/ caraga state university · ict laboratories
A workstation access-control platform for Caraga State University ICT laboratories: a Rust coordination server, an administrative manager, a student kiosk, and a per-workstation client that enforces fair, time-limited sessions.
System status
operational/ system components
04 + 1 planned
Workstation lockdown
Runs fullscreen on every lab PC and holds the lock until a valid session token is presented.
Student check-in
The student entry point — verifies identity and issues a one-time token for an assigned workstation.
Control plane
The administrative command surface — real-time floorplan, session control, and the bundled server sidecar.
Coordination layer
The single source of truth — registration, token issuance, and real-time state distribution across every device.
Student scheduling · planned
/ system architecture
The Rust server is the central authority. Discovery, live state, and request/response traffic are isolated on separate channels across the lab network.
Lab hardware
edge
Client PCs
1 per workstation · Tauri
edge
Student Kiosk
check-in terminal · Tauri
Core infrastructure
authority
CARSU Server
Rust · Axum · Tokio
Primary DB
primary store
Settings DB
settings store
Management
control
Primary Manager
local admin PC · sidecar
control
Remote Manager
staff laptop · LAN/tunnel
Background subsystems
Session monitor
tick 60s · expiry → LOCK
Stats updater
tick 10s · occupancy
Network discovery
auto-locate on LAN
Power-outage recovery
orphan sessions · fair refund
Data model · SQLite
Endorsed machines
Physical inventory · signed identity
Clients
Runtime state · heartbeat · specs
Students
Directory · balance · validation
Sessions
Usage history · timestamps
Access tokens
One-time access · student
Tamper events
Security trail · resolution
/ security & authentication
Every live connection is authenticated before any state flows — unauthorized devices can't join the network.
Verified accessSensitive actions require a separate administrative credential, verified server-side on every request.
Admin gatedRecovery secrets are protected with public-key cryptography; the private key never leaves the server. Each machine carries a signed identity.
Public-key sealed