Source: vpn-router
Section: net
Priority: optional
Maintainer: Sławomir Koszewski <slawek@koszewscy.waw.pl>
Build-Depends: debhelper-compat (= 13)
Standards-Version: 4.6.2
Rules-Requires-Root: no

Package: vpn-router
Architecture: all
Depends: ${misc:Depends},
         strongswan-swanctl (>= 5.0),
         charon-systemd (>= 5.0),
         libstrongswan-extra-plugins,
         libcharon-extra-plugins,
         wireguard-tools,
         ufw,
         debconf,
         ucf,
         python3,
         python3-cryptography,
         python3-jinja2,
         python3-ldap,
         python3-pyotp,
         python3-fido2,
         python3-psycopg,
         python3-psutil,
         python3-prometheus-client,
         postgresql,
         slapd,
         nslcd,
         libnss-ldapd,
         libpam-ldapd,
         sudo,
         openvpn,
         openvpn-auth-ldap,
         iproute2,
         systemd-resolved,
         zstd
Suggests: caddy,
          rclone,
          proxmox-backup-client-static
Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
 Configures a Linux host or virtual machine as a VPN router: site-to-site
 IKEv2 IPSec (strongSwan swanctl) with pre-shared keys or certificates,
 optional road-warrior access using EAP-TLS, optional OpenVPN with a
 certificate and a password per user, kept in a local LDAP directory, optional
 WireGuard, and the routing, NAT, MSS clamping and firewall rules a router
 needs. Its two-level CA, whose root may be kept offline, has issuing CAs for
 the VPN clients, for site-to-site and for general use, and publishes their
 certificates and CRLs. Caddy, installed by the package from the Ubuntu
 archive or from Caddy's repository, serves HTTPS. It keeps metrics of the
 router in PostgreSQL and serves them for an OpenTelemetry Collector, and
 makes scheduled backups to a local folder, copied to the cloud with rclone,
 or to a Proxmox Backup Server. Nothing in the package is specific to a cloud
 provider.
 .
 Settings live in /etc/vpn-router/vpn-router.json, which is created on first
 install and owned by the administrator afterwards. Editing it and restarting
 vpn-router-setup applies the change; the same service reconciles the system
 at every boot. It is built on two inputs, the external and internal interface
 names; the addresses on them are read from the system rather than configured
 again, and nothing is auto-detected.
 .
 Platform-specific additions are provided by modules under
 /usr/lib/vpn-router, selected explicitly by the platform setting. Modules for
 Azure and GCP are included.