Cargo.lock

@@ -84,9 +84,9 @@ dependencies = [
 
 [[package]]
 name = "arc-swap"
-version = "1.9.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
+checksum = "a07d1f37ff60921c83bdfc7407723bdefe89b44b98a9b772f225c8f9d67141a6"
 dependencies = [
  "rustversion",
 ]
@@ -522,6 +522,16 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -757,9 +767,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.9.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -772,6 +782,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
+ "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -1145,6 +1156,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "log",
+ "qrcode",
  "rcgen",
  "reqwest",
  "ring",
@@ -1219,6 +1231,12 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
 [[package]]
 name = "plotters"
 version = "0.3.7"
@@ -1295,6 +1313,12 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "qrcode"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d68782463e408eb1e668cf6152704bd856c78c5b6417adaee3203d8f4c1fc9ec"
+
 [[package]]
 name = "quinn"
 version = "0.11.9"
@@ -1674,6 +1698,16 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
@@ -1833,14 +1867,15 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.51.1"
+version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f66bf9585cda4b724d3e78ab34b73fb2bbaba9011b9bfdf69dc836382ea13b8c"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
 dependencies = [
  "bytes",
  "libc",
  "mio",
  "pin-project-lite",
+ "signal-hook-registry",
  "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
@@ -1848,9 +1883,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "5c55a2eff8b69ce66c84f85e1da1c233edc36ceb85a2058d11b0d6a3c7e7569c"
 dependencies = [
  "proc-macro2",
  "quote",

Cargo.toml

@@ -10,7 +10,7 @@ keywords = ["dns", "dns-server", "ad-blocking", "reverse-proxy", "developer-tool
 categories = ["network-programming", "development-tools"]
 
 [dependencies]
-tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time", "sync"] }
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time", "sync", "signal"] }
 axum = "0.8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
@@ -30,6 +30,7 @@ tokio-rustls = "0.26"
 arc-swap = "1"
 ring = "0.17"
 rustls-pemfile = "2.2.0"
+qrcode = { version = "0.14", default-features = false }
 
 [dev-dependencies]
 criterion = { version = "0.8", features = ["html_reports"] }

src/lib.rs

@@ -17,6 +17,7 @@ pub mod question;
 pub mod record;
 pub mod recursive;
 pub mod service_store;
+pub mod setup_phone;
 pub mod srtt;
 pub mod stats;
 pub mod system_dns;

src/main.rs

@@ -54,6 +54,9 @@ async fn main() -> numa::Result<()> {
                 }
             };
         }
+        "setup-phone" => {
+            return numa::setup_phone::run().await.map_err(|e| e.into());
+        }
         "lan" => {
             let sub = std::env::args().nth(2).unwrap_or_default();
             let config_path = std::env::args()
@@ -85,6 +88,7 @@ async fn main() -> numa::Result<()> {
             eprintln!("  service status  Check if the service is running");
             eprintln!("  lan on          Enable LAN service discovery (mDNS)");
             eprintln!("  lan off         Disable LAN service discovery");
+            eprintln!("  setup-phone     Generate a QR code to install Numa DoT on a phone");
             eprintln!("  help            Show this help");
             eprintln!();
             eprintln!("Config path defaults to numa.toml");

src/setup_phone.rs

@@ -0,0 +1,267 @@
+use std::net::{Ipv4Addr, SocketAddr};
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+
+use qrcode::render::unicode;
+use qrcode::QrCode;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpListener;
+
+const SETUP_PORT: u16 = 8765;
+const RUST_OK_HEADERS: &str = "HTTP/1.1 200 OK\r\nContent-Type: application/x-apple-aspen-config\r\nContent-Disposition: attachment; filename=\"numa.mobileconfig\"\r\nConnection: close\r\nContent-Length: ";
+const RUST_NOT_FOUND: &str =
+    "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n";
+
+/// Strip the PEM header/footer and newlines from a CA cert, leaving raw base64
+/// for embedding in a plist `<data>` block.
+fn pem_to_base64(pem: &str) -> String {
+    pem.lines()
+        .filter(|line| !line.starts_with("-----"))
+        .collect::<String>()
+}
+
+/// Build a combined `.mobileconfig` containing:
+/// 1. Root CA payload — installs and trusts the Numa local CA
+/// 2. DNS payload — points the device at Numa over DoT
+///
+/// UUIDs and PayloadIdentifiers are intentionally fixed (not randomized) so
+/// that re-running `numa setup-phone` after an IP change replaces the existing
+/// profile rather than accumulating duplicates in iOS Settings.
+fn build_mobileconfig(lan_ip: Ipv4Addr, ca_pem: &str) -> String {
+    let ca_base64 = pem_to_base64(ca_pem);
+
+    // Wrap base64 at 52 chars per line for plist readability (matches Apple convention)
+    let ca_wrapped: String = ca_base64
+        .chars()
+        .collect::<Vec<_>>()
+        .chunks(52)
+        .map(|chunk| format!("\t\t\t{}", chunk.iter().collect::<String>()))
+        .collect::<Vec<_>>()
+        .join("\n");
+
+    format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>PayloadContent</key>
+	<array>
+		<dict>
+			<key>PayloadCertificateFileName</key>
+			<string>numa-ca.pem</string>
+			<key>PayloadContent</key>
+			<data>
+{ca}
+			</data>
+			<key>PayloadDescription</key>
+			<string>Numa local Certificate Authority — required for DoT trust</string>
+			<key>PayloadDisplayName</key>
+			<string>Numa Local CA</string>
+			<key>PayloadIdentifier</key>
+			<string>com.numa.dns.ca</string>
+			<key>PayloadType</key>
+			<string>com.apple.security.root</string>
+			<key>PayloadUUID</key>
+			<string>B2C3D4E5-F6A7-8901-BCDE-F12345678901</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+		</dict>
+		<dict>
+			<key>DNSSettings</key>
+			<dict>
+				<key>DNSProtocol</key>
+				<string>TLS</string>
+				<key>ServerAddresses</key>
+				<array>
+					<string>{ip}</string>
+				</array>
+				<key>ServerName</key>
+				<string>numa.numa</string>
+			</dict>
+			<key>PayloadDescription</key>
+			<string>Routes all DNS queries through Numa over DNS-over-TLS</string>
+			<key>PayloadDisplayName</key>
+			<string>Numa DNS-over-TLS</string>
+			<key>PayloadIdentifier</key>
+			<string>com.numa.dns.dot</string>
+			<key>PayloadType</key>
+			<string>com.apple.dnsSettings.managed</string>
+			<key>PayloadUUID</key>
+			<string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+		</dict>
+	</array>
+	<key>PayloadDescription</key>
+	<string>Trusts the Numa local CA and routes DNS queries to Numa over DoT on your local network ({ip})</string>
+	<key>PayloadDisplayName</key>
+	<string>Numa DNS</string>
+	<key>PayloadIdentifier</key>
+	<string>com.numa.dns.profile</string>
+	<key>PayloadRemovalDisallowed</key>
+	<false/>
+	<key>PayloadType</key>
+	<string>Configuration</string>
+	<key>PayloadUUID</key>
+	<string>F1E2D3C4-B5A6-7890-1234-567890ABCDEF</string>
+	<key>PayloadVersion</key>
+	<integer>1</integer>
+</dict>
+</plist>
+"#,
+        ca = ca_wrapped,
+        ip = lan_ip
+    )
+}
+
+fn render_qr(url: &str) -> Result<String, String> {
+    let code = QrCode::new(url).map_err(|e| format!("failed to encode QR: {}", e))?;
+    Ok(code
+        .render::<unicode::Dense1x2>()
+        .dark_color(unicode::Dense1x2::Light)
+        .light_color(unicode::Dense1x2::Dark)
+        .build())
+}
+
+async fn accept_loop(listener: TcpListener, profile: Arc<String>, count: Arc<AtomicUsize>) {
+    loop {
+        let (mut stream, peer) = match listener.accept().await {
+            Ok(c) => c,
+            Err(_) => continue,
+        };
+
+        let profile = Arc::clone(&profile);
+        let count = Arc::clone(&count);
+
+        tokio::spawn(async move {
+            let mut buf = [0u8; 1024];
+            let _ = match tokio::time::timeout(Duration::from_secs(5), stream.read(&mut buf)).await
+            {
+                Ok(Ok(n)) => n,
+                _ => return,
+            };
+
+            let request = String::from_utf8_lossy(&buf);
+            if request.starts_with("GET /setup") || request.starts_with("GET / ") {
+                let body = profile.as_bytes();
+                let mut response =
+                    format!("{}{}\r\n\r\n", RUST_OK_HEADERS, body.len()).into_bytes();
+                response.extend_from_slice(body);
+                let _ = stream.write_all(&response).await;
+                let _ = stream.flush().await;
+                let n = count.fetch_add(1, Ordering::Relaxed) + 1;
+                eprintln!(
+                    "  \x1b[32m✓\x1b[0m Profile downloaded by {} ({} total)",
+                    peer.ip(),
+                    n
+                );
+            } else {
+                let _ = stream.write_all(RUST_NOT_FOUND.as_bytes()).await;
+            }
+        });
+    }
+}
+
+/// Run the `numa setup-phone` flow.
+pub async fn run() -> Result<(), String> {
+    let lan_ip = crate::lan::detect_lan_ip()
+        .ok_or("could not detect LAN IP — are you connected to a network?")?;
+
+    let ca_path: PathBuf = crate::data_dir().join("ca.pem");
+    let ca_pem = std::fs::read_to_string(&ca_path).map_err(|e| {
+        format!(
+            "could not read CA at {}: {} — is Numa installed and has the service started at least once?",
+            ca_path.display(),
+            e
+        )
+    })?;
+
+    let profile = build_mobileconfig(lan_ip, &ca_pem);
+    let url = format!("http://{}:{}/setup", lan_ip, SETUP_PORT);
+    let qr = render_qr(&url)?;
+
+    let bind_addr = SocketAddr::from(([0, 0, 0, 0], SETUP_PORT));
+    let listener = TcpListener::bind(bind_addr).await.map_err(|e| {
+        format!(
+            "could not bind setup server on port {}: {} — is another setup running?",
+            SETUP_PORT, e
+        )
+    })?;
+
+    eprintln!();
+    eprintln!("  \x1b[1;38;2;192;98;58mNuma Phone Setup\x1b[0m\n");
+    eprintln!("  Serving setup profile at: \x1b[36m{}\x1b[0m\n", url);
+    for line in qr.lines() {
+        eprintln!("  {}", line);
+    }
+    eprintln!();
+    eprintln!("  \x1b[1mOn your iPhone:\x1b[0m");
+    eprintln!("    1. Open Camera, point at the QR code, tap the yellow banner");
+    eprintln!("    2. Allow the download when Safari asks");
+    eprintln!("    3. Open Settings — tap \"Profile Downloaded\" near the top");
+    eprintln!("       (or: Settings → General → VPN & Device Management → Numa DNS)");
+    eprintln!("    4. Tap Install (top right), enter passcode, Install again");
+    eprintln!("    5. \x1b[1mSettings → General → About → Certificate Trust Settings\x1b[0m");
+    eprintln!("       Toggle ON \"Numa Local CA\" — required for DoT to work");
+    eprintln!();
+    eprintln!(
+        "  \x1b[33mNote:\x1b[0m profile uses your laptop's current IP ({}). If your",
+        lan_ip
+    );
+    eprintln!("  laptop changes networks, re-run this command — iOS will replace the");
+    eprintln!("  existing profile automatically.");
+    eprintln!();
+    eprintln!("  Waiting for download (Ctrl+C to exit)...");
+    eprintln!();
+
+    let count = Arc::new(AtomicUsize::new(0));
+    let server = tokio::spawn(accept_loop(listener, Arc::new(profile), Arc::clone(&count)));
+
+    let _ = tokio::signal::ctrl_c().await;
+    server.abort();
+    eprintln!();
+    let total = count.load(Ordering::Relaxed);
+    if total > 0 {
+        eprintln!(
+            "  Setup ended — {} download{} served",
+            total,
+            if total == 1 { "" } else { "s" }
+        );
+    } else {
+        eprintln!("  Setup cancelled — no downloads served");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pem_to_base64_strips_headers() {
+        let pem = "-----BEGIN CERTIFICATE-----\nABCDEF\nGHIJKL\n-----END CERTIFICATE-----\n";
+        assert_eq!(pem_to_base64(pem), "ABCDEFGHIJKL");
+    }
+
+    #[test]
+    fn mobileconfig_contains_ip_and_ca() {
+        let pem =
+            "-----BEGIN CERTIFICATE-----\nMIIBkDCCATagAwIBAgIUTEST\n-----END CERTIFICATE-----\n";
+        let config = build_mobileconfig(Ipv4Addr::new(192, 168, 1, 100), pem);
+        assert!(config.contains("192.168.1.100"));
+        assert!(config.contains("MIIBkDCCATagAwIBAgIUTEST"));
+        assert!(config.contains("com.apple.security.root"));
+        assert!(config.contains("com.apple.dnsSettings.managed"));
+        assert!(config.contains("DNSProtocol"));
+    }
+
+    #[test]
+    fn render_qr_produces_unicode() {
+        let qr = render_qr("http://192.168.1.9:8765/setup").unwrap();
+        assert!(!qr.is_empty());
+        // Dense1x2 uses these block characters
+        assert!(qr.chars().any(|c| matches!(c, '█' | '▀' | '▄' | ' ')));
+    }
+}