vyos-1x.git/src/conf_mode/pki.py, branch rolling

pki: T8994: add graceful error handling in case certbot fails

2026-06-18T14:07:54+00:00

If ACME and certbot are used for PKI and e.g. haproxy it can become an issue if certbot is blocked by the firewall. The renewal service will fail and tear-down the production service - even if the certificate is yet not expired. The production service was not restarted. This has been changed as every service which is stopped prior to the renew is later restarted even upon failure of renewing said certificate.

T8410: Fix typos and mistakes for operational and configuration commands

2026-03-24T17:02:56+00:00

Fix typos and mistakes in the commands and comments No functional changes

pki: T7976: calls to node_changed_presence() must use unmangled config paths

2025-11-02T09:22:15+00:00

We do use mangled config paths where pki = conf.get_config_dict(base, key_mangling=('-', '_'), ... returns a config dict where "-" is replaced by "_" when assembling the config dict keys. This does not work when we throw the retrieved path into ConfigDiff().node_changed_presence() https://github.com/vyos/vyos-1x/blob/07936657062c/src/conf_mode/pki.py#L259-L265 Add orig_path key which is preferred over path.

pki: T7953: implement certbot_renew() function to have everything at one place

2025-10-29T19:18:41+00:00

pki: T7953: reword inline comments

2025-10-26T15:26:38+00:00

pki: T7953: certbot_request() should return None

2025-10-26T15:25:12+00:00

pki: T7953: use dict_set_nested() over manually assembly of dict data

2025-10-26T15:08:18+00:00

pki: T7885: add openconnect to the list of used_by services

2025-10-02T21:46:51+00:00

pki: T7885: check_port_availability() can't be used during system boot

2025-10-02T21:39:35+00:00

A call to check_port_availability() will always fail during system boot when listen_address is set and the address is not yet assigned to an interface. This happens b/c PKI subsystem is called prior to any inteface - e.g. ethernet - and thus the OS will always be unable to bind() a socket() to a non existing IP address.

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice