feat: added support for running the VPN router on a host with Docker Community Edition.

debian-package/debian/changelog

@@ -1,3 +1,22 @@
+vpn-router (0.3.0-1) unstable; urgency=medium
+
+  * Secure the ports Docker publishes. Rules in a chain of their own,
+    VPN-ROUTER-DOCKER, entered by a jump at the top of DOCKER-USER, accept
+    IPsec protected traffic, TCP to docker.exposed_ports and established
+    connections from the external interface and drop the rest of it. Other
+    rules in DOCKER-USER are left alone. The rules cover IPv4 only.
+  * Add the docker configuration section. docker.mode is auto (the default,
+    secures Docker when docker.service is installed), on (requires Docker) or
+    off (removes the rules); docker.exposed_ports lists the TCP ports and port
+    ranges reachable from the external interface, none by default.
+  * Add the vpn-router-docker service, which applies the Docker rules after
+    docker.service starts and removes them when it stops. vpn-router-setup
+    restarts it while Docker runs, so a changed configuration takes effect.
+  * Installing Docker before this package is recommended. When Docker is
+    installed later, restart vpn-router-setup to apply the rules.
+
+ -- Sławomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 12:44:45 +0200
+
 vpn-router (0.2.0-1) unstable; urgency=medium
 
   * Change the configuration file to JSON, /etc/vpn-router/vpn-router.json.

debian-package/debian/install

@@ -2,6 +2,7 @@ src/etc/sysctl.d/99-vpn-router.conf                   etc/sysctl.d/
 src/usr/lib/vpn-router/vpnrouter.py                   usr/lib/vpn-router/
 src/usr/lib/vpn-router/simple-ca                      usr/lib/vpn-router/
 src/usr/lib/vpn-router/configure                      usr/lib/vpn-router/
+src/usr/lib/vpn-router/docker-rules                   usr/lib/vpn-router/
 src/usr/lib/vpn-router/setup                          usr/lib/vpn-router/
 src/usr/lib/vpn-router/generate-config                usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_platforms/*.py       usr/lib/vpn-router/vpnrouter_platforms/

debian-package/debian/rules

@@ -4,3 +4,4 @@
 
 override_dh_installsystemd:
 	dh_installsystemd --name=vpn-router-setup
+	dh_installsystemd --name=vpn-router-docker

debian-package/debian/vpn-router.vpn-router-docker.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=VPN Router rules for Docker published ports
+Documentation=file:/usr/share/doc/vpn-router/README.md
+After=docker.service vpn-router-setup.service
+PartOf=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/lib/vpn-router/docker-rules apply
+ExecStop=/usr/lib/vpn-router/docker-rules remove
+
+[Install]
+WantedBy=docker.service