fix: update doc arch

diagrams/architecture.puml

@@ -4,18 +4,19 @@ title After: everything goes through the front
 
 actor Player as player
 node "Master\netmaster.net:27950" as master
+actor "Admin tool\n(tunnel side)" as admin
 
 node "Front (public IP)" {
   component "etrelay\n0.0.0.0:27960" as relay
+  component "control API\n<front-wg>:8090" as control
 }
 
 node "Home" {
-  component "nginx stream\n<wg-peer>:27960" as nginx
-  component "ET server\n<et-server>:27960" as et
+  component "ET server\n<et-server>:27960\n(own WireGuard peer)" as et
 }
 
 player <--> relay : game traffic
 master <--> relay : heartbeat / getChallenge / getInfo
-relay <--> nginx : WireGuard (wg0)
-nginx <--> et : LAN
+relay <--> et : WireGuard (wg0), direct:\none source port per client
+admin --> control : WireGuard: sessions, bans\n(bearer token)
 @enduml

diagrams/ban.puml

@@ -0,0 +1,22 @@
+@startuml
+skinparam shadowing false
+title Control API: real address and ban of a player
+
+participant "Admin tool" as admin
+participant "etrelay control API\n<front-wg>:8090" as control
+participant "etrelay\nrelay loop" as relay
+participant "ET server" as et
+actor "Player\n203.0.113.7" as player
+
+note over admin, et : the ET server shows the player as <front-wg>:51234
+admin -> control : GET /sessions
+control --> admin : [{client: 203.0.113.7:27960, port: 51234}]
+note right of admin : port 51234 = 203.0.113.7
+
+== Ban ==
+admin -> control : PUT /bans/203.0.113.7\n{reason, minutes}
+control -> control : bans.json (atomic write)\ncut 203.0.113.7's sessions
+player -> relay : game packets
+relay -> relay : banned: dropped
+note over et : no packet: times the player out
+@enduml

diagrams/player-session.puml

@@ -2,18 +2,20 @@
 skinparam shadowing false
 title Player: one session per client address
 
-actor "Player\n1.2.3.4:5555" as player
+actor "Player\n203.0.113.7:27960" as player
 participant "etrelay\nfront :27960" as relay
-participant "session task\n(ephemeral socket)" as session
+participant "session task\n(socket :51234)" as session
 participant "ET server" as et
 
 player -> relay : getchallenge / connect / game packets
+relay -> relay : filter (command, query rate)\nban check
 relay -> session : first packet: open session
-session -> et : forward (source = ephemeral port)
+session -> et : forward (source = <front-wg>:51234)
+note right of et : sees the player as\n<front-wg>:51234
 et --> session : reply
 session --> player : reply sent from front:27960
 ...packets both ways, deadline pushed back on each packet...
 ...2 min without any packet...
 session -> session : close (socket dropped)
-note over relay : next packet from 1.2.3.4:5555\nopens a new session
+note over relay : next packet from 203.0.113.7:27960\nopens a new session (new port)
 @enduml

diagrams/registration.puml

@@ -4,7 +4,7 @@ title Master registration (every 5 min)
 
 participant "Master\netmaster.net:27950" as master
 participant "etrelay\nfront :27960" as relay
-participant "ET server\n(via wg + nginx)" as et
+participant "ET server\n(via wg)" as et
 
 == Liveness probe (dedicated ephemeral socket) ==
 relay -> et : getinfo etrelay
@@ -16,7 +16,7 @@ relay -> master : heartbeat EnemyTerritory-1\nsource = front:27960
 
 == Master checks: handled like any client ==
 master -> relay : getChallenge\nto front:27960
-relay -> relay : new session for master:27950
+relay -> relay : filter: allowed, rate ok\nnew session for master:27950
 relay -> et : getChallenge
 et --> relay : challengeResponse
 relay --> master : challengeResponse\nsource = front:27960

diagrams/tasks.puml

@@ -4,7 +4,12 @@ title Tasks and data flow
 
 rectangle "relay loop (main task)" as loop {
   card "public socket\nrecv_from" as recv
-  card "sessions:\nHashMap<client, Sender>" as map
+  card "filter\n(commands, query rate)" as filter
+}
+
+rectangle "shared state (Mutex)" as shared {
+  card "sessions:\nHashMap<client, Session>" as map
+  card "bans\n(bans.json)" as bans
 }
 
 rectangle "session task (one per client)" as st {
@@ -17,10 +22,18 @@ rectangle "heartbeat task" as hb {
   card "probe socket" as probe
 }
 
-recv --> map : lookup client
+rectangle "control API task (axum)" as ctl {
+  card "GET /sessions\nGET/PUT/DELETE /bans" as routes
+}
+
+recv --> filter
+filter --> bans : banned?
+filter --> map : lookup client
 map --> rx : try_send(packet)\n(full: drop)
 rx --> up : send
 up --> recv : recv, then public.send_to(client)
 tick --> probe : getinfo
 tick --> recv : heartbeat via public socket
+routes --> map : list ports,\ndrop a banned IP's sessions
+routes --> bans : set / lift
 @enduml