Files

T

pastilhas ef3582f2aa init: OffScale — standalone MIT Tailscale/Headscale client

Extracted from the officer-suite monorepo into its own public repo. The app is
open source and free; the rest of the suite is not, so it could not stay in a
tree that ships an account layer.

What moved:

- apps/offscale/*                  -> repo root (App shell, app.json, assets)
- packages/officer-net/            -> modules/officer-net/, a `file:` dependency
- packages/core VPN closure        -> src/vpn/ (screen, hook, native bridge, invite)
- packages/core shared primitives  -> src/ui/ (theme, cards, tabs, backdrop, splash)
- scripts/build-{ios,android}.sh   -> scripts/, cut down to this one app

What deliberately did NOT move: the platform account layer. VpnScreen used to
render core's AppSettingsScreen, which drags in ServersSection -> servers.ts,
useAuth, api.ts, shared-session, install-guard, api-keys. None of that exists
here. src/settings/SettingsScreen.tsx is a fresh replacement rendering exactly
what VpnScreen passed it — the app's own sections plus About — with no Servers
tab, no Appearance control (the app is pinned to dark) and no sign-out.

The one platform reference left in the closure was a dead `import { request }
from './api'` in officer-net.ts, unused since enrollVpn() was removed. Gone. The
app now contacts nothing but the control server you point it at, its peers, and
the enrolment sidecar named inside an invite link you tapped.

Dependencies are pinned to the exact versions the monorepo has installed, not to
ranges: this repo starts from versions already proven to build, and an unpinned
install is a supply-chain decision nobody made. react-query, react-dom,
react-native-screens, expo-secure-store, track-player, expo-audio and
expo-file-system were all declared by the old app and imported by none of this
code, so they are not here.

NOTICE carries Tailscale's BSD-3 text, names the built artifacts that contain
their compiled code, and treats the trademark question separately — including
that src/ui/TailscaleMark.tsx reproduces their logo in the attribution strip.

2026-08-14 20:32:17 +01:00

3.1 KiB

Raw Permalink Blame History

officer-net Expo config plugin

Wires the OS-level capabilities the VPN needs into the app at prebuild. Enabled from app.json:

plugins: [
  ["officer-net", {
    appGroup: "group.pastilhas.officer.offscale",
    neBundleId: "dev.officer.offscale.net",
    enableNetworkExtension: true,
  }],
]

Props (all optional; defaults shown):

prop	default	what it controls
`appGroup`	`group.pastilhas.officer.mobile`	iOS App Group shared by the app and the NE
`neBundleId`	`dev.officer.mobile.net`	the Network Extension target's bundle id
`specialUseSubtype`	VPN mesh tunnel justification	Android `FOREGROUND_SERVICE_SPECIAL_USE` purpose
`enableNetworkExtension`	`false`	add the iOS entitlement and synthesise the NE target

enableNetworkExtension is off by default because the entitlement fails device code-signing until the Apple provisioning below exists. With it off the app signs, installs and renders; the engine is inert. The repo's own app.json turns it on.

What the plugin does

iOS — adds com.apple.developer.networking.networkextension (packet-tunnel-provider) to the main app, and writes OfficerNetExtensionBundleId into Info.plist. That key is load-bearing, not a breadcrumb: the Swift module reads it to fill providerBundleIdentifier, which is how iOS knows which extension to launch. A hardcoded value there means the start command is accepted, nothing matches, and the tunnel silently never starts.
iOS, under enableNetworkExtension — synthesises the Network Extension Xcode target (withNetworkExtensionTarget.js): a new target compiling this package's ios/PacketTunnelProvider.swift, its Info.plist (NSExtensionPointIdentifier = com.apple.networkextension.packet-tunnel), its own entitlements, NetworkExtension.framework, the vendored TailCore.xcframework, and the app's Embed App Extensions phase. Doing this by hand after every expo prebuild --clean is what this replaces.
Android — adds FOREGROUND_SERVICE and FOREGROUND_SERVICE_SPECIAL_USE, and registers OfficerVpnService with BIND_VPN_SERVICE, foregroundServiceType="specialUse" and the android.net.VpnService intent-filter.

Apple provisioning prerequisites (one-time, in the Apple Developer portal)

A separate App ID for the extension (neBundleId) with the Network Extensions capability.
The Network Extensions capability on the main app ID.
Provisioning profiles for both, with those capabilities.

xcodebuild -allowProvisioningUpdates cannot create these while Xcode has no account signed in: it falls back to the wildcard team profile and fails with "Provisioning profile 'iOS Team Provisioning Profile: *' doesn't include the Network Extensions capability". Sign in under Xcode → Settings → Accounts first. Android needs none of this.

3.1 KiB Raw Permalink Blame History

officer-net Expo config plugin

What the plugin does

Apple provisioning prerequisites (one-time, in the Apple Developer portal)

3.1 KiB

Raw Permalink Blame History