vpn-router (0.6.0-1) unstable; urgency=medium

  feature: users can be enrolled for TOTP one-time passwords.

  * vpn-router-user otp-new makes a TOTP secret and its otpauth URI,
    otp-enrol stores the secret, read from standard input, given a code of
    it, and otp-remove removes it. list and every answer show whether a user
    is enrolled, as otp.
  * The web service enrols with POST, PUT and DELETE /users/<name>/otp.
  * The secret is kept in the user's entry with the OATH-LDAP schema of
    slapd's otp module; only the user manager account may set it, and no
    one can read it. Logins do not ask for the codes.
  * The package depends on python3-pyotp.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 23:30:00 +0200

vpn-router (0.5.9-1) unstable; urgency=medium

  fix: package upgrades no longer ask the configuration questions.

  * The configuration questions are asked only on a fresh installation and
    by dpkg-reconfigure.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 21:00:00 +0200

vpn-router (0.5.8-1) unstable; urgency=medium

  fix: an upgrade keeps the configuration and asks nothing.

  * postinst passes on only the debconf answers that were given. The
    defaults of questions never asked, such as platform none, no longer
    replace settings of vpn-router.json.
  * Without an answer that changes it, the configuration ucf is given is
    vpn-router.json byte for byte, so an upgrade has no conflict to ask
    about; settings the file leaves out keep their defaults when it is read.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 20:00:00 +0200

vpn-router (0.5.7-1) unstable; urgency=medium

  feature: users have a first name, a last name and an e-mail address.

  * vpn-router-user add needs --first-name, --last-name and --email, kept as
    givenName, sn and mail, with cn set to the first and the last name.
    vpn-router-user update changes them, and list and every answer show
    them as first_name, last_name and email.
  * POST /users needs first_name, last_name and email, and PUT
    /users/<name> changes them.
  * vpn-router-user answers in text: a table of the users, the client
    profile or a short message, with failures on standard error. --json
    gives the JSON answers. -h and --help show the commands and their
    options.
  * The web service manages users with vpnrouter_users, the module
    vpn-router-user uses, instead of running vpn-router-user for each
    request.
  * Groups of users, kept as groupOfNames entries in ou=groups with a
    description and at least one member. vpn-router-group lists, adds,
    renames, describes and removes them and adds and takes out members, and
    the web service serves the same under /groups. Removing a user takes it
    out of its groups and is refused while it is the last member of one.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 19:00:00 +0200

vpn-router (0.5.6-1) unstable; urgency=medium

  update: the status web service listens on port 7081 by default.

  * web.port defaults to 7081.
  * vpn-router-setup opens the Router Manager's port, 7080 by default, on
    the internal interface.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 18:00:00 +0200

vpn-router (0.5.5-1) unstable; urgency=medium

  feature: users and their certificates no longer need a P2S system enabled.

  * vpn-router-setup provisions the user directory, the CA and its CRL once
    a platform is chosen, whether or not OpenVPN or road-warrior access is
    enabled. The server certificate is issued once wan.local_fqdn is set,
    also for an existing CA that has none.
  * /users and vpn-router-user manage users and issue and revoke their
    certificates without a P2S system; only the OpenVPN client profile
    needs OpenVPN.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 16:00:00 +0200

vpn-router (0.5.4-1) unstable; urgency=medium

  feature: the firewall lets the Router Manager in on the internal interface.

  * While vpn-router-manager is installed, vpn-router-setup opens its port,
    port in /etc/vpn-router-manager/manager.json or 8090, on the internal
    interface. Purging the package removes the rule.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 13:00:00 +0200

vpn-router (0.5.3-1) unstable; urgency=medium

  fix: the status always shows the state of slapd.

  * /status and the status page show the state of slapd whether or not
    OpenVPN or road-warrior access is configured, since the package always
    runs it.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 12:00:00 +0200

vpn-router (0.5.2-1) unstable; urgency=medium

  fix: /config no longer shows secret options.

  * The configuration shown by /config leaves out the secret options (psk,
    jwt_secret, and options named like a password, token or key) instead of
    showing them masked.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 11:00:00 +0200

vpn-router (0.5.1-1) unstable; urgency=medium

  fix: the web service works in every state of the router.

  * vpn-router-web works whether /etc/vpn-router/pki and
    /etc/swanctl/x509crl exist or not; they exist only while OpenVPN or
    road-warrior access is configured. The paths the unit may write are
    used when they exist and ignored when they do not.
  * vpn-router-web starts on its own and keeps running. Every 30 seconds a
    discovery thread works out the internal address from vpn-router.json as
    general.mode directs, with web.port and web.enabled, and starts, moves
    or stops the server thread to match. Each request reads the token
    secret, the features and the facts it shows. The service is no longer
    ordered after vpn-router-setup, which no longer restarts it, and
    web.json no longer holds the address, the port or the secret.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 10:00:00 +0200

vpn-router (0.5.0-1) unstable; urgency=medium

  * OpenVPN P2S access, set in the openvpn section (enabled, address_pool,
    port, protocol). Clients need a certificate of the router CA and the
    password of the user named in it; the password is checked against a
    local LDAP directory by openvpn-auth-ldap.
  * The users live in the package's own slapd database, dc=vpn-router,
    dc=local, which vpn-router-setup provisions while OpenVPN or road-warrior
    access is configured. slapd listens on its local socket only. Passwords
    are stored as ARGON2 hashes, and a disabled user is locked with the
    password policy.
  * vpn-router-user lists, adds, disables, enables and removes users, sets
    passwords and gives OpenVPN client profiles. Adding a user also issues
    the user's client certificate; removing one revokes it.
  * The web service manages users under /users, with the same token as
    /config, and /status shows the OpenVPN clients.
  * The CA gets a certificate revocation list when it is created, and an
    existing CA without one gets one.
  * Purging the package removes the firewall rules of the web service, which
    it left behind before.
  * The status page follows the browser's light or dark colour scheme,
    uses a proportional font and reloads itself every minute.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 23:00:00 +0200

vpn-router (0.4.3-1) unstable; urgency=medium

  * swanctl output with more closing than opening lines is read as not
    available instead of failing the request.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 22:00:00 +0200

vpn-router (0.4.2-1) unstable; urgency=medium

  * /config gives the IPsec connections and SAs as objects, read from
    swanctl --pretty, and the routes as objects from ip -j, instead of
    lines of text. The site-to-site and road-warrior state of /status is
    counted from the same swanctl objects.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 21:30:00 +0200

vpn-router (0.4.1-1) unstable; urgency=medium

  * Fix the start of vpn-router-setup hanging on a host that runs Docker.
    vpn-router-setup restarted vpn-router-docker and waited for it, but that
    unit was ordered after vpn-router-setup, so each waited for the other,
    the installation of the package never finished and vpn-router-web was
    never enabled or started. vpn-router-docker is no longer ordered after
    vpn-router-setup, so vpn-router-setup still waits for it and the Docker
    rules are in place when it ends. The restart of vpn-router-web is queued
    without waiting.
  * Start vpn-router-setup after docker.service, so that Docker is up when
    the setup looks for it and does not start in parallel with it. The
    ordering applies only when Docker is installed.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 20:10:00 +0200

vpn-router (0.4.0-1) unstable; urgency=medium

  * Add the vpn-router-web service, a small status web service that uses only
    the Python standard library. It listens on the internal address and on
    web.port, 8080 by default. / shows the state of the router for people,
    as plain text for curl and wget and as a Tailwind CSS page for a
    browser, and /status shows the same as JSON: the state of the services,
    the package version, whether Docker is installed, and the state of
    site-to-site, road-warrior and WireGuard, with no configuration data.
  * Add the web configuration section. web.enabled (true by default) and
    web.port. vpn-router-setup opens the port on the internal interface in
    UFW and restarts the service.
  * Add /config to the status web service, for a client such as manage-ui. It
    shows the configuration with its secrets masked, the interfaces,
    addresses, identities and routes the router resolved, the IPsec
    connections and SAs, the WireGuard peers (no keys) and the Docker rules.
    It needs a JWT signed with HS256 by web.jwt_secret, with an exp claim
    within ten minutes, and is not served while web.jwt_secret is not set.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 19:00:00 +0200

vpn-router (0.3.2-1) unstable; urgency=medium

  * Accept an IPv4 or IPv6 address as remote.id and as wan.local_fqdn. The
    identities are written to the strongSwan configuration as given, without
    an @ added, and strongSwan reads an address as an IP identity and a name
    as an FQDN. A value that starts with @ is refused with an error, since
    strongSwan 5.0 and later need no @ to avoid resolving a name.
    Road-warrior access still needs a name in wan.local_fqdn.
  * Depend on strongswan-swanctl and charon-systemd 5.0 or later.

 -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 18:00:00 +0200

vpn-router (0.3.1-1) unstable; urgency=medium

  * Ignore virtual interfaces when mode auto looks for the internal
    interface. The Docker bridge docker0, which has an address, was counted
    as a second internal interface, so vpn-router-setup and
    vpn-router-docker failed on a host with Docker installed.

 -- Sławomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 13:44:00 +0200

vpn-router (0.3.0-1) unstable; urgency=medium

  * Secure the ports Docker publishes. Rules in a chain of their own,
    VPN-ROUTER-DOCKER, entered by a jump at the top of DOCKER-USER, accept
    IPsec protected traffic, TCP to docker.exposed_ports and established
    connections from the external interface and drop the rest of it. Other
    rules in DOCKER-USER are left alone. The rules cover IPv4 only.
  * Add the docker configuration section. docker.mode is auto (the default,
    secures Docker when docker.service is installed), on (requires Docker) or
    off (removes the rules); docker.exposed_ports lists the TCP ports and port
    ranges reachable from the external interface, none by default.
  * Add the vpn-router-docker service, which applies the Docker rules after
    docker.service starts and removes them when it stops. vpn-router-setup
    restarts it while Docker runs, so a changed configuration takes effect.
  * Installing Docker before this package is recommended. When Docker is
    installed later, restart vpn-router-setup to apply the rules.

 -- Sławomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 12:44:45 +0200

vpn-router (0.2.0-1) unstable; urgency=medium

  * Change the configuration file to JSON, /etc/vpn-router/vpn-router.json.
    Lists are arrays, booleans and the WireGuard listen port are native JSON
    types, and unknown sections, unknown settings and wrong value types are
    rejected.
  * Replace remote.psk_b64 with remote.psk, holding the pre-shared key as a
    plain string. remote.psk_file still takes precedence.
  * Ship /usr/share/doc/vpn-router/vpn-router.json.example in place of
    vpn-router.conf.example.
  * Add platform "none" as the default, so installing the package changes
    nothing on the machine until a platform is chosen.
  * Add the mode setting (manual, interfaces, auto) controlling how much of
    the network configuration is supplied and how much is read from the
    system.
  * Manage the configuration file with ucf, so dpkg-reconfigure reapplies
    debconf answers without overwriting local edits.
  * Apply NAT and forward rules to every local subnet, not only the first.

 -- Sławomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 08:00:06 +0200

vpn-router (0.1.0-1) unstable; urgency=medium

  * Initial release.

 -- Sławomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 26 May 2026 00:00:00 +0200
