89 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
slawek	77bdbcb058	feature: the web service serves the last lines of the journal of the router's units and of the log files web.log_files lists, at /logs.	2026-10-26 12:37:51 +01:00
slawek	cb33b3bfa1	feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.	2026-10-26 11:48:47 +01:00
slawek	81b7f4cac6	feature: bash completes the vpn-* commands, their options and the names they take.	2026-10-26 11:35:46 +01:00
slawek	8cac21845a	feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.	2026-10-26 11:15:12 +01:00
slawek	d1d565b1d9	fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.	2026-10-26 09:11:13 +01:00
slawek	e675540ce2	fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start.	2026-10-26 08:40:24 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.	2026-10-26 08:35:10 +01:00
slawek	91cc64d6a6	fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.	2026-10-26 07:56:23 +01:00
slawek	a1f314d8c1	fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page.	2026-10-26 07:18:39 +01:00
slawek	7d8892b8c4	fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.	2026-10-26 02:59:56 +01:00
slawek	4491377d9b	fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.	2026-10-26 02:50:39 +01:00
slawek	f1d9c3bc36	feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.	2026-10-26 02:33:58 +01:00
slawek	015fba50ca	fix: the status gives the number of connected OpenVPN clients at most 5 seconds old instead of up to a minute.	2026-10-26 02:10:38 +01:00
slawek	9255d56276	feature: /remote-access of the web service shows and changes the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each runs, for the Router Manager's Remote access page.	2026-10-26 00:57:22 +01:00
slawek	07dbe91d0c	fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.	2026-10-26 00:43:55 +01:00
slawek	ec93bc6a2d	fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.	2026-10-26 00:21:13 +01:00
slawek	2e1eb89f52	feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.	2026-10-26 00:05:14 +01:00
slawek	1825e1efb1	fix: the status gives the number of site-to-site connections set up and established, not each connection by name.	2026-10-25 23:44:05 +01:00
slawek	d648d294ec	feature: pki.extended_key_usages adds custom extended key usages by their OIDs, which templates give by name, and a template's policies put certificate policy OIDs into its certificates.	2026-10-25 23:27:19 +01:00
slawek	a245ec26cd	fix: /status/full of the status web service gives an authenticated client the whole status, whatever web.status_content says.	2026-10-25 23:16:18 +01:00
slawek	7404ee88c4	fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the directory each as itself, instead of failing on a CA with a CRL.	2026-10-25 23:07:24 +01:00
slawek	448ce05b3a	fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.	2026-10-25 23:03:03 +01:00
slawek	e11c88f0de	fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.	2026-10-25 22:20:39 +01:00
slawek	c19b195ea0	fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.	2026-10-25 22:12:13 +01:00
slawek	8d3469d10a	feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.	2026-10-25 22:05:39 +01:00
slawek	fe45272f7c	feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.	2026-10-25 20:18:00 +01:00
slawek	7d1f639508	update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.	2026-10-25 19:08:24 +01:00
slawek	959ca0cd32	update: ADR-24 says that the Router Manager checks for updates on demand.	2026-10-25 19:02:19 +01:00
slawek	1cef4c044f	fix: /metrics/history gives the availability of each site-to-site connection as the percentage of time it was up in slots of the view.	2026-10-25 18:49:47 +01:00
slawek	25c151841b	feature: service accounts have a display name and a description, which the router sets for its internal ones.	2026-10-25 18:34:59 +01:00
slawek	68ebd541b2	fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.	2026-10-25 18:27:10 +01:00
slawek	f01be41191	fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.	2026-10-25 18:18:03 +01:00
slawek	d1970b77b7	fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.	2026-10-25 18:00:25 +01:00
slawek	bf651da5a6	update: release.py tags a Debian revision other than 1 as x.y.z-n.	2026-10-25 17:32:48 +01:00
slawek	4a5b15a559	feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.	2026-10-25 17:14:23 +01:00
slawek	a79510a02f	feature: /config shows the router's PostgreSQL clusters and their settings, and /postgresql their databases with their sizes.	2026-10-25 15:26:54 +01:00
slawek	38151bf5be	feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.	2026-10-25 14:57:47 +01:00
slawek	83c1c50d8d	feature: vpn-config-edit shows and changes the router's configuration.	2026-10-25 13:29:12 +01:00
slawek	650896131d	fix: web.status_content is basic by default.	2026-10-25 13:09:57 +01:00
slawek	dbc2046e24	feature: the status page shows the Client IP, and web.status_content sets how much it shows.	2026-10-25 13:08:08 +01:00
slawek	45d73abe7b	feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.	2026-10-25 12:25:57 +01:00
slawek	993a7a9fa9	fix: the web service listens on the internal address, the external address or both.	2026-10-25 11:37:43 +01:00
slawek	581b53d447	fix: the web service manages users also when it started before setup.	2026-10-24 21:32:00 +02:00
slawek	8782edff0f	fix: the status page shows whether the Router Manager runs.	2026-10-24 12:50:49 +02:00
slawek	fe17e83b49	feature: every user manages their own account through /account.	2026-10-24 12:44:49 +02:00
slawek	17331eea37	feature: the status page shows the Router Manager's version.	2026-10-24 12:16:02 +02:00
slawek	af3127d1e8	feature: Manager-only accounts, and the Router Manager's first administrator.	2026-10-24 11:56:58 +02:00
slawek	b1e6d9cd0b	fix: the web service starts once libpq can be found.	2026-10-24 11:07:45 +02:00
slawek	732cc8cb54	fix: the web service waits for the PostgreSQL driver instead of failing at start.	2026-10-24 10:43:51 +02:00
slawek	c0cd323a0c	feature: bootstrap diagnostics on port 17081 during the first setup.	2026-10-24 10:07:22 +02:00
slawek	2e2bacee7d	feature: the web service creates its key and database itself and shows its starting phase.	2026-10-24 09:07:28 +02:00
slawek	4f1aa282f6	fix: a failing user directory or token database no longer leaves the tunnels down.	2026-10-24 08:55:25 +02:00
slawek	caf0e334f0	feature: users sign in to the web service, and only members of admins manage the router.	2026-10-24 04:19:01 +02:00
slawek	791fc7fddd	feature: users can be enrolled for TOTP one-time passwords.	2026-10-24 03:00:35 +02:00
slawek	f135d776f8	fix: package upgrades no longer ask the configuration questions.	2026-10-24 02:16:19 +02:00
slawek	cda33fc4c7	fix: an upgrade keeps the configuration and asks nothing.	2026-10-24 02:08:23 +02:00
slawek	08693f7e68	feature: users have a first name, a last name and an e-mail address.	2026-10-24 01:47:50 +02:00
slawek	b9003bacb9	update: the status web service listens on port 7081 by default.	2026-10-24 01:14:21 +02:00
slawek	0bf78b16b1	feature: users and their certificates no longer need a P2S system enabled.	2026-10-24 00:00:44 +02:00
slawek	0ff74cc8c9	feature: the firewall lets the Router Manager in on the internal interface.	2026-10-23 23:24:59 +02:00
slawek	a7b29e0655	fix: the status always shows the state of slapd.	2026-10-23 22:59:17 +02:00
slawek	c377801be0	fix: /config no longer shows secret options.	2026-10-23 22:48:31 +02:00
slawek	a4cffb67e4	fix: the web service works in every state of the router.	2026-10-23 22:35:53 +02:00
slawek	cc6748a622	update: Added OpenLDAP and OpenVPN to the router.	2026-10-23 21:55:03 +02:00
slawek	609921348b	fix: incorrect swanctl parsing.	2026-10-23 20:56:52 +02:00
slawek	90e7c79840	fix: replace webservice swanctl call human readble output with structured one.	2026-10-23 20:44:17 +02:00
slawek	a6b25b8bb4	fix: router setup hangs on race condition with Docker.	2026-10-23 20:03:17 +02:00
slawek	7163f167e0	feature: Added an internally only exposed status web service.	2026-10-23 19:46:26 +02:00
slawek	5402256ef6	fix: removed unnecressary peer ID handling that is no longer required for >=5.0 StrongSwan.	2026-10-23 17:31:22 +02:00
slawek	64da0cf97f	fix: update interface detection code to support additional interfaces Docker adds.	2026-10-23 13:43:46 +02:00
slawek	2e0cee10ac	feat: added support for running the VPN router on a host with Docker Community Edition.	2026-10-23 13:17:32 +02:00
slawek	66fcd69d40	feat: change the workflow to use owner secrets.	2026-10-23 08:24:40 +02:00
slawek	19567aa273	feat: add Gitea workflow that builds package on tag push.	2026-10-23 08:10:15 +02:00
slawek	656e1733d5	feat: change config from INI to JSON.	2026-10-23 08:04:55 +02:00
slawek	b18947ed9b	Converted router configuration file from .conf to JSON.	2026-10-23 07:35:43 +02:00
slawek	c423ea9347	Added GCP example vars.	2026-10-22 00:52:25 +02:00
slawek	c8f54ca865	Add GCP deployment examples: create Terraform configurations for GCP, including network setup, instance definitions, and routing, along with a README for usage instructions.	2026-08-27 21:23:47 +02:00
slawek	245d0dfd96	Enhance Azure example configurations: add subscription_id and tenant_id variables, update terraform.tfvars.example, and refine .gitignore for tfplan files	2026-08-23 22:38:48 +02:00
slawek	dac5cea5ee	Add Azure deployment examples and enhance configuration management ... - Update .gitignore to exclude Terraform files - Enhance README with Azure deployment instructions - Refactor publish.sh to use a container for changelog parsing - Add Azure example files including Terraform configurations - Create cloud-init templates for PKI and default configurations - Implement workload VM setup for testing routing	2026-08-23 22:10:29 +02:00
slawek	7cb2f1b8dd	Defer configuration by default and manage vpn-router.conf with ucf ... Add platform = none as the shipped default so installing the package changes nothing on the machine until a platform is chosen. Add a mode setting (manual/interfaces/auto) controlling how much of the network configuration is supplied versus detected from the system. Manage /etc/vpn-router/vpn-router.conf with ucf instead of writing it once, so dpkg-reconfigure can safely reapply debconf answers without clobbering local edits. Extend NAT/forward rules to all local subnets, not just the first.	2026-08-23 17:15:49 +02:00
slawek	083ad9a596	Reengineed the code. Generalized the package. Cloud configurators are modules.	2026-08-10 09:02:45 +02:00
slawek	be4bb34bb0	Update .gitignore to ensure CLAUDE.md is excluded from version control	2026-08-09 12:01:24 +02:00
slawek	7b5e18628f	Update .gitignore to include additional file patterns for exclusion	2026-05-28 09:20:02 +02:00
slawek	1f6d168fb3	Moved Debian package sources to a subdirectory of the repository.	2026-05-28 09:18:43 +02:00
slawek	ac6482a4a1	Update Dockerfile and build script to include HOST_UID and HOST_GID arguments for improved user permissions	2026-05-27 08:14:20 +02:00
slawek	079edee6e6	Add Dockerfile and build script; update .gitignore and installation paths	2026-05-27 07:58:24 +02:00
slawek	0b36f71394	Remove Plan.md and simple-ca.sh files from the repository	2026-05-27 00:36:09 +02:00
slawek	3c665c2b6c	Add cloud-router configuration templates and scripts ... - Introduced debian templates for cloud-router configuration parameters. - Added simple-ca.sh script for managing a minimal Certificate Authority (CA) for IKEv2 PKI. - Created sysctl configuration to enable IP forwarding and adjust rp_filter settings. - Implemented configure script to render configuration files using Jinja2 templates. - Added simple-ca script for generating CA and certificates. - Created Jinja2 templates for various configuration files including netplan, strongSwan, and WireGuard. - Implemented UFW rules setup for IPsec and WireGuard. - Added support for road-warrior and site-to-site VPN configurations.	2026-05-27 00:33:07 +02:00
slawek	db78066d5c	Add .gitignore and initial README.md for project documentation	2026-05-26 22:15:40 +02:00