vyos-1x.git/data/templates/https/nginx.default.j2, branch T9338-l3vpn-multi-domain-switchingVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=T9338-l3vpn-multi-domain-switching2026-09-11T21:22:16+00:00https: T8989: fix X-Client-Verify header passthrough auth bypass2026-09-11T21:22:16+00:00omnom62omnom62@outlook.com2026-09-11T21:22:16+00:00urn:sha1:fa46c294c8239534472a140293125864c0ea857d
Always set proxy_set_header X-Client-Verify unconditionally so a
client-supplied X-Client-Verify: SUCCESS header cannot bypass mTLS
authentication when mTLS is not configured.
When mTLS is disabled, nginx sets X-Client-Verify to empty string
which correctly fails the == 'SUCCESS' check in auth_required.
Fixes: GHSA-4w7q-wwx4-6973
http-api: T8989: translate to correct term in nginx directive2026-09-02T02:06:13+00:00John Estabrookjestabro@vyos.io2026-09-02T02:06:13+00:00urn:sha1:99decdac737629507b88c4d0390344a981a181abhttp-api: T8989: address further review comments2026-08-26T18:33:34+00:00omnom62omnom62@outlook.com2026-08-12T05:22:05+00:00urn:sha1:1832b2bb3e9948f8bf6dfb3be50fd10363bc3a38
- Scope mTLS CA chain to selected CA only (not all configured CAs)
- Pass verify-client value to nginx template instead of hardcoding optional
- Allow mTLS-only REST configuration without API keys
- Add mTLS warning when no API keys are configured
http-api: T8989: linter fixes2026-08-26T18:33:34+00:00omnom62omnom62@outlook.com2026-08-11T07:01:58+00:00urn:sha1:c489a19e454a9be5438fc16e26e62407a0d64f49http-api: T8989: add mTLS client certificate authentication2026-08-26T18:33:34+00:00omnom62omnom62@outlook.com2026-08-11T06:45:15+00:00urn:sha1:0cdf7e696b4deb3c3103a596bfe4d4f167dcf4b7
Add support for mutual TLS (mTLS) authentication to the VyOS REST API.
When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.
Configuration:
set service https certificates ca-certificate <name>
set service https certificates verify-client <optional|required>
Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
http-api: T8989: add REST Bearer token authentication2026-08-26T18:33:34+00:00omnom62omnom62@outlook.com2026-08-04T23:14:32+00:00urn:sha1:f3012e652edef614d4f0ed169b320106a85d83b3
Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.
- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
existing key/X-API-Key auth
- New config nodes: service https api rest authentication
{expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
since GraphQL may not be enabled on all deployments and the two
subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
to the rest node, not just graphql, so REST authentication
defaults populate correctly on commit
http-api: T9224: add ping endpoint to REST API2026-08-18T12:53:52+00:00Jonathan Vossjvoss@onvox.net2026-08-17T04:50:22+00:00urn:sha1:ea65e1d24bf9327edd2244a81e9c307f3001b16fT6734: Nginx disable software version reporting2026-01-27T22:02:49+00:00Viacheslav Hletenkov.gletenko@vyos.io2026-01-27T22:02:49+00:00urn:sha1:8fcaa97be4d7532a9efc61e52672d09f1c12be02T7395: Add support for renew in REST Server2025-05-28T14:42:26+00:00IDerribrahim@derraz.fr2025-05-28T14:42:26+00:00urn:sha1:7b3ce52e3babdf3a17910ce5322e571d5c91bb38T4406: Add public API endpoint to display information2025-03-06T12:46:40+00:00oniko94onikolaiev94@outlook.com2025-03-05T17:37:07+00:00urn:sha1:9fe7d85f78e967c251b3437a90e1a5f01dab1868