# Third-party licenses — crash reporter backend & apps.f0xx.org stack

Prepared for landing / legal disclosure. **Verify against production deploy** before publishing.

## Android Cast application code (PHP/JS in this tree)

- **License:** same BSD-style terms as the Android Cast mobile app (see repo root / mobile `licenses/combined.html`).
- **Scope:** `examples/crash_reporter/backend/` PHP, views, static JS/CSS under `public/assets/`.

## Runtime infrastructure (operator-installed)

| Component | Typical license | Notes |
|-----------|-----------------|--------|
| Alpine Linux | Various (GPL-2.0 kernel; mixed userspace) | BE VM base |
| nginx | BSD-2-Clause | Reverse proxy / static |
| PHP 8.x | PHP License v3.01 | FPM |
| MariaDB / SQLite | GPL-2.0 (MariaDB); public domain (SQLite) | DB engine |
| OpenSSH / OpenSSL | Various | Admin access, TLS |

These are **server-side**; not bundled in the mobile APK.

## Optional remote-access tooling

| Component | License | When used |
|-----------|---------|-----------|
| **wireguard-tools** (`wg`, `wg-quick`) | GPLv2 (userspace) | BE dynamic peer provisioning (`WireGuardPeerProvisioner.php`) |
| Linux **WireGuard** kernel module | GPLv2 | UDP tunnel termination on BE |

Mobile WireGuard mode uses outbound tunnel from device; app embeds `wireguard-android` tunnel (`third-party/wireguard-android`, Apache-2.0) — see app `licenses/combined.html`.

## Planned: reverse SSH (RSSH)

**Alpha essential** (owner agreement). Device opt-in via existing `heartbeat.php` RA flow; outbound SSH reverse tunnel to bastion; no `VpnService`. Stack may include OpenSSH-compatible client on device and `sshd`/SFTP on bastion — licenses TBD (typically OpenSSH license + OpenSSL).

## Frontend assets (this backend)

- **Vanilla JavaScript/CSS** in `public/assets/` — project-authored unless noted.
- No npm bundle in production tree at time of writing; if CDN libraries are added later, list them here.

## Publishing on landing

Suggested public URL after deploy sync:

`https://apps.f0xx.org/app/androidcast_project/crashes/THIRD_PARTY_LICENSES.md`

(or render an HTML excerpt on the hub legal page linking mobile + BE lists).
