57 Commits

Include renames

Author	SHA1	Message	Date
slawek	f36e2a3b04	feature: https.acme_staging takes Caddy's certificates from Let's Encrypt's staging environment.	2026-10-30 02:35:21 +01:00
slawek	1e0e375d60	fix: an answer whose client went away ends quietly, and a shell whose client left before it opened is stopped.	2026-10-30 02:03:58 +01:00
slawek	3c4c5a8c32	feature: the OpenID Provider has the client credentials and device authorization grants, public clients, and service accounts as resources with roles and scopes in JWT access tokens.	2026-10-30 01:01:45 +01:00
slawek	3ed79c7563	feature: a shell opens with one of the user's passkeys in place of the password and the TOTP code.	2026-10-29 23:13:11 +01:00
slawek	46d3550eab	update: the router web service is split into the package vpnrouter_web, with one module per family of paths.	2026-10-29 18:52:51 +01:00
slawek	3b14b7723e	feature: vre opens files from the Router Manager's shell in the editor of its Shell page.	2026-10-29 18:10:58 +01:00
slawek	45cea95728	fix: vpn-router-setup runs on a new installation once libpq can be found.	2026-10-28 21:41:52 +01:00
slawek	dd2dfaaf2b	fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.	2026-10-27 08:46:36 +01:00
slawek	1697e1aa38	fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.	2026-10-26 21:26:47 +01:00
slawek	57e8bbcffe	feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.	2026-10-26 20:58:33 +01:00
slawek	74c24d7bc6	feature: the web service gives Apple VPN profiles that set up IKEv2 road-warrior access on macOS, iOS and iPadOS.	2026-10-26 20:37:58 +01:00
slawek	770332728e	fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.	2026-10-26 18:33:03 +01:00
slawek	e14bbe2ba1	fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.	2026-10-26 16:53:42 +01:00
slawek	dabe4e8365	fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.	2026-10-26 16:11:08 +01:00
slawek	ea8ca97417	feature: Caddy serves static web sites from folders on the router, defined in their own database, with files uploaded through the web service or WebDAV, and an optional PowerDNS name server answers for a zone of the sites.	2026-10-26 15:27:28 +01:00
slawek	77bdbcb058	feature: the web service serves the last lines of the journal of the router's units and of the log files web.log_files lists, at /logs.	2026-10-26 12:37:51 +01:00
slawek	81b7f4cac6	feature: bash completes the vpn-* commands, their options and the names they take.	2026-10-26 11:35:46 +01:00
slawek	8cac21845a	feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.	2026-10-26 11:15:12 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.	2026-10-26 08:35:10 +01:00
slawek	91cc64d6a6	fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.	2026-10-26 07:56:23 +01:00
slawek	f1d9c3bc36	feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.	2026-10-26 02:33:58 +01:00
slawek	07dbe91d0c	fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.	2026-10-26 00:43:55 +01:00
slawek	ec93bc6a2d	fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.	2026-10-26 00:21:13 +01:00
slawek	2e1eb89f52	feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.	2026-10-26 00:05:14 +01:00
slawek	448ce05b3a	fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.	2026-10-25 23:03:03 +01:00
slawek	8d3469d10a	feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.	2026-10-25 22:05:39 +01:00
slawek	fe45272f7c	feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.	2026-10-25 20:18:00 +01:00
slawek	7d1f639508	update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.	2026-10-25 19:08:24 +01:00
slawek	959ca0cd32	update: ADR-24 says that the Router Manager checks for updates on demand.	2026-10-25 19:02:19 +01:00
slawek	25c151841b	feature: service accounts have a display name and a description, which the router sets for its internal ones.	2026-10-25 18:34:59 +01:00
slawek	68ebd541b2	fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.	2026-10-25 18:27:10 +01:00
slawek	f01be41191	fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.	2026-10-25 18:18:03 +01:00
slawek	d1970b77b7	fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.	2026-10-25 18:00:25 +01:00
slawek	4a5b15a559	feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.	2026-10-25 17:14:23 +01:00
slawek	38151bf5be	feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.	2026-10-25 14:57:47 +01:00
slawek	650896131d	fix: web.status_content is basic by default.	2026-10-25 13:09:57 +01:00
slawek	dbc2046e24	feature: the status page shows the Client IP, and web.status_content sets how much it shows.	2026-10-25 13:08:08 +01:00
slawek	45d73abe7b	feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.	2026-10-25 12:25:57 +01:00
slawek	993a7a9fa9	fix: the web service listens on the internal address, the external address or both.	2026-10-25 11:37:43 +01:00
slawek	581b53d447	fix: the web service manages users also when it started before setup.	2026-10-24 21:32:00 +02:00
slawek	fe17e83b49	feature: every user manages their own account through /account.	2026-10-24 12:44:49 +02:00
slawek	af3127d1e8	feature: Manager-only accounts, and the Router Manager's first administrator.	2026-10-24 11:56:58 +02:00
slawek	b1e6d9cd0b	fix: the web service starts once libpq can be found.	2026-10-24 11:07:45 +02:00
slawek	732cc8cb54	fix: the web service waits for the PostgreSQL driver instead of failing at start.	2026-10-24 10:43:51 +02:00
slawek	c0cd323a0c	feature: bootstrap diagnostics on port 17081 during the first setup.	2026-10-24 10:07:22 +02:00
slawek	2e2bacee7d	feature: the web service creates its key and database itself and shows its starting phase.	2026-10-24 09:07:28 +02:00
slawek	caf0e334f0	feature: users sign in to the web service, and only members of admins manage the router.	2026-10-24 04:19:01 +02:00
slawek	791fc7fddd	feature: users can be enrolled for TOTP one-time passwords.	2026-10-24 03:00:35 +02:00
slawek	08693f7e68	feature: users have a first name, a last name and an e-mail address.	2026-10-24 01:47:50 +02:00
slawek	b9003bacb9	update: the status web service listens on port 7081 by default.	2026-10-24 01:14:21 +02:00