vyos-documentation.git/docs/configuration/firewall/groups.md, branch secure-boot

firewall/groups: document include option and remote-group interval (#2241)

2026-09-15T09:59:52+00:00

* firewall/groups: document include option and remote-group interval These CLI nodes existed in the XML definitions but were missing from the docs entirely, per docs.vyos.io/en/1.5/coverage.html: - include: lets one group nest another group of the same type (address-group, ipv6-address-group, network-group, ipv6-network-group, mac-group, port-group, interface-group) - remote-group interval: overrides the global resolver-interval on a per-group basis * firewall/groups: clarify remote-group interval range applies post-conversion CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py: human_to_seconds() converts the value first, then the range check runs on the converted seconds -- so e.g. "30s" is rejected same as "30".

firewall: T9076: document remote-group update interval (#2148)

2026-09-11T11:42:42+00:00

* firewall: T9076: document remote-group update interval Document the new 'set firewall group remote-group interval' command: per-group update interval from 60 seconds to 4 weeks, given as plain seconds or with s/m/h/d/w suffixes (e.g. 4h), falling back to the global resolver-interval when unset. Co-Authored-By: Claude Fable 5 * firewall: T9076: note URL quoting and log redaction for remote-group Warn that remote-group URLs with query strings must be quoted (unquoted '&' silently truncates the value; literal '?' may need Ctrl-V, see T9077) and that vyos-domain-resolver logs redact the query string on download failures (T8829). Co-Authored-By: Claude Fable 5 * firewall: T9076: note that remote-group interval suffixes may be combined Address review feedback: document that s/m/h/d/w units can be stacked (e.g. 1h30m), matching human_to_seconds and the CLI regex. --------- Co-authored-by: Claude Fable 5

feat: flip swap mechanism — MD as primary, RST as override (Phase 1)

2026-05-06T17:42:32+00:00

This is the first of three phases inverting the per-page swap mechanism so MD becomes the canonical primary and RST becomes the rare override. Phase 1 — file renames + conf.py exclude_patterns flip only: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 254 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 254 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty comment-only since no pages need the RST fallback right now - conf.py exclude_patterns flipped: rst-*.rst is now excluded by default instead of md-*.md - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt (Phase 2 will rewrite swap_sources.py to produce these names; for now no swap script runs because overrides list is empty) Phase 2 (next commit on this branch) will rewrite scripts/swap_sources.py with inverted rename direction, delete scripts/import_myst.py + tests, and update tests/test_swap_sources.py for the new semantics. Phase 3 will be the cleanup pass and ready-for-review flip. Generated by robots https://vyos.io