vyos-documentation.git/docs, branch scutum

T861: secure-boot: replace install mok with mokutil

2026-10-19T18:25:29+00:00

Enrolling a MOK is only needed for development with custom signed images. Official LTS images ship officially signed binaries and boot out of the box. (cherry picked from commit 07df2e477ba2c6846ca5626fd5e8c2e9a96cfd3a)

Apply formatting suggestion from @github-actions[bot]

2026-10-19T15:13:44+00:00

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (cherry picked from commit 2277fc507fa87d3c1ade5b477c7c139dc3e970c0)

T861: secure-boot: document show secure-boot op-mode commands

2026-10-19T15:13:44+00:00

Add an Operation section with {opcmd} entries for 'show secure-boot' and 'show secure-boot detail', and reference it from the installation verification step. (cherry picked from commit 8a30d067745b07146768fd4e1e428cdf98c6407c)

container: T9453: explain migration to kernel overlayfs from fuse-overlayfs

2026-10-17T17:53:21+00:00

(cherry picked from commit 6fb26907c617758fe2f27546b7a50d0f0da5aada)

docs: update flowtable and ethernet/bonding documentation (#2106) (#2155)

2026-08-04T16:31:27+00:00

* docs: update flowtable and ethernet/bonding documentation * Removing Netfilter word and add the identification of the interfaces to use FlowTables * Fixed warning from commit:c433e15 * Update docs/configuration/firewall/flowtables.md * Update docs/configuration/firewall/flowtables.md * Update docs/configuration/firewall/flowtables.md * Update docs/configuration/firewall/flowtables.md * cfgmc structure and sub-interface offload fixed * Fixed conflicts on flowtable documentation * revert ethernet.md and fixed the latest infos * added subsection to the checks section to show offloaded traffic for sub-interfaces * Final changes * Changed conntrack -L to VyOS command * Replacing new output description with VyOS command --------- (cherry picked from commit a0067e0fbc8c3bee2af6701b3542eb013146fcf8) Co-authored-by: jvela-dot Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

docs: Update Event handler page to VyOS 1.5 standards (backport #2130) (#2156)

2026-08-04T16:30:27+00:00

* docs: Update Event handler page to VyOS 1.5 standards (#2130) * docs: Update Event handler page to VyOS 1.5 standards * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (cherry picked from commit d08dbfacca29aa1e9750468293dd00910ad775ee) * Use "event handler" styling in text and remove the mention of netplugd since it's replaced by vyos-netlinkd in rolling already Co-authored-by: Daniil Baturin --------- Co-authored-by: LiudmylaNad Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Daniil Baturin Co-authored-by: Daniil Baturin

docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks (#2136) (#2144)

2026-08-04T10:15:07+00:00

* docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks In DMVPN the mGRE tunnel and the IPSec protecting it are handled independently, so GRE can be forwarded while no IPSec SA is active for a peer (e.g. while an SA is still being negotiated or after one expires), allowing unencrypted GRE to leave the router. This is inherent to combining GRE with IPSec and is common to DMVPN implementations in general. Add a "Protecting against unencrypted traffic leaks" section to the DMVPN reference page explaining the behaviour and recommending an output filter rule that drops GRE not matched by an outbound IPSec policy (ipsec match-none-out). Note that this disables unencrypted GRE on the node entirely, so coexisting plain GRE tunnels would stop working. Apply the same rule in the Dual HUB Dual Cloud example on the VyOS nodes. * docs(DMVPN): reflow DMVPN documentation for line length compliance Reformat the DMVPN guide and dual-hub dual-cloud example to wrap long lines and improve readability without changing the documented behavior or configuration guidance. --------- (cherry picked from commit 50acf8f188475b0554b99a739cb8ada12d51e77b) Co-authored-by: zdc Co-authored-by: Daniil Baturin

vyos-api: clarify comment regarding commit failure and partial commits (#2178) (#2180)

2026-08-04T09:44:24+00:00

(cherry picked from commit 4631db6a1578550dd4c1410a8416575899f36936) Co-authored-by: John Estabrook

Merge pull request #2157 from vyos/mergify/bp/circinus/pr-2152

2026-08-03T13:40:49+00:00

vyos-api: fill automation API doc gaps (T9087–T9092) (backport #2152)

docs(Installation): Remove outdated portal link and Proxmox/KVM cloud… (backport #2176) (#2179)

2026-07-31T11:30:58+00:00

* docs(Installation): Remove outdated portal link and Proxmox/KVM cloud-init note (Manual backport of Liudmyla's original for rolling) * Break long lines in install.md to pass the linter check --------- Co-authored-by: Daniil Baturin