104 lines
5.5 KiB
Plaintext
104 lines
5.5 KiB
Plaintext
vpn-router (0.4.1-1) unstable; urgency=medium
|
|
|
|
* Fix the start of vpn-router-setup hanging on a host that runs Docker.
|
|
vpn-router-setup restarted vpn-router-docker and waited for it, but that
|
|
unit was ordered after vpn-router-setup, so each waited for the other,
|
|
the installation of the package never finished and vpn-router-web was
|
|
never enabled or started. vpn-router-docker is no longer ordered after
|
|
vpn-router-setup, so vpn-router-setup still waits for it and the Docker
|
|
rules are in place when it ends. The restart of vpn-router-web is queued
|
|
without waiting.
|
|
* Start vpn-router-setup after docker.service, so that Docker is up when
|
|
the setup looks for it and does not start in parallel with it. The
|
|
ordering applies only when Docker is installed.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 20:10:00 +0200
|
|
|
|
vpn-router (0.4.0-1) unstable; urgency=medium
|
|
|
|
* Add the vpn-router-web service, a small status web service that uses only
|
|
the Python standard library. It listens on the internal address and on
|
|
web.port, 8080 by default. / shows the state of the router for people,
|
|
as plain text for curl and wget and as a Tailwind CSS page for a
|
|
browser, and /status shows the same as JSON: the state of the services,
|
|
the package version, whether Docker is installed, and the state of
|
|
site-to-site, road-warrior and WireGuard, with no configuration data.
|
|
* Add the web configuration section. web.enabled (true by default) and
|
|
web.port. vpn-router-setup opens the port on the internal interface in
|
|
UFW and restarts the service.
|
|
* Add /config to the status web service, for a client such as manage-ui. It
|
|
shows the configuration with its secrets masked, the interfaces,
|
|
addresses, identities and routes the router resolved, the IPsec
|
|
connections and SAs, the WireGuard peers (no keys) and the Docker rules.
|
|
It needs a JWT signed with HS256 by web.jwt_secret, with an exp claim
|
|
within ten minutes, and is not served while web.jwt_secret is not set.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 19:00:00 +0200
|
|
|
|
vpn-router (0.3.2-1) unstable; urgency=medium
|
|
|
|
* Accept an IPv4 or IPv6 address as remote.id and as wan.local_fqdn. The
|
|
identities are written to the strongSwan configuration as given, without
|
|
an @ added, and strongSwan reads an address as an IP identity and a name
|
|
as an FQDN. A value that starts with @ is refused with an error, since
|
|
strongSwan 5.0 and later need no @ to avoid resolving a name.
|
|
Road-warrior access still needs a name in wan.local_fqdn.
|
|
* Depend on strongswan-swanctl and charon-systemd 5.0 or later.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 18:00:00 +0200
|
|
|
|
vpn-router (0.3.1-1) unstable; urgency=medium
|
|
|
|
* Ignore virtual interfaces when mode auto looks for the internal
|
|
interface. The Docker bridge docker0, which has an address, was counted
|
|
as a second internal interface, so vpn-router-setup and
|
|
vpn-router-docker failed on a host with Docker installed.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 13:44:00 +0200
|
|
|
|
vpn-router (0.3.0-1) unstable; urgency=medium
|
|
|
|
* Secure the ports Docker publishes. Rules in a chain of their own,
|
|
VPN-ROUTER-DOCKER, entered by a jump at the top of DOCKER-USER, accept
|
|
IPsec protected traffic, TCP to docker.exposed_ports and established
|
|
connections from the external interface and drop the rest of it. Other
|
|
rules in DOCKER-USER are left alone. The rules cover IPv4 only.
|
|
* Add the docker configuration section. docker.mode is auto (the default,
|
|
secures Docker when docker.service is installed), on (requires Docker) or
|
|
off (removes the rules); docker.exposed_ports lists the TCP ports and port
|
|
ranges reachable from the external interface, none by default.
|
|
* Add the vpn-router-docker service, which applies the Docker rules after
|
|
docker.service starts and removes them when it stops. vpn-router-setup
|
|
restarts it while Docker runs, so a changed configuration takes effect.
|
|
* Installing Docker before this package is recommended. When Docker is
|
|
installed later, restart vpn-router-setup to apply the rules.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 12:44:45 +0200
|
|
|
|
vpn-router (0.2.0-1) unstable; urgency=medium
|
|
|
|
* Change the configuration file to JSON, /etc/vpn-router/vpn-router.json.
|
|
Lists are arrays, booleans and the WireGuard listen port are native JSON
|
|
types, and unknown sections, unknown settings and wrong value types are
|
|
rejected.
|
|
* Replace remote.psk_b64 with remote.psk, holding the pre-shared key as a
|
|
plain string. remote.psk_file still takes precedence.
|
|
* Ship /usr/share/doc/vpn-router/vpn-router.json.example in place of
|
|
vpn-router.conf.example.
|
|
* Add platform "none" as the default, so installing the package changes
|
|
nothing on the machine until a platform is chosen.
|
|
* Add the mode setting (manual, interfaces, auto) controlling how much of
|
|
the network configuration is supplied and how much is read from the
|
|
system.
|
|
* Manage the configuration file with ucf, so dpkg-reconfigure reapplies
|
|
debconf answers without overwriting local edits.
|
|
* Apply NAT and forward rules to every local subnet, not only the first.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 08:00:06 +0200
|
|
|
|
vpn-router (0.1.0-1) unstable; urgency=medium
|
|
|
|
* Initial release.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Tue, 26 May 2026 00:00:00 +0200
|