From 650896131d91c49966a2d6af4a9e299db81bb3e7 Mon Sep 17 00:00:00 2001 From: Slawomir Koszewski Date: Sun, 25 Oct 2026 13:09:57 +0100 Subject: [PATCH] fix: web.status_content is basic by default. --- ADR.md | 6 +++--- README.md | 6 +++--- debian-package/debian/changelog | 10 ++++++++++ debian-package/src/usr/lib/vpn-router/vpnrouter.py | 2 +- debian-package/src/usr/lib/vpn-router/web | 12 ++++++------ .../usr/share/doc/vpn-router/vpn-router.json.example | 2 +- 6 files changed, 24 insertions(+), 14 deletions(-) diff --git a/ADR.md b/ADR.md index 4322a10..5120ae6 100644 --- a/ADR.md +++ b/ADR.md @@ -44,9 +44,9 @@ address of the internal interface, of the external interface or of both, as `web unless `web.enabled` is `false` (ADR-7). `/` is for people, in plain text for `curl` and `wget` and as a Tailwind CSS page for a browser, and `/status` is the same status as JSON. Both show as much as `web.status_content` says, since the router is reachable from the internet and the -operator decides how much it tells strangers: `basic` the overall status and the Client IP, -`standard` also the package versions and the number of active and other services, and `full`, -the default, also each service and the state of the site-to-site, road-warrior, OpenVPN and +operator decides how much it tells strangers: `basic`, the default because it tells the least, +the overall status and the Client IP, `standard` also the package versions and the number of +active and other services, and `full` also each service and the state of the site-to-site, road-warrior, OpenVPN and WireGuard features. The Client IP is the address the request came from, through the trusted proxies, so a person can see the address the router sees. Nothing comes from the configuration. `/status` names its content, so clients such as manage-ui and the Router Manager show what it diff --git a/README.md b/README.md index 089f8bf..0a42c4e 100644 --- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ must have the type shown below; an unknown section or setting is an error. | `web` | `port` | integer | `7081` | TCP port of the status web service | | `web` | `database` | string | | A PostgreSQL connection string for the refresh tokens; without it, the `vpn-router` database on this host that the web service creates | | `web` | `trusted_proxies` | list | the address the call came in on | Addresses whose `X-Forwarded-For` header names the client for the `/auth` rate limit and the Client IP of the status | -| `web` | `status_content` | string | `full` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) | +| `web` | `status_content` | string | `basic` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) | | `https` | `enabled` | boolean | `true` | Caddy serves the status web service and the Router Manager over HTTPS for `wan.local_fqdn` | | `https` | `email` | string | | The e-mail address of the Let's Encrypt account | | `https` | `web_port` | integer | `7444` | HTTPS port of the status web service | @@ -506,9 +506,9 @@ configuration: no key, identity, subnet, or address but the client's. They show | `status_content` | `/` and `/status` show | |---|---| -| `basic` | The overall status (`ok` or `degraded`), the time and the Client IP | +| `basic` (default) | The overall status (`ok` or `degraded`), the time and the Client IP | | `standard` | Also the `vpn-router` version, the `vpn-router-manager` version or that it is not installed, and the number of active services and of services in any other state, without their names | -| `full` (default) | Also each service and its state, Docker, and the state of site-to-site, road-warrior, OpenVPN and WireGuard | +| `full` | Also each service and its state, Docker, and the state of site-to-site, road-warrior, OpenVPN and WireGuard | The Client IP is the address the request came from: the last entry of `X-Forwarded-For` for a request from one of `web.trusted_proxies`, by default the address the request came in on, so diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog index 20cf7dc..bdd172c 100644 --- a/debian-package/debian/changelog +++ b/debian-package/debian/changelog @@ -1,3 +1,13 @@ +vpn-router (0.14.1-1) unstable; urgency=medium + + fix: web.status_content is basic by default. + + * Without web.status_content, or with a value that is not allowed, / + and /status show only the overall status, the time and the Client + IP; set it to standard or full to show more. + + -- Slawomir Koszewski Sun, 25 Oct 2026 17:00:00 +0200 + vpn-router (0.14.0-1) unstable; urgency=medium feature: the status page shows the Client IP, and web.status_content sets how much it shows. diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter.py b/debian-package/src/usr/lib/vpn-router/vpnrouter.py index f18a9bd..1bb7e07 100644 --- a/debian-package/src/usr/lib/vpn-router/vpnrouter.py +++ b/debian-package/src/usr/lib/vpn-router/vpnrouter.py @@ -55,7 +55,7 @@ SCHEMA = { 'openvpn': {'enabled': False, 'address_pool': '', 'port': 1194, 'protocol': 'udp'}, 'docker': {'mode': 'auto', 'exposed_ports': []}, 'web': {'enabled': True, 'listen': DEFAULT_LISTEN, 'port': 7081, 'database': '', 'trusted_proxies': [], - 'status_content': 'full'}, + 'status_content': 'basic'}, 'https': {'enabled': True, 'email': '', 'web_port': 7444, 'manager_port': 7443}, } diff --git a/debian-package/src/usr/lib/vpn-router/web b/debian-package/src/usr/lib/vpn-router/web index c9906e0..f7a0db8 100644 --- a/debian-package/src/usr/lib/vpn-router/web +++ b/debian-package/src/usr/lib/vpn-router/web @@ -29,10 +29,10 @@ served (404) while the key does not exist. /auth is limited to AUTH_LIMIT calls address in AUTH_WINDOW seconds; the address of a call from one of web.trusted_proxies, by default the address the call came in on, is the last entry of its X-Forwarded-For header. -/ and /status show only the status, as much as web.status_content says (see shown): basic the -overall status, the time and the client's address (its address as for the rate limit below); -standard also the package version, the installed version of vpn-router-manager (manager_version, -null when it is not installed) and the number of active and other services; full, the default, +/ and /status show only the status, as much as web.status_content says (see shown): basic, the +default, the overall status, the time and the client's address (its address as for the rate limit +below); standard also the package version, the installed version of vpn-router-manager +(manager_version, null when it is not installed) and the number of active and other services; full whether each service runs, whether Docker is installed, and the state of site-to-site, road-warrior (IPsec P2S), OpenVPN and WireGuard. No configuration data or key is shown, and no address but the client's. @@ -298,10 +298,10 @@ def shown(status, content, client): Every content has status, time and client_ip, the client's address, and content, which one it is: basic nothing more; standard adds version, manager_version and services, the number of active units and of units in every other state; full adds the whole status document of collect. Content that is not one of - vpnrouter.STATUS_CONTENTS is full. + vpnrouter.STATUS_CONTENTS, or not set, is basic. """ if content not in vpnrouter.STATUS_CONTENTS: - content = 'full' + content = 'basic' if content == 'full': return {**status, 'content': content, 'client_ip': client} document = {'status': status['status'], 'content': content, 'time': status['time'], 'client_ip': client} diff --git a/debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example b/debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example index 84d71eb..b413d59 100644 --- a/debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example +++ b/debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example @@ -49,7 +49,7 @@ "port": 7081, "database": "", "trusted_proxies": [], - "status_content": "full" + "status_content": "basic" }, "https": { "enabled": true,