feature: the name server's domains have wan.local_fqdn and dns.secondary as their name servers, and a site with dns router gets records of the router's public, internal or external address.
Release / release (push) Successful in 35s
Release / release (push) Successful in 35s
This commit is contained in:
slawek committed
1 parent
c2c33cfca0
commit
7f85a1a2e5
16 files changed
+497
-304
No files matched your search
+167
-61
@@ -1,6 +1,32 @@
|
||||
vpn-router (0.39.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the name server's domains have wan.local_fqdn and dns.secondary as
|
||||
their name servers, and a site with dns router gets records of the router's
|
||||
public, internal or external address.
|
||||
|
||||
* The SOA and the first NS of every domain are wan.local_fqdn, and the
|
||||
second NS is dns.secondary, a host name, whose addresses are notified
|
||||
of every change and may transfer the domains; dns.nameserver is gone.
|
||||
* wan.local_fqdn gets no record in the domains; its record is kept in
|
||||
the DNS of its own domain.
|
||||
* A site has dns, user (the default), served elsewhere, or router, whose
|
||||
host names get an A or AAAA record in their closest domain, with
|
||||
dns_address public (wan.public_address, new), internal or external.
|
||||
dns.addresses, the domains' site records switch and the per-domain
|
||||
secondaries with their routes are gone; dns.nameserver and
|
||||
dns.addresses of an earlier configuration are left out when read.
|
||||
* A site may use wan.local_fqdn as a host name on a port of its own.
|
||||
* GET /dns answers nameserver, wan.local_fqdn, and public_address,
|
||||
which PUT /dns changes.
|
||||
* The summaries of the changelog entries are wrapped at 80 columns, and
|
||||
release.py joins the lines of a summary into the commit message.
|
||||
|
||||
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 30 Oct 2026 21:30:01 +0100
|
||||
|
||||
vpn-router (0.38.1-1) unstable; urgency=medium
|
||||
|
||||
fix: /https/settings shows the https section and switches https.acme_staging, for the Router Manager.
|
||||
fix: /https/settings shows the https section and switches https.acme_staging,
|
||||
for the Router Manager.
|
||||
|
||||
* GET /https/settings shows the https section, and PUT /https/settings
|
||||
changes acme_staging; the other settings of the section stay with
|
||||
@@ -10,7 +36,8 @@ vpn-router (0.38.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.38.0-1) unstable; urgency=medium
|
||||
|
||||
feature: https.acme_staging takes Caddy's certificates from Let's Encrypt's staging environment.
|
||||
feature: https.acme_staging takes Caddy's certificates from Let's Encrypt's
|
||||
staging environment.
|
||||
|
||||
* While https.acme_staging is true, Caddy's only CA is Let's Encrypt's
|
||||
staging environment, for the router's services and the web sites
|
||||
@@ -20,7 +47,8 @@ vpn-router (0.38.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.37.3-1) unstable; urgency=medium
|
||||
|
||||
fix: an answer whose client went away ends quietly, and a shell whose client left before it opened is stopped.
|
||||
fix: an answer whose client went away ends quietly, and a shell whose client
|
||||
left before it opened is stopped.
|
||||
|
||||
* The web service, the metrics service and the bootstrap server stop
|
||||
writing an answer when its client closes the connection, and a site
|
||||
@@ -32,7 +60,9 @@ vpn-router (0.37.3-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.37.2-1) unstable; urgency=medium
|
||||
|
||||
fix: the web service, the metrics service and the bootstrap server log a failure in one line instead of a traceback, and nothing when a client goes away.
|
||||
fix: the web service, the metrics service and the bootstrap server log a
|
||||
failure in one line instead of a traceback, and nothing when a client goes
|
||||
away.
|
||||
|
||||
* A request whose client closed the connection is no longer logged.
|
||||
* Any other failure of a request, a thread or the service is logged in
|
||||
@@ -51,7 +81,9 @@ vpn-router (0.37.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.37.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the OpenID Provider has the client credentials and device authorization grants, public clients, and service accounts as resources with roles and scopes in JWT access tokens.
|
||||
feature: the OpenID Provider has the client credentials and device
|
||||
authorization grants, public clients, and service accounts as resources with
|
||||
roles and scopes in JWT access tokens.
|
||||
|
||||
* A client may have the grants client_credentials, by which a
|
||||
confidential client gets an access token as its own service account,
|
||||
@@ -80,7 +112,8 @@ vpn-router (0.37.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.36.0-1) unstable; urgency=medium
|
||||
|
||||
feature: a shell opens with one of the user's passkeys in place of the password and the TOTP code.
|
||||
feature: a shell opens with one of the user's passkeys in place of the
|
||||
password and the TOTP code.
|
||||
|
||||
* POST /shell/passkey begins a proof for one of the signed-in user's own
|
||||
passkeys, with user verification; POST /shell takes the browser's
|
||||
@@ -94,7 +127,8 @@ vpn-router (0.36.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.35.2-2) unstable; urgency=medium
|
||||
|
||||
update: the package is published for Ubuntu 26.04 (resolute) as well as 24.04 (noble).
|
||||
update: the package is published for Ubuntu 26.04 (resolute) as well as 24.04
|
||||
(noble).
|
||||
|
||||
* publish.sh uploads the package to the distributions noble and resolute
|
||||
of the repository, component main, skipping a distribution that has
|
||||
@@ -105,7 +139,8 @@ vpn-router (0.35.2-2) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.35.2-1) unstable; urgency=medium
|
||||
|
||||
fix: the web service answers /, /status and /status/full again while IKEv2 runs.
|
||||
fix: the web service answers /, /status and /status/full again while IKEv2
|
||||
runs.
|
||||
|
||||
* The status of IKEv2 clients is collected again; the requests that
|
||||
collect the status were dropped with a NameError since 0.35.1.
|
||||
@@ -114,7 +149,8 @@ vpn-router (0.35.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.35.1-1) unstable; urgency=medium
|
||||
|
||||
update: the router web service is split into the package vpnrouter_web, with one module per family of paths.
|
||||
update: the router web service is split into the package vpnrouter_web, with
|
||||
one module per family of paths.
|
||||
|
||||
* /usr/lib/vpn-router/web initializes and serves; the package
|
||||
/usr/lib/vpn-router/vpnrouter_web/ answers the requests, with a module
|
||||
@@ -126,7 +162,8 @@ vpn-router (0.35.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.35.0-1) unstable; urgency=medium
|
||||
|
||||
feature: vre opens files from the Router Manager's shell in the editor of its Shell page.
|
||||
feature: vre opens files from the Router Manager's shell in the editor of its
|
||||
Shell page.
|
||||
|
||||
* vpn-router-editor FILE..., or vre, in the shell of the Router Manager
|
||||
opens the files in the editor of the Shell page and returns at once;
|
||||
@@ -141,7 +178,9 @@ vpn-router (0.35.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.34.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the web service shows and changes the settings of the metrics service at /metrics/settings, and OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.
|
||||
feature: the web service shows and changes the settings of the metrics service
|
||||
at /metrics/settings, and OpenVPN starts on a new router, as setup installs
|
||||
CRLs that revoke nothing.
|
||||
|
||||
* GET and PUT /metrics/settings show and change the metrics section;
|
||||
otlp_password is never shown, an empty one keeps it, and an empty
|
||||
@@ -174,7 +213,8 @@ vpn-router (0.33.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.33.1-1) unstable; urgency=medium
|
||||
|
||||
fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.
|
||||
fix: the name server is the primary of any number of domains, each with
|
||||
secondary name servers and a switch for the records of the sites.
|
||||
|
||||
* The domains, their secondaries and manual records are kept in the
|
||||
vpn-router-dns database and changed through /dns/domains; dns.zone is
|
||||
@@ -192,7 +232,8 @@ vpn-router (0.33.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.33.0-1) unstable; urgency=medium
|
||||
|
||||
feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.
|
||||
feature: road-warrior clients resolve the domains of the new setting
|
||||
p2s.dns_domains with the router's resolver.
|
||||
|
||||
* p2s.dns_domains lists up to 16 domains; setup pushes them to IKEv2
|
||||
clients as INTERNAL_DNS_DOMAIN (RFC 8598, attribute 25) of the
|
||||
@@ -204,7 +245,8 @@ vpn-router (0.33.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.32.1-1) unstable; urgency=medium
|
||||
|
||||
fix: a VPN user downloads the own OpenVPN client profile through /account, with the current password and code.
|
||||
fix: a VPN user downloads the own OpenVPN client profile through /account,
|
||||
with the current password and code.
|
||||
|
||||
* POST /account/profile answers the user's OpenVPN client profile; it
|
||||
needs the current password and, when enrolled, a code.
|
||||
@@ -213,7 +255,8 @@ vpn-router (0.32.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.32.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the web service gives Apple VPN profiles that set up IKEv2 road-warrior access on macOS, iOS and iPadOS.
|
||||
feature: the web service gives Apple VPN profiles that set up IKEv2
|
||||
road-warrior access on macOS, iOS and iPadOS.
|
||||
|
||||
* POST /users/<name>/apple-profile and POST /account/apple-profile answer
|
||||
an unsigned .mobileconfig with the P2S CA and the root CA, the user's
|
||||
@@ -227,7 +270,9 @@ vpn-router (0.32.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.31.3-1) unstable; urgency=medium
|
||||
|
||||
fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.
|
||||
fix: WireGuard clients may use the router's DNS resolver, which runs while
|
||||
WireGuard does, and /remote-access names its addresses for their
|
||||
configuration.
|
||||
|
||||
* The firewall opens port 53 of the remote access clients' resolver for
|
||||
the WireGuard network, as it does for the IKEv2 and OpenVPN pools.
|
||||
@@ -241,7 +286,8 @@ vpn-router (0.31.3-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.31.2-1) unstable; urgency=medium
|
||||
|
||||
fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.
|
||||
fix: dnsmasq answers the remote access clients' DNS queries, so they no longer
|
||||
get the router's own host name with all its addresses from systemd-resolved.
|
||||
|
||||
* vpn-router-resolver.service runs dnsmasq on the addresses of
|
||||
p2s.dns_listen, forwarding to systemd-resolved's stub on 127.0.0.53;
|
||||
@@ -256,7 +302,9 @@ vpn-router (0.31.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.31.1-1) unstable; urgency=medium
|
||||
|
||||
fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.
|
||||
fix: the remote access clients' resolver answers on the internal address by
|
||||
default, chosen by p2s.dns_listen, so the name server can take port 53 of the
|
||||
external addresses.
|
||||
|
||||
* The new setting p2s.dns_listen chooses the addresses of the resolver the
|
||||
road-warrior and OpenVPN clients are given: internal, the default,
|
||||
@@ -269,7 +317,9 @@ vpn-router (0.31.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.31.0-1) unstable; urgency=medium
|
||||
|
||||
feature: Caddy serves static web sites from folders on the router, defined in their own database, with files uploaded through the web service or WebDAV, and an optional PowerDNS name server answers for a zone of the sites.
|
||||
feature: Caddy serves static web sites from folders on the router, defined in
|
||||
their own database, with files uploaded through the web service or WebDAV, and
|
||||
an optional PowerDNS name server answers for a zone of the sites.
|
||||
|
||||
* The new database vpn-router-sites holds the web sites: host names,
|
||||
port, interfaces, TLS (none, Let's Encrypt, an issuing CA or a
|
||||
@@ -305,7 +355,8 @@ vpn-router (0.31.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.30.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the web service serves the last lines of the journal of the router's units and of the log files web.log_files lists, at /logs.
|
||||
feature: the web service serves the last lines of the journal of the router's
|
||||
units and of the log files web.log_files lists, at /logs.
|
||||
|
||||
* GET /logs lists the units whose journal and the files whose lines it
|
||||
serves; GET /logs/journal?unit=&lines= and /logs/file?path=&lines=
|
||||
@@ -318,7 +369,8 @@ vpn-router (0.30.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.29.0-1) unstable; urgency=medium
|
||||
|
||||
feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.
|
||||
feature: vpn-config-edit set and remove take --restart, which applies the
|
||||
change with vpn-router-setup and waits for it.
|
||||
|
||||
* vpn-config-edit set --restart and remove --restart restart
|
||||
vpn-router-setup after writing the configuration and wait until it has
|
||||
@@ -329,7 +381,8 @@ vpn-router (0.29.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.28.0-1) unstable; urgency=medium
|
||||
|
||||
feature: bash completes the vpn-* commands, their options and the names they take.
|
||||
feature: bash completes the vpn-* commands, their options and the names they
|
||||
take.
|
||||
|
||||
* Bash completes the commands, options and arguments of vpn-router-user,
|
||||
vpn-router-group, vpn-router-token, vpn-config-edit, vpn-router-backup,
|
||||
@@ -342,7 +395,9 @@ vpn-router (0.28.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.27.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.
|
||||
feature: the web service is an OpenID Provider, which signs the directory's
|
||||
users in to other systems, the clients being service accounts with redirect
|
||||
URIs.
|
||||
|
||||
* oidc.enabled turns on the OpenID Provider at the issuer
|
||||
https://<wan.local_fqdn>:<https.web_port>, with discovery, JWKS,
|
||||
@@ -371,7 +426,8 @@ vpn-router (0.27.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.26.2-1) unstable; urgency=medium
|
||||
|
||||
fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.
|
||||
fix: a service account may be named by a GUID in lowercase, as the Router
|
||||
Manager proposes for a new one.
|
||||
|
||||
* vpn-router-user add --service and POST /service-accounts take a GUID
|
||||
in lowercase as the name, besides a user name; users and groups keep
|
||||
@@ -381,7 +437,8 @@ vpn-router (0.26.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.26.1-1) unstable; urgency=medium
|
||||
|
||||
fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start.
|
||||
fix: the package installs vpnrouter_passkeys, without which the web service
|
||||
and vpn-router-user do not start.
|
||||
|
||||
* /usr/lib/vpn-router/vpnrouter_passkeys.py is part of the package.
|
||||
|
||||
@@ -389,7 +446,8 @@ vpn-router (0.26.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.26.0-1) unstable; urgency=medium
|
||||
|
||||
feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.
|
||||
feature: users sign in to the Router Manager with passkeys, and console login
|
||||
needs a TOTP token, so a user without one is refused the shell, SSH and sudo.
|
||||
|
||||
* Console login is switched on only for a user enrolled for TOTP. A user
|
||||
whose console login is on without a token is refused POST /shell, the
|
||||
@@ -413,7 +471,8 @@ vpn-router (0.26.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.25.4-1) unstable; urgency=medium
|
||||
|
||||
fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.
|
||||
fix: a shell opens without the password and code again while the user's last
|
||||
use of a shell is within web.shell_auth_timeout minutes.
|
||||
|
||||
* New setting web.shell_auth_timeout, 15 minutes by default, 0 to 1440:
|
||||
POST /shell without a password gives a ticket while the user's last
|
||||
@@ -424,7 +483,8 @@ vpn-router (0.25.4-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.25.3-1) unstable; urgency=medium
|
||||
|
||||
fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page.
|
||||
fix: /config gives the state of caddy.service with the installed Caddy, for
|
||||
the Router Manager's Web page.
|
||||
|
||||
* caddy of /config is {"version", "source", "service"}.
|
||||
|
||||
@@ -432,7 +492,9 @@ vpn-router (0.25.3-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.25.2-1) unstable; urgency=medium
|
||||
|
||||
fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.
|
||||
fix: wireguard.address must be the router's own address in its network, not
|
||||
the network or broadcast address, from which the peers' addresses are told
|
||||
apart.
|
||||
|
||||
* A wireguard.address that is the network or the broadcast address of a
|
||||
network larger than /31, such as 192.168.232.0/24, is refused with the
|
||||
@@ -442,7 +504,8 @@ vpn-router (0.25.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.25.1-1) unstable; urgency=medium
|
||||
|
||||
fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.
|
||||
fix: /remote-access gives the router's WireGuard public key, endpoint and
|
||||
allowed IPs, which a peer's configuration needs.
|
||||
|
||||
* GET /remote-access answers wireguard_server: {"public_key",
|
||||
"endpoint", "allowed_ips"}.
|
||||
@@ -451,7 +514,8 @@ vpn-router (0.25.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.25.0-1) unstable; urgency=medium
|
||||
|
||||
feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.
|
||||
feature: a VPN user has WireGuard peers, each a device with its public key and
|
||||
IPs, kept in the directory and written into wg0.conf by setup.
|
||||
|
||||
* PUT /users/<name> takes wireguard_peers, [{"public_key", "ips"}],
|
||||
which replaces the user's peers; keys are unique and IPs may not
|
||||
@@ -467,7 +531,8 @@ vpn-router (0.25.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.24.1-1) unstable; urgency=medium
|
||||
|
||||
fix: the status gives the number of connected OpenVPN clients at most 5 seconds old instead of up to a minute.
|
||||
fix: the status gives the number of connected OpenVPN clients at most 5
|
||||
seconds old instead of up to a minute.
|
||||
|
||||
* The OpenVPN server writes its status file every 5 seconds, so a
|
||||
refresh of the status shows clients that connected or left since.
|
||||
@@ -476,7 +541,9 @@ vpn-router (0.24.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.24.0-1) unstable; urgency=medium
|
||||
|
||||
feature: /remote-access of the web service shows and changes the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each runs, for the Router Manager's Remote access page.
|
||||
feature: /remote-access of the web service shows and changes the settings of
|
||||
IKEv2 road-warrior, OpenVPN and WireGuard access and whether each runs, for
|
||||
the Router Manager's Remote access page.
|
||||
|
||||
* GET /remote-access answers the p2s, openvpn and wireguard sections,
|
||||
which of them setup runs, and wan.local_fqdn; PUT
|
||||
@@ -488,7 +555,9 @@ vpn-router (0.24.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.23.2-1) unstable; urgency=medium
|
||||
|
||||
fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.
|
||||
fix: the shell of a user's own POSIX account opens on the first setup that
|
||||
sets up console login, and the journal records each refused shell with the
|
||||
reason.
|
||||
|
||||
* Setup restarts vpn-router-web when it adds ldap to the name service
|
||||
switch, so the web service finds the POSIX accounts of the directory.
|
||||
@@ -499,7 +568,9 @@ vpn-router (0.23.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.23.1-1) unstable; urgency=medium
|
||||
|
||||
fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.
|
||||
fix: the shell runs as the console account of each member of admins, a local
|
||||
account or the user's own POSIX account in the directory, which also signs in
|
||||
with SSH and sudo, instead of one web.shell_user.
|
||||
|
||||
* vpn-router-user console <name> --posix | --account LOCAL | --off, and
|
||||
PUT /users/<name>/console with a token of vpn-router-token, switch a
|
||||
@@ -517,7 +588,9 @@ vpn-router (0.23.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.23.0-1) unstable; urgency=medium
|
||||
|
||||
feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.
|
||||
feature: web.shell lets /shell of the web service open a login shell of
|
||||
web.shell_user over a WebSocket for the Router Manager's Shell page, after the
|
||||
user signs in again.
|
||||
|
||||
* web.shell (false), web.shell_user and web.shell_idle_minutes (15).
|
||||
* POST /shell takes the password and the TOTP code and answers a
|
||||
@@ -529,7 +602,8 @@ vpn-router (0.23.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.22.1-1) unstable; urgency=medium
|
||||
|
||||
fix: the status gives the number of site-to-site connections set up and established, not each connection by name.
|
||||
fix: the status gives the number of site-to-site connections set up and
|
||||
established, not each connection by name.
|
||||
|
||||
* site_to_site of the status document is {"connections", "established"},
|
||||
and the status page shows "Site to site: N of M established".
|
||||
@@ -538,7 +612,9 @@ vpn-router (0.22.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.22.0-1) unstable; urgency=medium
|
||||
|
||||
feature: pki.extended_key_usages adds custom extended key usages by their OIDs, which templates give by name, and a template's policies put certificate policy OIDs into its certificates.
|
||||
feature: pki.extended_key_usages adds custom extended key usages by their
|
||||
OIDs, which templates give by name, and a template's policies put certificate
|
||||
policy OIDs into its certificates.
|
||||
|
||||
* pki.extended_key_usages maps a name to the OID of a custom extended
|
||||
key usage; a template's extended_key_usage takes the built-in and the
|
||||
@@ -552,7 +628,8 @@ vpn-router (0.22.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.21.5-1) unstable; urgency=medium
|
||||
|
||||
fix: /status/full of the status web service gives an authenticated client the whole status, whatever web.status_content says.
|
||||
fix: /status/full of the status web service gives an authenticated client the
|
||||
whole status, whatever web.status_content says.
|
||||
|
||||
* /status/full takes the token of /config and answers the status
|
||||
document as web.status_content full shows it.
|
||||
@@ -561,7 +638,8 @@ vpn-router (0.21.5-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.21.4-1) unstable; urgency=medium
|
||||
|
||||
fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the directory each as itself, instead of failing on a CA with a CRL.
|
||||
fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the
|
||||
directory each as itself, instead of failing on a CA with a CRL.
|
||||
|
||||
* A CA's CRL was read as its key and its key as its CRL, so every
|
||||
operation on a CA with a CRL failed with "Could not deserialize key
|
||||
@@ -571,7 +649,10 @@ vpn-router (0.21.4-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.21.3-1) unstable; urgency=medium
|
||||
|
||||
fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.
|
||||
fix: the PKI is kept in ou=pki of the router's directory instead of files
|
||||
under /etc/vpn-router/pki, and the router's site-to-site certificate names
|
||||
only the identities its connections present, and /ca/bundle gives the
|
||||
certificate bundle of a CA.
|
||||
|
||||
* The CAs with their certificates, keys, CSRs and CRLs, and every
|
||||
certificate issued with its revocation, are entries of the
|
||||
@@ -595,7 +676,8 @@ vpn-router (0.21.3-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.21.2-1) unstable; urgency=medium
|
||||
|
||||
fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.
|
||||
fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca
|
||||
about the root key on the router.
|
||||
|
||||
* pki.root_key_warning, true by default, set to false silences the
|
||||
warning that the root key is on the router.
|
||||
@@ -604,7 +686,8 @@ vpn-router (0.21.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.21.1-1) unstable; urgency=medium
|
||||
|
||||
fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.
|
||||
fix: vpn-router-ca status and /ca warn about a CRL the router signs only once
|
||||
vpn-router-pki.timer has not renewed it in time.
|
||||
|
||||
* A CRL whose CA key is on the router is reported once past half of its
|
||||
validity, when the timer should have signed it again; a root CRL
|
||||
@@ -614,7 +697,10 @@ vpn-router (0.21.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.21.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.
|
||||
feature: the router has a two-level CA with an optional offline root, issuing
|
||||
CAs for P2S, site-to-site and general use, templates, published certificates
|
||||
and CRLs and an ACME server, site-to-site connections authenticate with
|
||||
certificates, and setup installs Caddy from Ubuntu or Caddy's repository.
|
||||
|
||||
* The root CA signs the issuing CAs p2s, which issues the router's VPN
|
||||
server certificate and the users' certificates, s2s, which issues
|
||||
@@ -653,7 +739,9 @@ vpn-router (0.21.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.20.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.
|
||||
feature: the router makes scheduled backups to a local folder, copied to the
|
||||
cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup
|
||||
restores them.
|
||||
|
||||
* The backup section of vpn-router.json switches on backups and sets
|
||||
the schedule (hourly, daily or weekly), the target (local or pbs),
|
||||
@@ -686,7 +774,8 @@ vpn-router (0.20.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.19.1-3) unstable; urgency=medium
|
||||
|
||||
update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.
|
||||
update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates
|
||||
the package lists.
|
||||
|
||||
* ADR-24 says that Ubuntu's apt-daily timer updates the package lists
|
||||
twice a day, and that apt-daily or unattended-upgrades may hold the
|
||||
@@ -705,7 +794,8 @@ vpn-router (0.19.1-2) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.19.1-1) unstable; urgency=medium
|
||||
|
||||
fix: /metrics/history gives the availability of each site-to-site connection as the percentage of time it was up in slots of the view.
|
||||
fix: /metrics/history gives the availability of each site-to-site connection
|
||||
as the percentage of time it was up in slots of the view.
|
||||
|
||||
* site_to_site_up of /metrics/history divides the view into slots of 5
|
||||
minutes for an hour, 1 hour for a day, 1 day for a month and 1 month
|
||||
@@ -716,7 +806,8 @@ vpn-router (0.19.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.19.0-1) unstable; urgency=medium
|
||||
|
||||
feature: service accounts have a display name and a description, which the router sets for its internal ones.
|
||||
feature: service accounts have a display name and a description, which the
|
||||
router sets for its internal ones.
|
||||
|
||||
* vpnRouterAccount of the package's schema also takes displayName and
|
||||
description; vpn-router-setup updates the schema of an existing
|
||||
@@ -734,7 +825,9 @@ vpn-router (0.19.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.18.3-1) unstable; urgency=medium
|
||||
|
||||
fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.
|
||||
fix: internal service accounts are the router's own, of which the metrics
|
||||
service's is the one at present, and the documentation says what a service
|
||||
account is.
|
||||
|
||||
* /service-accounts, /groups and the internal field of the answers
|
||||
take every internal service account, the accounts the router creates
|
||||
@@ -749,7 +842,8 @@ vpn-router (0.18.3-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.18.2-1) unstable; urgency=medium
|
||||
|
||||
fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.
|
||||
fix: service accounts are managed at /service-accounts, not /users, and the
|
||||
internal one of the metrics service is only listed.
|
||||
|
||||
* /service-accounts, for members of admins and admin tokens, lists the
|
||||
service accounts, adds one with a password and an optional e-mail
|
||||
@@ -766,7 +860,9 @@ vpn-router (0.18.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.18.1-1) unstable; urgency=medium
|
||||
|
||||
fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.
|
||||
fix: vpn-router-setup owns only the creation of the metrics service's account,
|
||||
which is marked internal, and administrators add service accounts with
|
||||
vpn-router-user add --service and /users.
|
||||
|
||||
* POST /users takes "service": true and adds a service account, which
|
||||
cannot sign in to /auth; vpn-router-user add takes --service.
|
||||
@@ -790,7 +886,8 @@ vpn-router (0.18.0-2) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.18.0-1) unstable; urgency=medium
|
||||
|
||||
feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.
|
||||
feature: site_to_site holds any number of named site-to-site connections,
|
||||
which /site-to-site lists, adds, changes and removes.
|
||||
|
||||
* site_to_site maps a connection name to addrs, id, cidrs, local_cidrs,
|
||||
local_id_mode, psk and psk_file; it replaces remote and
|
||||
@@ -830,7 +927,8 @@ vpn-router (0.18.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.17.0-1) unstable; urgency=medium
|
||||
|
||||
feature: /config shows the router's PostgreSQL clusters and their settings, and /postgresql their databases with their sizes.
|
||||
feature: /config shows the router's PostgreSQL clusters and their settings,
|
||||
and /postgresql their databases with their sizes.
|
||||
|
||||
* /config has a postgresql section: each cluster of pg_lsclusters with
|
||||
its version, name, port, status and data directory, and the main
|
||||
@@ -842,7 +940,8 @@ vpn-router (0.17.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.16.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.
|
||||
feature: the router keeps its metrics in PostgreSQL, serves them for an
|
||||
OpenTelemetry Collector and pushes them over OTLP.
|
||||
|
||||
* vpn-router-metrics takes a sample every minute: CPU, memory, free
|
||||
space of /, bytes per second on the external and the internal
|
||||
@@ -894,7 +993,8 @@ vpn-router (0.14.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.14.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the status page shows the Client IP, and web.status_content sets how much it shows.
|
||||
feature: the status page shows the Client IP, and web.status_content sets how
|
||||
much it shows.
|
||||
|
||||
* / and /status show the Client IP, the address the request came from:
|
||||
the last X-Forwarded-For entry for a request from a trusted proxy, so
|
||||
@@ -909,7 +1009,8 @@ vpn-router (0.14.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.13.0-1) unstable; urgency=medium
|
||||
|
||||
feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.
|
||||
feature: Caddy serves the status page and the Router Manager over HTTPS with a
|
||||
certificate from Let's Encrypt.
|
||||
|
||||
* The package depends on caddy. While https.enabled is true, the
|
||||
default, and wan.local_fqdn is set, vpn-router-setup writes
|
||||
@@ -932,7 +1033,8 @@ vpn-router (0.13.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.12.3-1) unstable; urgency=medium
|
||||
|
||||
fix: the web service listens on the internal address, the external address or both.
|
||||
fix: the web service listens on the internal address, the external address or
|
||||
both.
|
||||
|
||||
* web.listen in vpn-router.json sets the interfaces the web service
|
||||
listens on: internal, external or both, the default. It is read
|
||||
@@ -1018,7 +1120,8 @@ vpn-router (0.9.2-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.9.1-1) unstable; urgency=medium
|
||||
|
||||
fix: the web service waits for the PostgreSQL driver instead of failing at start.
|
||||
fix: the web service waits for the PostgreSQL driver instead of failing at
|
||||
start.
|
||||
|
||||
* The web service imports psycopg as the first step of its
|
||||
initialization, retrying every 15 seconds and logging the failure while
|
||||
@@ -1048,7 +1151,8 @@ vpn-router (0.9.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.8.0-1) unstable; urgency=medium
|
||||
|
||||
feature: the web service creates its key and database itself and shows its starting phase.
|
||||
feature: the web service creates its key and database itself and shows its
|
||||
starting phase.
|
||||
|
||||
* vpn-router-web makes its signing key and creates the refresh tokens'
|
||||
database on its first run, retrying every 15 seconds until PostgreSQL
|
||||
@@ -1063,7 +1167,8 @@ vpn-router (0.8.0-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.7.1-1) unstable; urgency=medium
|
||||
|
||||
fix: a failing user directory or token database no longer leaves the tunnels down.
|
||||
fix: a failing user directory or token database no longer leaves the tunnels
|
||||
down.
|
||||
|
||||
* vpn-router-setup brings up strongSwan and WireGuard before it provisions
|
||||
the user directory and the token database. A failure of either no
|
||||
@@ -1073,7 +1178,8 @@ vpn-router (0.7.1-1) unstable; urgency=medium
|
||||
|
||||
vpn-router (0.7.0-1) unstable; urgency=medium
|
||||
|
||||
feature: users sign in to the web service, and only members of admins manage the router.
|
||||
feature: users sign in to the web service, and only members of admins manage
|
||||
the router.
|
||||
|
||||
* POST /auth signs a user in with the password, and the TOTP code for an
|
||||
enrolled user, and answers a 5 minute access token and an 8 hour refresh
|
||||
|
||||
Reference in new issue
Block a user