41 Commits

Include renames

Author	SHA1	Message	Date
slawek	81b7f4cac6	feature: bash completes the vpn-* commands, their options and the names they take.	2026-10-26 11:35:46 +01:00
slawek	8cac21845a	feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.	2026-10-26 11:15:12 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.	2026-10-26 08:35:10 +01:00
slawek	91cc64d6a6	fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.	2026-10-26 07:56:23 +01:00
slawek	f1d9c3bc36	feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.	2026-10-26 02:33:58 +01:00
slawek	07dbe91d0c	fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.	2026-10-26 00:43:55 +01:00
slawek	ec93bc6a2d	fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.	2026-10-26 00:21:13 +01:00
slawek	2e1eb89f52	feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.	2026-10-26 00:05:14 +01:00
slawek	448ce05b3a	fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.	2026-10-25 23:03:03 +01:00
slawek	8d3469d10a	feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.	2026-10-25 22:05:39 +01:00
slawek	fe45272f7c	feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.	2026-10-25 20:18:00 +01:00
slawek	7d1f639508	update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.	2026-10-25 19:08:24 +01:00
slawek	959ca0cd32	update: ADR-24 says that the Router Manager checks for updates on demand.	2026-10-25 19:02:19 +01:00
slawek	25c151841b	feature: service accounts have a display name and a description, which the router sets for its internal ones.	2026-10-25 18:34:59 +01:00
slawek	68ebd541b2	fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.	2026-10-25 18:27:10 +01:00
slawek	f01be41191	fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.	2026-10-25 18:18:03 +01:00
slawek	d1970b77b7	fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.	2026-10-25 18:00:25 +01:00
slawek	4a5b15a559	feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.	2026-10-25 17:14:23 +01:00
slawek	38151bf5be	feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.	2026-10-25 14:57:47 +01:00
slawek	650896131d	fix: web.status_content is basic by default.	2026-10-25 13:09:57 +01:00
slawek	dbc2046e24	feature: the status page shows the Client IP, and web.status_content sets how much it shows.	2026-10-25 13:08:08 +01:00
slawek	45d73abe7b	feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.	2026-10-25 12:25:57 +01:00
slawek	993a7a9fa9	fix: the web service listens on the internal address, the external address or both.	2026-10-25 11:37:43 +01:00
slawek	581b53d447	fix: the web service manages users also when it started before setup.	2026-10-24 21:32:00 +02:00
slawek	fe17e83b49	feature: every user manages their own account through /account.	2026-10-24 12:44:49 +02:00
slawek	af3127d1e8	feature: Manager-only accounts, and the Router Manager's first administrator.	2026-10-24 11:56:58 +02:00
slawek	b1e6d9cd0b	fix: the web service starts once libpq can be found.	2026-10-24 11:07:45 +02:00
slawek	732cc8cb54	fix: the web service waits for the PostgreSQL driver instead of failing at start.	2026-10-24 10:43:51 +02:00
slawek	c0cd323a0c	feature: bootstrap diagnostics on port 17081 during the first setup.	2026-10-24 10:07:22 +02:00
slawek	2e2bacee7d	feature: the web service creates its key and database itself and shows its starting phase.	2026-10-24 09:07:28 +02:00
slawek	caf0e334f0	feature: users sign in to the web service, and only members of admins manage the router.	2026-10-24 04:19:01 +02:00
slawek	791fc7fddd	feature: users can be enrolled for TOTP one-time passwords.	2026-10-24 03:00:35 +02:00
slawek	08693f7e68	feature: users have a first name, a last name and an e-mail address.	2026-10-24 01:47:50 +02:00
slawek	b9003bacb9	update: the status web service listens on port 7081 by default.	2026-10-24 01:14:21 +02:00
slawek	0bf78b16b1	feature: users and their certificates no longer need a P2S system enabled.	2026-10-24 00:00:44 +02:00
slawek	0ff74cc8c9	feature: the firewall lets the Router Manager in on the internal interface.	2026-10-23 23:24:59 +02:00
slawek	c377801be0	fix: /config no longer shows secret options.	2026-10-23 22:48:31 +02:00
slawek	a4cffb67e4	fix: the web service works in every state of the router.	2026-10-23 22:35:53 +02:00
slawek	cc6748a622	update: Added OpenLDAP and OpenVPN to the router.	2026-10-23 21:55:03 +02:00
slawek	7163f167e0	feature: Added an internally only exposed status web service.	2026-10-23 19:46:26 +02:00
slawek	2e0cee10ac	feat: added support for running the VPN router on a host with Docker Community Edition.	2026-10-23 13:17:32 +02:00