feat(daemon): VPN daemon endpoints and compose artifact generation [P29.04]

[cesarnml]

Summary

• Adds POST /api/vpn/profile — validates and atomically writes .ovpn file, updates manifest, updates config, regenerates compose artifact
• Adds POST /api/vpn/credentials — writes gluetun-format credentials file (user\npass\n, mode 0o600), updates manifest, regenerates compose artifact
• Adds GET /api/vpn/compose — serves pre-generated compose.synology.yml from <configDir>/vpn/; 404 with { error: string } JSON if no profile saved
• Adds POST /api/vpn/verify — checks gluetun /v1/openvpn/status + Transmission RPC in parallel (10s timeout); returns passthrough (no creds), vpn_bridge_active, or vpn_bridge_unreachable
• Generates single compose.synology.yml artifact (gluetun always present) with ALLOWED_ORIGINS wired from trusted-origins.json; credentials never appear in the YAML
• All endpoints behind checkWriteAuth (write token); new module src/vpn-api.ts registered in src/api.ts
• 14 new tests in test/vpn-api.test.ts; CI: 450 daemon pass, 160 web pass

Test plan

• POST /api/vpn/profile with valid .ovpn → 200; files written; manifest set; compose generated
• POST /api/vpn/profile invalid body (empty, JSON) → 400
• POST /api/vpn/profile no auth → 401
• POST /api/vpn/credentials → 200; creds file = user\npass\n; manifest hasCredentials = true
• POST /api/vpn/credentials no auth → 401
• Credentials never appear in generated compose YAML
• ALLOWED_ORIGINS present in generated compose
• GET /api/vpn/compose no profile → 404 { error: string }
• GET /api/vpn/compose with profile → 200 application/yaml
• POST /api/vpn/verify no creds → { status: 'passthrough' }
• POST /api/vpn/verify gluetun unreachable → { status: 'vpn_bridge_unreachable' }
• POST /api/vpn/verify both reachable → { status: 'vpn_bridge_active' }
• POST /api/vpn/verify transmission unreachable → { status: 'vpn_bridge_unreachable' }

[qodo-code-review]

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

[coderabbitai]

Warning

Rate limit exceeded

@cesarnml has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 28 minutes and 32 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 339e37ef-d8ea-43a1-bbb4-eb23c864099d

📥 Commits

Reviewing files that changed from the base of the PR and between 7a273e0 and 9de3a0e.

📒 Files selected for processing (5)

• cspell.json
• docs/product/delivery/phase-29/ticket-04-vpn-daemon-endpoints-and-compose-generation.md
• src/api.ts
• src/vpn-api.ts
• test/vpn-api.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}