vyos-documentation.git/docs/configexamples, branch mergify/bp/circinus/pr-2136

docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks (#2136)

2026-07-10T15:35:14+00:00

* docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks In DMVPN the mGRE tunnel and the IPSec protecting it are handled independently, so GRE can be forwarded while no IPSec SA is active for a peer (e.g. while an SA is still being negotiated or after one expires), allowing unencrypted GRE to leave the router. This is inherent to combining GRE with IPSec and is common to DMVPN implementations in general. Add a "Protecting against unencrypted traffic leaks" section to the DMVPN reference page explaining the behaviour and recommending an output filter rule that drops GRE not matched by an outbound IPSec policy (ipsec match-none-out). Note that this disables unencrypted GRE on the node entirely, so coexisting plain GRE tunnels would stop working. Apply the same rule in the Dual HUB Dual Cloud example on the VyOS nodes. Co-authored-by: Daniil Baturin * docs(DMVPN): reflow DMVPN documentation for line length compliance Reformat the DMVPN guide and dual-hub dual-cloud example to wrap long lines and improve readability without changing the documented behavior or configuration guidance. --------- Co-authored-by: Daniil Baturin (cherry picked from commit 50acf8f188475b0554b99a739cb8ada12d51e77b)

configexamples/inter-vrf-routing-vrf-lite: fix formatting (#2112)

2026-06-23T10:26:54+00:00

* configexamples/inter-vrf-routing-vrf-lite: fix formatting * configexamples/inter-vrf-routing-vrf-lite: reformat text to limit line length

chore: remove RST swap mechanism, archive rst-*.rst under docs/_rst_legacy/

2026-05-10T14:23:58+00:00

The swap mechanism (RST-as-fallback for migrated MD pages) is dormant — docs/_rst_overrides.txt has been empty since the MyST flip trio (#1899/#1900/#1901) landed. The mechanism's surface area is dead weight and the rst-*.rst shadows scattered across the source tree cause Context7's parser to misclassify the project as RST. Sibling PR on rolling: yuriy/remove-rst-swap-mechanism Changes: - Move 253 rst-*.rst shadow files into docs/_rst_legacy/ preserving subdirectory structure. They remain in the repo for reference; Sphinx excludes the folder via exclude_patterns. - Strip swap_sources.py invocation from docs/Makefile. - Strip jobs: pre_build/post_build block from .readthedocs.yml. - Strip rst-*.rst exclude entry and the _md_exclude.txt loader from docs/conf.py; replace with a single _rst_legacy exclude. - Delete scripts/swap_sources.py, tests/test_swap_sources.py, docs/_rst_overrides.txt. - Update AGENTS.md: drop the "RST override mechanism" section and the test-runner snippet for the deleted test. Verified: sphinx-build -b html with --keep-going produces identical warning set (68 unique), identical sitemap entry count (267), identical llms.txt entry count (22), zero rst-* URLs in any artifact. 🤖 Generated by [robots](https://vyos.io)

feat: flip swap mechanism on circinus — MD as primary, RST as override

2026-05-06T18:08:17+00:00

Mirror of #1899 for circinus. Same logic, same scripts, per-branch file set. Changes: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 253 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 253 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty - conf.py exclude_patterns flipped: rst-*.rst excluded by default - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt - scripts/swap_sources.py rewritten with inverted rename direction (rst-.rst → .rst when applying overrides; .md excluded via _md_exclude.txt) - scripts/import_myst.py and tests/test_import_myst.py deleted (obsolete) - tests/test_swap_sources.py rewritten for new semantics Identical change set to #1899 (current). Per-branch differences: - circinus has 253 stems vs current's 254 (suricata is current-only) - otherwise the script/conf.py/test changes are byte-identical with current Generated by robots https://vyos.io

feat: import MyST swap mechanism, llms.txt feature, and content from current

2026-05-06T14:47:58+00:00

Replaces the broken #1885/#1869/#1875 trio with a single PR for circinus. This PR: - Imports 254 md-*.md files from currents working MyST conversion (the broken converter that produced #1885s md-*.md files is not used here; currents files are correct as verified on /en/rolling/). - Adds the per-page RST-to-MyST swap mechanism: scripts/swap_sources.py, scripts/import_myst.py, tests, _swap.txt, _ext/vyos.py and Makefile swap-wrapped targets, .readthedocs.yml pre/post hooks. - Replaces 175 .jpg/.png with 187 .webp images for swapped pages. - Adds the llms.txt + sitemap feature (sphinx_llms_txt, sphinx_sitemap) with circinus-tailored html_baseurl https://docs.vyos.io/en/1.5/ and curated docs/_html_extra/llms.txt for 1.5.x. - Updates docs/_html_extra/robots.txt with AI crawler Allow rules and the /en/1.5/sitemap.xml reference. - Drops configuration/service/suricata from the swap set (no matching RST sibling on circinus; suricata is a current-only feature). Supersedes: - #1885 (broken md-*.md converter output) - #1869 (LLM doc adaptation backport, bundled here) - #1875 (llms.txt circinus, bundled here) Generated by robots https://vyos.io

Revert "docs: fix typos and grammar (ported from #1852 RST → MyST)"

2026-05-06T14:16:23+00:00

docs: fix everythingg regression in md-fwall-and-bridge.md

2026-05-06T13:18:42+00:00

Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/81963933-7762-401c-bb92-7ef80dbcafba Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>

docs: fix typos and a few grammar issues (ported from #1852 RST → MyST)

2026-05-06T13:18:42+00:00

Ports the typo/grammar sweep originally captured in PR #1852 from .rst files to their .md equivalents, plus the eventhandler grammar fix that Copilot flagged in #1852's review (which the RST PR explicitly skipped as scope-stretch). Sources: - 73 typo/grammar substitutions from PR #1852 (rebased from #1801) - "Using environments is more preferable" → "Using environment variables is preferable" (Copilot review comment on #1852) #1852 itself is being discarded since it targets RST and we are phasing out the RST tree in favor of MyST. The 4 RST-linter line-wrap comments and 1 RST section-underline comment from Copilot's #1852 review are RST-specific and do not apply to .md. 🤖 Generated by [robots](https://vyos.io)

docs: address review feedback (backport from PR #1857)

2026-05-06T13:18:42+00:00

🤖 Generated by [robots](https://vyos.io)

feat(swap-circinus): add incremental RST-to-MyST swap mechanism

2026-05-06T13:18:42+00:00

Backport of the swap mechanism from feat/incremental-myst-swap onto the circinus release branch. Built directly on top of origin/circinus, so the underlying RST tree is circinus's (not current's). Mechanism: - scripts/import_myst.py — import md from myst/* with md- prefix - scripts/swap_sources.py — rename md-{name}.md → {name}.md before Sphinx builds, restore after; writes _build/_swap_state.json and _build/_swap_exclude.txt - docs/Makefile — html/dirhtml/pdf/livehtml all run swap → build → trap restore; explicit `swap` and `restore` targets too - docs/conf.py — MyST extensions enabled; swap exclude_patterns loader; _prefer_webp builder hook so html prefers webp over png Content (all from origin/myst/circinus): - 253 md-prefixed pages alongside each {name}.rst counterpart - 1 plain MyST-only page kept at canonical name (docs/copyright.md, no .rst counterpart) - 182 .webp images added (circinus release previously had only PNG/JPG; this PR brings webp into circinus alongside the originals) - docs/_swap.txt populated with all 253 stems → MyST is served by default; revert a page by removing its stem from _swap.txt 🤖 Generated by [robots](https://vyos.io)