feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.

README.md

@@ -343,6 +343,7 @@ vpn-config-edit set web.port 7082
 vpn-config-edit set web.trusted_proxies 127.0.0.1,10.0.0.4
 vpn-config-edit set site_to_site.branch.addrs branch.example.net
 vpn-config-edit remove site_to_site.branch
+vpn-config-edit set --restart oidc.enabled true
 ```
 
 `show` prints the file as indented JSON and does not change it. `set` takes a setting as
@@ -351,7 +352,9 @@ creates with the defaults when it does not exist, and converts the value to the
 a whole number, `true` or `false`, a list separated by commas (an empty value is an empty list),
 or a string; an unknown setting is refused. `remove site_to_site.NAME` removes a connection. It
 checks the whole configuration as `vpn-router-setup` does, and only then writes the file,
-indented, with mode 0600, and reminds that `vpn-router-setup` applies it. The status web service
+indented, with mode 0600, and reminds that `vpn-router-setup` applies it; with `--restart`, `set`
+and `remove` restart `vpn-router-setup` and wait until it has applied the change, and exit with
+status 1 when it fails. The status web service
 writes the file the same way, and a lock keeps the two from overwriting each other's change. A
 refused request exits with status 2, any other failure with 1.
 
@@ -1339,8 +1342,7 @@ answers it only on `127.0.0.1`, where Caddy passes the requests, so the provider
 over plain HTTP. The setting needs `web.enabled`, `https.enabled` and `wan.local_fqdn`.
 
 ```sh
-vpn-config-edit set oidc.enabled true
+vpn-config-edit set --restart oidc.enabled true
-systemctl restart vpn-router-setup
 curl https://router.example.com:7444/.well-known/openid-configuration
 ```
 

debian-package/debian/changelog

@@ -1,3 +1,14 @@
+vpn-router (0.29.0-1) unstable; urgency=medium
+
+  feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.
+
+  * vpn-config-edit set --restart and remove --restart restart
+    vpn-router-setup after writing the configuration and wait until it has
+    applied the change; a failed run exits with status 1 and points to its
+    journal. Bash completes --restart.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 26 Oct 2026 17:00:00 +0100
+
 vpn-router (0.28.0-1) unstable; urgency=medium
 
   feature: bash completes the vpn-* commands, their options and the names they take.

debian-package/src/usr/sbin/vpn-config-edit

@@ -9,18 +9,21 @@ number, true or false, a list of strings separated by commas (an empty value is
 or a string. remove takes site_to_site.NAME and removes that connection. The configuration with
 the change is checked as vpn-router-setup checks it, and only then written with
 vpnrouter.save_config, holding vpnrouter.config_lock; vpn-router-setup applies it at its next
-run, which set and remove remind of. A failure is a message on standard error; the exit status
+run, which set and remove remind of. With --restart they restart vpn-router-setup and wait until
-is 2 for an invalid request and 1 for any other failure. -h or --help shows the options.
+it has applied the change. A failure is a message on standard error; the exit status is 2 for an
+invalid request and 1 for any other failure, a failed run of vpn-router-setup included. -h or
+--help shows the options.
 
   vpn-config-edit show
-  vpn-config-edit set SECTION.OPTION VALUE
+  vpn-config-edit set [--restart] SECTION.OPTION VALUE
-  vpn-config-edit set site_to_site.NAME.OPTION VALUE
+  vpn-config-edit set [--restart] site_to_site.NAME.OPTION VALUE
-  vpn-config-edit remove site_to_site.NAME
+  vpn-config-edit remove [--restart] site_to_site.NAME
 """
 
 import argparse
 import copy
 import json
+import subprocess
 import sys
 
 sys.path.insert(0, '/usr/lib/vpn-router')
@@ -86,6 +89,9 @@ def main(argv):
         setter.add_argument('value', metavar='VALUE', help='its value; a list separated by commas')
         remover = commands.add_parser('remove', help='remove a site-to-site connection and write the configuration')
         remover.add_argument('key', metavar='site_to_site.NAME', help='the connection')
+        for changer in (setter, remover):
+            changer.add_argument('--restart', action='store_true',
+                                 help='restart vpn-router-setup and wait until it has applied the change')
         options = parser.parse_args(argv)
 
         if options.command == 'show':
@@ -124,7 +130,14 @@ def main(argv):
         print(f'{options.key} set to {json.dumps(value)} in {vpnrouter.CONFIG_FILE}.')
     else:
         print(f'{options.key} removed from {vpnrouter.CONFIG_FILE}.')
-    print('Apply it with: systemctl restart vpn-router-setup')
+    if not options.restart:
+        print('Apply it with: systemctl restart vpn-router-setup, or --restart')
+        return 0
+    print('Restarting vpn-router-setup...', flush=True)
+    if subprocess.run(['systemctl', 'restart', 'vpn-router-setup.service']).returncode != 0:
+        print('vpn-config-edit: vpn-router-setup failed; see journalctl -u vpn-router-setup', file=sys.stderr)
+        return 1
+    print('vpn-router-setup applied it.')
     return 0
 
 

debian-package/src/usr/share/bash-completion/completions/vpn-config-edit.bash

@@ -43,7 +43,7 @@ _vpn_config_edit()
     done
 
     if [[ $cur == -* ]]; then
-        COMPREPLY=($(compgen -W '--help' -- "$cur"))
+        COMPREPLY=($(compgen -W "--help$([[ $command == @(set|remove) ]] && echo ' --restart')" -- "$cur"))
         return
     fi