summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-04docs: update flowtable and ethernet/bonding documentation (#2106) (#2155)circinusmergify[bot]
* docs: update flowtable and ethernet/bonding documentation * Removing Netfilter word and add the identification of the interfaces to use FlowTables * Fixed warning from commit:c433e15 * Update docs/configuration/firewall/flowtables.md * Update docs/configuration/firewall/flowtables.md * Update docs/configuration/firewall/flowtables.md * Update docs/configuration/firewall/flowtables.md * cfgmc structure and sub-interface offload fixed * Fixed conflicts on flowtable documentation * revert ethernet.md and fixed the latest infos * added subsection to the checks section to show offloaded traffic for sub-interfaces * Final changes * Changed conntrack -L to VyOS command * Replacing new output description with VyOS command --------- (cherry picked from commit a0067e0fbc8c3bee2af6701b3542eb013146fcf8) Co-authored-by: jvela-dot <j.vela@vyos.io> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-04 docs: Update Event handler page to VyOS 1.5 standards (backport #2130) (#2156)mergify[bot]
* docs: Update Event handler page to VyOS 1.5 standards (#2130) * docs: Update Event handler page to VyOS 1.5 standards * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (cherry picked from commit d08dbfacca29aa1e9750468293dd00910ad775ee) * Use "event handler" styling in text and remove the mention of netplugd since it's replaced by vyos-netlinkd in rolling already Co-authored-by: Daniil Baturin <daniil@baturin.org> --------- Co-authored-by: LiudmylaNad <l.nadolina@vyos.io> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Daniil Baturin <daniil@vyos.io> Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-08-04docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks ↵mergify[bot]
(#2136) (#2144) * docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks In DMVPN the mGRE tunnel and the IPSec protecting it are handled independently, so GRE can be forwarded while no IPSec SA is active for a peer (e.g. while an SA is still being negotiated or after one expires), allowing unencrypted GRE to leave the router. This is inherent to combining GRE with IPSec and is common to DMVPN implementations in general. Add a "Protecting against unencrypted traffic leaks" section to the DMVPN reference page explaining the behaviour and recommending an output filter rule that drops GRE not matched by an outbound IPSec policy (ipsec match-none-out). Note that this disables unencrypted GRE on the node entirely, so coexisting plain GRE tunnels would stop working. Apply the same rule in the Dual HUB Dual Cloud example on the VyOS nodes. * docs(DMVPN): reflow DMVPN documentation for line length compliance Reformat the DMVPN guide and dual-hub dual-cloud example to wrap long lines and improve readability without changing the documented behavior or configuration guidance. --------- (cherry picked from commit 50acf8f188475b0554b99a739cb8ada12d51e77b) Co-authored-by: zdc <zdc@users.noreply.github.com> Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-08-04vyos-api: clarify comment regarding commit failure and partial commits ↵mergify[bot]
(#2178) (#2180) (cherry picked from commit 4631db6a1578550dd4c1410a8416575899f36936) Co-authored-by: John Estabrook <jestabro@vyos.io>
2026-08-03ci: bump REVIEWER_REF to reviewer-v1.0.3 (rolling branch-map fix) (#2182) ↵mergify[bot]
(#2183) The reviewer-v1.0.2 tag ships a branches.json that maps docs branch 'rolling' to vyos-1x branch 'current'. The vyos-networks/vyos-1x mirror renamed 'current' to 'rolling', so the 'Checkout vyos-1x at mapped branch' step fails on every rolling-based PR (first observed run 30565684480, PR #2177). reviewer-v1.0.3 carries the corrected mapping (rolling -> rolling) plus CI/docs-only changes; no reviewer Python source changes between the two tags. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 3263d8760117ab85bdfc6e13bbaf2d45db3c10a8) Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
2026-08-03Merge pull request #2157 from vyos/mergify/bp/circinus/pr-2152John Estabrook
vyos-api: fill automation API doc gaps (T9087–T9092) (backport #2152)
2026-07-31docs(Installation): Remove outdated portal link and Proxmox/KVM cloud… ↵mergify[bot]
(backport #2176) (#2179) * docs(Installation): Remove outdated portal link and Proxmox/KVM cloud-init note (Manual backport of Liudmyla's original for rolling) * Break long lines in install.md to pass the linter check --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-07-28docs: exclude superpowers/ from the Sphinx build (#2167)mergify[bot]
`docs/superpowers/` holds Claude Code plugin-generated internal design specs and plans, not user documentation. Adding `superpowers` to `exclude_patterns` guards against Sphinx ever picking the directory up and publishing it should it reappear in the source tree. Guard only — the content itself was already removed in 3ab97e71 and abb8be5b. (cherry picked from commit a9dc16aac2a7e7a6e5e4bb1c19897b3d707ba4d1) Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
2026-07-28chore: ignore Claude Code local settings and git worktrees (#2169)Yuriy Andamasov
`.claude/settings.local.json` can hold local secrets and must never be committable on a build branch; `.worktrees/` is local scratch space. Both ignore blocks already exist on `rolling`; `circinus` was missing them. Additive only — no existing line is removed or reordered, and the resulting file is byte-identical to rolling's `.gitignore`.
2026-07-21vyos-api: T9087: T9092: apply review feedback (line length, retry safety)mergify/bp/circinus/pr-2152Brad Kollmyer
Convert the multi-field-node table to wrapped list items per the 80-char docs guideline, and rework the bulk-apply bullet to reconcile state before retrying after a timeout instead of recommending blind retries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 2510eefadc8e7520e7f85f45a2b29fdab634474a)
2026-07-21vyos-api: T9087: tighten firewall same-request wording (review feedback)Brad Kollmyer
Only port/port-group require protocol in the same request; description alone is fine on an existing rule but fails on a rule no request has created yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 9e90088827c53f8d61e82e2e29910a9346009e87)
2026-07-21vyos-api: T9092: add bulk configuration guidanceBrad Kollmyer
Batch sizing, geoip/remote-group commit cost, the 1 MB request-body-size-limit, and commit-confirm as a remote safety net. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit af04731c74b0383bc36c66addd6cc22ba41c55e0)
2026-07-21vyos-api: T9090: T9091: batched /configure semantics; save via /config-fileBrad Kollmyer
Document that an operation list commits as one transaction whose error may not identify the failing op (bisect / one-op fallback), and that /configure rejects {"op": "save"} — persistence goes through /config-file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit f002549a5fe3ae782be8fe02160fa2796e7e0471)
2026-07-21vyos-api: T9089: document /retrieve showConfig on empty pathsBrad Kollmyer
showConfig returns HTTP 400 'Configuration under specified path is empty' for schema-valid but unconfigured paths; recommend probing with exists or treating that error as an empty subtree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 3a952350bf5b5b38a7db1208ed3c910ded7b4b24)
2026-07-21vyos-api: T9088: document /show configuration commands exportBrad Kollmyer
The /show endpoint can return the running config as flat set commands (op-mode 'show configuration commands' equivalent) — the natural way to mirror or back up a router over the API; previously undocumented. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit ca902d4eebd49697f476d538eadfcaeb8ebb2232)
2026-07-21vyos-api: T9087: document commit atomicity for multi-field nodesBrad Kollmyer
Each /configure request is validated and committed on its own, so fields of one node (task-scheduler executable+interval, NAT translation, firewall action/protocol before port) must be sent in a single request. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> (cherry picked from commit 0b88b491d043e5f281d8e3ae499c4d045da28f28)
2026-07-16Merge pull request #2154 from vyos/t9096/retarget-current-refs-circinusYevhen Bondarenko
T9096: retire @current reusable-workflow refs (circinus)
2026-07-16T9096: retire @current reusable-workflow refs (circinus)t9096/retarget-current-refs-circinusYuriy Andamasov
The frozen 'current' compat alias on vyos/.github and vyos-cla-signatures is being retired. Retarget refs of surviving reusables to @production; drop callers of reusables that were retired from the central repo (replaced by Mergify central config / rulesets). 🤖 Generated by [robots](https://vyos.io)
2026-07-02ci: track Context7 variant by branch (circinus companion) (#2128)Yuriy Andamasov
Companion to vyos-documentation#2127 (rolling). That PR switched the Context7 1.5/1.4 variants to branch-backed and moved context7-refresh to a push trigger, but a push-triggered workflow only fires from the copy present on the pushed branch. Land the same two workflow changes on circinus so pushes here self-refresh the branch variant: - context7-refresh.yml: workflow_run chain → push trigger on rolling/circinus/sagitta; refresh payload uses branch:"circinus". - Delete update-version-tags.yml (obsolete — no more git-tag indirection; branch variant tracks HEAD natively). No context7.json on this branch — Context7 reads config only from the default branch (rolling). Workflow-only change. 🤖 Generated by [robots](https://vyos.io)
2026-07-01bgp: T6573: add input/output queue limit CLI commands (#2123)1.5mergify[bot]
(cherry picked from commit 9ad380fb7a1b122a605c7562124085e3200e30f0) Co-authored-by: Christian Breunig <christian@breunig.cc>
2026-07-01DOCS: Backport 2117 (Revise Console server page) to Circinus (#2121)LiudmylaNad
* DOCS: Backport 2117 (Revise Console server page) to Circinus * Update console-server.md
2026-06-30 docs: Update TFTP server page to VyOS 1.5 standards (#2119) (#2122)T9032-circinusmergify[bot]
* docs: Update TFTP server page to VyOS 1.5 standards * Update tftp-server.md (cherry picked from commit 8be9ced92fdc2b12b16aae9e438884acfd387faf) Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
2026-06-23configexamples/inter-vrf-routing-vrf-lite: fix formatting (#2112)Nico Felbinger
* configexamples/inter-vrf-routing-vrf-lite: fix formatting * configexamples/inter-vrf-routing-vrf-lite: reformat text to limit line length
2026-06-23docs: Update Config sync page to VyOS 1.5 standards (#2113) (#2114)mergify[bot]
* docs: Update Config sync page to VyOS 1.5 standards * Minor corrections * Update config-sync.md * Apply suggestion from @github-actions[bot] * Apply suggestion from @github-actions[bot] --------- (cherry picked from commit 228149f1a1d824b968b565f82c3ee73eb7ba489c) Co-authored-by: LiudmylaNad <l.nadolina@vyos.io> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-17Fix Cookiebot consent dialog rendering unstyled and breaking the page ↵mergify[bot]
(#2108) (#2109) On a fresh (no-consent) load the consent banner could render completely unstyled and expand to full page height. Cookiebot delivers its dialog CSS as a constructed stylesheet on document.adoptedStyleSheets; ReadTheDocs' readthedocs-addons.js reassigns that whole-array property with a destructive replace, and when that lands after Cookiebot's network-gated adoption it drops Cookiebot's sheet, leaving #CybotCookiebotDialog at position:static expanded to ~6700px. It is a race, so it is intermittent and clears once consent is given (the dialog then never renders). - layout.html: a small adoptedStyleSheets shim, installed before any page script, that preserves Cookiebot's sheet so another library cannot drop it. - custom.css: a leak-safe safety net that keeps the dialog contained even if its adopted sheet is ever absent. It uses only properties Cookiebot itself sets, so it has verifiably no effect on the normal, styled banner. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit dce7bb521e3947af59fe18895b609ec353e0450e) Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
2026-06-17Merge pull request #2107 from cleiton-faria/syslog_fix_T8983Viacheslav Hletenko
docs: fix local syslog command syntax for 1.5 (T8983)
2026-06-16syslog_update_T8983Cleiton Faria
2026-06-16traffic-engineering: backport from rolling (#2104)LiudmylaNad
2026-06-09Revert "docs: Update Traffic Engineering page to VyOS 1.5 standards (#2066) ↵Daniil Baturin
(…" (#2095) This reverts commit 6b88b233b56e7231fbdf0ed4644f741cf634b9ba.
2026-06-09docs: Update RPKI page to VyOS 1.5 standards (#2061) (#2093)mergify[bot]
* docs: Update RPKI page to VyOS 1.5 standards * Update rpki.md * Update rpki.md (cherry picked from commit 5d631ab0628d6b3266b14a7d25ad9e7b66035636) Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
2026-06-09docs: Update Traffic Engineering page to VyOS 1.5 standards (#2066) (#2092)mergify[bot]
* docs: Update Traffic Engineering page to VyOS 1.5 standards * Update traffic-engineering.md * Update traffic-engineering.md (cherry picked from commit 361ea4841449956af979eb24a0b4e2f869d6ebf2) # Conflicts: # docs/configuration/protocols/traffic-engineering.md Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
2026-06-08docs: Update Segment Routing page to VyOS 1.5 standards (#2067) (#2091)mergify[bot]
* docs: Update Segment Routing page to VyOS 1.5 standards * docs: Minor corrections * docs: Minor formatting corrections * Update segment-routing.md (cherry picked from commit f01638d2e6ac85b0096a0895635c325569a7771a) Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
2026-06-08docs: Update RIP page to VyOS 1.5 standards (#2068) (#2090)mergify[bot]
* docs: Update RIP page to VyOS 1.5 standards * Update rip.md (cherry picked from commit b8a4d737a86015606a1faf0ab49b631db02448b2) Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
2026-06-08docs: Update MPLS page to VyOS 1.5 standards (#2082) (#2089)mergify[bot]
* docs: Update MPLS page to VyOS 1.5 standards * Update mpls.md (cherry picked from commit b02ee21632e7097bc1408388bdfd99f84f8e7771) Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
2026-06-08T8600: Add option to change logging verbosity in Kea (#2076)mergify[bot]
(cherry picked from commit 875b0825b24c03b9a5ba904f8f2d2de946564b74) Co-authored-by: Nataliia Solomko <natalirs1985@gmail.com>
2026-06-06ci: T8966: remove orphaned docs T-ID override (strict rule retired ↵Yuriy Andamasov
centrally) (#2084)
2026-06-05Merge pull request #2073 from vyos/mergify/bp/circinus/pr-2053Viacheslav Hletenko
high-availability: T7059: Add persistence-timeout option in virtual-server (backport #2053)
2026-06-05Merge pull request #2075 from vyos/mergify/bp/circinus/pr-1891Viacheslav Hletenko
bgp: T8607: Add CLI support for BGP update-delay and establish-wait (backport #1891)
2026-06-05Merge pull request #2081 from alexandr-san4ez/T8308-circinus_backportViacheslav Hletenko
conntrack: T8308: Enhancements to the `show conntrack table` op-mode command (mirror 2055) (backport)
2026-06-05conntrack: T8308: Enhancements to the `show conntrack table` op-mode commandOleksandr Kuchmystyi
- Display per-flow packet and byte counters (original and reply direction). - Add VRF filter option `show conntrack table <ipv4|ipv6> vrf <vrf-name>`. (cherry picked from commit 447b0bd6e804896506d3eb65f01856f82c8b9af7)
2026-06-03Merge pull request #2078 from vyos/mergify/bp/circinus/pr-2077Yuriy Andamasov
T8960: ai-validation — consolidate cross-repo auth onto vyos-bot App (backport #2077)
2026-06-03T8960: ai-validation — mint vyos-bot token via get-token@productionYuriy Andamasov
Swap the cross-repo-checkout token from the dedicated vyos-docs-reviewer App (VYOS_APP_ID/_PRIVATE_KEY) to the shared vyos-bot App via the fleet get-token composite, scoped contents:read. Skip-check now gates on APP_CLIENT_ID + APP_PRIVATE_KEY + ANTHROPIC_API_KEY (org-level vyos-bot creds); reword the stale token comment. PR-comment posting still uses the default GITHUB_TOKEN. Byte-identical to the paired reference copy in VyOS-Networks/vyos-docs-opus-reviewer (scripts/ai-validation.yml). 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 459109f13adf026d012c4e803f4a86a8f84e6ce3)
2026-06-02bgp: T8607: Add CLI support for BGP update-delay and establish-wait (#1891)Nataliia S.
* bgp: T8607: Add CLI support for BGP update-delay and establish-wait * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * T8607: Apply Copilot's suggestions --------- Co-authored-by: Christian Breunig <christian@breunig.cc> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> (cherry picked from commit 65a5a35942c099f337ef4224251bbbaf8e076dbb)
2026-06-02high-availability: T7059: Add persistence-timeout option in virtual-serverNataliia Solomko
(cherry picked from commit dc04c30291806195311e585450b490d0c672c356)
2026-05-29Merge pull request #2064 from vyos/mergify/bp/circinus/pr-2063Yuriy Andamasov
ci(ai-validation): allow Pass 2 review on external-contributor PRs (backport #2063)
2026-05-29ci(ai-validation): allow Pass 2 review on external-contributor PRsYuriy Andamasov
The upstream `anthropics/claude-code-action` performs a write-permission check on `github.actor` before our skip logic runs. On `pull_request_target` the actor is the PR author; external contributors resolve to `read` and the action exits 1 with `Actor does not have write permissions to the repository`. Net effect: AI validation has been failing on every external-contributor PR (LiudmylaNad, teslazonda, scottlaird in the last 4 weeks) while succeeding on maintainer PRs. Failure reproduced on run 26541079685 (PR #2061). Fix: set `allowed_non_write_users: '*'` on the Pass 2 step. The action bypasses the actor check when this input is set and `github_token` is provided (already the case). The action also auto-scrubs Anthropic / cloud / GHA secrets from subprocess envs when this input is set. Safe in THIS workflow because the existing defense-in-depth bounds what Pass 2 can do with untrusted PR content: - `allowedTools` restricted to inline-comment + read-only surfaces - `github_token` is the PR-scoped default (not the broader VYOS_APP_ID) - prompt marks PR content as untrusted via `<UNTRUSTED-PR-CONTENT>` - workspace-wipe removes `CLAUDE.md` / `.claude/` before Pass 2 - prepare bundles MD via `git show HEAD:<path>` (blob, not `cp`) Full rationale inlined as a comment block above the new input. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 1fa39bd7ac64898f7a21922bc0f195d115d3cdeb)
2026-05-14Merge pull request #2044 from vyos/mergify/bp/circinus/pr-2043Yuriy Andamasov
ci(ai-validation): skip prepare on Mergify-authored PRs (backport #2043)
2026-05-14ci(ai-validation): skip prepare on Mergify-authored PRsYuriy Andamasov
Lifts the existing Mergify-author short-circuit (today inside validate's `secrets-check` step) to a job-level `if:` on `prepare`, so the whole pipeline skips for backport/queue PRs. Why now: every Mergify backport whose merge ref shares no shallow ancestor with the (advanced) base branch fails the prepare step at git diff "$BASE...HEAD" --name-only ... fatal: FETCH_HEAD...HEAD: no merge base (because base is `git fetch --no-tags --depth=1` and the merge ref is `fetch-depth: 2`). Proximate symptom: run 25842928620 on PR #2042 (sagitta backport of #2023). AI Validation isn't a required check so the queue isn't blocked, but every Mergify backport is left with a red "prepare" check that adds noise to PR review. The validate-level skip in commit 0e8a2956 was correct for the "claude-code-action rejects bot-initiated runs" failure mode but fires too late — prepare has already run and crashed before validate's `if: needs.prepare.outputs.has_md_changes == 'true'` even evaluates. Implementation: single job-level `if:` on prepare. validate's `needs: [prepare]` cascades the skip naturally (skipped needs make the dependent's expression-based `if:` evaluate against empty outputs). The in-step author check in validate stays as defense-in-depth. 🤖 Generated by [robots](https://vyos.io) (cherry picked from commit 7d94d6116be1a4776b7317cb5190a83dd065e571)
2026-05-14Merge pull request #2041 from vyos/mergify/bp/circinus/pr-2023Yuriy Andamasov
ci(doc-linter): fix 12 accumulated bugs flagged across PR #2014/#2019/#2020 reviews (backport #2023)
2026-05-14ci(doc-linter): anchor .. code-block:: detection + drop debug printYuriy Andamasov
Addresses Copilot review on PR #2023: 1. .. code-block:: tracking was triggered by a plain substring check, which matched mid-line occurrences too. In MD prose like ``.. code-block::`` (docs/documentation.md:222) this set in_rst_codeblock=True spuriously and could suppress line-length checks downstream. Replace with a leading-whitespace- anchored regex and gate on file_ext in ('.rst', '.txt') or an open {eval-rst} MyST fence so the directive opener is only recognized where it can actually occur. 2. print('start') in main() was leftover debug noise — remove it. (cherry picked from commit e87278ef35660a6257b55f4585274a52d3124583)
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-28 14:53:58 +0000