100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
slawek	dd489e65aa	fix: the web service, the metrics service and the bootstrap server log a failure in one line instead of a traceback, and nothing when a client goes away.	2026-10-30 02:01:27 +01:00
slawek	3de030b06b	fix: /config answers the OpenID Provider's state and issuer.	2026-10-30 01:54:50 +01:00
slawek	3c4c5a8c32	feature: the OpenID Provider has the client credentials and device authorization grants, public clients, and service accounts as resources with roles and scopes in JWT access tokens.	2026-10-30 01:01:45 +01:00
slawek	3ed79c7563	feature: a shell opens with one of the user's passkeys in place of the password and the TOTP code.	2026-10-29 23:13:11 +01:00
slawek	3e78d520ae	update: the package is published for Ubuntu 26.04 (resolute) as well as 24.04 (noble).	2026-10-29 21:42:15 +01:00
slawek	d99e4ea425	fix: the web service answers /, /status and /status/full again while IKEv2 runs.	2026-10-29 19:04:11 +01:00
slawek	46d3550eab	update: the router web service is split into the package vpnrouter_web, with one module per family of paths.	2026-10-29 18:52:51 +01:00
slawek	3b14b7723e	feature: vre opens files from the Router Manager's shell in the editor of its Shell page.	2026-10-29 18:10:58 +01:00
slawek	5303779559	feature: the web service shows and changes the settings of the metrics service at /metrics/settings, and OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.	2026-10-28 22:31:27 +01:00
slawek	2dc4db440f	fix: OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.	2026-10-28 22:00:37 +01:00
slawek	45cea95728	fix: vpn-router-setup runs on a new installation once libpq can be found.	2026-10-28 21:41:52 +01:00
slawek	dd2dfaaf2b	fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.	2026-10-27 08:46:36 +01:00
slawek	1697e1aa38	fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.	2026-10-26 21:26:47 +01:00
slawek	57e8bbcffe	feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.	2026-10-26 20:58:33 +01:00
slawek	9ca8fce14e	fix: a VPN user downloads the own OpenVPN client profile through /account, with the current password and code.	2026-10-26 20:43:33 +01:00
slawek	74c24d7bc6	feature: the web service gives Apple VPN profiles that set up IKEv2 road-warrior access on macOS, iOS and iPadOS.	2026-10-26 20:37:58 +01:00
slawek	770332728e	fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.	2026-10-26 18:33:03 +01:00
slawek	e14bbe2ba1	fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.	2026-10-26 16:53:42 +01:00
slawek	dabe4e8365	fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.	2026-10-26 16:11:08 +01:00
slawek	ea8ca97417	feature: Caddy serves static web sites from folders on the router, defined in their own database, with files uploaded through the web service or WebDAV, and an optional PowerDNS name server answers for a zone of the sites.	2026-10-26 15:27:28 +01:00
slawek	77bdbcb058	feature: the web service serves the last lines of the journal of the router's units and of the log files web.log_files lists, at /logs.	2026-10-26 12:37:51 +01:00
slawek	cb33b3bfa1	feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.	2026-10-26 11:48:47 +01:00
slawek	81b7f4cac6	feature: bash completes the vpn-* commands, their options and the names they take.	2026-10-26 11:35:46 +01:00
slawek	8cac21845a	feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.	2026-10-26 11:15:12 +01:00
slawek	d1d565b1d9	fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.	2026-10-26 09:11:13 +01:00
slawek	e675540ce2	fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start.	2026-10-26 08:40:24 +01:00
slawek	90db6d46a2	feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.	2026-10-26 08:35:10 +01:00
slawek	91cc64d6a6	fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.	2026-10-26 07:56:23 +01:00
slawek	a1f314d8c1	fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page.	2026-10-26 07:18:39 +01:00
slawek	7d8892b8c4	fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.	2026-10-26 02:59:56 +01:00
slawek	4491377d9b	fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.	2026-10-26 02:50:39 +01:00
slawek	f1d9c3bc36	feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.	2026-10-26 02:33:58 +01:00
slawek	015fba50ca	fix: the status gives the number of connected OpenVPN clients at most 5 seconds old instead of up to a minute.	2026-10-26 02:10:38 +01:00
slawek	9255d56276	feature: /remote-access of the web service shows and changes the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each runs, for the Router Manager's Remote access page.	2026-10-26 00:57:22 +01:00
slawek	07dbe91d0c	fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.	2026-10-26 00:43:55 +01:00
slawek	ec93bc6a2d	fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.	2026-10-26 00:21:13 +01:00
slawek	2e1eb89f52	feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.	2026-10-26 00:05:14 +01:00
slawek	1825e1efb1	fix: the status gives the number of site-to-site connections set up and established, not each connection by name.	2026-10-25 23:44:05 +01:00
slawek	d648d294ec	feature: pki.extended_key_usages adds custom extended key usages by their OIDs, which templates give by name, and a template's policies put certificate policy OIDs into its certificates.	2026-10-25 23:27:19 +01:00
slawek	a245ec26cd	fix: /status/full of the status web service gives an authenticated client the whole status, whatever web.status_content says.	2026-10-25 23:16:18 +01:00
slawek	7404ee88c4	fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the directory each as itself, instead of failing on a CA with a CRL.	2026-10-25 23:07:24 +01:00
slawek	448ce05b3a	fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.	2026-10-25 23:03:03 +01:00
slawek	e11c88f0de	fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.	2026-10-25 22:20:39 +01:00
slawek	c19b195ea0	fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.	2026-10-25 22:12:13 +01:00
slawek	8d3469d10a	feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.	2026-10-25 22:05:39 +01:00
slawek	fe45272f7c	feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.	2026-10-25 20:18:00 +01:00
slawek	7d1f639508	update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.	2026-10-25 19:08:24 +01:00
slawek	959ca0cd32	update: ADR-24 says that the Router Manager checks for updates on demand.	2026-10-25 19:02:19 +01:00
slawek	1cef4c044f	fix: /metrics/history gives the availability of each site-to-site connection as the percentage of time it was up in slots of the view.	2026-10-25 18:49:47 +01:00
slawek	25c151841b	feature: service accounts have a display name and a description, which the router sets for its internal ones.	2026-10-25 18:34:59 +01:00
slawek	68ebd541b2	fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.	2026-10-25 18:27:10 +01:00
slawek	f01be41191	fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.	2026-10-25 18:18:03 +01:00
slawek	d1970b77b7	fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.	2026-10-25 18:00:25 +01:00
slawek	bf651da5a6	update: release.py tags a Debian revision other than 1 as x.y.z-n.	2026-10-25 17:32:48 +01:00
slawek	4a5b15a559	feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.	2026-10-25 17:14:23 +01:00
slawek	a79510a02f	feature: /config shows the router's PostgreSQL clusters and their settings, and /postgresql their databases with their sizes.	2026-10-25 15:26:54 +01:00
slawek	38151bf5be	feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.	2026-10-25 14:57:47 +01:00
slawek	83c1c50d8d	feature: vpn-config-edit shows and changes the router's configuration.	2026-10-25 13:29:12 +01:00
slawek	650896131d	fix: web.status_content is basic by default.	2026-10-25 13:09:57 +01:00
slawek	dbc2046e24	feature: the status page shows the Client IP, and web.status_content sets how much it shows.	2026-10-25 13:08:08 +01:00
slawek	45d73abe7b	feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.	2026-10-25 12:25:57 +01:00
slawek	993a7a9fa9	fix: the web service listens on the internal address, the external address or both.	2026-10-25 11:37:43 +01:00
slawek	581b53d447	fix: the web service manages users also when it started before setup.	2026-10-24 21:32:00 +02:00
slawek	8782edff0f	fix: the status page shows whether the Router Manager runs.	2026-10-24 12:50:49 +02:00
slawek	fe17e83b49	feature: every user manages their own account through /account.	2026-10-24 12:44:49 +02:00
slawek	17331eea37	feature: the status page shows the Router Manager's version.	2026-10-24 12:16:02 +02:00
slawek	af3127d1e8	feature: Manager-only accounts, and the Router Manager's first administrator.	2026-10-24 11:56:58 +02:00
slawek	b1e6d9cd0b	fix: the web service starts once libpq can be found.	2026-10-24 11:07:45 +02:00
slawek	732cc8cb54	fix: the web service waits for the PostgreSQL driver instead of failing at start.	2026-10-24 10:43:51 +02:00
slawek	c0cd323a0c	feature: bootstrap diagnostics on port 17081 during the first setup.	2026-10-24 10:07:22 +02:00
slawek	2e2bacee7d	feature: the web service creates its key and database itself and shows its starting phase.	2026-10-24 09:07:28 +02:00
slawek	4f1aa282f6	fix: a failing user directory or token database no longer leaves the tunnels down.	2026-10-24 08:55:25 +02:00
slawek	caf0e334f0	feature: users sign in to the web service, and only members of admins manage the router.	2026-10-24 04:19:01 +02:00
slawek	791fc7fddd	feature: users can be enrolled for TOTP one-time passwords.	2026-10-24 03:00:35 +02:00
slawek	f135d776f8	fix: package upgrades no longer ask the configuration questions.	2026-10-24 02:16:19 +02:00
slawek	cda33fc4c7	fix: an upgrade keeps the configuration and asks nothing.	2026-10-24 02:08:23 +02:00
slawek	08693f7e68	feature: users have a first name, a last name and an e-mail address.	2026-10-24 01:47:50 +02:00
slawek	b9003bacb9	update: the status web service listens on port 7081 by default.	2026-10-24 01:14:21 +02:00
slawek	0bf78b16b1	feature: users and their certificates no longer need a P2S system enabled.	2026-10-24 00:00:44 +02:00
slawek	0ff74cc8c9	feature: the firewall lets the Router Manager in on the internal interface.	2026-10-23 23:24:59 +02:00
slawek	a7b29e0655	fix: the status always shows the state of slapd.	2026-10-23 22:59:17 +02:00
slawek	c377801be0	fix: /config no longer shows secret options.	2026-10-23 22:48:31 +02:00
slawek	a4cffb67e4	fix: the web service works in every state of the router.	2026-10-23 22:35:53 +02:00
slawek	cc6748a622	update: Added OpenLDAP and OpenVPN to the router.	2026-10-23 21:55:03 +02:00
slawek	609921348b	fix: incorrect swanctl parsing.	2026-10-23 20:56:52 +02:00
slawek	90e7c79840	fix: replace webservice swanctl call human readble output with structured one.	2026-10-23 20:44:17 +02:00
slawek	a6b25b8bb4	fix: router setup hangs on race condition with Docker.	2026-10-23 20:03:17 +02:00
slawek	7163f167e0	feature: Added an internally only exposed status web service.	2026-10-23 19:46:26 +02:00
slawek	5402256ef6	fix: removed unnecressary peer ID handling that is no longer required for >=5.0 StrongSwan.	2026-10-23 17:31:22 +02:00
slawek	64da0cf97f	fix: update interface detection code to support additional interfaces Docker adds.	2026-10-23 13:43:46 +02:00
slawek	2e0cee10ac	feat: added support for running the VPN router on a host with Docker Community Edition.	2026-10-23 13:17:32 +02:00
slawek	66fcd69d40	feat: change the workflow to use owner secrets.	2026-10-23 08:24:40 +02:00
slawek	19567aa273	feat: add Gitea workflow that builds package on tag push.	2026-10-23 08:10:15 +02:00
slawek	656e1733d5	feat: change config from INI to JSON.	2026-10-23 08:04:55 +02:00
slawek	b18947ed9b	Converted router configuration file from .conf to JSON.	2026-10-23 07:35:43 +02:00
slawek	c423ea9347	Added GCP example vars.	2026-10-22 00:52:25 +02:00
slawek	c8f54ca865	Add GCP deployment examples: create Terraform configurations for GCP, including network setup, instance definitions, and routing, along with a README for usage instructions.	2026-08-27 21:23:47 +02:00
slawek	245d0dfd96	Enhance Azure example configurations: add subscription_id and tenant_id variables, update terraform.tfvars.example, and refine .gitignore for tfplan files	2026-08-23 22:38:48 +02:00
slawek	dac5cea5ee	Add Azure deployment examples and enhance configuration management ... - Update .gitignore to exclude Terraform files - Enhance README with Azure deployment instructions - Refactor publish.sh to use a container for changelog parsing - Add Azure example files including Terraform configurations - Create cloud-init templates for PKI and default configurations - Implement workload VM setup for testing routing	2026-08-23 22:10:29 +02:00
slawek	7cb2f1b8dd	Defer configuration by default and manage vpn-router.conf with ucf ... Add platform = none as the shipped default so installing the package changes nothing on the machine until a platform is chosen. Add a mode setting (manual/interfaces/auto) controlling how much of the network configuration is supplied versus detected from the system. Manage /etc/vpn-router/vpn-router.conf with ucf instead of writing it once, so dpkg-reconfigure can safely reapply debconf answers without clobbering local edits. Extend NAT/forward rules to all local subnets, not just the first.	2026-08-23 17:15:49 +02:00