Define Rust environment and toolchain

README.md

@@ -1,2 +1,43 @@
 # wireguard-admin
 
+This repository now contains the initial Rust package, startup boundary, and
+validated settings loader for WireGuard Admin. Client management and the VPN
+management interface have not been implemented yet.
+
+The package requires Rust 1.97.1 or newer and uses the Rust 2024 edition. From
+the repository root, run:
+
+```sh
+cargo run -- --help
+cargo run -- --version
+```
+
+`--help` and `--version` work without root. Starting with no arguments requires
+root; until the management interface is implemented, startup exits with an
+error and does not read server configuration or vault files.
+
+## Settings
+
+Settings use TOML in the fixed file `wireguard-admin.toml` beside the
+executable. Start from [`config/wireguard-admin.example.toml`](config/wireguard-admin.example.toml).
+The required fields are:
+
+- `interface_name`: existing WireGuard interface name (1–15 ASCII characters).
+- `server_config_path`: path to the existing server configuration.
+- `client_source_directory`: directory containing existing client files.
+- `server_endpoint`: hostname or IPv4 address followed by `:port`, or IPv6 in
+  brackets followed by `:port` (for example, `[2001:db8::2]:51820`).
+- `ipv4_allocation_range` and `ipv6_allocation_range`: CIDR ranges of the
+  matching address family.
+- `dns_addresses`: non-empty list of IPv4 and/or IPv6 literal addresses.
+- `systemd_unit`: service unit name ending in `.service`.
+- `restart_timeout_seconds`: positive integer.
+
+`data_root` is optional. It defaults to `Backup` beside the executable;
+current internal data and the encrypted vault are under `data`, and archives
+are under `archives`. Relative configured paths, including an explicit
+`data_root`, resolve from the executable directory. Absolute paths remain
+absolute. Settings validation checks syntax and values only; it does not
+require the referenced files, directories, or service to exist and does not
+perform DNS lookups.
+