feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.

2026-10-25 17:14:23 +01:00
1 parent a79510a02f
commit 4a5b15a559
@@ -1,3 +1,43 @@
+vpn-router (0.18.0-1) unstable; urgency=medium
+
+  feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.
+
+  * site_to_site maps a connection name to addrs, id, cidrs, local_cidrs,
+    local_id_mode, psk and psk_file; it replaces remote and
+    wan.local_id_mode, and a configuration with them is refused.
+  * The install answers fill the connection remote-site; the local subnets
+    fill both its local_cidrs and local.cidrs.
+  * Every ready connection is written to
+    /etc/swanctl/conf.d/site-to-site.conf as the swanctl connection and
+    child of its name with the secret ike-psk-<name>; remote-site.conf is
+    no longer written.
+  * Traffic from each connection's local_cidrs to its cidrs is not
+    masqueraded.
+  * /site-to-site, for members of admins and admin tokens, lists the
+    connections without their keys, adds, changes and removes them, and
+    restarts vpn-router-setup to apply the change.
+  * vpn-config-edit sets site_to_site.NAME.option, creating the
+    connection, and removes site_to_site.NAME; it and the web service
+    write vpn-router.json under one lock.
+  * The status shows site_to_site.connections, whether each connection is
+    established.
+  * The metrics service keeps, per site-to-site connection, whether it is
+    up, the bytes and packets per second received and sent, and the
+    seconds its IKE SA has been up, in metrics_site_to_site and its
+    summaries; /metrics/history has them in site_to_site of each point.
+  * /metrics serves vpn_router_site_to_site_up,
+    vpn_router_site_to_site_uptime_seconds,
+    vpn_router_site_to_site_io_bytes_per_second and
+    vpn_router_site_to_site_packets_per_second by connection, and the
+    OTLP push the vpn_router.site_to_site gauges; vpn_router_clients and
+    metrics_vpn no longer have the kind site_to_site.
+  * /config shows each connection in network.site_to_site, and no psk at
+    any level of the configuration.
+  * Removing the package terminates every site-to-site connection; purging
+    removes site-to-site.conf.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sun, 25 Oct 2026 23:00:00 +0100
+
 vpn-router (0.17.0-1) unstable; urgency=medium

  feature: /config shows the router's PostgreSQL clusters and their settings, and /postgresql their databases with their sizes.
@@ -43,7 +43,7 @@ case "$1" in
            ucfr --purge vpn-router /etc/vpn-router/vpn-router.json
        fi

-        rm -f /etc/swanctl/conf.d/remote-site.conf \
+        rm -f /etc/swanctl/conf.d/site-to-site.conf \
              /etc/swanctl/conf.d/road-warrior.conf \
              /etc/systemd/resolved.conf.d/p2s-forwarder.conf \
              /etc/wireguard/wg0.conf \
@@ -6,8 +6,13 @@ case "$1" in
        # Stop offering the tunnels, but leave strongSwan itself enabled: it is
        # a shared service and may be in use by something other than this
        # package. The connection files are removed on purge.
+        # The site-to-site connections are the names of site_to_site in vpn-router.json.
        if [ -d /run/systemd/system ]; then
-            swanctl --terminate --ike remote-site >/dev/null 2>&1 || true
+            connections="$(python3 -c 'import json, sys; print(" ".join(json.load(open(sys.argv[1])).get("site_to_site", {})))' \
+                /etc/vpn-router/vpn-router.json 2>/dev/null || true)"
+            for connection in $connections; do
+                swanctl --terminate --ike "$connection" >/dev/null 2>&1 || true
+            done
            swanctl --terminate --ike road-warrior >/dev/null 2>&1 || true
        fi

@@ -66,7 +66,8 @@ Type: select
 Choices: fqdn, public_ip, internal_ip
 Default: fqdn
 Description: IKE local identity mode:
- How to derive the IKE identity advertised to the remote site:
+ How to derive the IKE identity the first site-to-site connection
+ advertises to the remote site:
 .
 fqdn - use the FQDN, which must match what the peer expects.
 .
@@ -78,8 +79,9 @@ Template: vpn-router/local_cidrs
 Type: string
 Default:
 Description: Local subnet CIDR(s):
- Comma-separated list of local subnet CIDRs to advertise into the
- site-to-site tunnel (for example 10.0.0.0/24 or 10.0.0.0/24,10.0.1.0/24).
+ Comma-separated list of local subnet CIDRs routed by this router and
+ advertised into the first site-to-site connection (for example
+ 10.0.0.0/24 or 10.0.0.0/24,10.0.1.0/24).

 Template: vpn-router/int_gateway_ip
 Type: string
@@ -94,25 +96,26 @@ Type: string
 Default:
 Description: Remote site WAN IP address(es):
 Comma-separated list of remote gateway addresses or FQDNs for the
- site-to-site IPSec tunnel.
+ first site-to-site connection.

 Template: vpn-router/remote_id
 Type: string
 Default:
 Description: Remote site IKE identity:
- IKE identity of the remote peer, without a leading @.
+ IKE identity of the remote peer of the first site-to-site connection,
+ without a leading @.

 Template: vpn-router/remote_cidrs
 Type: string
 Default:
 Description: Remote subnet CIDR(s):
 Comma-separated list of remote subnet CIDRs reachable through the
- site-to-site tunnel (for example 192.168.0.0/24).
+ first site-to-site connection (for example 192.168.0.0/24).

 Template: vpn-router/psk
 Type: password
 Description: Pre-shared key (PSK):
- Pre-shared key for the site-to-site IKEv2 tunnel. Must match the value
+ Pre-shared key of the first site-to-site connection. Must match the value
 configured on the remote peer. Stored in the configuration file and cleared
 from the debconf database after installation.