255 lines
12 KiB
Plaintext
255 lines
12 KiB
Plaintext
vpn-router (0.5.8-1) unstable; urgency=medium
|
|
|
|
fix: an upgrade keeps the configuration and asks nothing.
|
|
|
|
* postinst passes on only the debconf answers that were given. The
|
|
defaults of questions never asked, such as platform none, no longer
|
|
replace settings of vpn-router.json.
|
|
* Without an answer that changes it, the configuration ucf is given is
|
|
vpn-router.json byte for byte, so an upgrade has no conflict to ask
|
|
about; settings the file leaves out keep their defaults when it is read.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 20:00:00 +0200
|
|
|
|
vpn-router (0.5.7-1) unstable; urgency=medium
|
|
|
|
feature: users have a first name, a last name and an e-mail address.
|
|
|
|
* vpn-router-user add needs --first-name, --last-name and --email, kept as
|
|
givenName, sn and mail, with cn set to the first and the last name.
|
|
vpn-router-user update changes them, and list and every answer show
|
|
them as first_name, last_name and email.
|
|
* POST /users needs first_name, last_name and email, and PUT
|
|
/users/<name> changes them.
|
|
* vpn-router-user answers in text: a table of the users, the client
|
|
profile or a short message, with failures on standard error. --json
|
|
gives the JSON answers. -h and --help show the commands and their
|
|
options.
|
|
* The web service manages users with vpnrouter_users, the module
|
|
vpn-router-user uses, instead of running vpn-router-user for each
|
|
request.
|
|
* Groups of users, kept as groupOfNames entries in ou=groups with a
|
|
description and at least one member. vpn-router-group lists, adds,
|
|
renames, describes and removes them and adds and takes out members, and
|
|
the web service serves the same under /groups. Removing a user takes it
|
|
out of its groups and is refused while it is the last member of one.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 19:00:00 +0200
|
|
|
|
vpn-router (0.5.6-1) unstable; urgency=medium
|
|
|
|
update: the status web service listens on port 7081 by default.
|
|
|
|
* web.port defaults to 7081.
|
|
* vpn-router-setup opens the Router Manager's port, 7080 by default, on
|
|
the internal interface.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 18:00:00 +0200
|
|
|
|
vpn-router (0.5.5-1) unstable; urgency=medium
|
|
|
|
feature: users and their certificates no longer need a P2S system enabled.
|
|
|
|
* vpn-router-setup provisions the user directory, the CA and its CRL once
|
|
a platform is chosen, whether or not OpenVPN or road-warrior access is
|
|
enabled. The server certificate is issued once wan.local_fqdn is set,
|
|
also for an existing CA that has none.
|
|
* /users and vpn-router-user manage users and issue and revoke their
|
|
certificates without a P2S system; only the OpenVPN client profile
|
|
needs OpenVPN.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 16:00:00 +0200
|
|
|
|
vpn-router (0.5.4-1) unstable; urgency=medium
|
|
|
|
feature: the firewall lets the Router Manager in on the internal interface.
|
|
|
|
* While vpn-router-manager is installed, vpn-router-setup opens its port,
|
|
port in /etc/vpn-router-manager/manager.json or 8090, on the internal
|
|
interface. Purging the package removes the rule.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 13:00:00 +0200
|
|
|
|
vpn-router (0.5.3-1) unstable; urgency=medium
|
|
|
|
fix: the status always shows the state of slapd.
|
|
|
|
* /status and the status page show the state of slapd whether or not
|
|
OpenVPN or road-warrior access is configured, since the package always
|
|
runs it.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 12:00:00 +0200
|
|
|
|
vpn-router (0.5.2-1) unstable; urgency=medium
|
|
|
|
fix: /config no longer shows secret options.
|
|
|
|
* The configuration shown by /config leaves out the secret options (psk,
|
|
jwt_secret, and options named like a password, token or key) instead of
|
|
showing them masked.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 11:00:00 +0200
|
|
|
|
vpn-router (0.5.1-1) unstable; urgency=medium
|
|
|
|
fix: the web service works in every state of the router.
|
|
|
|
* vpn-router-web works whether /etc/vpn-router/pki and
|
|
/etc/swanctl/x509crl exist or not; they exist only while OpenVPN or
|
|
road-warrior access is configured. The paths the unit may write are
|
|
used when they exist and ignored when they do not.
|
|
* vpn-router-web starts on its own and keeps running. Every 30 seconds a
|
|
discovery thread works out the internal address from vpn-router.json as
|
|
general.mode directs, with web.port and web.enabled, and starts, moves
|
|
or stops the server thread to match. Each request reads the token
|
|
secret, the features and the facts it shows. The service is no longer
|
|
ordered after vpn-router-setup, which no longer restarts it, and
|
|
web.json no longer holds the address, the port or the secret.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Sat, 24 Oct 2026 10:00:00 +0200
|
|
|
|
vpn-router (0.5.0-1) unstable; urgency=medium
|
|
|
|
* OpenVPN P2S access, set in the openvpn section (enabled, address_pool,
|
|
port, protocol). Clients need a certificate of the router CA and the
|
|
password of the user named in it; the password is checked against a
|
|
local LDAP directory by openvpn-auth-ldap.
|
|
* The users live in the package's own slapd database, dc=vpn-router,
|
|
dc=local, which vpn-router-setup provisions while OpenVPN or road-warrior
|
|
access is configured. slapd listens on its local socket only. Passwords
|
|
are stored as ARGON2 hashes, and a disabled user is locked with the
|
|
password policy.
|
|
* vpn-router-user lists, adds, disables, enables and removes users, sets
|
|
passwords and gives OpenVPN client profiles. Adding a user also issues
|
|
the user's client certificate; removing one revokes it.
|
|
* The web service manages users under /users, with the same token as
|
|
/config, and /status shows the OpenVPN clients.
|
|
* The CA gets a certificate revocation list when it is created, and an
|
|
existing CA without one gets one.
|
|
* Purging the package removes the firewall rules of the web service, which
|
|
it left behind before.
|
|
* The status page follows the browser's light or dark colour scheme,
|
|
uses a proportional font and reloads itself every minute.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 23:00:00 +0200
|
|
|
|
vpn-router (0.4.3-1) unstable; urgency=medium
|
|
|
|
* swanctl output with more closing than opening lines is read as not
|
|
available instead of failing the request.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 22:00:00 +0200
|
|
|
|
vpn-router (0.4.2-1) unstable; urgency=medium
|
|
|
|
* /config gives the IPsec connections and SAs as objects, read from
|
|
swanctl --pretty, and the routes as objects from ip -j, instead of
|
|
lines of text. The site-to-site and road-warrior state of /status is
|
|
counted from the same swanctl objects.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 21:30:00 +0200
|
|
|
|
vpn-router (0.4.1-1) unstable; urgency=medium
|
|
|
|
* Fix the start of vpn-router-setup hanging on a host that runs Docker.
|
|
vpn-router-setup restarted vpn-router-docker and waited for it, but that
|
|
unit was ordered after vpn-router-setup, so each waited for the other,
|
|
the installation of the package never finished and vpn-router-web was
|
|
never enabled or started. vpn-router-docker is no longer ordered after
|
|
vpn-router-setup, so vpn-router-setup still waits for it and the Docker
|
|
rules are in place when it ends. The restart of vpn-router-web is queued
|
|
without waiting.
|
|
* Start vpn-router-setup after docker.service, so that Docker is up when
|
|
the setup looks for it and does not start in parallel with it. The
|
|
ordering applies only when Docker is installed.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 20:10:00 +0200
|
|
|
|
vpn-router (0.4.0-1) unstable; urgency=medium
|
|
|
|
* Add the vpn-router-web service, a small status web service that uses only
|
|
the Python standard library. It listens on the internal address and on
|
|
web.port, 8080 by default. / shows the state of the router for people,
|
|
as plain text for curl and wget and as a Tailwind CSS page for a
|
|
browser, and /status shows the same as JSON: the state of the services,
|
|
the package version, whether Docker is installed, and the state of
|
|
site-to-site, road-warrior and WireGuard, with no configuration data.
|
|
* Add the web configuration section. web.enabled (true by default) and
|
|
web.port. vpn-router-setup opens the port on the internal interface in
|
|
UFW and restarts the service.
|
|
* Add /config to the status web service, for a client such as manage-ui. It
|
|
shows the configuration with its secrets masked, the interfaces,
|
|
addresses, identities and routes the router resolved, the IPsec
|
|
connections and SAs, the WireGuard peers (no keys) and the Docker rules.
|
|
It needs a JWT signed with HS256 by web.jwt_secret, with an exp claim
|
|
within ten minutes, and is not served while web.jwt_secret is not set.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 19:00:00 +0200
|
|
|
|
vpn-router (0.3.2-1) unstable; urgency=medium
|
|
|
|
* Accept an IPv4 or IPv6 address as remote.id and as wan.local_fqdn. The
|
|
identities are written to the strongSwan configuration as given, without
|
|
an @ added, and strongSwan reads an address as an IP identity and a name
|
|
as an FQDN. A value that starts with @ is refused with an error, since
|
|
strongSwan 5.0 and later need no @ to avoid resolving a name.
|
|
Road-warrior access still needs a name in wan.local_fqdn.
|
|
* Depend on strongswan-swanctl and charon-systemd 5.0 or later.
|
|
|
|
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 18:00:00 +0200
|
|
|
|
vpn-router (0.3.1-1) unstable; urgency=medium
|
|
|
|
* Ignore virtual interfaces when mode auto looks for the internal
|
|
interface. The Docker bridge docker0, which has an address, was counted
|
|
as a second internal interface, so vpn-router-setup and
|
|
vpn-router-docker failed on a host with Docker installed.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 13:44:00 +0200
|
|
|
|
vpn-router (0.3.0-1) unstable; urgency=medium
|
|
|
|
* Secure the ports Docker publishes. Rules in a chain of their own,
|
|
VPN-ROUTER-DOCKER, entered by a jump at the top of DOCKER-USER, accept
|
|
IPsec protected traffic, TCP to docker.exposed_ports and established
|
|
connections from the external interface and drop the rest of it. Other
|
|
rules in DOCKER-USER are left alone. The rules cover IPv4 only.
|
|
* Add the docker configuration section. docker.mode is auto (the default,
|
|
secures Docker when docker.service is installed), on (requires Docker) or
|
|
off (removes the rules); docker.exposed_ports lists the TCP ports and port
|
|
ranges reachable from the external interface, none by default.
|
|
* Add the vpn-router-docker service, which applies the Docker rules after
|
|
docker.service starts and removes them when it stops. vpn-router-setup
|
|
restarts it while Docker runs, so a changed configuration takes effect.
|
|
* Installing Docker before this package is recommended. When Docker is
|
|
installed later, restart vpn-router-setup to apply the rules.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 12:44:45 +0200
|
|
|
|
vpn-router (0.2.0-1) unstable; urgency=medium
|
|
|
|
* Change the configuration file to JSON, /etc/vpn-router/vpn-router.json.
|
|
Lists are arrays, booleans and the WireGuard listen port are native JSON
|
|
types, and unknown sections, unknown settings and wrong value types are
|
|
rejected.
|
|
* Replace remote.psk_b64 with remote.psk, holding the pre-shared key as a
|
|
plain string. remote.psk_file still takes precedence.
|
|
* Ship /usr/share/doc/vpn-router/vpn-router.json.example in place of
|
|
vpn-router.conf.example.
|
|
* Add platform "none" as the default, so installing the package changes
|
|
nothing on the machine until a platform is chosen.
|
|
* Add the mode setting (manual, interfaces, auto) controlling how much of
|
|
the network configuration is supplied and how much is read from the
|
|
system.
|
|
* Manage the configuration file with ucf, so dpkg-reconfigure reapplies
|
|
debconf answers without overwriting local edits.
|
|
* Apply NAT and forward rules to every local subnet, not only the first.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Fri, 23 Oct 2026 08:00:06 +0200
|
|
|
|
vpn-router (0.1.0-1) unstable; urgency=medium
|
|
|
|
* Initial release.
|
|
|
|
-- Sławomir Koszewski <slawek@koszewscy.waw.pl> Tue, 26 May 2026 00:00:00 +0200
|