93 Commits

Include renames

Author	SHA1	Message	Date
slawek	46d3550eab	update: the router web service is split into the package vpnrouter_web, with one module per family of paths.	2026-10-29 18:52:51 +01:00
slawek	3b14b7723e	feature: vre opens files from the Router Manager's shell in the editor of its Shell page.	2026-10-29 18:10:58 +01:00
slawek	5303779559	feature: the web service shows and changes the settings of the metrics service at /metrics/settings, and OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.	2026-10-28 22:31:27 +01:00
slawek	2dc4db440f	fix: OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.	2026-10-28 22:00:37 +01:00
slawek	45cea95728	fix: vpn-router-setup runs on a new installation once libpq can be found.	2026-10-28 21:41:52 +01:00
slawek	dd2dfaaf2b	fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.	2026-10-27 08:46:36 +01:00
slawek	1697e1aa38	fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.	2026-10-26 21:26:47 +01:00
slawek	57e8bbcffe	feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.	2026-10-26 20:58:33 +01:00
slawek	9ca8fce14e	fix: a VPN user downloads the own OpenVPN client profile through /account, with the current password and code.	2026-10-26 20:43:33 +01:00
slawek	74c24d7bc6	feature: the web service gives Apple VPN profiles that set up IKEv2 road-warrior access on macOS, iOS and iPadOS.	2026-10-26 20:37:58 +01:00
slawek	770332728e	fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.	2026-10-26 18:33:03 +01:00
slawek	e14bbe2ba1	fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.	2026-10-26 16:53:42 +01:00
slawek	dabe4e8365	fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.	2026-10-26 16:11:08 +01:00
slawek	ea8ca97417	feature: Caddy serves static web sites from folders on the router, defined in their own database, with files uploaded through the web service or WebDAV, and an optional PowerDNS name server answers for a zone of the sites.	2026-10-26 15:27:28 +01:00
slawek	77bdbcb058	feature: the web service serves the last lines of the journal of the router's units and of the log files web.log_files lists, at /logs.	2026-10-26 12:37:51 +01:00
slawek	cb33b3bfa1	feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.	2026-10-26 11:48:47 +01:00
slawek	81b7f4cac6	feature: bash completes the vpn-* commands, their options and the names they take.	2026-10-26 11:35:46 +01:00
slawek	8cac21845a	feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.	2026-10-26 11:15:12 +01:00
slawek	d1d565b1d9	fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.	2026-10-26 09:11:13 +01:00
slawek	e675540ce2	fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start.	2026-10-26 08:40:24 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.	2026-10-26 08:35:10 +01:00
slawek	91cc64d6a6	fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.	2026-10-26 07:56:23 +01:00
slawek	a1f314d8c1	fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page.	2026-10-26 07:18:39 +01:00
slawek	7d8892b8c4	fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.	2026-10-26 02:59:56 +01:00
slawek	4491377d9b	fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.	2026-10-26 02:50:39 +01:00
slawek	f1d9c3bc36	feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.	2026-10-26 02:33:58 +01:00
slawek	015fba50ca	fix: the status gives the number of connected OpenVPN clients at most 5 seconds old instead of up to a minute.	2026-10-26 02:10:38 +01:00
slawek	9255d56276	feature: /remote-access of the web service shows and changes the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each runs, for the Router Manager's Remote access page.	2026-10-26 00:57:22 +01:00
slawek	07dbe91d0c	fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.	2026-10-26 00:43:55 +01:00
slawek	ec93bc6a2d	fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.	2026-10-26 00:21:13 +01:00
slawek	2e1eb89f52	feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.	2026-10-26 00:05:14 +01:00
slawek	1825e1efb1	fix: the status gives the number of site-to-site connections set up and established, not each connection by name.	2026-10-25 23:44:05 +01:00
slawek	d648d294ec	feature: pki.extended_key_usages adds custom extended key usages by their OIDs, which templates give by name, and a template's policies put certificate policy OIDs into its certificates.	2026-10-25 23:27:19 +01:00
slawek	a245ec26cd	fix: /status/full of the status web service gives an authenticated client the whole status, whatever web.status_content says.	2026-10-25 23:16:18 +01:00
slawek	7404ee88c4	fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the directory each as itself, instead of failing on a CA with a CRL.	2026-10-25 23:07:24 +01:00
slawek	448ce05b3a	fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.	2026-10-25 23:03:03 +01:00
slawek	e11c88f0de	fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.	2026-10-25 22:20:39 +01:00
slawek	c19b195ea0	fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.	2026-10-25 22:12:13 +01:00
slawek	8d3469d10a	feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.	2026-10-25 22:05:39 +01:00
slawek	fe45272f7c	feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.	2026-10-25 20:18:00 +01:00
slawek	7d1f639508	update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.	2026-10-25 19:08:24 +01:00
slawek	959ca0cd32	update: ADR-24 says that the Router Manager checks for updates on demand.	2026-10-25 19:02:19 +01:00
slawek	1cef4c044f	fix: /metrics/history gives the availability of each site-to-site connection as the percentage of time it was up in slots of the view.	2026-10-25 18:49:47 +01:00
slawek	25c151841b	feature: service accounts have a display name and a description, which the router sets for its internal ones.	2026-10-25 18:34:59 +01:00
slawek	68ebd541b2	fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.	2026-10-25 18:27:10 +01:00
slawek	f01be41191	fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.	2026-10-25 18:18:03 +01:00
slawek	d1970b77b7	fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.	2026-10-25 18:00:25 +01:00
slawek	bf651da5a6	update: release.py tags a Debian revision other than 1 as x.y.z-n.	2026-10-25 17:32:48 +01:00
slawek	4a5b15a559	feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.	2026-10-25 17:14:23 +01:00
slawek	a79510a02f	feature: /config shows the router's PostgreSQL clusters and their settings, and /postgresql their databases with their sizes.	2026-10-25 15:26:54 +01:00