checkpoint: implement wgcloak v1 foundations

docs/SECURITY.md

@@ -0,0 +1,49 @@
+# Security model
+
+## What is protected
+
+The server treats every public listener as hostile. v1 requires a configured
+client ID and at least 256 bits of entropy in its shared secret. Direct UDP
+authenticates every session and every data packet, rejects replay, tolerates
+authenticated NAT rebinding, and does not trust a session ID by itself.
+TLS-capable transports authenticate the server through normal X.509 hostname
+verification and authenticate the client with a post-connection HMAC
+challenge/response.
+
+Secrets and application payloads must not appear in logs. Cryptographic
+operations belong to maintained Rust libraries; wgcloak does not implement
+encryption, HMAC, HKDF, SHA, or TLS itself.
+
+## Local permissions
+
+Use separate secret files rather than inline values. Secret files should be
+owned by the service account and mode `0600`; the parent configuration
+directory should not be writable by untrusted users. The Unix control socket
+must be created in a private runtime directory with restrictive ownership and
+mode (normally `0600`). Do not put it in a world-writable directory.
+
+The systemd templates apply `NoNewPrivileges`, a read-only system view, private
+temporary storage, restricted address families, and other process hardening.
+Review `ReadWritePaths`, certificate access, and local policy before enabling
+them. Grant only `CAP_NET_BIND_SERVICE` when a low port is essential. Never
+grant `CAP_NET_ADMIN` or `CAP_SYS_ADMIN` for normal operation.
+
+## Threat boundaries
+
+The relay protects session admission and transport integrity; it does not make
+the encapsulated application secure. Direct UDP is not encrypted by wgcloak,
+so use QUIC, HTTP/3, or TLS/TCP when outer confidentiality is needed. A shared
+secret is a credential: rotate it out of band and avoid putting it in command
+lines, shell history, or issue reports.
+
+Resource limits and bounded parsing reduce denial-of-service exposure, but a
+public relay still needs host firewalling, monitoring, and capacity planning.
+Authentication failure must stop probing rather than causing endless fallback
+traffic.
+
+## Explicit non-goals
+
+v1 does not configure WireGuard, create TUN/TAP interfaces, manage routes or
+firewalls, provide traffic-shaping or browser/TLS-fingerprint evasion, hide
+traffic metadata from a compromised host, cluster servers, or support multiple
+simultaneous client tunnels. These boundaries are intentional.