c2c33cfca0
fix: /https/settings shows the https section and switches https.acme_staging, for the Router Manager.
main
0.38.1
slawek2026-10-30 02:46:07 +01:00
1e0e375d60
fix: an answer whose client went away ends quietly, and a shell whose client left before it opened is stopped.
0.37.3
slawek2026-10-30 02:03:58 +01:00
dd489e65aa
fix: the web service, the metrics service and the bootstrap server log a failure in one line instead of a traceback, and nothing when a client goes away.
0.37.2
slawek2026-10-30 02:01:27 +01:00
3de030b06b
fix: /config answers the OpenID Provider's state and issuer.
0.37.1
slawek2026-10-30 01:54:50 +01:00
3c4c5a8c32
feature: the OpenID Provider has the client credentials and device authorization grants, public clients, and service accounts as resources with roles and scopes in JWT access tokens.
0.37.0
slawek2026-10-30 01:01:45 +01:00
3ed79c7563
feature: a shell opens with one of the user's passkeys in place of the password and the TOTP code.
0.36.0
slawek2026-10-29 23:13:11 +01:00
3e78d520ae
update: the package is published for Ubuntu 26.04 (resolute) as well as 24.04 (noble).
0.35.2-2
slawek2026-10-29 21:42:15 +01:00
d99e4ea425
fix: the web service answers /, /status and /status/full again while IKEv2 runs.
0.35.2
slawek2026-10-29 19:04:11 +01:00
46d3550eab
update: the router web service is split into the package vpnrouter_web, with one module per family of paths.
0.35.1
slawek2026-10-29 18:52:51 +01:00
3b14b7723e
feature: vre opens files from the Router Manager's shell in the editor of its Shell page.
0.35.0
slawek2026-10-29 18:10:58 +01:00
5303779559
feature: the web service shows and changes the settings of the metrics service at /metrics/settings, and OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.
0.34.0
slawek2026-10-28 22:31:27 +01:00
2dc4db440f
fix: OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.
0.33.4
slawek2026-10-28 22:00:37 +01:00
45cea95728
fix: vpn-router-setup runs on a new installation once libpq can be found.
0.33.3
slawek2026-10-28 21:41:52 +01:00
dd2dfaaf2b
fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.
0.33.2
slawek2026-10-27 08:46:36 +01:00
1697e1aa38
fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.
0.33.1
slawek2026-10-26 21:26:47 +01:00
57e8bbcffe
feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.
0.33.0
slawek2026-10-26 20:58:33 +01:00
9ca8fce14e
fix: a VPN user downloads the own OpenVPN client profile through /account, with the current password and code.
0.32.1
slawek2026-10-26 20:43:33 +01:00
74c24d7bc6
feature: the web service gives Apple VPN profiles that set up IKEv2 road-warrior access on macOS, iOS and iPadOS.
0.32.0
slawek2026-10-26 20:37:58 +01:00
770332728e
fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.
0.31.3
slawek2026-10-26 18:33:03 +01:00
e14bbe2ba1
fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.
0.31.2
slawek2026-10-26 16:53:42 +01:00
dabe4e8365
fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.
0.31.1
slawek2026-10-26 16:11:08 +01:00
ea8ca97417
feature: Caddy serves static web sites from folders on the router, defined in their own database, with files uploaded through the web service or WebDAV, and an optional PowerDNS name server answers for a zone of the sites.
0.31.0
slawek2026-10-26 15:27:28 +01:00
77bdbcb058
feature: the web service serves the last lines of the journal of the router's units and of the log files web.log_files lists, at /logs.
0.30.0
slawek2026-10-26 12:37:51 +01:00
cb33b3bfa1
feature: vpn-config-edit set and remove take --restart, which applies the change with vpn-router-setup and waits for it.
0.29.0
slawek2026-10-26 11:48:47 +01:00
81b7f4cac6
feature: bash completes the vpn-* commands, their options and the names they take.
0.28.0
slawek2026-10-26 11:35:46 +01:00
8cac21845a
feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.
0.27.0
slawek2026-10-26 11:15:12 +01:00
d1d565b1d9
fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.
0.26.2
slawek2026-10-26 09:11:13 +01:00
e675540ce2
fix: the package installs vpnrouter_passkeys, without which the web service and vpn-router-user do not start.
0.26.1
slawek2026-10-26 08:40:24 +01:00
90db6d46a2
feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.
0.26.0
slawek2026-10-26 08:35:10 +01:00
91cc64d6a6
fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.
0.25.4
slawek2026-10-26 07:56:23 +01:00
a1f314d8c1
fix: /config gives the state of caddy.service with the installed Caddy, for the Router Manager's Web page.
0.25.3
slawek2026-10-26 07:18:39 +01:00
7d8892b8c4
fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.
0.25.2
slawek2026-10-26 02:59:56 +01:00
4491377d9b
fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.
0.25.1
slawek2026-10-26 02:50:39 +01:00
f1d9c3bc36
feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.
0.25.0
slawek2026-10-26 02:33:58 +01:00
015fba50ca
fix: the status gives the number of connected OpenVPN clients at most 5 seconds old instead of up to a minute.
0.24.1
slawek2026-10-26 02:10:38 +01:00
9255d56276
feature: /remote-access of the web service shows and changes the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each runs, for the Router Manager's Remote access page.
0.24.0
slawek2026-10-26 00:57:22 +01:00
07dbe91d0c
fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.
0.23.2
slawek2026-10-26 00:43:55 +01:00
ec93bc6a2d
fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.
0.23.1
slawek2026-10-26 00:21:13 +01:00
2e1eb89f52
feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.
0.23.0
slawek2026-10-26 00:05:14 +01:00
1825e1efb1
fix: the status gives the number of site-to-site connections set up and established, not each connection by name.
0.22.1
slawek2026-10-25 23:44:05 +01:00
d648d294ec
feature: pki.extended_key_usages adds custom extended key usages by their OIDs, which templates give by name, and a template's policies put certificate policy OIDs into its certificates.
0.22.0
slawek2026-10-25 23:27:19 +01:00
a245ec26cd
fix: /status/full of the status web service gives an authenticated client the whole status, whatever web.status_content says.
0.21.5
slawek2026-10-25 23:16:18 +01:00
7404ee88c4
fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the directory each as itself, instead of failing on a CA with a CRL.
0.21.4
slawek2026-10-25 23:07:24 +01:00
448ce05b3a
fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.
0.21.3
slawek2026-10-25 23:03:03 +01:00
e11c88f0de
fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.
0.21.2
slawek2026-10-25 22:20:39 +01:00
c19b195ea0
fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.
0.21.1
slawek2026-10-25 22:12:13 +01:00
8d3469d10a
feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.
0.21.0
slawek2026-10-25 22:05:39 +01:00
fe45272f7c
feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.
0.20.0
slawek2026-10-25 20:18:00 +01:00
7d1f639508
update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.
0.19.1-3
slawek2026-10-25 19:08:24 +01:00
959ca0cd32
update: ADR-24 says that the Router Manager checks for updates on demand.
0.19.1-2
slawek2026-10-25 19:02:19 +01:00
1cef4c044f
fix: /metrics/history gives the availability of each site-to-site connection as the percentage of time it was up in slots of the view.
0.19.1
slawek2026-10-25 18:49:47 +01:00
25c151841b
feature: service accounts have a display name and a description, which the router sets for its internal ones.
0.19.0
slawek2026-10-25 18:34:59 +01:00
68ebd541b2
fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.
0.18.3
slawek2026-10-25 18:27:10 +01:00
f01be41191
fix: service accounts are managed at /service-accounts, not /users, and the internal one of the metrics service is only listed.
0.18.2
slawek2026-10-25 18:18:03 +01:00
d1970b77b7
fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.
0.18.1
slawek2026-10-25 18:00:25 +01:00
bf651da5a6
update: release.py tags a Debian revision other than 1 as x.y.z-n.
0.18.0-2
slawek2026-10-25 17:32:48 +01:00
4a5b15a559
feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.
0.18.0
slawek2026-10-25 17:14:23 +01:00
a79510a02f
feature: /config shows the router's PostgreSQL clusters and their settings, and /postgresql their databases with their sizes.
0.17.0
slawek2026-10-25 15:26:54 +01:00
38151bf5be
feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.
0.16.0
slawek2026-10-25 14:57:47 +01:00
83c1c50d8d
feature: vpn-config-edit shows and changes the router's configuration.
0.15.0
slawek2026-10-25 13:29:12 +01:00
dbc2046e24
feature: the status page shows the Client IP, and web.status_content sets how much it shows.
0.14.0
slawek2026-10-25 13:08:08 +01:00
45d73abe7b
feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.
0.13.0
slawek2026-10-25 12:25:57 +01:00
993a7a9fa9
fix: the web service listens on the internal address, the external address or both.
0.12.3
slawek2026-10-25 11:37:43 +01:00
581b53d447
fix: the web service manages users also when it started before setup.
0.12.2
slawek2026-10-24 21:32:00 +02:00
8782edff0f
fix: the status page shows whether the Router Manager runs.
0.12.1
slawek2026-10-24 12:50:49 +02:00
fe17e83b49
feature: every user manages their own account through /account.
0.12.0
slawek2026-10-24 12:44:49 +02:00
17331eea37
feature: the status page shows the Router Manager's version.
0.11.0
slawek2026-10-24 12:16:02 +02:00
af3127d1e8
feature: Manager-only accounts, and the Router Manager's first administrator.
0.10.0
slawek2026-10-24 11:56:58 +02:00
b1e6d9cd0b
fix: the web service starts once libpq can be found.
0.9.2
slawek2026-10-24 11:07:45 +02:00
732cc8cb54
fix: the web service waits for the PostgreSQL driver instead of failing at start.
0.9.1
slawek2026-10-24 10:43:51 +02:00
c0cd323a0c
feature: bootstrap diagnostics on port 17081 during the first setup.
0.9.0
slawek2026-10-24 10:07:22 +02:00
2e2bacee7d
feature: the web service creates its key and database itself and shows its starting phase.
0.8.0
slawek2026-10-24 09:07:28 +02:00
4f1aa282f6
fix: a failing user directory or token database no longer leaves the tunnels down.
0.7.1
slawek2026-10-24 08:55:25 +02:00
caf0e334f0
feature: users sign in to the web service, and only members of admins manage the router.
0.7.0
slawek2026-10-24 04:19:01 +02:00
791fc7fddd
feature: users can be enrolled for TOTP one-time passwords.
0.6.0
slawek2026-10-24 03:00:35 +02:00
f135d776f8
fix: package upgrades no longer ask the configuration questions.
0.5.9
slawek2026-10-24 02:16:19 +02:00
cda33fc4c7
fix: an upgrade keeps the configuration and asks nothing.
0.5.8
slawek2026-10-24 02:08:23 +02:00
08693f7e68
feature: users have a first name, a last name and an e-mail address.
0.5.7
slawek2026-10-24 01:47:50 +02:00
b9003bacb9
update: the status web service listens on port 7081 by default.
0.5.6
slawek2026-10-24 01:14:21 +02:00
0bf78b16b1
feature: users and their certificates no longer need a P2S system enabled.
0.5.5
slawek2026-10-24 00:00:44 +02:00
0ff74cc8c9
feature: the firewall lets the Router Manager in on the internal interface.
0.5.4
slawek2026-10-23 23:24:59 +02:00
a7b29e0655
fix: the status always shows the state of slapd.
0.5.3
slawek2026-10-23 22:59:17 +02:00
c8f54ca865
Add GCP deployment examples: create Terraform configurations for GCP, including network setup, instance definitions, and routing, along with a README for usage instructions.
slawek2026-08-27 21:23:47 +02:00
slawek