163 lines
8.4 KiB
Plaintext
163 lines
8.4 KiB
Plaintext
vpn-router (0.5.1-1) unstable; urgency=medium
|
|
|
|
fix: the web service works in every state of the router.
|
|
|
|
* vpn-router-web works whether /etc/vpn-router/pki and
|
|
/etc/swanctl/x509crl exist or not; they exist only while OpenVPN or
|
|
road-warrior access is configured. The paths the unit may write are
|
|
used when they exist and ignored when they do not.
|
|
* vpn-router-web starts on its own and keeps running. Every 30 seconds a
|
|
discovery thread works out the internal address from vpn-router.json as
|
|
general.mode directs, with web.port and web.enabled, and starts, moves
|
|
or stops the server thread to match. Each request reads the token
|
|
secret, the features and the facts it shows. The service is no longer
|
|
ordered after vpn-router-setup, which no longer restarts it, and
|
|
web.json no longer holds the address, the port or the secret.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 10:00:00 +0200
|
|
|
|
vpn-router (0.5.0-1) unstable; urgency=medium
|
|
|
|
* OpenVPN P2S access, set in the openvpn section (enabled, address_pool,
|
|
port, protocol). Clients need a certificate of the router CA and the
|
|
password of the user named in it; the password is checked against a
|
|
local LDAP directory by openvpn-auth-ldap.
|
|
* The users live in the package's own slapd database, dc=vpn-router,
|
|
dc=local, which vpn-router-setup provisions while OpenVPN or road-warrior
|
|
access is configured. slapd listens on its local socket only. Passwords
|
|
are stored as ARGON2 hashes, and a disabled user is locked with the
|
|
password policy.
|
|
* vpn-router-user lists, adds, disables, enables and removes users, sets
|
|
passwords and gives OpenVPN client profiles. Adding a user also issues
|
|
the user's client certificate; removing one revokes it.
|
|
* The web service manages users under /users, with the same token as
|
|
/config, and /status shows the OpenVPN clients.
|
|
* The CA gets a certificate revocation list when it is created, and an
|
|
existing CA without one gets one.
|
|
* Purging the package removes the firewall rules of the web service, which
|
|
it left behind before.
|
|
* The status page follows the browser's light or dark colour scheme,
|
|
uses a proportional font and reloads itself every minute.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 23:00:00 +0200
|
|
|
|
vpn-router (0.4.3-1) unstable; urgency=medium
|
|
|
|
* swanctl output with more closing than opening lines is read as not
|
|
available instead of failing the request.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 22:00:00 +0200
|
|
|
|
vpn-router (0.4.2-1) unstable; urgency=medium
|
|
|
|
* /config gives the IPsec connections and SAs as objects, read from
|
|
swanctl --pretty, and the routes as objects from ip -j, instead of
|
|
lines of text. The site-to-site and road-warrior state of /status is
|
|
counted from the same swanctl objects.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 21:30:00 +0200
|
|
|
|
vpn-router (0.4.1-1) unstable; urgency=medium
|
|
|
|
* Fix the start of vpn-router-setup hanging on a host that runs Docker.
|
|
vpn-router-setup restarted vpn-router-docker and waited for it, but that
|
|
unit was ordered after vpn-router-setup, so each waited for the other,
|
|
the installation of the package never finished and vpn-router-web was
|
|
never enabled or started. vpn-router-docker is no longer ordered after
|
|
vpn-router-setup, so vpn-router-setup still waits for it and the Docker
|
|
rules are in place when it ends. The restart of vpn-router-web is queued
|
|
without waiting.
|
|
* Start vpn-router-setup after docker.service, so that Docker is up when
|
|
the setup looks for it and does not start in parallel with it. The
|
|
ordering applies only when Docker is installed.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 20:10:00 +0200
|
|
|
|
vpn-router (0.4.0-1) unstable; urgency=medium
|
|
|
|
* Add the vpn-router-web service, a small status web service that uses only
|
|
the Python standard library. It listens on the internal address and on
|
|
web.port, 8080 by default. / shows the state of the router for people,
|
|
as plain text for curl and wget and as a Tailwind CSS page for a
|
|
browser, and /status shows the same as JSON: the state of the services,
|
|
the package version, whether Docker is installed, and the state of
|
|
site-to-site, road-warrior and WireGuard, with no configuration data.
|
|
* Add the web configuration section. web.enabled (true by default) and
|
|
web.port. vpn-router-setup opens the port on the internal interface in
|
|
UFW and restarts the service.
|
|
* Add /config to the status web service, for a client such as manage-ui. It
|
|
shows the configuration with its secrets masked, the interfaces,
|
|
addresses, identities and routes the router resolved, the IPsec
|
|
connections and SAs, the WireGuard peers (no keys) and the Docker rules.
|
|
It needs a JWT signed with HS256 by web.jwt_secret, with an exp claim
|
|
within ten minutes, and is not served while web.jwt_secret is not set.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 19:00:00 +0200
|
|
|
|
vpn-router (0.3.2-1) unstable; urgency=medium
|
|
|
|
* Accept an IPv4 or IPv6 address as remote.id and as wan.local_fqdn. The
|
|
identities are written to the strongSwan configuration as given, without
|
|
an @ added, and strongSwan reads an address as an IP identity and a name
|
|
as an FQDN. A value that starts with @ is refused with an error, since
|
|
strongSwan 5.0 and later need no @ to avoid resolving a name.
|
|
Road-warrior access still needs a name in wan.local_fqdn.
|
|
* Depend on strongswan-swanctl and charon-systemd 5.0 or later.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 18:00:00 +0200
|
|
|
|
vpn-router (0.3.1-1) unstable; urgency=medium
|
|
|
|
* Ignore virtual interfaces when mode auto looks for the internal
|
|
interface. The Docker bridge docker0, which has an address, was counted
|
|
as a second internal interface, so vpn-router-setup and
|
|
vpn-router-docker failed on a host with Docker installed.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 13:44:00 +0200
|
|
|
|
vpn-router (0.3.0-1) unstable; urgency=medium
|
|
|
|
* Secure the ports Docker publishes. Rules in a chain of their own,
|
|
VPN-ROUTER-DOCKER, entered by a jump at the top of DOCKER-USER, accept
|
|
IPsec protected traffic, TCP to docker.exposed_ports and established
|
|
connections from the external interface and drop the rest of it. Other
|
|
rules in DOCKER-USER are left alone. The rules cover IPv4 only.
|
|
* Add the docker configuration section. docker.mode is auto (the default,
|
|
secures Docker when docker.service is installed), on (requires Docker) or
|
|
off (removes the rules); docker.exposed_ports lists the TCP ports and port
|
|
ranges reachable from the external interface, none by default.
|
|
* Add the vpn-router-docker service, which applies the Docker rules after
|
|
docker.service starts and removes them when it stops. vpn-router-setup
|
|
restarts it while Docker runs, so a changed configuration takes effect.
|
|
* Installing Docker before this package is recommended. When Docker is
|
|
installed later, restart vpn-router-setup to apply the rules.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 12:44:45 +0200
|
|
|
|
vpn-router (0.2.0-1) unstable; urgency=medium
|
|
|
|
* Change the configuration file to JSON, /etc/vpn-router/vpn-router.json.
|
|
Lists are arrays, booleans and the WireGuard listen port are native JSON
|
|
types, and unknown sections, unknown settings and wrong value types are
|
|
rejected.
|
|
* Replace remote.psk_b64 with remote.psk, holding the pre-shared key as a
|
|
plain string. remote.psk_file still takes precedence.
|
|
* Ship /usr/share/doc/vpn-router/vpn-router.json.example in place of
|
|
vpn-router.conf.example.
|
|
* Add platform "none" as the default, so installing the package changes
|
|
nothing on the machine until a platform is chosen.
|
|
* Add the mode setting (manual, interfaces, auto) controlling how much of
|
|
the network configuration is supplied and how much is read from the
|
|
system.
|
|
* Manage the configuration file with ucf, so dpkg-reconfigure reapplies
|
|
debconf answers without overwriting local edits.
|
|
* Apply NAT and forward rules to every local subnet, not only the first.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 08:00:06 +0200
|
|
|
|
vpn-router (0.1.0-1) unstable; urgency=medium
|
|
|
|
* Initial release.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Tue, 26 May 2026 00:00:00 +0200
|