa/4.0/?ref=chooser-v1" target="_blank" rel="license noopener noreferrer" style="display:inline-block;">CC BY-NC-SA 4.0<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1"><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1"><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/nc.svg?ref=chooser-v1"><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/sa.svg?ref=chooser-v1"></a></p>
+
+* Nym applications and binaries are [GPL-3.0-only](https://www.gnu.org/licenses/)
+
+* Used libraries and different components are [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0.html) or [MIT](https://mit-license.org/)
+
@@ -198,5 +198,7 @@ For the moment then yes, the mixnet is free to use. There are no limits on the a
 No, although we do recommend that apps that wish to integrate look into running some of their own infrastructure such as gateways in order to assure uptime. 

 ### How can I find out if an application is already supported by network requester services? 
-You can check the [default allowed list](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) file to see which application traffic is whitelisted by default. If the domain is present on that list, it means that existing [network requesters](https://nymtech.net/docs/nodes/network-requester.html) can be used to privacy-protect your application traffic. Simply use [NymConnect](../quickstart/nymconnect-gui.md) to connect to this service through the mixnet.  
+You can check the [default allowed list](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) file to see which application traffic is whitelisted by default. If the domain is present on that list, it means that existing [network requesters](https://nymtech.net/docs/nodes/network-requester.html) can be used to privacy-protect your application traffic. Simply use [NymConnect](../quickstart/nymconnect-gui.md) to connect to this service through the mixnet.
+
+Currently we are undergoing changes on this policy under the name [Project Smoosh](https://nymtech.net/operators/faq/smoosh-faq.html) where a new type of node [Exit Gateway](https://nymtech.net/operators/legal/exit-gateway.html) will allow users to connect to much wider range of domains, restricted by our new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt). Follow the changes [here](https://nymtech.net/operators/faq/smoosh-faq.html#what-are-the-changes).

@@ -4,6 +4,6 @@ Welcome to the Nym Developer Portal, containing quickstart resources, user manua

 For more in-depth information about nodes, network traffic flows, clients, coconut etc check out the [docs](https://nymtech.net/docs). 

-If you are looking for information and setup guides for the various pieces of Nym mixnet infrastructure (mix nodes, gateways and network requesters) and Nyx blockchain validators see the **new [Operators Guides](https://nymtech.net/operators)** book. 
+If you are looking for information and setup guides for the various pieces of Nym mixnet infrastructure (mix nodes, gateways and network requesters) and Nyx blockchain validators see the [Operators Guides](https://nymtech.net/operators) book. 

-If you're looking for TypeScript/JavaScript related information such as SDKs to build your own tools, step-by-step tutorials, live playgrounds and more, make sure to check out the **new [TS SDK Handbook](https://sdk.nymtech.net/)** !
+If you're looking for TypeScript/JavaScript related information such as SDKs to build your own tools, step-by-step tutorials, live playgrounds and more, make sure to check out the  [TS SDK Handbook](https://sdk.nymtech.net/).
@@ -1,5 +1,11 @@
 # Licensing

-Nym is Free Software released under the Apache License V2.
+As a general approach, licensing is as follows this pattern:

-All of the contributions of the Nym core developers are © Nym Technologies SA. If you are interested in talking to us about other licenses, please get in touch.
+* <p xmlns:cc="http://creativecommons.org/ns#" xmlns:dct="http://purl.org/dc/terms/"><a property="dct:title" rel="cc:attributionURL" href="https://nymtech.net/docs">Nym Documentation</a> by <a rel="cc:attributionURL dct:creator" property="cc:attributionName" href="https://nymtech.net">Nym Technologies</a> is licensed under <a href="http://creativecommons.org/licenses/by-nc-sa/4.0/?ref=chooser-v1" target="_blank" rel="license noopener noreferrer" style="display:inline-block;">CC BY-NC-SA 4.0<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1"><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1"><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/nc.svg?ref=chooser-v1"><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/sa.svg?ref=chooser-v1"></a></p>
+
+* Nym applications and binaries are [GPL-3.0-only](https://www.gnu.org/licenses/)
+
+* Used libraries and different components are [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0.html) or [MIT](https://mit-license.org/)
+
+For accurate information, please check individual files.
@@ -29,7 +29,7 @@ cargo new nym-cosmos-service
 ```
 [dependencies]
 clap = { version = "4.0", features = ["derive"] }
-cosmrs = "=0.14.0"
+cosmrs = "=0.15.0"
 tokio = { version = "1.24.1", features = ["rt-multi-thread", "macros"] }
 serde = "1.0.152"
 serde_json = "1.0.91"
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
--- a/Show More
+++ b/Show More