32 Commits

Include renames

Author	SHA1	Message	Date
slawek	770332728e	fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.	2026-10-26 18:33:03 +01:00
slawek	e14bbe2ba1	fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.	2026-10-26 16:53:42 +01:00
slawek	dabe4e8365	fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.	2026-10-26 16:11:08 +01:00
slawek	ea8ca97417	feature: Caddy serves static web sites from folders on the router, defined in their own database, with files uploaded through the web service or WebDAV, and an optional PowerDNS name server answers for a zone of the sites.	2026-10-26 15:27:28 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.	2026-10-26 08:35:10 +01:00
slawek	07dbe91d0c	fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.	2026-10-26 00:43:55 +01:00
slawek	ec93bc6a2d	fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.	2026-10-26 00:21:13 +01:00
slawek	448ce05b3a	fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.	2026-10-25 23:03:03 +01:00
slawek	8d3469d10a	feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.	2026-10-25 22:05:39 +01:00
slawek	fe45272f7c	feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.	2026-10-25 20:18:00 +01:00
slawek	25c151841b	feature: service accounts have a display name and a description, which the router sets for its internal ones.	2026-10-25 18:34:59 +01:00
slawek	4a5b15a559	feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.	2026-10-25 17:14:23 +01:00
slawek	38151bf5be	feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.	2026-10-25 14:57:47 +01:00
slawek	45d73abe7b	feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.	2026-10-25 12:25:57 +01:00
slawek	993a7a9fa9	fix: the web service listens on the internal address, the external address or both.	2026-10-25 11:37:43 +01:00
slawek	af3127d1e8	feature: Manager-only accounts, and the Router Manager's first administrator.	2026-10-24 11:56:58 +02:00
slawek	c0cd323a0c	feature: bootstrap diagnostics on port 17081 during the first setup.	2026-10-24 10:07:22 +02:00
slawek	2e2bacee7d	feature: the web service creates its key and database itself and shows its starting phase.	2026-10-24 09:07:28 +02:00
slawek	4f1aa282f6	fix: a failing user directory or token database no longer leaves the tunnels down.	2026-10-24 08:55:25 +02:00
slawek	caf0e334f0	feature: users sign in to the web service, and only members of admins manage the router.	2026-10-24 04:19:01 +02:00
slawek	b9003bacb9	update: the status web service listens on port 7081 by default.	2026-10-24 01:14:21 +02:00
slawek	0bf78b16b1	feature: users and their certificates no longer need a P2S system enabled.	2026-10-24 00:00:44 +02:00
slawek	0ff74cc8c9	feature: the firewall lets the Router Manager in on the internal interface.	2026-10-23 23:24:59 +02:00
slawek	c377801be0	fix: /config no longer shows secret options.	2026-10-23 22:48:31 +02:00
slawek	a4cffb67e4	fix: the web service works in every state of the router.	2026-10-23 22:35:53 +02:00
slawek	cc6748a622	update: Added OpenLDAP and OpenVPN to the router.	2026-10-23 21:55:03 +02:00
slawek	a6b25b8bb4	fix: router setup hangs on race condition with Docker.	2026-10-23 20:03:17 +02:00
slawek	7163f167e0	feature: Added an internally only exposed status web service.	2026-10-23 19:46:26 +02:00
slawek	2e0cee10ac	feat: added support for running the VPN router on a host with Docker Community Edition.	2026-10-23 13:17:32 +02:00
slawek	b18947ed9b	Converted router configuration file from .conf to JSON.	2026-10-23 07:35:43 +02:00
slawek	7cb2f1b8dd	Defer configuration by default and manage vpn-router.conf with ucf ... Add platform = none as the shipped default so installing the package changes nothing on the machine until a platform is chosen. Add a mode setting (manual/interfaces/auto) controlling how much of the network configuration is supplied versus detected from the system. Manage /etc/vpn-router/vpn-router.conf with ucf instead of writing it once, so dpkg-reconfigure can safely reapply debconf answers without clobbering local edits. Extend NAT/forward rules to all local subnets, not just the first.	2026-08-23 17:15:49 +02:00
slawek	083ad9a596	Reengineed the code. Generalized the package. Cloud configurators are modules.	2026-08-10 09:02:45 +02:00