VPN service built with Rust — daemon, Telegram bot, admin panel, and Tauri 2 client app. Two tunnel protocols, two VPS regions: WireGuard — client connects to Moscow VPS (:51820), traffic routes to Europe VPS via a site-to-site WireGuard tunnel (policy routing + MASQUERADE) VLESS+REALITY — client connects directly to Europe VPS (:443), camouflaged as regular HTTPS How it works: Server writes peer changes to PostgreSQL (e.g. sync_status = 'pending_add') → DB trigger fires pg_notify('peer_changed') → daemon picks it up, syncs WireGuard, applies rate limits, and marks peer as active. The VLESS proxy on Europe syncs its user registry from the same database via pg LISTEN/NOTIFY. All state lives in the database. Traffic metrics from both daemon and VLESS are scraped by VictoriaMetrics; the server queries VM to serve traffic stats in the API. Features Daemon Stateless WireGuard peer synchronization via wg set Per-peer HFSC traffic shaping (bidirectional — egress + IFB ingress) Prometheus metrics endpoint — traffic counters scraped by VictoriaMetrics Auto-runs database migrations on startup VLESS Proxy shoes-lite — VLESS+REALITY with Vision flow control Per-user token-bucket rate limiting synced from subscription plans Real-time user registry via pg LISTEN/NOTIFY + periodic full sync Prometheus metrics endpoint for per-user traffic counters Constant-time UUID comparison (timing-attack resistant) Telegram Bot User registration with automatic 7-day trial Subscription status, language switching (en/ru) Inline button to open the web app Admin Panel Dashboard with server stats and traffic overview User management — create, search, subscription control Plan management — speed limits, peer limits, pricing Peer monitoring — sync status, traffic, last handshake CLI Client Standalone WireGuard client (floppa-cli) for headless/server use Also used as the tunnel binary for integration tests Client App (Tauri 2) Cross-platform: Linux, Windows, Android WireGuard and VLESS+REALITY tunnel support Split tunneling with per-app selection (Android) WireGuard config persistence via OS keyring (desktop) or encrypted file (Android) Deep-link authentication (Telegram Login Widget → JWT) Two-process architecture on Android (VPN survives app swipe-close)