19 Commits

Include renames

Author	SHA1	Message	Date
slawek	dd2dfaaf2b	fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.	2026-10-27 08:46:36 +01:00
slawek	57e8bbcffe	feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.	2026-10-26 20:58:33 +01:00
slawek	74c24d7bc6	feature: the web service gives Apple VPN profiles that set up IKEv2 road-warrior access on macOS, iOS and iPadOS.	2026-10-26 20:37:58 +01:00
slawek	ea8ca97417	feature: Caddy serves static web sites from folders on the router, defined in their own database, with files uploaded through the web service or WebDAV, and an optional PowerDNS name server answers for a zone of the sites.	2026-10-26 15:27:28 +01:00
slawek	8cac21845a	feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.	2026-10-26 11:15:12 +01:00
slawek	d1d565b1d9	fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.	2026-10-26 09:11:13 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.	2026-10-26 08:35:10 +01:00
slawek	f1d9c3bc36	feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.	2026-10-26 02:33:58 +01:00
slawek	ec93bc6a2d	fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.	2026-10-26 00:21:13 +01:00
slawek	448ce05b3a	fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.	2026-10-25 23:03:03 +01:00
slawek	8d3469d10a	feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.	2026-10-25 22:05:39 +01:00
slawek	25c151841b	feature: service accounts have a display name and a description, which the router sets for its internal ones.	2026-10-25 18:34:59 +01:00
slawek	68ebd541b2	fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.	2026-10-25 18:27:10 +01:00
slawek	d1970b77b7	fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.	2026-10-25 18:00:25 +01:00
slawek	38151bf5be	feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.	2026-10-25 14:57:47 +01:00
slawek	af3127d1e8	feature: Manager-only accounts, and the Router Manager's first administrator.	2026-10-24 11:56:58 +02:00
slawek	caf0e334f0	feature: users sign in to the web service, and only members of admins manage the router.	2026-10-24 04:19:01 +02:00
slawek	791fc7fddd	feature: users can be enrolled for TOTP one-time passwords.	2026-10-24 03:00:35 +02:00
slawek	08693f7e68	feature: users have a first name, a last name and an e-mail address.	2026-10-24 01:47:50 +02:00